By Compliancy Group

When you work in health care, hearing about HIPAA is inevitable. There is a ton of information online about the Health Insurance Portability and Accountability Act of 1996 (HIPAA), but as a medical spa, finding information related to your business can be challenging. The HIPAA FAQs discussed below serve as a guide for medical spa professionals in meeting their requirements.

HIPAA rules overview

What is the HIPAA Privacy Rule?

The HIPAA Privacy Rule sets standards for how your practice should use patient information and when disclosing that information to third parties is appropriate. This includes information sharing between providers, health plans and business associates.

What is the HIPAA Security Rule?

The HIPAA Security Rule requires you to put security measures in place to secure patient information. Security measures should be “reasonable and appropriate” for your practice, which means that it is not expected for a small medical spa to have the same security measures in place that a hospital does. You must conduct a HIPAA security risk assessment annually to determine appropriate measures for your practice.

What is the HIPAA Breach Notification Rule?

The HIPAA Breach Notification Rule requires you to report breaches that compromise the privacy or security of patient information. Breaches affecting fewer than 500 patients must be reported to affected patients and the Department of Health and Human Services (HHS) Office for Civil Rights (OCR); these breaches can be reported annually, by March 1 of the following year. Breaches affecting 500 or more patients must be reported to affected patients, HHS OCR and media outlets. Large breaches must be reported within 60 days of discovering the incident.

HIPAA and patient information

What is protected health information?

Protected health information (PHI) is individually identifiable health information created, used or disclosed during diagnosis or treatment.

The Department of Health and Human Services classifies PHI into 18 identifiers:

1. Name;
2. Address;
3. Any dates directly related to an individual;
4. Telephone number;
5. Fax number;
6. Email address;
7. Social Security Number;
8. Medical record number;
9. Health plan beneficiary number;
10. Account number;
11. Certificate/license number;
12. Vehicle identifiers, serial numbers or license plate numbers;
13. Device identifiers or serial numbers;
14. Web URLs;
15. IP address;
16. Biometric identifiers, such as fingerprints or voiceprints;
17. Full-face photos; and
18. Any other unique identifying numbers, characteristics or codes.

What is a Notice of Privacy Practices?

A Notice of Privacy Practices (NPP) describes how your practice may and may not use PHI and patients’ rights concerning their PHI. You must provide patients with your NPP on or before their first visit, and a copy must be available upon request.

What is a HIPAA authorization form?

You must obtain an authorization form from a patient to use or disclose their PHI for purposes beyond treatment, payment or health care operations. Signed authorization forms must be obtained for marketing purposes or reasons other than regular use and disclosure as outlined by your NPP.

What is the HIPAA minimum necessary standard?

PHI use and disclosure must be limited to the minimum necessary to perform a job function. The minimum necessary standard also requires PHI access to be limited based on an employee’s job role and access to the information to be monitored and logged.

What is the HIPAA right of access?

The HIPAA right of access gives patients a legal right to see and receive copies of the information in their medical and other health records. Under this standard, patients must be provided with requested documents within 30 days of the request in the format they request.

HIPAA violations and fines

What is considered a HIPAA violation?

HIPAA violations occur when health care organizations fail to make a “good faith effort” to ensure the confidentiality, integrity or availability of PHI. Failure to address just one requirement of HIPAA can result in a HIPAA violation, subjecting you to fines and corrective actions.

Common HIPAA violations include:

• Improper use or disclosure of PHI;
• Failure to conduct a risk assessment;
• Failure to encrypt devices containing PHI when it is reasonable to do so; and
• Failure to comply with the HIPAA right of access standard.

How are HIPAA fine amounts determined?

The HHS OCR determines fine amounts based on the level of perceived negligence. Based on the severity of a HIPAA violation, fines can range from $120 – $1.8 million per violation.

Contributed by Compliancy Group

Compliancy Group’s simplified software and Customer Success Team remove the complexities and stress of HIPAA, helping medical spa professionals achieve HIPAA compliance quickly. They give practices confidence in their compliance plans, increasing patient loyalty and profitability while reducing risk. As an AmSpa Vendor Affiliate, medical spa professionals can be confident in Compliancy Group’s compliance program.

Compliancy Group’s software automates HIPAA compliance for medical spas. Achieving compliance can be done quickly through just a few self-paced virtual meetings. New customers will save 15% on Compliancy Group’s software, which includes live coaching to guide you through your compliance requirements, risk assessment that makes the required HIPAA risk assessment a breeze, policies and procedures that fully satisfy HIPAA regulations and protect your business, and intuitive and automated HIPAA training that awards the HIPAA Seal of Compliance upon completion.