If any part of running a dental practice could be called “most important” while being least likely to be front of mind, it’s HIPAA compliance for protecting patient information. A good portion of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is dedicated to protecting patient information from fraud and theft, and compliance is vital for dental startups.
01How the regulations apply
HIPAA requires you and your business associates to develop and follow procedures that ensure the security and confidentiality of patient health information whenever it’s handled, received, shared, or transferred. The rules apply to all forms of protected information, including paper, electronic, and even oral, and only the minimum necessary health information should be used or shared.
02Digital-age risks
Patient information used to be secured in locked filing cabinets. With the internet and email came unauthorized access and theft, especially at practices unaware of the security measures they should take. In short, unprotected or poorly protected patient information is at serious risk in the digital age.
03What happens if you’re not compliant?
Penalties for non-compliance can be severe and can be levied whether or not a violation was intentional. The agency that issues them, HHS’s Office for Civil Rights (OCR), often resolves cases through voluntary compliance, but ignorance of the rules is not an excuse. Don’t take chances.
Insecure email is a common source of violations. HIPAA penalties fall into four tiers based on culpability:
| Tier | Situation | Minimum per violation | Annual cap (2019 policy) |
|---|---|---|---|
| 1 | You didn’t know, and reasonably couldn’t have known, about the violation (for example, that you needed HIPAA-compliant email) | $100 | $25,000 |
| 2 | Reasonable cause: you knew or should have known, such as continuing to send non-compliant email | $1,000 | $100,000 |
| 3 | Willful neglect, corrected: for example, using compliant email but ignoring its policies and best practices, then fixing it | $10,000 | $250,000 |
| 4 | Willful neglect, not corrected, even after being warned | $50,000 | $1.5 million |
Serious cases can also be referred to the Department of Justice for possible criminal charges.
04Making your dental startup HIPAA compliant
Studying every regulation and then learning the technology required for compliance can be confusing, time-consuming, and frustrating, and few practices get it fully right on their own. As HIPAA compliance specialists, we’re happy to walk you through what we do (or could do, if you aren’t a client) to protect your data and maintain compliance, and we can share our HIPAA compliance checklist.
The easiest path is to work with Darkhorse Tech, an IT company dedicated to dental IT for startups and established practices. Our staff is trained in HIPAA compliance and can handle your compliance measures while you run a thriving practice.
.svg)
