Critical Access Hospitals Not Immune...

OCR has broken free their corrective action plan log jam and announced another settlement today. Pagosa Springs Medical Center, a Colorado critical access hospital, has agreed to a $111,400 two-year corrective action plan. While no person is perfect, we advocate for a team effort to ensure good communications between ePHI system administrators, information services staff and human resources. No one should have ePHI access after their employment has concluded.

The addressable citation 164.308(a)(3)(ii)(C) reminds us to "...Implement procedures for termination access to electronic protected health information when the employment of a workforce member ends or as required by determination made as specified in paragraph (a)(3)(ii)(B) of this section..."

If you are unsure whether your program has adequately addressed this Security Rule citation, give us a call. Addressable does not mean "optional".