Questions? Contact Us Today!
1-800-266-1938 | Email
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the HHS Office of the National Coordinator (ONC) recently updated their Security Risk Assessment (SRA) Tool for small to mid-sized health care organizations. The Tool includes 156 questions designed to help organizations conduct and document that they have performed a security risk assessment.
HRSA recently announced that the Change in Scope (CIS) process will be revised to remove redundant questions, to revise the assurances sections, to remove financial questions, and to align CIS budget changes with annual application processes. The current CIS submission process in the Electronic Handbooks (EHBs) System will undergo a temporary suspension period from October 6 through November 3. No new CIS requests may be submitted during this time. HRSA has advised health centers to work with their project officers on any current in-process CIS requests.
On September 8, 2016, the Centers for Medicare and Medicaid Services (CMS) issued a Final Rule to address gaps in the current Medicare and Medicaid emergency preparedness regulations for providers and suppliers.
The Final Rule dictates that Medicare and Medicaid providers and suppliers are now required to meet common emergency best practice standards in order to continue to participate in these programs. They will need to:
Civil monetary penalties for violations of the False Claims Act, the Program Fraud Civil Remedies Act and the Anti-Kickback Act nearly doubled with the issuance of an interim final rule by the Department of Justice on August 1st. The minimum per claim penalty increased from $5,500 to $10,781 and the maximum per claim penalty increased from $11,000 to $21,563. The increased penalty amounts apply to penalties assessed after August 1, 2016 for violations that occurred after November 2, 2015.
The Office for Civil Rights (OCR) recently announced that its Regional Offices will expand their investigations into breaches that affect fewer than 500 individuals. OCR stated that the factors it will take into consideration when deciding whether to investigate include the size of the breach, type of protected health information (PHI) involved, whether the PHI was encrypted, whether the breach involved intrusions to IT systems (such as hacking), and whether the covered entity or business associate has filed other breach reports that raise similar issues.