One of the questions I'm asked most frequently by dentists and dental practice managers is, "Why do I need your service?"
In addition to keeping your technology up to date and your office running smoothly, at Darkhorse Dental IT we:
- Design, install, and maintain your dental office technology
- Protect your business and patient data
- Provide your practice with consistently reliable IT service and support
- Ensure your office is secured properly and compliant with HHS, HIPAA, and HITECH Rules for healthcare providers
The last bullet point is especially important because the number of practices that don't know what it takes to properly protect their dental office(s) in today's digital world is alarming.
In this article, I'll provide some general guidance and information to help you understand compliance requirements for dental practices and the potential consequences of non-compliance.
01What laws and guidelines apply to my dental practice?
I am also frequently asked what specific laws and rules are required and how to follow them. Over the years I developed a sort of cheat sheet that I reference to help explain to dental offices why we implement all the compliance and security protocols that we do, and in this blog I am sharing it with our readers.
There are several rules in the HITECH security requirements. We have analyzed each of these and their impact on dental practices. Here are my top five compliance and security rules, with a simplified breakdown of what each means for your dental practice.
My top 5 compliance and security rules
| Rule | What it means for your practice |
|---|---|
| 1. Security patches HIPAA Security Rule 45 C.F.R. § 164.308(a)(5)(ii)(B) specifically requires updated patches on all systems. | All hardware and software must be up to date with security patches in place. This is the rule that makes Server 2008 and Windows 7 operating systems not compliant in a healthcare environment, because they no longer receive security updates from Microsoft. It also means your Dentrix, Eaglesoft, Open Dental, etc. should be running on the latest stable version. |
| 2. Backup and recovery HIPAA Security Rule 45 C.F.R. § 164.308(a)(7)(ii)(A) Data Backup Plan, 164.308(a)(7)(ii)(B) Disaster Recovery Plan, 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan. | You must have backups of your data that are secure and protected, and you must have a disaster recovery plan, so that if there is an office catastrophe or disaster, your recovery plan can be enacted and emergency operations can be set up. |
| 3. Audit controls HIPAA Security Rule 45 C.F.R. § 164.312(b) (also known as the HIPAA logging requirements) requires Covered Entities and Business Associates to have audit controls in place. | Access controls and audit trails need to be in place to keep Protected Health Information (PHI) secure. This can only be accomplished by managed firewalls, managed antivirus, activity logs, and a domain controller. |
| 4. Workstation security HIPAA Security Rule 45 C.F.R. § 164.312(c). Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users. | Data must always be protected by best efforts. |
| 5. Disposal (required) HIPAA Security Rule 45 C.F.R. § 164.312(c)(i). Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored. | Old equipment that has PHI on it must be disposed of properly and documented. Our company provides complimentary, environmentally friendly, NIST- and HIPAA-compliant PHI e-waste destruction. |
02What are the specific violations and penalties?
Several times, someone whose practice was non-compliant has said, "Well, I just didn't know." Unfortunately, this is similar to when a police officer pulls someone over for holding their cell phone while driving in Georgia: "I didn't know" is not an acceptable response, and the driver is in violation of the law.
When it comes to HIPAA requirements for healthcare providers, a lack of understanding is not an acceptable rationale, and the consequences for non-compliance can result in potentially large financial penalties and damage to a practice's reputation.
Note that "per violation" could mean each record, in the event of a records breach. Additionally, a breach doesn't have to occur for the Office for Civil Rights (OCR) to fine an office for negligence.
03The high penalty of non-compliance
In addition to the monetary penalties, there are a number of additional consequences that can result from non-compliance. A breach or non-compliance violation can be damaging to a dental office's reputation. It can be hard to distance the practice from negative blemishes once they have occurred, and it can have a long-lasting negative impact on the business. In fact, for large breaches, the Office for Civil Rights maintains a publicly available list, including the practice name and the nature of the violation.
For example, I know of a local practice that was the victim of a cyberattack in 2016 in which a hacker obtained the PHI of over 200,000 patients. The Office for Civil Rights conducted an investigation and determined negligence, resulting in a $1.5 million fine to the practice. Although the practice did not intentionally violate security protocols, their lack of understanding and compliance cost them severely.
Dental practices cannot afford to risk their financial stability and their reputation due to a lack of knowledge and compliance.
04How do I protect my dental practice?
As healthcare providers, dental offices are legally required to follow specific security rules and guidelines. While it can seem overwhelming to understand and comply with all of these requirements, it doesn't have to be. We can manage this for you. Darkhorse Tech has been specializing in dental office security and technology for 14 years, and we are dedicated to ensuring your office is safe, secure, protected, and running smoothly.
The bottom line
What you don't know can hurt you when it comes to security and HIPAA compliance. The purpose of this article is to give you guidance and knowledge to make informed decisions regarding your practice. I hope you found this information beneficial.
Get a free compliance evaluation
To see if your dental practice is following HIPAA best practices and security standards, contact us for a complimentary office evaluation to find out if your office is in compliance and running as efficiently and profitably as possible.
.svg)
