HIPAA and Privacy Compliance Videos

Jeffrey Segal, MD, JD, Chief Executive Officer and Founder of Medical Justice, shares stories from cases involving physicians who violated HIPAA and explains the key lessons on how they could have prevented the consequences that followed. Medical Justice offers comprehensive support to help physicians navigate complex challenges that can put their practice and reputation at risk. We provide the tools and analysis needed to identify and mitigate patient and practice-related issues before they escalate. Our team of experts, including Jeff Segal, MD, JD, helps you respond effectively to unwarranted refund demands, sham peer reviews, medical board complaints, and notices of intent to sue—working to prevent frivolous lawsuits and guide situations toward a safer, more controlled resolution. We also deliver strategic online reputation management, helping you address defamatory reviews and shape a digital presence that accurately reflects your professionalism and the quality of care you provide. Visit our site to learn more about our services and to schedule a free consultation: https://medicaljustice.com/ Learn more about Medical Justice’s protection plans for doctors: https://medicaljustice.com/services/legal-protection-plans-for-doctors/
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay45NDk1REZENzhEMzU5MDQz

HIPAA Police: Lessons Learned

Chief Executive Officer & Founder of Medical Justice, Jeffrey Segal, MD, JD walks through some of the nuances of HIPAA to help ensure you are aware of the details that you, as a doctor, might be violating without even knowing it. Medical Justice offers comprehensive support to help physicians navigate complex challenges that can put their practice and reputation at risk. We provide the tools and analysis needed to identify and mitigate patient and practice-related issues before they escalate. Our team of experts, including Jeff Segal, MD, JD, helps you respond effectively to unwarranted refund demands, sham peer reviews, medical board complaints, and notices of intent to sue—working to prevent frivolous lawsuits and guide situations toward a safer, more controlled resolution. We also deliver strategic online reputation management, helping you address defamatory reviews and shape a digital presence that accurately reflects your professionalism and the quality of care you provide. Visit our site to learn more about our services and to schedule a free consultation: https://medicaljustice.com/ Learn more about Medical Justice’s protection plans for doctors: https://medicaljustice.com/services/legal-protection-plans-for-doctors/
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay40NzZCMERDMjVEN0RFRThB

HIPAA Refresher: Are You Violating HIPAA Without Knowing?

eMerit & Medical Justice Interview Series - Social Media and HIPAA Compliance. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878. Transcript: Jeff: Many people, most people are on social media today. It includes Facebook, Instagram, etc. How should doctors think about interacting on Facebook, in particular when patients initiate the contact. Mike: Ok, so we need to be very careful here because the Federation of State Medical Boards has given specific guidance to us. And if we want to listen to anyone we want to listen to the people that control our licenses to practice medicine, right? And so there are certain guidelines on what you can do and what you can't do and I think that it's not terribly difficult if it's explained to you and you have some policies in place. Certainly one area of mistake that I see people make is they think, oh if I just don't use the patient's name and I just don't show a photograph of the patient's face, everything will be ok because there's no possible way that anyone could ever link this up. And I'm here to tell you that people link things up and I can give you multiple examples of physicians having their license suspended for doing just something right along those lines. Jeff: Alright, I would be remiss if I didn't bring up the hotrod case. Would you be kind enough to educate our audience about the hotrod case where the patient's name was not released and a picture of his face was not released. Mike: So, there was a patient that was having a gallbladder surgery and while being prepped for the surgery it was discovered that this patient had tattooed on his body, "hotrod." Well this was too exciting for the surgical staff and someone pulled out their smartphone and took a close up of the tattoo. And it was, no one told the patient at the time and the patient only found out about it some weeks later when contacted by media requesting an interview about his hotrod tattoo. So, that's an example of how it went from one person's smartphone to being on the national news. Jeff: So what happened to that doctor? Mike: The honest answer is it was not pretty, there were a number of different sanctions involved as well as remedial and there was a lawsuit. So, what happened involved attorneys and so I can always tell you that when attorneys are involved it's not a happy scenario. Jeff: Certainly not in this particular case. Mike: No, that's correct. Jeff: Alright. For more information or to join our mailing list sign up at info@medicaljustice.com. eMerit & Medical Justice Interview Series - Social Media and HIPAA Compliance. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878.
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay5DQUNERDQ2NkIzRUQxNTY1

