July 3, 2013
Our website is sporting a new look today! We’ve made several changes to our website over the past few weeks to make it easier for you to find the tools and information to help you define your path to HIPAA compliance. If you’re used to finding our blog on the home page, then you’ll see one of the biggest changes we’ve made – we’ve moved the blog to the Blog tab. It’s still the same great content – delivered every week to the inbox of all of our loyal Practice Manager Solutions’ subscribers.
Moving the blog has freed up space on our home page for some very valuable information. Starting today, the home page contains the following information:
- My new video series 1-2-3 Steps to Compliance!
- Compliance Solutions that address the complex compliance issues that medical practices are facing today.
- Free Video Tips & Solutions directly from my YouTube channel
- Up-to-date announcements of upcoming guests and topics for my Internet blog talk radio program – MORE for Your Practice.
- And more ways for you to connect and stay informed.
We’d love to hear your reaction to the new look and how the information is helping you in your medical practice. Call us at 1-866-492-0481 or email me at email@example.com.
February 23, 2012
This week I’m pleased to introduce you to my business partner Kelly McLendon. Kelly is the owner of CompliancePro Solutions™ and has created a software tool for the HIPAA security gap assessment required under Meaningful Use.
RM: Kelly, can you tell us a little more about the software tool you’ve created?
KM: Yes. Our HIPAA Privacy and Security Gap Assessment software was created to help medical providers who are attesting to Meaningful Use fulfill the requirements of Measure 15. This is an Excel-based assessment tool that evaluates the state of your Electronic Health Record (EHR) system to identify any potential security gaps that may exist. In fact, even if a medical provider is not attesting to Meaningful Use, they’re still required to perform these assessments. The HIPAA Security Rule states that any provider who maintains HIPAA-protected information in an electronic record must perform a security assessment and implement procedures to manage risks.
RM: That’s right Kelly. I think many providers don’t really understand that even if they’re not attesting to Meaningful Use, they still have to perform the security assessment.
KM: And, as enforcement progresses, providers run the risk of being fined if they don’t have the security assessment completed. Even if they do the assessment in Stage 1, they have to maintain it – which means updating it periodically as new risks are identified.
RM: But the security assessment isn’t the only thing the software does, right?
KM: Yes, that’s true. Not only do you have to perform the security assessment, but you also have to create the policies that address any potential security risks. Our software helps providers create those policies. We use Word templates for the policies. Then, as you know, the final, and perhaps most critical, step is to create the procedures that support the policies. Procedures ensure that actions take place to address the risks. That’s the part of the process where your expertise helps us to provide a full-scale solution for providers. There are too many variables involved in establishing procedures for a software program to do an effective job. A practice consultant, such as yourself, is in a much better position to work with the medical office in establishing those procedures.
RM: How long does the assessment take?
KM: Well, the software takes about a day to run the risk assessment. Policy and procedure building can take up to six months. The software takes the results of the assessment and prioritizes the highest levels of vulnerability. We look at what has the potential to cause the greatest harm the soonest and prioritize into high, medium and low categories. You can’t tackle everything at once. But you do need to address the critical, high priority risks as soon as possible and create a schedule for addressing the medium and low priorities.
RM: Right. Medical practices have so many demands on them. This is a great resource to help them get the assessment completed and establish a plan for managing risks and addressing the creation of Policies & Procedures to mitigate current and potential risk. That’s really what Meaningful Use Measure 15 is all about.
KM: The Office for Civil Right (OCR) is really starting to focus on the security measures. Up to this point, the focus has been on privacy. Privacy and security are two separate sets of rules, but they are related. Our security assessment tool bridges into the privacy realm. The software packages some privacy with the security assessment.
RM: Who is a good candidate for the security assessment software?
KM: Anyone attesting for Meaningful Use – any size from a solo practitioner up to multi-practitioner offices. I believe a third-party assessment is a good idea regardless of whether you have resource issues. It provides an unbiased, auditing point of view. Self-assessing is fine, but a third party assessment is much stronger. We have more expertise than the average medical practice because we see more sites and can help with implementing best practices.
RM: What does this cost?
KM: We try to keep the price low by templating as much as we can. But the security risk assessment and development of Policies & Procedures are part of the cost of getting your meaningful use certification.
RM: Can you tell us a little about your background and why you decided to create the assessment software?
KM: Well, I have been a credentialed HIM professional for 35 years. I’m credentialed in privacy and security. I have many years of experience working with privacy incident, detection and automation. I’m a frequent speaker on the subjects of Legal Health records and AARA / HITECH. I also write quite extensively on the subject, especially for AHIMA.
RM: If someone is interested in learning more about the HIPAA Security Risk Assessment program, how can they get more information?
KL: I think, as my business partner, you’re the right person for them to contact.
RM: OK, anyone interested in learning more can reach me at Rebecca@rebeccamorehead.com or call me at 1-866-492-0481 ext. 1.
