Due to HITECH, tougher penalties for HIPAA compliance failures were introduced for healthcare organizations and their business associates.

With HIPAA violation fines reaching up to $50,000 per occurrence and a maximum annual penalty of $1.5 million per violation, it's important for us to ensure we are HIPAA compliant at all times. While all possible HIPAA violations should be considered potential threats to our company, some are more common than others.

Because HIPAA regulations are complex and ever-changing, it is hard to stay up-to-date on the latest changes and common violations. By ensuring employees are well-trained on HIPAA compliance to understand which violations occur most often, Encore can more adequately protect against instances of violations.

Below is a list of the most common HIPAA violations and examples of necessary steps to prevent them.

1. Keeping Unsecured Records: As part of employee training, all staff members should be instructed to keep documents with PHI in a secure location at all times. Physical files containing PHI should be locked in a desk, filing cabinet or office. Digital files should require secure passwords to access them.

2. Hacking: Although we hope it would never happen, hacking is a real threat to medical EPHI. There are hackers out there who want to use this information for malicious purposes. Therefore, we need to protect against hacking wherever possible, such as never accessing a link in an email from an unknown sender. Most hacking starts by opening a malicious email link. This may result in ransom ware and shutting down all system computers.

3. Loss or Theft of Devices: If devices containing EPHI are not stored in a secure location at all times, they are subject to the possibility of loss or theft. If the information stored on such devices is not encrypted or password protected, the loss or theft of the device becomes an even more severe issue. Devices therefore, should never be left unattended in a vehicle, an unsecured office, or shared with non-employees (anyone without an Encore assigned password and/or authorization to use device).

4. Lack of Employee Training: When it comes to training employees on HIPAA regulations and compliance, it is important that every employee who comes in contact with PHI be thoroughly educated. Employee HIPAA training is more than a recommendation - it is a requirement of the HIPAA law. All staff members must be well-trained on the law, as well as on the particular policies and procedures set forth by Encore's HIPAA policies and procedures.

5. Gossiping/ Sharing PHI: When talking to co-workers, there is no reason to discuss PHI. Unintentionally, in-office gossip can come with a hefty fine. Medical practice employees with access to patient PHI need to be careful about the information they share amongst themselves and with others. When discussing PHI, Encore employees should always be aware of who may be listening or in ear shot. Keep conversations about PHI behind closed doors, only when necessary to perform assigned job duties and only with appropriate office personnel.

6. Employee Dishonesty: Although not always done with a malicious purpose, when employees try to access PHI that they are not authorized to view, this is a HIPAA violation. Often it is merely out of curiosity, but the punishment is the same regardless of the intent. Thorough and precise training and procedures that outline who can access what, as well as a clear indication of the consequences that will result, can help prevent occurrences of this particular HIPAA violation.

7. Improper Disposal of Records: One of the most important procedures to enforce is proper disposal of PHI records. All staff members should understand that all information containing PHI, such as social security numbers, medical procedures, diagnoses, and financial information, should be shredded, destroyed, properly wiped from the hard drive, etc. If any of this information is left lying around, in a trash can, in a computer's recent files folder, etc., it could get into the hands of the wrong person, and this would be a serious HIPAA violation.

8. Unauthorized Release of Information: This violation most often occurs when members of the media release PHI regarding public figures and celebrities. It can also happen for example, when medical personnel release PHI for a dependent to family members that are unauthorized, or to those without a Power of Attorney for a family member.

9. 3rd Party Disclosure of PHI: When it comes to discussing PHI, it should only be discussed with the people who need to know, such as the patient, the doctor(s), and/or the person(s) billing for the procedure, medication, or other related service. If you have access to PHI and discuss it with those who do not have the right access to this information, then you are in direct violation of HIPAA.