This concise, practical guide helps the advocate understand the sometimes dense rules in advising patients, physicians, and hospitals, and in litigating HIPAA-related issues.

In the realm of health care, privacy protections are needed to preserve patients' dignity and prevent possible harms. Ten years ago, to address these concerns as well as set guidelines for ethical health research, Congress called for a set of federal standards now known as the HIPAA Privacy Rule. In its 2009 report, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, the Institute of Medicine's Committee on Health Research and the Privacy of Health Information concludes that the HIPAA Privacy Rule does not protect privacy as well as it should, and that it impedes important health research.

Family caregiving affects millions of Americans every day, in all walks of life. At least 17.7 million individuals in the United States are caregivers of an older adult with a health or functional limitation. The nation's family caregivers provide the lion's share of long-term care for our older adult population. They are also central to older adults' access to and receipt of health care and community-based social services. Yet the need to recognize and support caregivers is among the least appreciated challenges facing the aging U.S. population. Families Caring for an Aging America examines the prevalence and nature of family caregiving of older adults and the available evidence on the effectiveness of programs, supports, and other interventions designed to support family caregivers. This report also assesses and recommends policies to address the needs of family caregivers and to minimize the barriers that they encounter in trying to meet the needs of older adults.

HIPAA is very complex. So are the privacy and security initiatives that must occur to reach and maintain HIPAA compliance. Organizations need a quick, concise reference in order to meet HIPAA requirements and maintain ongoing compliance. The Practical Guide to HIPAA Privacy and Security Compliance is a one-stop resource for real-world HIPAA privacy and security advice that you can immediately apply to your organization's unique situation. This how-to reference explains what HIPAA is about, what it requires, and what you can do to achieve and maintain compliance. It describes the HIPAA.

This vital resource offers mental and behavioral health providers clear, demystified guidance on HIPAA and HITECH regulations pertinent to practice. Many mental health providers erroneously believe that if they uphold their ethical and legal obligation to client confidentiality, they are HIPAA compliant. Others may believe that because their electronic health record provider promises HIPAA compliance, that their practice or organization is HIPAA compliant also not true. The reality is HIPAA has changed how providers conduct business, permanently, and providers need to know how to apply the regulations in daily practice. Providers now have very specific privacy requirements for managing patient information, and in our evolving digital era, HIPAA security regulations also force providers to consider all electronic aspects of their practice. HIPAA Demystified applies to anyone responsible for HIPAA compliance, ranging from sole practitioners, to agencies, to larger mental health organizations, and mental health educators. While this book is written for HIPAA covered entities and business associates, for those who fall outside of the regulations, it is important to know that privacy and security regulations reflect a new standard of care for protection of patient information for all practitioners, regardless of compliance status. Additionally, some HIPAA requirements are now being codified into state laws, including breach notification. This book s concise but comprehensive format describes HIPAA compliance in ways that are understandable and practical. Differences between traditional patient confidentiality and HIPAA privacy and security regulations are explained. Other important regulatory issues covered that are of importance of mental health providers include: Patient rights under HIPAA How HIPAA regulations define psychotherapy notes, with added federal protection Conducting a required security risk assessment and subsequent risk management strategies The interaction with HIPAA regulations and state mental health regulations Details about you may need Business Associate Agreements, and a Covered Entity s responsibility to complete due diligence on their BAs Training and documentation requirements, and the importance of sanction policies for violations of HIPAA Understanding what having a HIPAA breach means, and applicable breach notification requirements Cyber defensive strategies. HIPAA Demystified also addresses common questions mental health providers typically have about application of HIPAA to mobile devices (e.g. cell phones, laptops, flash drives), encryption requirements, social media, and Skype and other video transmissions. The book also demonstrates potential costs of failing to comply with the regulations, including financial loss, reputational damage, ethico-legal issues, and damage to the therapist-patient relationship. Readers will find this book chock full of real-life examples of individuals and organizations who ignored HIPAA, did not understand or properly implement specific requirements, failed to properly analyze the risks to their patient s private information, or intentionally skirted the law. In the quest to lower compliance risks for mental health providers HIPAA Demystified presents a concise, comprehensive guide, paving the path to HIPAA compliance for mental health providers in any setting.

This User’s Guide is intended to support the design, implementation, analysis, interpretation, and quality evaluation of registries created to increase understanding of patient outcomes. For the purposes of this guide, a patient registry is an organized system that uses observational study methods to collect uniform data (clinical and other) to evaluate specified outcomes for a population defined by a particular disease, condition, or exposure, and that serves one or more predetermined scientific, clinical, or policy purposes. A registry database is a file (or files) derived from the registry. Although registries can serve many purposes, this guide focuses on registries created for one or more of the following purposes: to describe the natural history of disease, to determine clinical effectiveness or cost-effectiveness of health care products and services, to measure or monitor safety and harm, and/or to measure quality of care. Registries are classified according to how their populations are defined. For example, product registries include patients who have been exposed to biopharmaceutical products or medical devices. Health services registries consist of patients who have had a common procedure, clinical encounter, or hospitalization. Disease or condition registries are defined by patients having the same diagnosis, such as cystic fibrosis or heart failure. The User’s Guide was created by researchers affiliated with AHRQ’s Effective Health Care Program, particularly those who participated in AHRQ’s DEcIDE (Developing Evidence to Inform Decisions About Effectiveness) program. Chapters were subject to multiple internal and external independent reviews.

Use this book to learn how to conduct a timely and thorough Risk Analysis and Assessment documenting all risks to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI), which is a key component of the HIPAA Security Rule. The requirement is a focus area for the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) during breach investigations and compliance audits. This book lays out a plan for healthcare organizations of all types to successfully comply with these requirements and use the output to build upon the cybersecurity program. With the proliferation of cybersecurity breaches, the number of healthcare providers, payers, and business associates investigated by the OCR has risen significantly. It is not unusual for additional penalties to be levied when victims of breaches cannot demonstrate that an enterprise-wide risk assessment exists, comprehensive enough to document all of the risks to ePHI. Why is it that so many covered entities and business associates fail to comply with this fundamental safeguard? Building a HIPAA Compliant Cybersecurity Program cuts through the confusion and ambiguity of regulatory requirements and provides detailed guidance to help readers: Understand and document all known instances where patient data exist Know what regulators want and expect from the risk analysis process Assess and analyze the level of severity that each risk poses to ePHI Focus on the beneficial outcomes of the process: understanding real risks, and optimizing deployment of resources and alignment with business objectives What You’ll Learn Use NIST 800-30 to execute a risk analysis and assessment, which meets the expectations of regulators such as the Office for Civil Rights (OCR) Understand why this is not just a compliance exercise, but a way to take back control of protecting ePHI Leverage the risk analysis process to improve your cybersecurity program Know the value of integrating technical assessments to further define risk management activities Employ an iterative process that continuously assesses the environment to identify improvement opportunities Who This Book Is For Cybersecurity, privacy, and compliance professionals working for organizations responsible for creating, maintaining, storing, and protecting patient information