eMerit & Medical Justice Interview Series – Social Media and HIPAA Compliance

How Doctors Can Protect Their Practice from HIPAA Errors by Vendors. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878. Jeff: One more. I can control my office. Let's say I do everything right, I can control my office, but an office is not an island. I have to work with other entities, vendors who may be touching protected health information. Help me understand what a doctor's office must do to work with vendors so that there handing protected health information safely. Mike: So, you bring up a great point. And these vendors that you speak of, under the law, are called business associates, and you're required to have a contract with them. So, let's think about what would be a business associate? Well, it's anyone that has access to patient information using patient information to help a physician's office. Let's say it's a third party billing service, or a transcription service, or your IT guys who come in to work on your system where there's all that patient information. Any of these people you need to have a business associate agreement with. Any you've identified an enormous area of risk. In fact, some studies show that there is a greater risk for a practice by the people it does business with then what goes on inside its four walls. One study shows 58% of all breaches happen at the business associate level. So, if you think you've gotten everything under control within your practice, I'm sorry to tell you that there is this whole other world of risk outside that we need to give some attention to. Jeff: Well, how do I avoid getting burned by the actions of my third party? Let's say I've got a good business associate agreement in place, which I assume you provide through the Medical Risk Institute? Mike: Yes. Jeff: What is in there that keeps me out of harm's way to the extent that this business associate mishandles the information? Mike: Well, we want to make sure that there's an indemnity provision under this and that's not required by federal law, that you're indemnified by your business associates. But you certainly want them to be responsible if they make a mistake for reimbursing you. And this becomes an area of tremendous cost because of all the notice requirements, filing both with the state the federal governments sending every patient involved a letter providing identity theft protection. The cost can be upwards of two-hundred dollars per patient in a breach. And that comes to us from the Ponemon Institute who tracks this. So, it's very expensive in a large scale electronic breach, and if that's done by one of your business associates, we need to think of the term agent because they are your agent. You have picked them, and you are responsible for their actions. So, we need, under that contract to make sure that they're indemnifying you and really that they have the ability to do that which means insurance coverage. I'd like to see that your business associate has the appropriate insurance coverage to pay for the mistakes that they might make on your behalf. Jeff: Okay, you just talked about insurance for the business associate what about insurance for me? Are all cyber insurance policies the same? And if not how is a person supposed to figure out what are the must-haves and what are the nice-to-haves versus the fluff? Mike: So, cyber policies are not uniform. Unlike your traditional med/mal policy that's pretty much standardized doesn't matter what carrier you get. It's all over the board with cyber because it's so new. I tell my clients, look for first-party coverage because that takes care of you and you want to make sure that it has all the different elements. It is somewhat complex because these are new creatures, and they're coming out all different ways and at different times whether it has media coverage which you may need to respond to a large-scale breach is an area that we don't often see and so I think that you want to make sure that it covers all the different things that you could be financially responsible for. Jeff: So you do want to be careful with getting the right policy, you don't want to over pay, you don't want to under pay. So it means having a real understanding of what are the must-haves in terms of the insurance. Is this something that you can point clients in a particular direction with reputable vendors? Mike: Right. Neither Medical Risk Institute nor eMerit sells any insurance. I think we view our role as being able to provide some guidance and say, "Here's what you need to look for both in the amount of coverage that you need and the type of coverage that you need." And that's really where we assist people. For more information or to join our mailing list sign up at info@medicaljustice.com. How Doctors Can Protect Their Practice from HIPAA Errors by Vendors. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878.
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay41MzJCQjBCNDIyRkJDN0VD

How Doctors Can Protect Their Practice from HIPAA Errors by Vendors

The Medical Justice HIPAA Compliance Protection Plan. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878. Transcript: Jeff: Since 2002 we've been protecting doctors from a host of evolving threats and HIPAA seems to be one of the most concerning of those threats that's why we've partnered with our general counsel, Mike Sacopulos to fix this problem. It is not a job for the faint of heart, but we've put together a package, a program with Mike's organization to make this inexpensive and easy to implement. Mike: The Office of Civil Rights has implemented random audits so you would receive something in the mail that would ask for certain documents to be produced. The Office of Civil Rights has field offices, and they can even send out agents to your practice to go through and see how compliant you are. This could be done totally randomly, or it could be generated by a complaint. And so, we are seeing a great increase in the enforcement of HIPAA that we did not see years ago. HIPAA can be complex, and it's the old story of, "What's gonna get ya in trouble is what ya don't know." And so that's why you need to have someone help you, walk you through it, package it up and make it simple so you can get back to what you do best which is practicing medicine and not trying to comply with a bunch of privacy standards. Jeff: By providing help to our clients, Medical Justice and eMerit is a business associate to our clients. And so, we've gone through this particular training with our general counsel's organization. We think it's important to be compliant because we don't want our plan members to be in harm's way. So, it's important to take action now. If you addressed it up front, it's an explanation. If you deal with it after the fact, it's an excuse. So, we recommend that you get in touch with us today. Do not wait. HIPAA is not going to get any easier it's only going to become more difficult. For more information or to join our mailing list, sign up at info@medicaljustice.com. The Medical Justice HIPAA Compliance Protection Plan. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878.
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay4xMkVGQjNCMUM1N0RFNEUx

