OCR Recently Released a Bulletin Outlining the Proper Use of Tracking Tech in Accordance with HIPAA Compliance

By Matt DiBlasi, Abyde President & Co-Founder

Covered entities and business associates, like health care providers, that use online tracking technology should ensure their electronic protected health information management meets HIPAA standards.

Have you ever talked about being out of toothpaste at work, and then when you get home there’s an ad for Colgate on your tablet as you decide what to order for dinner? It’s creepy, but it’s efficient. You’ve been targeted and the Colgate marketing department is doing its job. In this example, the transmission of your tracked demographics and shopping habits is not as sensitive as the transmission of your patient’s data.

Recently, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services issued a bulletin (visit bit.ly/3uOmUiy to view) regarding the correlation between sharing electronic protected health information (ePHI) and online tracking technology. While we at Abyde aren’t experts in targeted advertising, we are HIPAA experts. There are rules that apply to regulated entities when collecting information through tracking technologies or disclosing ePHI to vendors with whom you may be working. The OCR put it plainly, “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of ePHI to tracking technology vendors or any other violations of the HIPAA rules.”

Do you know if your PHI is being captured through online tracking? Are you monitoring what patient data is being shared with third-party vendors? Even more importantly, do you use Google Analytics or Meta Pixel? If so, you might want to listen up. Whether you or a third-party agency set this tracking up, if there are not permissible disclosures from your patients, you are putting your practice and patients at risk if ePHI is shared through the tracking technology.

Let’s Head Around the Bases to Make Sure You’re Covering Your Bases.

Nice base hit – you made it to first. The first thing you can do is ensure you have Business Associate Agreements (BAA) in place with all third-party vendors, especially those who create, maintain or receive ePHI. While you’re cross-checking if your vendors meet the definition of a business associate (visit bit.ly/3j7Es6E to view), make sure your agreements denote the permitted use case for ePHI.

And the crowd goes wild – way to steal second. Before you think, “Well, I’ll just ask the vendor to delete any protected data before they use or save it,” that’s not going to cut it. Per the OCR, “Any disclosure of PHI to the vendor without individuals’ authorizations … requires that there is an applicable Privacy Rule permission for disclosure.” Through the Privacy Rule (visit bit.ly/3htIeab to view) patients are empowered to have more control over their health information. This allows for access, options to make any changes as needed and sets boundaries on the use and release of health records, including the minimum necessary standard for information disclosures.

A bunt from your teammate gets you over to third – nice work! Before we round out to home, ask yourself if the risk is worth the reward. And if you’re still unsure, check in with your Security Risk Analysis (visit bit.ly/3WesUNo to view) and scorecard – another benefit to Abyde’s ongoing compliance. We work with you to identify the potential risk and associated exposure.

As we make our way to home base, we will summarize with this: if ePHI is involved in any of the data being shared by the tracking technology, HIPAA rules must be followed. Here are the final words from the OCR: “all disclosures of PHI to tracking technology vendors are specifically permitted by the Privacy Rule and that, unless an exception applies, only the minimum necessary PHI to achieve the intended purpose is disclosed.”

Abyde is an FDA Crown Savings Endorsed Partner and the Abyde software solution is the easiest way for any sized dental practice to implement and sustain comprehensive HIPAA and OSHA compliance programs. FDA members save 20% on Abyde services that help their practices meet government-mandated standards through the implementation of risk management programs, training for doctors and staff, customized policy generation and more. Visit fdaservices.com/abyde or call 800.594.0883. Reprinted with permission from Abyde’s blog post.

By Lianne Bell, FDA Leadership Affairs Manager

An organization’s ability to thrive is primarily determined by the quality and effectiveness of its leadership. Leadership matters whether the organization is a study group, Rotary Club, an affiliate dental society, or your dental office. We know good leaders can create tremendous success, but how do we become that kind of leader? Often, they have learned skills that take thoughtful training and practice to develop. For these reasons, we are excited to introduce a new corner of Today’s FDA called, “Take the LEAD.” The impetus for this new feature is the work done by the FDA’s Leadership Development Committee, specifically, their program Leaders Emerging Among Dentistry or LEAD. LEAD was developed out of a desire to help member dentists develop to serve their patients and colleagues better and to ensure the excellence of work being done at the local, state and national levels by organized dentistry continues. In this new section of the journal, we will include information about the LEAD program, upcoming dates, articles from featured speakers and other general leadership resources. We hope you’ll turn here to learn, stay informed and continue to grow in your personal develop- ment. Additionally, we hope to meet you at one of our LEAD programs, where you can enjoy the opportunity to network and learn along with your peers.

The FDA’s Leadership Development Committee: l Dr. Angela McNeight, chair, Merritt Island l Dr. Jenna Schwibner, Vero Beach l Dr. Matthew Sheldon, Melbourne l Dr. Millie Tannen, Jacksonville l Dr. Chinara Garraway, Tallahassee l Dr. Melissa Sedeno, Miami Lakes l Dr. Kristie Johnson, Largo l Mariangel Fuchs, LECOM l Austin Jackson, Nova l Stephanie Taylor, UFCD

While all methods of self-improvement should be applauded, the fact remains that leaders change over time. As you grow in your practice and become more confident in your leadership skills, it is important to reevaluate your strengths and receive additional training on areas of your skill set that may be a struggle. As much as leaders change, teams and their needs change as well. The challenges dentists face today are different than the challenges faced even a few years ago.

Are you looking to get more involved in organized dentistry but don’t know where to begin or how to get your foot in the door? Then come check out Leaders Emerging Among Dentistry (LEAD). LEAD is the Florida Dental Association’s premier leadership training program. The program is in its fourth year, hosted annually by the Leadership Development Committee. It has provided hundreds of dentists with the tools necessary to help run an organization, your office or even your personal life more effectively and efficiently. You can find the latest information on the program at floridadental.org/lead.

Committee members and attendees at meetings and past LEAD events.