Coronavirus/COVID-19

Cyber threats and cybersecurity controls have evolved significantly over the past two decades since the HIPAA Security Rule were originally promulgated. During this same time, healthcare entities have increasingly become a prime target of hackers seeking to extort payment using ransomware, exfiltrate patient data to commit fraud, or disrupt operations in other nefarious ways.  Recognizing these challenges, some security professionals have sought further clarity on the HIPAA Security Rule that they deem to be “long in the tooth”. Yet, regulators have not made any significant modifications – perhaps driven by the original policy considerations of the HIPAA Security Rule that: “the standard should be comprehensive and coordinated to address all aspects of security”; that it be “scalable, so that it can be effectively implemented by covered entities of all types and sizes”; and that it “not be linked to specific technologies, allowing covered entities to make use of future technology advancements.”

On April 19, 2021, the Office of Inspector General’s (OIG) Office of Audit Services (OAS) released the results of an audit conducted on the accuracy of diagnosis codes submitted to CMS by Humana, Inc. for 2015 dates of service. Based on the audit results, the OIG recommended Humana return a whopping $197.7 million in alleged overpayments and enhance its policies and procedures to prevent, detect and correct noncompliance with Federal requirements for diagnosis codes that are used to calculate risk-adjusted payments.