Category Archives: Current Affairs

THE ACA AND NURSE PRACTITIONERS UNDER CALIFORNIA LAW

NURSE PRACTITIONERS REQUIRE SOME DUE DILIGENCE

The ACA utilizes the idea of non-physician professionals to help bridge the gap presented by having insufficient physicians to handle patients.  It is hoped that utilizing these professionals will help increase communications with patients, particularly chronic patients who could avoid hospital stays by seeing a nurse practitioner for an office visit or even email communication with a knowledgeable professional  Finally, utilizing non-physicians should lower costs.

In California, this presents some major issues.  California carefully regulates the use of such professionals, particularly nurse practitioners.    Specialists need to  pay attention to creating the right environment for such professionals.  Standardized Procedures should be updated to conform to the needs of the practice.  The California Code of Regulations (Title 16, section 1472) requires physicians to have “standardized procedures” before permitting registered nurses to perform treatments and procedures.  The purpose of the standardized procedures is to establish policies and protocols for NPs so that they are able to perform their authorized duties.  It is particularly important to update these standardized procedures because your NP will most likely be characterized as your employee, which will expand the scope of your liability for her acts.

California Code of Regulations Title 16, section 1474 establishes specific guidelines for the standardized procedures and provides that each standardized procedure must:

v    Be in writing.

v    Specify which functions the nurse may perform and under what circumstances.

v    State specific requirements to be followed by the nurse in performing specific functions.

v    Specify experience, training, and education requirements for the performance of the procedure function.

v    Establish a method for initial and continuing evaluation of the competence of the registered nurse.

v    Provide for a method of maintaining a written record of who is authorized to perform standardized procedure functions.

v    Specify the scope of supervision required for performance of standardized procedure functions.

v    Set forth specialized circumstances under which the nurse is to immediately communicate with the patient’s physician concerning the patient’s condition.

v    State the limitations on settings.

v    Specify patient record keeping requirements.

v    Provide for a method of periodic review of the standardized procedure.

 

            (a)       Furnishing Scheduled Drugs

                        Of particular importance are the standardized procedures on Furnishing Scheduled Drugs.  California law requires that you specifically list “which drugs or devices may be furnished or ordered” and “under what circumstances.”  (Bus. & Prof. Code, § 2836.1(c)(1).)  We recommend to physicians that they review the “List of Scheduled Drugs” to ensure that it is consistent with the drugs that the NP may prescribe to patients.  

            (b)       Dispensing Hormonal Contraceptives

                        California law also has strict guidelines for a nurse’s dispensation of self-administered hormonal contraceptives.  In order to administer hormonal contraceptives, your practice must have standardized procedures developed in compliance with Business and Professions Code section 2725.2.  These standardized procedures must include, but are not limited to, the following:

v    Which nurse may dispense the hormonal contraceptive.

v    Minimum training requirements regarding educating patients on medical standards for ongoing women’s preventative health.

v    Competency in providing the appropriate prior examination of checking blood pressure, weight, and patient and family health history, including medications taken by the patient.

v    List of the contraceptives that may be dispensed or administered under specific circumstances.

v    Criteria and procedure for identification, documentation, and referral of patients with contraindications for hormonal contraceptives and patients in need of a follow-up visit to a physician and surgeon, nurse practitioner, certified nurse-midwife, or physician assistant.

v    The extent of physician and surgeon supervision requested.

3.         Ensure that Your Nurse Practitioner is “Clinically Competent”

           NPs  must be “clinically-competent” to treat a particular population.  Standardized procedures should establish a method for the continuing evaluation of the competence of your NP to perform the specified procedures.

Following these procedures will help you utilize nurse practitioners to help your patients.  You will also avoid accusations of failing to follow state law in guiding the NPs to perform as if they were an extension of your care.

BY:  Matt Kinley, Esq,

REPORT ON EHR COMPLIANCE: What Providers are Not Doing

The Department of Health & Human Services, Office of Inspector General, has issued a report entitled “CMS and Its Contractors Have Adopted Few Program Integrity Practices to Address Vulnerabilities in EHRs.

According to the OIG, few Medicare contractors were effectively utilizing EHRs, and most still utilized paper medical records.  Much of the report is devoted to guidance that can be offered t providers by CMS, especially on detecting fraud in the medical records.   CMS should also assist with providing information on what is necessary in the EHR file, and electronic signatures.

ALL THE AGENCIES THAT REGULATE HEALTHCARE ALL IN ONE PLACE!

Oversight of Health Care Industry

MEANINGFUL USE AUDITS TAKE BACK INCENTIVE PAYMENTS

EHR Incentive Programs/Supporting Documentation For Audits

Contact Matthew L. Kinley, Esq at Tredway, Lumsdaine & Doyle if you are subject to audit or need advice about your compliance program.

877.923.0971

According to the Centers for Medicare and Medicaid Services, about 10% of the healthcare providers who took advantage of the meaningful use incentives will be audited by a private contractor hired to look for errors.

THE MEANINGFUL USE PROGRAM

Under the 2009 HITECH Act, health care providers who demonstrate meaningful use of certified electronic health records will receive incentive payments through Medicaid and Medicare. States can receive a 90% federal funding match for incentive payments distributed to Medicaid providers who adopt EHRs under the meaningful use criteria.  Eigible physicians who see Medicare and/or Medicaid patients, as defined by the HITECH Act summary, will be compensated from $44,000 to $63,750 over a 5 year term for fulfilling the recently defined ‘meaningful use’ criteria. To further promote the use of certified systems, if these same physicians do not utilize healthcare IT that meets the Federal requirement by 2015, they will be faced with increasing penalties of up to 5%.

