MedEsthetics magazines offers business education and in-depth coverage of the latest noninvasive cosmetic procedures for physicians and practice managers working in the medical aesthetics industry.
Issue link: https://medesthetics.epubxp.com/i/123304
LEGAL ISSUES the current reporting requirements. It is reasonable to conclude that with tighter guidelines there will be an increase in investigations, the additional cost of which will be covered by fines and penalties for noncompliance. The new rules increase the HHS's ability to assess fines and penalties, and the annual maximum amount of fines and penalties has been increased to $1.5 million per violation. Breach Notification Requirements Tightened. Previously, an impermissible use or disclosure of PHI was a breach only if there was a significant risk of harm, and the burden to prove that risk fell on the HHS. Under the for making the communications from a third party whose product or service is being marketed. This frequently occurs with industry-sponsored events or co-marketing programs with laser, neurotoxin and dermal filler vendors. The HHS recognizes the inherent diffi culty in distinguishing between "treatment communications (marketing)" and "healthcare operations (communications)." Some patient communications that are part of a medical practice's operational management may include marketing or treatmentrelated information as well. Thus, it may be diffi cult to distinguish between the two variations. Therefore the HHS will treat as marketing communications "all subsidized communications that market a health-related product or service." Accordingly, if a communication (marketing piece) is paid, in part or in full, by the business associate (laser company, dermal filler firm, etc.), it will be deemed to be marketing in nature and the HIPAA guidelines will apply. If the business associate even provides the materials (brochures, etc.) or information for the materials for the communication being sent to patients (case studies or testimonials, for example), HIPAA regulations will apply as they relate to protected health information and the privacy of the patients. The HHS recognizes the inherent difficulty in distinguishing between 'treatment communications' and 'healthcare operations' communications. 22 MAY/JUNE 2013 | MedEsthetics The HHS has spent a significant amount of time and resources to craft these new regulations, so it is prudent to comply. Frequently, the presence of well-drafted business associate agreements alone will prevent further scrutiny in the case of violations that occur as the result of third-party communications or co-marketing programs. Compliance audits are costly in terms of both practice disruption of operations and the monetary fines or penalties. Therefore, it is time to update your HIPAA protocols and implement new measures to ensure compliance. ME Padraic B. Deighan, JD, PhD, is president of Aston McLaren, a medical and spa consulting firm, and the former president and CEO of DermAmerica, the nation's largest network of dermatology and plastic surgery centers. Contact him at 877.557.9669, medicalspaconsulting.com. © ISTOCKPHOTO.COM new regulations, an impermissible use or disclosure of PHI is presumed to be a breach unless the medical practice or business associate of the medical practice can demonstrate that there is a low probability that the protected health information has been compromised. This is a very substantial burden for the medical practice. Marketing Rules More Clearly Defined. The Final HIPAA Rule modifies the approach to marketing. You may recall from prior issues that we discussed new Federal Trade Commission (FTC) marketing guidelines (See "HIPAA Update," March/April 2010). These HIPAA marketing guidelines are in addition to the new regulations adopted by the FTC. The new regulations require authorization for all treatment and healthcare facility operational communications where the medical practice receives financial remuneration