{"id":14136,"date":"2020-11-19T06:21:57","date_gmt":"2020-11-19T11:21:57","guid":{"rendered":"https:\/\/www.m2sys.com\/blog\/?p=14136"},"modified":"2022-06-21T07:53:49","modified_gmt":"2022-06-21T11:53:49","slug":"develop-constructive-hipaa-incident-response-plan","status":"publish","type":"post","link":"https:\/\/www.m2sys.com\/blog\/patient-identification\/develop-constructive-hipaa-incident-response-plan\/","title":{"rendered":"How to Develop a Constructive HIPAA Incident Response Plan"},"content":{"rendered":"

No matter how effective your safeguards may be, healthcare facilities are always exposed to different types of security threats. Under the HIPAA Security Rule, a security incident is defined as the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with information in an information system. In simple terms, a HIPAA security incident is an attempt to do something unauthorized. The HIPAA law requires covered entities and business associates to develop robust incident management and response plans under the Security Incident Procedures standard of the HIPAA Security Rule<\/a>.\u00a0<\/span><\/p>\n

HIPAA Incident Response<\/span><\/h2>\n

Despite having well-established policies and procedures, robust training programs, and commitment to overall HIPAA compliance<\/a>, breaches can still occur. Organizations that deal with protected health information (PHI) must develop a response plan for these incidents, documenting them appropriately, and determining the root causes to prevent further occurrences. Here are some of the best practices to keep in mind:<\/span><\/p>\n

Act efficiently when a breach occurs<\/span><\/h2>\n

Whenever a breach takes place, an organization will have 60 days to address it. How an organization responds will vary depending on the severity of the compliance issue. Even though it may be tempting to wait before addressing the problem, providers should act immediately. If they don\u2019t, they might risk an onsite visit and receive potential penalties if a staff or a patient reports the incident to the HHS. Official bodies want to see that an organization is aware of the incident and has made solid efforts to address the issue. Demonstrating this commitment can help mitigate the risk of receiving penalties.<\/span><\/p>\n