Case Study – Comprehensive Counseling Services

Comprehensive Counseling Service is a dual certified ODMH/ODADAS agency in Middletown, Ohio.  Specific programs are offered for Mental Health, Chemical Dependency, and Domestic Violence.  This agency faced a complex regulatory challenge.  Their regulatory status and program offerings required them to simultaneously comply with federal HIPAA Privacy and Security laws, the federal privacy guidelines for alcohol and drug abuse programs (42 CFR Part 2), the Ohio Department of Mental Health confidentiality guidelines,  the Ohio Department of Alcohol & Drug Addiction Services, and various other Ohio laws.   These regulations heavily overlap, with the requirement for Eagle Consulting Partners was engaged to assist with comprehensive confidentiality and computer security policies to comply with all of these regulations.

The engagement began with an on-site inspection of facilities and review of oral privacy procedures, followed by the creation of  an inventory of paper and electronic protected health information.  Subsequent steps included a review of hardware, software, and electronic communications facilities.  Administrative and clinical personnel were interviewed regarding practices, concerns, and objectives.  Personnel from the outside computer vendor were interviewed regarding configuration specifications.  All written policies were assessed.

The risk assessment procedure was based on the NIST SP 800-30, with simplifications because of the size of the agency.  Based on this risk assessment, decisions were made regarding how the 22 addressable implementation specifications of he HIPAA Security rule would be handled, and appropriate documentation was created.

The final deliverables from the engagement included

  • Summaries of  personnel interviews
  • Written PHI Inventory
  • Risk Assessment
  • Documentation of handling of Addressable Implementation Specifications from HIPAA Security Rule
  • A remediation plan including action steps for management including adjustments to computer procedures, several minor physical modifications to facility, and other items
  • A set of approximately 35 policies and procedures for HIPAA Privacy and Security, and 42 CFR Part 2 compliance
  • A staff training program detailing new policies

A follow-up engagement provided assistance with implementation of the remediation plan.