July 1, 2011
Last week I spoke at a local Practice Manager meeting at Fish Memorial Hospital on a very hot topic for medical offices these days – Resolving Conflict. It seems that the majority of the offices I have encountered are struggling with conflicts that range from disgruntled employees to discontented doctors, and even dissatisfied patients.
Did you know that there are over 7 million responses returned when you search Google for conflict resolution? It is even more surprising how sizzling this topic is within the medical field these days. More and more practice managers are commenting on how they are “dealing” with (and sometimes not dealing with) these unpleasant situations in the office.
I have even been asked to host a teleseries on this subject and that announcement will be coming soon so stay tuned…..
Until the teleseries starts, I thought it would be appropriate to discuss something very important in the way we view conflict. Many people think that conflict is something to shy away from or avoid. On the contrary, conflict helps us to see what is not working. In the medical world, we describe our bodies as being good indicators at providing warnings when something is not working. We are often asked when our intake is happening, “what is happening” or “where does it hurt?”. We are keenly aware when something has not settled well on our stomachs or when an allergic reaction lets us know that our body rejected something.
Much like this analogy, conflict within our environment helps us to become aware of the friction that is being caused by two opposing forces encountering friction. To quote one of my mentors – “pain is a great course corrector” and it is so true. One way or another, the pain will cause an action. By avoiding the conflict, we prolong the pain and thus submit everyone in the office to the burden of shouldering the conflict until we are ready to “deal” with it.
Let me encourage you today to consider that the solution is somewhere in the problem. If we keep avoiding the problem, we are in essence denying ourselves of the solution. Embrace the aspect that conflict is telling you what is not working in your office and you as a practice manager have the opportunity to get out the magnifying glass anytime you are ready to analyze the problem and open the door to finding a solution. The sooner you do, the sooner your solution will be revealed. As the saying goes, when the student is ready, the teacher appears.
My personal thanks to Fish Memorial Practice Managers for being willing and open to explore conflict in a new way and a special thanks to Rachel Canlas for inviting me to speak on Conflict Resolution and Creating Positive Change in our Medical Offices.
June 9, 2011
Have you ever tried to complete a task without all the tools? My husband is quite the handyman and he always needs tools for the job. He really hates it when he has to run out in the middle of completing something and get a tool or product to complete the job. Not having the proper tools can be so frustrating.
It’s kind of like our providers who are now switching to Electronic Health Records (EHR) and now they are really wanting to ramp up electronic prescribing before it is too late, but they need the tools to do so. As a practice manager you can help them with the tools they will need to make writing scripts electronically go much smoother. So what are the tools that they need in place?
- Electronic Prescribing System – this is first and foremost. You can either select and write scripts through a separate portal service outside of your existing practice management system which is one option; or you can utilize the capability built into your EHR system to send electronic scripts. Either way you go, providers will need to be registered first with the vendor they will be submitting to.
- Drug/Pharmacy Database – You need an existing drug database and pharmacy database to order scripts electronically. Most portals will have this capability. If you are using your own EHR system to produce the script, then make sure you have loaded a current drug listing, along with a pharmacy list for those closest to your office. Many of these systems will allow you to import pharmacies based on area code or zip code.
Be sure to keep your drug and pharmacy databases updated and current at all times. It is best to perform these types of updates when providers are not seeing patients and attempting to perform these functions.
- Patient’s Medication List – It is best to have listed each and every medication that the patient is taking in order to build a medication list and utilize the capabilities to check scripts for contraindications, allergies, and interactions. It does not benefit the patient for you to keep only a paper medication list and then begin issuing scripts electronically. Once you write a script in your system or portal, you are building a list for medications you have written. Keep a consolidated list for medication reconciliation on the patient’s behalf.
- Drug Formulary – You can begin collecting insurance information on patients to allow for drug formulary checking. One of the benefits of having a formulary accessible is to help the provider to write a prescription within the patient’s allowed list of medications within that formulary. Providers who cannot check a formulary on a patient could cause the patient to have to call back once they reach the pharmacy for a different prescription. They may also have to pay more for a prescription that was not in the formulary or allowed by their insurance. If you know this up front when writing the script you can avoid the additional hassles that could arise.
- Staff Support – Make sure that clinical supportive staff members are trained and ready to support the transition from paper scripts to electronic scripts.
One of the important things to keep in mind is that once you switch to an electronic prescribing for a patient, then you must maintain that list electronically. If you inadvertently pick up the prescription pad and write a script on a patient that is electronic, make sure that you add that script in your system as an issued prescription within your list so that the list is maintained and comprehensive.
If you are a practice manager who is trying to get your provider to begin sending scripts electronically some of the ideas around doing this might be:
- Begin with new patients – building a list with new patients only.
- Take the prescription pads and lock them up in a safe place to avoid reverting back to the paper method.
- Start an auditing system to track who is electronically prescribing the most efficiently and consistently among your providers and report back to the group for comparison.
By the way, these are meaningful use criteria also, so if you are e-prescribing with these things in mind you are getting closer to meeting your criteria in this area as well.