Quick Feedback Request
Highlighted Resources & Events
Need Assistance?
Would you like more assistance regarding Privacy and Security strategies or support in using any of the include resource sets?

  Request Support

 

The Quadruple Aim
Quadruple Aim

A Conceptual Framework

Improving the U.S. health care system requires four aims: improving the experience of care, improving the health of populations, reducing per capita costs and improving care team well-being. HITEQ Center resources seek to provide content and direction aligned with the goals of the Quadruple Aim

Learn More

Resource Overview

Conducting an SRA in accordance with HIPAA policy is a complex task, especially for small to medium providers such as community health centers. The HIPAA Security Rule mandates security standards to safeguard electronic Protected Health Information (ePHI) maintained by electronic health record (EHR) technology, with detailed attention to how ePHI is stored, accessed, transmitted, and audited. This rule is different from the HIPAA Privacy Rule, which requires safeguards to protect the privacy of PHI and sets limits and conditions on it use and disclosure. Meaningful Use supports the HIPAA Security Rule. In order to successfully attest to Meaningful Use, providers must conduct a security risk assessment (SRA), implement updates as needed, and correctly identify security deficiencies. By conducting an SRA regularly, providers can identify and document potential threats and vulnerabilities related to data security, and develop a plan of action to mitigate them.

Security vulnerabilities must be addressed before the SRA can be considered complete. Providers must document the process and steps taken to mitigate risks in three main areas: administration, physical environment, and technical hardware and software. The following set of resources provide education, strategies and tools for conducting SRA.

Security Risk Analysis Resources

Health Center Resilience in the Face of Cyber Adversity

A Case Study of the Family Health Center of Worcester’s Ransomware Incident, February 2024

Molly Rafferty 0 323
The use of ransomware — malicious software that restricts access to computer systems with financial demands — has escalated, targeting health centers and putting countless lives at risk. This dire reality came to the forefront during the alarming ransomware attack on the Family Health Center of Worcester, Inc. (FHCW), where the personal health information and care continuity for thousands of patients were compromised. This resource uses FHCW's experience as a case study to demonstrate the imperative of preparedness and the strength of a community-centered response in ensuring the continuity of healthcare services amidst the ever-growing tide of cyber vulnerabilities.

Navigating Compliance Challenges with the Information Blocking Rule: A Collection of Case Studies

HITEQ Center and Feldesman Tucker Leifer Fidell LLP, September 2023

Molly Rafferty 0 3594

The Office of the National Coordinator for Health Information Technology’s (ONC) 21st Century Cures Act Information Blocking Rule (Info Blocking Rule) prohibits covered actors – including health care providers, health IT developers of certified health IT, and health information exchanges/health information networks– from engaging in practices likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI). The Info Blocking Rule includes eight exceptions that provide actors with certainty that, when their practice interferes with the access, exchange, or use of EHI and meets the conditions of one or more exception, such practice will not be considered information blocking. An actor’s practice that does not meet all the conditions of an exception will be evaluated on a case-by-case basis to determine whether information blocking has occurred.

Sensitive Information and the Electronic Patient Record

HITEQ Center, June 2023

Molly Rafferty 0 3351

With nearly 100% of community health centers utilizing electronic health records (EHR) to care for patients, focus has pivoted from implementation and new workflow development to enhancement in order to drive value and reflect patient needs and population trends. EHR technology presents potential opportunities and significant constraints. Providers frequently document and share potentially sensitive information in the EHR, such as risk for intimate partner violence (IPV), consistent offers of pre-exposure prophylaxis (PrEP), or patient sexual orientation and gender identity (SOGI). Capturing such information can be immensely helpful in providing care tailored to individuals’ needs, but additionally challenges teams to develop workflows that keep the data private rather than risk harm to patients through improper or unintended disclosure.

Health Center Information Blocking Avenger

A HITEQ Center Training Badge

HITEQ Center 0 21922

In March 2019, the Office of the National Coordinator for Health Information Technology (ONC) issued a Proposed Rule, 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program. ONC released a final rule in March 2020, published in the Federal Register on May 1, 2020. The Final Rule on Information Blocking prohibits actors from blocking the exchange of electronic health information and seeks to increase the ease and choices available for patients to access their data

Click Read More below to understand how this impacts health centers.

SAMHSA 42 CFR Part 2 Revised Rule

HITEQ Highlights Webinar

Molly Rafferty 0 28587

New guidelines from SAMHSA released in July 2020 are designed to improve coordination of care for patients in treatment for substance disorder, while protecting confidentiality against unauthorized disclosure and use of patient information. View this HITEQ webinar on changes to SAMHSA’s 42 CFR Part 2 rule (Part 2) which protects individuals receiving substance use disorder treatment by defining privacy and security requirements for written, electronic and verbal information. This webinar features expert presenters from the University of New Hampshire Institute for Health Policy and Practice and the Center of Excellence for Protected Health Information who present on the new final Part 2 rule and future changes in the CARES Act, including what has changed, what has not changed, what this means for health centers in regard to consents and disclosures, and the implications for care coordination. This presentation also addresses privacy considerations for tele-behavioral health and exceptions during the state of emergency waiver.

I Provide SUD Services in an FQHC: Does Part 2 Apply to Me?

A Decision Tree from the Legal Action Center

HITEQ Center 0 28519

This decision tree, developed through funding from the  Substance Abuse and Mental Health Services Administration (SAMHSA) helps organizations determine if Part 2 of CFR 42 applies to them. It should be noted that FQHCs will always be designated as “federally assisted” due to certified status as Medicaid providers and/or federal funding.

Behavioral Health Consent Management

From the Office of the National Coordinator

HITEQ Center 0 19709

The timely exchange of health information between behavioral health providers and physical health providers to support care coordination is a critical element of the National Quality Strategy and health reform efforts. However, privacy and confidentiality concerns are currently limiting the inclusion of behavioral health data in electronic health information exchange efforts.

