HIPAA & Meaningful Use

As a healthcare professional or administrator, you’re well aware of the importance of complying with HIPAA and Meaningful Use requirements.  (Even though Meaningful use has been replaced by the Merit-based Incentive Payment System (MIPS), most people still call it Meaningful Use, so we’ll use that term here).

Both HIPAA and Meaningful Use are necessary for protecting both your company from costly fees and, crucially, for safeguarding your patients’ protected health information (PHI).

But are you fully aware of the difference between the two—or the unique requirements for each? 

Our guide to HIPAA and Meaningful Use will take the fear out of HIPAA compliance by answering FAQs about the differences and requirements of each of these critical aspects of protecting sensitive patient health information.

First, it’s important to establish what we mean by the terms HIPAA and Meaningful Use.

HIPAA Definition: 

• The Health Insurance Portability Act of 1996 (HIPAA) is a federal law that established the standards that covered entities must follow to ensure the protection of all PHI.These security rules dictate that healthcare professionals cannot use or disclose PHI without authorization, and must implement safeguards to protect it. 

HIPAA Meaningful Use Definition:

• Meaningful Use is the commonly used term for the electronic health information (EHR) incentive programs established by the Center of Medicare and Medicaid (CSM).
  
  These programs allow health care providers to receive incentive payments if they can demonstrate “meaningful use” of the EHR system they have in place.
  
  The creation of the Meaningful Use program was a product of the Health Information Technology Economic and Clinical Health (HITECH) Act, which was passed in response to the growing use of electronic protected health information (ePHI).Electronic PHI has played an important role in improving patient care, but does present unique challenges for those tasked with protecting that information.In other words, while HIPAA compliance involves protecting patient data in all of its forms, Meaningful Use requirements relate specifically to the use of electronic health records (EHRs).

What Happens if My Company Doesn’t Comply with HIPAA and Meaningful Use Requirements?

Covered entities that don’t follow HIPAA rules can be subject to harsh fines and even criminal penalties.

Failure to meet Meaningful Use requirements, meanwhile, will result in an annual reduction of the rates of your Medicare and Medicaid reimbursements.

HIPAA Compliance and Meaningful Use Attestation: What’s the Difference?

The Office of Civil Rights (OCR) determines HIPAA compliance through random audits, and investigations after breaches and complaints.

Meaningful Use attestation is the process of proving that you’ve met Meaningful Use requirements in order to receive your EHR Incentive Program reimbursements.

It’s important to note that proof of one does not cancel out the other. 

If you’ve recently passed a HIPAA compliance audit, you’re not exempt from submitting your Meaningful Use attestation, and vice versa.

How Do I Ensure My Covered Entity Meets the Requirements of HIPAA and Meaningful Use? 

Here’s a quick overview of the steps you can take to avoid the costly consequences of failing to comply with HIPAA and Meaningful Use requirements.

For a more detailed explanation of these steps, request a copy of our HIPAA Compliance Checklist and HIPAA Audit Checklist.

• Develop a comprehensive security policy
  • It’s crucial for every company to have processes in place that will allow it to achieve HIPAA compliance and meet Meaningful Use requirements. The most painless way to develop such processes is to enlist the help of a cyber security team that specializes in compliance.
• Regularly train staff
  • HIPAA compliance training is a mandatory aspect of compliance for entities that handle protected health information, but it’s also the best way to ensure your team members take a proactive role in defending the security of your PHI.
    
• Make sure you’re using certified EHR technology 
  • Covered entities must store EHRs using technology that the CMS and Office of the National Coordinator for Health Information Technology (ONC) have certified.
• Conduct a risk assessment
  Covered entities must provide a security risk analysis as a condition of compliance. Such analyses are best carried out under the guidance of an IT expert, who can help companies to identify and resolve HIPAA gaps and vulnerabilities. It’s not necessary to conduct a second risk assessment for Meaningful Use; one risk analysis will cover both HIPAA and Meaningful Use. 

Still have questions about the relationship between HIPAA and Meaningful Use? Contact Techumen to speak with one of our highly skilled IT specialists.