Eagle Associates, Inc. is pleased to announce that we are now an ADA CERP Recognized Provider. This means that we may award Continuing Education credits (CEs) for participation in our online training program, eCompliance Training. eCompliance Training is an electronically mediated, self-study training program.

Participants must be enrolled in Eagle Associates’ eCompliance Training program and must print transcripts of completion each year before December 31st.  (Note that Eagle Associates must document participation in order to award credits. We are not permitted to award credits for paper completion of the training tests – they must be completed online.)

Available training modules

We offer seven OSHA training modules that apply universally to all healthcare facilities, such as Bloodborne Pathogens, Hazard Communication and Emergency Preparedness. In addition, access to 10 special safety training modules are available for employees/workplaces to which the topics apply. For example, if employees will be exposed to ionizing radiation, nitrous oxide or laser systems, they must receive training.

We offer three HIPAA training modules that include the HIPAA Privacy Rule, Security Rule and Privacy Breach and Identity Verification that must be completed by each workforce member of a covered entity.

One training module is provided to meet OIG Fraud, Waste and Abuse Prevention training requirements for practices that participate in Federal health care programs such as Medicare, Medicaid and the Children’s Health Insurance Program (CHIP).

New hire (orientation) training modules are available for OSHA, HIPAA and OIG training to jumpstart training of new employees.

For more information about how to enroll in eCompliance Training, contact our office via email at info@eagleassociates.net, or by phone at (800) 777-2337.

Eagle Associates, Inc. is an ADA CERP Recognized Provider.

ADA CERP is a service of the American Dental Association to assist dental professionals in identifying quality providers of continuing dental education. ADA CERP does not approve or endorse individual courses or instructors, nor does it imply acceptance of credit hours by boards of dentistry.

Concerns or complaints about a CE provider may be directed to the provider or to Commission for Continuing Education Provider Recognition at ADA.org/CERP.

The Cybersecurity and Infrastructure Security Agency (CISA) published a notice regarding cyber threat actors that are attempting to exploit CVE-2021-21985, a remote code execution vulnerability in VMware vCenter Server and VMware Cloud Foundation. 

Although patches were made available on May 25, 2021, unpatched systems remain an attractive target and attackers can exploit this vulnerability to take control of an unpatched system. VMware vCenter Server and VMware Cloud Foundation are part of the underlying infrastructure for most agencies with on-premises network management. 

CISA is encouraging private sector organizations, including medical and dental providers, to review VMware’s VMSA-21-0010, blogpost, and FAQ  for more information about the vulnerability and apply the necessary updates as soon as possible, even if it would mean pushing updates outside of your normal patch schedule.  If your organization cannot immediately apply the update, then apply the workarounds in the interim.

We encourage you to forward the information in this alert to your IT vendor for immediate action.

The Office for Civil Rights (OCR) has been aggressively pursuing enforcement actions, with civil monetary penalties, regarding patients’ right of access to their records.  As part of OCR’s Phase 2 audits, the agency has fulfilled its promise to vigorously enforce the rights of patients to receive copies of their medical records promptly and without being overcharged. 

A 2019 study published by medRxiv (https://www.medrxiv.org/content/10.1101/19004291v1) found that more than 50% of the providers evaluated were not fully compliant with access requirements or it took multiple requests to obtain records as required. Additionally, 24% did not appear to be aware of fee limitations for providing medical record copies.

Pending Regulatory Actions

While studies and increased enforcement have uncovered issues with patients being able to obtain copies of records, HHS has published proposed changes to the Privacy Rule that will enhance requirements for timeliness of access, allowable fees for copies of medical records, strengthened right of inspection, and advance notice for access and fees.  HHS’ proposed modifications to the Privacy Rule will provide patients with more and stronger rights for obtaining information in their medical records.

Practices need to familiarize themselves with current rights that are granted to patients and their representatives.  Additionally, there is a need to monitor changes that will be implemented in the next 12 to 18 months. Eagle Associates will be publishing updates in the Advisor® as well as providing new policies and procedures to ensure compliance. Now is the time to review existing procedures to ensure compliance with right of access requirements.

---

Note:  If you subscribe to Eagle Associates’ HIPAA Compliance System, there are policies for Right of Access (Section 3.15) and Copies of Protected Health Information (Section 3.15d).

For detailed information about the right of access, refer to the article “OCR Enforcement of Patient Right of Access” on page 9 of the February 2020 issue of the Advisor®.