Red Flag Rules - Revision history

Mfrdmanager: /* OVERVIEW: */

2025-01-29T14:19:54Z

‎OVERVIEW:

Mfrdmanager: /* OVERVIEW: */

2017-09-28T17:19:47Z

‎OVERVIEW:

Mfrdmanager: /* OVERVIEW: */

2016-03-01T23:11:28Z

‎OVERVIEW:

Mfrdmanager: Protected "Red Flag Rules" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

2016-03-01T12:50:35Z

Protected "Red Flag Rules" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

Mfrdmanager: /* OVERVIEW: */

2016-02-21T16:23:52Z

‎OVERVIEW:

Mfrdmanager: /* Section 1 - ADMINISTRATIVE */

2016-02-21T16:23:21Z

‎Section 1 - ADMINISTRATIVE

Mfrdmanager: /* OVERVIEW: */

2016-02-21T15:57:15Z

‎OVERVIEW:

Mfrdmanager at 15:55, 21 February 2016

2016-02-21T15:55:29Z

Mfrdmanager: /* OVERVIEW: */

2016-02-21T15:53:56Z

‎OVERVIEW:

Mfrdmanager: /* OVERVIEW: */

2016-02-21T15:53:26Z

‎OVERVIEW:

@@ Line 87: / Line 87: @@
 **All billing office personnel;
 **All management personnel and administrative support staff
-* Initial training shall occur no later than May 1,2009 for all current personnel. Newly hired personnel shall be trained in the implementation of the program as part of their standard compliance and HIPPAA training. Refresher training shall be included in the annual compliance and HIPPAA training given to the provider personnel and may be given to specific employees time to time on an “as needed” basis.
+* Initial training shall occur no later than May 1,2009 for all current personnel. Newly hired personnel shall be trained in the implementation of the program as part of their standard compliance and HIPAA training. Refresher training shall be included in the annual compliance and HIPAA training given to the provider personnel and may be given to specific employees time to time on an “as needed” basis.
 * The provider shall exercise appropriate and effective oversight of all arrangements involving a service provider whose duties include opening, monitoring or processing patient accounts or performing other activities which place them in a position to prevent, detect or mitigate identity theft. Each service provider shall be required to execute an amendment or addendum to its service agreement or business associate agreement which requires it to:
 **Implement a written Identity Theft Program that meets the requirements of the “Red Flag Rule”;