The Medical Justice HIPAA-Compliance Protection Plan

Q&A with Founder and General Council of Medical Justice - HIPAA Compliance for Dentists and Physicians in 2018. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878. Transcript: Jeff Segal: Alright, I"m just going to bust through some questions our Medical Justice and eMerit plan members have given to us. So for example, if a patient dies, their assumption is that HIPAA doesn't rule any longer. Is that accurate? Mike Sacopulos: It's not. You have to go with who is in charge of the executor of the estate or the personal representative depends on what state you're in, has control over those records. You can't just turn them loose. HIPAA does not end at death. Jeff: So HIPAA continues living forward after death for some time, is that correct? Mike: That's exactly right. Jeff: Wow, that sounds like there are a lot of details related to HIPAA that aren't particularly intuitive. Mike: Unfortunately the devil is always in the detail, right? This is an area of law that there's lots of detail. Jeff: OK, I've got one more that I've been led to believe and it sounds a bit crazy. Help dispell this myth. I understand that if you send an email to a patient that that is not Kosher but to the extent, you send a fax that's OK. Is that correct? Mike: Oddly, I think you're right. You can send emails in certain situations but the email comes under both HIPAA and the High Tech Act, where the fax does not. So it's outside of these rules. Now, in today's world, we have fax account that go through email accounts and so forth so distinction seems very odd and archaic and I think that it is. It's just another example of how people can get in trouble or how the rules and regulations are confusing. Jeff: So many patients and at least people that I know want to communicate through email, they want to communicate through texting. What does a practice need to do when they see a patient to determine whether they can safely communicate by email or by text? Mke: Well, I recommend you get a patient's permission to do that. Certainly, if that patient initiates the communication, you're able to respond in the fashion that you were contacted right, so if the patient sends you an email, it's assumed that you can respond to that email without any kind of problem. If you want to initiate the conversation, then I think you need to have the patient's permission to do so. Jeff: So, by permission, you mean a very particular and formal type of authorization, is that accurate? Mike: That's right. Jeff: So people can get in touch with our organization to get a template of such a release, is that correct or authorization? Mike: You're exactly right. They certainly can. And this is not an area that is terribly difficult. The problems come by what you don't know. So this is an area that hopefully we've identified the risk and provided easy solutions for people to implement in their practices. So they just keep them out of harm's way. Jeff: Is it enough to have in the intake form a document which says "I give permission for Dr. Segal do send an email to me"? Is that adequate or does it really need to be a bit more involved than that? Mike: I think it needs to be a little bit more involved. We need to talk about what type of an email. Some people may not want certain types of information sent. Sometimes they only want them to go to certain email accounts. So there needs to be a little bit more in depth than what you propose but you're certainly on the right path. For more information or to join our mailing list, sign up at info@medicaljustice.com. General Counsel, Mike Sacopulos joins Founder & CEO of eMerit and Medical Justice, Jeff Segal, MD, JD in a lightning round of questions from our clients about HIPAA.
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay45ODRDNTg0QjA4NkFBNkQy

Q&A with Founder and General Council of Medical Justice – HIPAA Compliance

Founder, Jeff Segal, MD, JD, FACS & General Counsel, Mike Sacapolus of Medical Justice Share HIPAA Rules Related to Referring Doctors and Insurance. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878. Hi, I'm Jeff Segal, founder, and CEO of Medical Justice and eMerit. We're here today with our general counsel, Mike Sacopulos. Jeff: If a doctor wants to connect with a referring doctor to get information from that referring doctor does the patient need to sign a HIPAA release to get that information or can a doctor actually speak with a referring doctor directly and learn all the things he needs to about that patient? Mike: Can definitely speak directly with the referring physician and provide information to the referring physician unless for some odd reason the patient has specifically said," Do not share my information with anyone." But in the general course of treatment when you're referring a patient on, yes, you can provide information to the referral source. Jeff: And what about an insurance company. If a patient comes in and presents their BlueCross card, is it assumed that you can then submit a claim on their behalf or send information to the insurance company to get paid or do you need the patient then to fill out reams of paperwork to accomplish that? Mike: No, in a move of surprising efficiency that was excluded from the rules if it's in the scope of getting paid for the services that you rendered, there's no specific requirement there. So, you may go ahead and bill third-party payers. Jeff: Who knew? It's great news. For more information or to join our mailing list, sign up at info@medicaljustice.com. Founder, Jeff Segal, MD, JD, FACS & General Counsel, Mike Sacapolus of Medical Justice Share HIPAA Rules Related to Referring Doctors and Insurance. Visit us online at https://goo.gl/Ddj3Cx or call 877-633-5878.
YouTube Video UExtRGMwd3BVcFR2bGxJZlViSHNQVnZrVEtGV2RKdjlZay4zMDg5MkQ5MEVDMEM1NTg2

Founder & Gen. Counsel of Medical Justice Share HIPAA Rules Related to Referring Drs and Insurance

Subscribe
Contact Us

We’re here to provide assistance to doctors in need of guidance. Fill out this online form to start the conversation, or schedule a 15-minute consultation using our online appointment manager.

This field is for validation purposes and should be left unchanged.
Name(Required)
Are you the doctor?(Required)
Newsletter