Strategic Cybersecurity Breach Protection and Incident Response

Guidance and Resources for Health Centers

HITEQ Center 0 26124

General cybersecurity guidance would suggest that Health IT breach should not be considered a matter of “if”, but rather a matter of “when”. How Health Centers prepare and respond to an episode of a breach is just as important as defending itself from the breach.

Health Center Defense Against the Dark Web Presentation

Strategies for Building Security Awareness, Education and Compliance

HITEQ Center 0 28383

It is of critical importance to motivate and educate healthcare professionals on current critical privacy and security concepts and methods for defense of health data. Aspects of security awareness training, breach protection, incident response, and related topics all play a role toward organization-wide information protection. Healthcare cybersecurity is the ultimate team sport. The responsibility goes beyond the IT staff and includes front and back office staff, doctors and nurses, patients, executives, and the board of directors. The attached presentation is directed to all levels of the healthcare organization so that they may be proactive and aware.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients

A publication of the Cybersecurity Act of 2015, Section 405(d) Task Group

HITEQ Center 0 28712

The HIPAA Security Rule establishes the requirements for protection of electronic patient health information. The safeguards identified are made up of three domains that include administrative, physical, and technical safeguards that need to be addressed. The technical safeguards as defined within 45 CFR §164.312 of the HIPAA Security Rule can be some of the most difficult to comprehend and implement for smaller Health Centers with lower levels of IT and security staffing. Resources and tools that help Health Centers better process and implement these security requirements are much needed and require well-documented methods for planning and maintaining critical security controls.

Substance Abuse Confidentiality Regulations - 42 CFR Part 2

Frequently Asked Questions (FAQs) and Fact Sheets regarding the Substance Abuse Confidentiality Regulations

Anonym 0 41769

Frequently Asked Questions (FAQs) and Fact Sheets regarding the Substance Abuse Confidentiality Regulations. 

Two fact sheets include: 

FAQs about Applying the Substance Abuse Confidentiality Regulations, answers provided by Substance Abuse and Mental Health Services Administration (SAMHSA)

Creating and Managing Strong Passwords at Your Health Center

Guidance in relation to updated NIST security requirements and HIPAA

HITEQ Center 0 44011

Is it acceptable/recommended for health centers to adopt the new password policy guidelines under NIST Special Publication 800-63B and will that still uphold the HIPAA security rule? This question had been posed to the HITEQ Center asking whether we had any guidance or recommendations on implementing the new NIST Guidelines regarding password security.  New Digital Identity Guidelines under NIST Special Publication 800-63-B presents new guidelines regarding password security that are much more user-friendly and consequently more likely to be observed by health center staff since constantly changing, complex password on multiple systems can be a source of frustration for the end user. 

The Health Center CIO’s Guide to HIPAA Compliant Text Messaging

2019 Updates on Methods for Successful Patient Text Messaging Strategies

HITEQ Center 0 74010

This slide deck provides health centers with information and a presentation template overview of the HIPAA and electronic PHI risks related to texting and messaging that are important for health center leadership and IT managers to understand in making organizational decisions for these types of tools.

Online Reputation Management for Health Centers

Maintaining a Good Name in the Digital Era, from Wyoming Primary Care Association

Wyoming PCA 0 34593

A Health Center’s online reputation plays an ever-growing role in client satisfaction, as 6 out of 10 patients use online patient reviews before selecting a physician. This webinar and related handouts recommend three specific steps to managing your reputation online to improve patient engagement.

Emergency Situations: Preparedness, Planning, and Response

Guidance from the Office for Civil Rights

Office for Civil Rights 0 35217

From the OCR: The Privacy Rule protects individually identifiable health information from unauthorized or impermissible uses and disclosures. The Rule is carefully designed to protect the privacy of health information, while allowing important health care communications to occur. These pages address the release of protected health information for planning or response activities in emergency situations.  In addition, please view the Civil Rights Emergency Preparedness page to learn how nondiscrimination laws apply during an emergency.

Limited Waiver of HIPAA Sanctions and Penalties During Declared Emergency

Guidance from the Office for Civil Rights

Office for Civil Rights 0 37692

From the OCR: Severe disasters – such as Hurricanes Harvey, Irma, and Maria – impose additional challenges on health care providers. Often questions arise about the ability of entities covered by the HIPAA regulations to share information, including with friends and family, public health officials, and emergency personnel. As summarized in more detail below, the HIPAA Privacy Rule allows patient information to be shared to assist in disaster relief efforts, and to assist patients in receiving the care they need. In addition, while the HIPAA Privacy Rule is not suspended during a public health or other emergency, the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.

42 CFR Part 2 Final Rule and Health Center Compliance

A HITEQ Webinar in collaboration with the California Primary Care Association (CPCA)

HITEQ Center 0 44920

This 2017 webinar explored the history and recent changes of 42 CFR Part 2, reviewed common definitions, and how the changes may affect integrated medication-assisted treatment (MAT) and Screening, Brief Intervention, and Referral to Treatment (SBIRT) programs, and discussion on LifeLong Medical Care’s experience.

RSS

Acknowledgements

This resource collection was cultivated and developed by the HITEQ team with valuable suggestions and contributions from HITEQ Project collaborators.

Looking for something different or have something you think could assist?

HITEQ works to provide top quality resources, but know your needs can be specific. If you are just not finding the right resource or have a highly explicit need then please use the Request a Resource button below so that we can try to better understand your requirements.

If on the other hand you know of a great resource already or have one that you have developed then please get in touch with us by clicking on the Share a Resource button below. We are always on the hunt for tools that can better server Health Centers.

Request a Resource  Share a Resource