@@ Line 14: / Line 14: @@
 * Section II of this Policy describes the risk assessment the Provider shall conduct at the inception of the Program and annually thereafter. Section III sets forth the “Red Flags” (i.e. warning signs) that may alert Provider personnel to the possible existence of identity theft in the course of the Provider’s day to day operations. Section IV sets forth the procedures the Provider will follow in attempting to detect those “Red Flags”. Section V sets forth the procedures the Provider will follow in responding appropriately to “Red Flags” that are detected, in order to prevent and mitigate identity theft. Section VI sets forth the procedures the Provider will take in responding to a claim by an individual that he has been a victim of identity theft. Section VII describes how the Provider will administer the Program. Section VIII describes the annual updating of the Program.
 * Questions regarding this Policy or the Program shall be directed to the Program Compliance Officer (the Fire Chief) designated pursuant to Section VII.
-'''Risk Assessment'''
+'''Section II - Risk Assessment'''
 * Upon initial implementation of the Program, and annually thereafter as a part of the annual update described in Section VIII of this Policy, the Provider shall determine whether it maintains covered accounts. As part of that determination, the Provider shall conduct a risk assessment to determine whether it offers or maintains covered accounts that carry a reasonably foreseeable risk of identity theft, including financial, operational, compliance, reputation or litigation risks. The risk assessment shall take into consideration:
 **The methods the Provider provides to open its accounts;
 **The methods it provides to access its accounts; and
 **Its previous experiences with identity theft.
-'''Identification Of “Red Flags”'''
+'''Section III - Identification Of “Red Flags”'''
 * A “Red Flag” is a pattern, practice or specific activity that indicates the possible existence of identity theft. In other words, a “Red Flag” is a warning sign regarding the possibility of identity theft.
 * In identifying “Red Flags” relevant to its operations, the Provider has:
@@ Line 49: / Line 49: @@
 * The Provider shall update the foregoing list of “Red Flags” as part of its annual update of the Program.
 * All Provider personnel have an affirmative obligation to be vigilant for any evidence of a “Red Flag” and to notify their immediate supervisor, or the Program Compliance Officer, to report the “Red Flag”.
-'''Procedures for Identifying Red Flags'''
+'''Section IV - Procedures for Identifying Red Flags'''
 Provider personnel will follow the following procedures in order to detect the “Red Flags” indicated above, which indicate the possibility of identity theft.
@@ Line 58: / Line 58: @@
 * Before providing information regarding an account or making any changes to an address or other information associated with an account, the requester shall be required to provide the social security number, full name, date of birth and address of the patient. If the requester makes the request in person, a driver’s license or other government issued photographic identification shall be requested.
 *In the event medical transport personnel or billing personnel encounter a “Red Flag”, the existence of the “Red Flag” shall be brought to the immediate attention of the individual’s supervisor or the Program Compliance Officer so that it can be investigated and addressed, as appropriate, in accordance with the procedures set forth in Section V below.
-'''Responding To “Red Flags”'''
+'''Section V - Responding To “Red Flags”'''
 * When a “Red Flag” is detected, Provider personnel shall investigate the situation, as necessary, to determine whether there is a material risk that identity theft has occurred or whether there is a benign explanation for the “Red Flag”. The investigation shall be documented in accordance with the Provider’s incident reporting policy. If it appears that identity theft has not occurred, the provider may determine no further action is necessary.
 * The Provider’s response shall be commensurate with the degree of risk posed by the “Red Flag”. In determining an appropriate response, the Provider shall consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a patient’s account records, or notice that a patient has provided information related to a Provider account to someone fraudulently claiming to represent the provider or to a fraudulent website.
@@ Line 73: / Line 73: @@
 *# Correct the medical record of any patient of the Provider whose identity was stolen, with the assistance of the patient as needed;
 *# If the circumstances indicate that there is no action that would prevent or mitigate the identity theft, no action need be taken.
-'''Investigation of Report by a Patient of Identity Theft'''
+'''Section VI - Investigation of Report by a Patient of Identity Theft'''
 * If an individual claims to have been a victim of identity theft (e.g., the individual claims to have received a bill for a transport he did not receive), the Provider [or its billing service] shall investigate the claim. Authentication of the claim shall require a copy of a police report and either;
 **The “Identity Theft” affidavit developed by the FTC, including supporting documentation; or
@@ Line 81: / Line 81: @@
 * If, following investigation, it appears the individual has been a victim of identity theft; the Provider will take the appropriate actions as indicated in Section V of this policy.
 * If, following investigation, it appears the report of identity theft was not credible, the individual shall be notified and the provider may continue billing on the account upon the approval of the Program Compliance Officer. The account shall not be billed without such approval.
-'''Administration of the Program'''
+'''Section VII - Administration of the Program'''
 * The program and all material changes thereto, shall be approved by the Program Compliance Officer. The Program Compliance Officer shall be responsible for oversight, development and implementation of the program.
 * The Provider shall train staff, as needed, to effectively implement the program. The following categories of personnel shall be trained in the implementation of the program:
@@ Line 98: / Line 98: @@
 **Significant incidents involving identity theft and the Provider’s response;
 **Recommendations for material changes to the Program.
-'''Annual Update of the Program'''
+'''Section VIII - Annual Update of the Program'''
 The program will be reviewed, revised and updated on an annual basis. In performing such update, the Provider shall consider:

