By Dr. Danika Brinda, CEO, Planet HIPAA
Did you know that your practice’s website can reveal to the world that you are out of compliance with HIPAA?
A quick look around your website could reveal to a HIPAA auditor that your practice is struggling with HIPAA compliance. Wondering what I am referring to? It’s the Notice of Privacy Practices! The regulations state that your practice must ensure that the most current version of your Notice of Privacy Practices is posted on the practice’s website (if one exists). Here is the specific language from the regulations:
CFR 164.520(c)(3)(i) – A covered entity that maintains a website that provides information about the covered entity’s customer services or benefits must prominently post its notice (of privacy practices) on their website and make the notice available electronically through their website.
Even with your Notice of Privacy Practices posted on your website, you must make sure that the document is your most current version and matches the one available in your office. You also must make sure it meets all the requirements that were defined in the 2013 HIPAA Privacy Regulations and the 2013 HIPAA Omnibus Rule. If any of the following three statements are true, your website revealed that you are out of compliance with HIPAA:
- Your Notice of Privacy Practices was not posted on your website.
- Your Notice of Privacy Practices was dated prior to Sept. 23, 2013.
- The Notice of Privacy Practices on your website isn’t the most up-to-date copy.
If you think the auditors will not be looking on your website to make sure your Notice of Privacy Practices is posted, think again. In the OCR 2016 HIPAA Desk Audit Guidance on Selected Protocol Elements, it states the covered entity must “upload the URL for the entity’s website and the URL for the posting of the entity’s notice.” In fact, the instructions for the HIPAA auditors state that they must:
“Determine whether the entity maintains a website. If so, observe the website to determine if the Notice of Privacy Practices is prominently displayed and available. An example of prominent posting of the notice would include a direct link from homepage with a clear description that the link is to the HIPAA Notice of Privacy Practices.”
Not only does it have to be posted on your website, but it must be in a location that is easy to find with an easy description!
The Notice of Privacy Practice is not a difficult area to comply with for the HIPAA regulations; however, it is a common area of non-compliance. To be compliant with this regulation, the following four items should be established:
- Notice of Privacy Practices
- Notice of Privacy Practices Policy and Procedure
- Acknowledge Form of the Notice of Privacy Practices
- Making the notice available on the practice’s website
The specific elements that need to be defined in the Notice of Privacy Practices are specifically defined in the regulations. More information can be found here.
Dr. Danika Brinda is the CEO of Planet HIPAA and has more than 12 years of experience in health care privacy and security practices. She also is a nationally recognized speaker on a variety of health care privacy and security topics, and specializes in helping dental organizations implement a HIPAA-compliance program.
This article was first published on Planet HIPAA on Sept. 5, 2016.