Health Center Resilience in the Face of Cyber Adversity
Health Center Resilience in the Face of Cyber Adversity
The use of ransomware — malicious software that restricts access to computer systems with financial demands — has escalated, targeting health centers and putting countless lives at risk. This dire reality came to the forefront during the alarming ransomware attack on the Family Health Center of Worcester, Inc. (FHCW), where the personal health information and care continuity for thousands of patients were compromised. This resource uses FHCW's experience as a case study to demonstrate the imperative of preparedness and the strength of a community-centered response in ensuring the continuity of healthcare services amidst the ever-growing tide of cyber vulnerabilities.
Navigating Compliance Challenges with the Information Blocking Rule: A Collection of Case Studies
Navigating Compliance Challenges with the Information Blocking Rule: A Collection of Case Studies
The Office of the National Coordinator for Health Information Technology’s (ONC) 21st Century Cures Act Information Blocking Rule (Info Blocking Rule) prohibits covered actors – including health care providers, health IT developers of certified health IT, and health information exchanges/health information networks– from engaging in practices likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI). The Info Blocking Rule includes eight exceptions that provide actors with certainty that, when their practice interferes with the access, exchange, or use of EHI and meets the conditions of one or more exception, such practice will not be considered information blocking. An actor’s practice that does not meet all the conditions of an exception will be evaluated on a case-by-case basis to determine whether information blocking has occurred.
Health Center Guidelines for Implementing FHIR and the Information Blocking Rule
This resource provides guidance to health centers for implementing FHIR in compliance with the Information Blocking Rule.
Sensitive Information and the Electronic Patient Record
With nearly 100% of community health centers utilizing electronic health records (EHR) to care for patients, focus has pivoted from implementation and new workflow development to enhancement in order to drive value and reflect patient needs and population trends. EHR technology presents potential opportunities and significant constraints. Providers frequently document and share potentially sensitive information in the EHR, such as risk for intimate partner violence (IPV), consistent offers of pre-exposure prophylaxis (PrEP), or patient sexual orientation and gender identity (SOGI). Capturing such information can be immensely helpful in providing care tailored to individuals’ needs, but additionally challenges teams to develop workflows that keep the data private rather than risk harm to patients through improper or unintended disclosure.
Keeping the Pediatric PHI Secure: Using the Security Risk Assessment Tool
This webinar discussed the importance and unique considerations for cyberthreats in pediatric health care settings, followed by a Security Risk Assessment (SRA) Tool walkthrough.
Health Center Information Blocking Avenger
In March 2019, the Office of the National Coordinator for Health Information Technology (ONC) issued a Proposed Rule, 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program. ONC released a final rule in March 2020, published in the Federal Register on May 1, 2020. The Final Rule on Information Blocking prohibits actors from blocking the exchange of electronic health information and seeks to increase the ease and choices available for patients to access their data.
Click Read More below to understand how this impacts health centers.
SAMHSA 42 CFR Part 2 Revised Rule
New guidelines from SAMHSA released in July 2020 are designed to improve coordination of care for patients in treatment for substance disorder, while protecting confidentiality against unauthorized disclosure and use of patient information. View this HITEQ webinar on changes to SAMHSA’s 42 CFR Part 2 rule (Part 2) which protects individuals receiving substance use disorder treatment by defining privacy and security requirements for written, electronic and verbal information. This webinar features expert presenters from the University of New Hampshire Institute for Health Policy and Practice and the Center of Excellence for Protected Health Information who present on the new final Part 2 rule and future changes in the CARES Act, including what has changed, what has not changed, what this means for health centers in regard to consents and disclosures, and the implications for care coordination. This presentation also addresses privacy considerations for tele-behavioral health and exceptions during the state of emergency waiver.
Telehealth Policy during Coronavirus/ COVID-19 Pandemic
We are adding additional telehealth policy information relevant to coronavirus/ COVID-19 pandemic as it impacts health centers as it becomes available.
I Provide SUD Services in an FQHC: Does Part 2 Apply to Me?
This decision tree, developed through funding from the Substance Abuse and Mental Health Services Administration (SAMHSA) helps organizations determine if Part 2 of CFR 42 applies to them. It should be noted that FQHCs will always be designated as “federally assisted” due to certified status as Medicaid providers and/or federal funding.
Behavioral Health Consent Management
The timely exchange of health information between behavioral health providers and physical health providers to support care coordination is a critical element of the National Quality Strategy and health reform efforts. However, privacy and confidentiality concerns are currently limiting the inclusion of behavioral health data in electronic health information exchange efforts.