@@ Line 14: / Line 14: @@
 * Section II of this Policy describes the risk assessment the Provider shall conduct at the inception of the Program and annually thereafter. Section III sets forth the “Red Flags” (i.e. warning signs) that may alert Provider personnel to the possible existence of identity theft in the course of the Provider’s day to day operations. Section IV sets forth the procedures the Provider will follow in attempting to detect those “Red Flags”. Section V sets forth the procedures the Provider will follow in responding appropriately to “Red Flags” that are detected, in order to prevent and mitigate identity theft. Section VI sets forth the procedures the Provider will take in responding to a claim by an individual that he has been a victim of identity theft. Section VII describes how the Provider will administer the Program. Section VIII describes the annual updating of the Program.
 * Questions regarding this Policy or the Program shall be directed to the Program Compliance Officer (the Fire Chief) designated pursuant to Section VII.
-'''2.1 Risk Assessment'''
+'''Risk Assessment'''
 * Upon initial implementation of the Program, and annually thereafter as a part of the annual update described in Section VIII of this Policy, the Provider shall determine whether it maintains covered accounts. As part of that determination, the Provider shall conduct a risk assessment to determine whether it offers or maintains covered accounts that carry a reasonably foreseeable risk of identity theft, including financial, operational, compliance, reputation or litigation risks. The risk assessment shall take into consideration:
 **The methods the Provider provides to open its accounts;
 **The methods it provides to access its accounts; and
 **Its previous experiences with identity theft.
-'''2.2 Identification Of “Red Flags”'''
+'''Identification Of “Red Flags”'''
 * A “Red Flag” is a pattern, practice or specific activity that indicates the possible existence of identity theft. In other words, a “Red Flag” is a warning sign regarding the possibility of identity theft.
 * In identifying “Red Flags” relevant to its operations, the Provider has:
@@ Line 49: / Line 49: @@
 * The Provider shall update the foregoing list of “Red Flags” as part of its annual update of the Program.
 * All Provider personnel have an affirmative obligation to be vigilant for any evidence of a “Red Flag” and to notify their immediate supervisor, or the Program Compliance Officer, to report the “Red Flag”.
-'''2.3 Procedures for Identifying Red Flags'''
+'''Procedures for Identifying Red Flags'''
 Provider personnel will follow the following procedures in order to detect the “Red Flags” indicated above, which indicate the possibility of identity theft.
@@ Line 58: / Line 58: @@
 * Before providing information regarding an account or making any changes to an address or other information associated with an account, the requester shall be required to provide the social security number, full name, date of birth and address of the patient. If the requester makes the request in person, a driver’s license or other government issued photographic identification shall be requested.
 *In the event medical transport personnel or billing personnel encounter a “Red Flag”, the existence of the “Red Flag” shall be brought to the immediate attention of the individual’s supervisor or the Program Compliance Officer so that it can be investigated and addressed, as appropriate, in accordance with the procedures set forth in Section V below.
-'''2.4 Responding To “Red Flags”'''
+'''Responding To “Red Flags”'''
 * When a “Red Flag” is detected, Provider personnel shall investigate the situation, as necessary, to determine whether there is a material risk that identity theft has occurred or whether there is a benign explanation for the “Red Flag”. The investigation shall be documented in accordance with the Provider’s incident reporting policy. If it appears that identity theft has not occurred, the provider may determine no further action is necessary.
 * The Provider’s response shall be commensurate with the degree of risk posed by the “Red Flag”. In determining an appropriate response, the Provider shall consider aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a patient’s account records, or notice that a patient has provided information related to a Provider account to someone fraudulently claiming to represent the provider or to a fraudulent website.
@@ Line 73: / Line 73: @@
 *# Correct the medical record of any patient of the Provider whose identity was stolen, with the assistance of the patient as needed;
 *# If the circumstances indicate that there is no action that would prevent or mitigate the identity theft, no action need be taken.
-'''2.5 Investigation of Report by a Patient of Identity Theft'''
+'''Investigation of Report by a Patient of Identity Theft'''
 * If an individual claims to have been a victim of identity theft (e.g., the individual claims to have received a bill for a transport he did not receive), the Provider [or its billing service] shall investigate the claim. Authentication of the claim shall require a copy of a police report and either;
 **The “Identity Theft” affidavit developed by the FTC, including supporting documentation; or
@@ Line 81: / Line 81: @@
 * If, following investigation, it appears the individual has been a victim of identity theft; the Provider will take the appropriate actions as indicated in Section V of this policy.
 * If, following investigation, it appears the report of identity theft was not credible, the individual shall be notified and the provider may continue billing on the account upon the approval of the Program Compliance Officer. The account shall not be billed without such approval.
-'''2.6 Administration of the Program'''
+'''Administration of the Program'''
 * The program and all material changes thereto, shall be approved by the Program Compliance Officer. The Program Compliance Officer shall be responsible for oversight, development and implementation of the program.
 * The Provider shall train staff, as needed, to effectively implement the program. The following categories of personnel shall be trained in the implementation of the program:
@@ Line 98: / Line 98: @@
 **Significant incidents involving identity theft and the Provider’s response;
 **Recommendations for material changes to the Program.
-'''2.7 Annual Update of the Program'''
+'''Annual Update of the Program'''
 The program will be reviewed, revised and updated on an annual basis. In performing such update, the Provider shall consider:

@@ Line 32: / Line 32: @@
 *# The Social Security Number (“SSN”) or other identifying information furnished by a patient is the same as identifying information in Provider’s records furnished by another patient.
 *# The SSN furnished by a patient has not been issued, is listed on the Social Security’s Administration’s Death Master File, or is otherwise invalid. The following numbers are always invalid:
-#*the first 3 digits are in the 800, 900, or 000 range, or in the 700 range above 772, or are 666;
+*#*the first 3 digits are in the 800, 900, or 000 range, or in the 700 range above 772, or are 666;
-#*the fourth and fifth digits are 00; or
+*#*the fourth and fifth digits are 00; or
-#*the last four digits are 0000;
+*#*the last four digits are 0000;
 *# The address given by a patient does not exist or is a post office box, or is the same address given by an unusually large number of other patients;
 *# The phone number given by the patient is invalid or is associated with a pager or an answering service, or is the same telephone number submitted by an unusually large number of other patients;

@@ Line 32: / Line 32: @@
 *# The Social Security Number (“SSN”) or other identifying information furnished by a patient is the same as identifying information in Provider’s records furnished by another patient.
 *# The SSN furnished by a patient has not been issued, is listed on the Social Security’s Administration’s Death Master File, or is otherwise invalid. The following numbers are always invalid:
-*##the first 3 digits are in the 800, 900, or 000 range, or in the 700 range above 772, or are 666;
+#*the first 3 digits are in the 800, 900, or 000 range, or in the 700 range above 772, or are 666;
-*##the fourth and fifth digits are 00; or
+#*the fourth and fifth digits are 00; or
-*##the last four digits are 0000;
+#*the last four digits are 0000;
 *# The address given by a patient does not exist or is a post office box, or is the same address given by an unusually large number of other patients;
 *# The phone number given by the patient is invalid or is associated with a pager or an answering service, or is the same telephone number submitted by an unusually large number of other patients;

← Older revision	Revision as of 12:50, 1 March 2016
(No difference)