Providers started receiving Medicare or Medicaid bonuses for using certified EHR technology in 2011 and will get around $20 billion over five years. The meaningful use incentive program requires hospitals and eligible professionals (e.g., physicians) to use EHRs to improve patient safety, quality of care and patient-provider communication. Providers must buy EHRs from vendors on the Certified Health IT Product List (see http://healthit.hhs.gov/chpl). If they don’t, they face a Medicare payment reduction after 2015.

REQUIREMENTS FOR HITECH

Documentation to support attestation data for meaningful use objectives and clinical quality measures should be retained for six years post-attestation. Documentation to support payment calculations (such as cost report data) should continue to follow the current documentation retention processes.

MEANINGFUL USE AUDITS

States and their contractors will perform audits on Medicaid providers. When providers are selected for an audit, they will receive an initial request letter from the auditor. The request letter will be sent electronically from a CMS email address and will include the audit contractor’s contact information.

The initial review process will be conducted at the audit contractor’s location, using the information received as a result of the initial request letter. Additional information might be needed during or after this initial review process, and in some cases an onsite review at the provider’s location could follow. A demonstration of the the EHR system could be requested during the on-site review

If there is any deficiency in the audit, providers will have to give back their entire meaningful use incentive payment.  That means their payments for the audit period are at risk unless their electronic health records show they kept every promise they made to the government when they accepted the money.

One letter from the EHR HITECH Incentive Payment Center said a meaningful use audit had determined that “an overpayment of HITECH funds has been determined and is owed.” CMS gave the provider 30 days to repay the money, although it had the right to appeal.

Most providers are having negative audit findings and owing the money back, often because they thought they met most of the core elements, but they didn’t get them all done, or they weren’t all properly documented. If you miss a core element, they ask for all the money back.

HIPAA and PRIVACY POLICIES

The security risk analysis is a problem area in meaningful use. Providers must attest that they conducted a risk analysis, which is a core measure as well as required by the HIPAA security regulation.  Most providers fail to do such an analysis.

BEST PRACTICES TO AVOID AN AUDIT

The following practices should be employed as soon as possible by all providers.  Those who worked for and obtained benefits for meaningful use are particularly vulnerable.

Best Practices

• Enter accurate numbers when you attest to meaningful use of an electronic health record (EHR).

• Keep your supporting documentation.

• Know that dated screen shots provide a good source of documentation.

• Save paper or electronic copies of reports used to attest if the practice’s EHR automatically changes numerator and denominator values after the reporting period ends.

• Turn on, for the entire reporting period, EHR features that track functionality issues, such as drug interaction checks and clinical decision support.

• Understand that the security risk analysis must be specific to the EHR and the practice and is required every year.

By Matthew L. Kinley

Human Resources is for Physician Offices, too

2ND ANNUAL EMPLOYER HR SUMMIT
CA EMPLOYMENT LAW & HEALTH CARE REFORM

TUESDAY  •  JANUARY 21, 2014

Matt Kinley, Tredway, Lumsdaine & Doyle
Audrianne Adams Lee, HR NETwork, Inc.

Location/Sponsored by:

Long Beach City College
4901 Carson St, Long Beach, CA 90808
Room # – TBA upon Registration

No cost to attend this event.
A box lunch is included.

Format/Schedule
8:30         Registration
9:00-12:00     2014 Workplace Compliance – New Laws and Trends
12:00-12:30    Box Lunch – Presentation by
10,000 Small Businesses
12:30-2:30     Health Care Reform – What Now?
2:30-3:00     Health Care/Vendor Panel for Q&A

To register, call 714.799.1115 or email to michelleb@hrnetworkinc.com
2014 Workplace Compliance –
New Laws and Trends
A wave of new employment legislation, case law developments, and other employment law trends stand to significantly impact the California workplace in 2014. With many of these new laws taking effect on January 1, employers with California operations must take prompt action to ensure compliance and to mitigate workplace law risk.

We discuss the critical changes in law, the impact of the new regulations, and recommendations for employers. Topics covered will include:

•     Legislative developments
•     Trends and significant decisions in California employment law
•     Cases to watch for 2014

Health Care Reform –
What Employers Need to Know

In this portion of the seminar, we will respond to these and many other questions you have surrounding Health Care Reform:

•    Meeting the threshold in 2015
•    What are my options to offer/not offer coverage (Under/over 50 employees)?
•    Calculating my FTE count
•    HIPAA Compliance – What I am responsible for?
•    Reporting requirements for Employers
•    How to assist and communicate the ACA to your employees

EMPLOYER STRATEGIES: NEW TAXES UNDER THE AFFORDABLE CARE ACT

OBAMACARE’S TAXES AND THE WORKPLACE

There is a tremendous amount of information about the Patient Protection and Affordable Care Act (ACA) and it is difficult to understand what the tax implications are.  Essentially under the ACA, health insurance is now tied to taxes.  There are two important tax implications of the ACA to individuals: 1) there is a tax credit to help pay for insurance premiums if one qualifies and 2) there are tax penalties if one does not have health insurance. For employers, the same basic principal applies and the tax implications vary depending upon whether the employer is small or large.

Individuals

Beginning in 2014, ACA provides a Premium Tax Credit, which is a refundable credit to help offset the cost of health insurance premiums for qualifying taxpayers.  A qualified taxpayer can take an advance payment of the advanced credit based upon his/her estimated income and family size for the year.  An equal portion of the estimated credit is paid directly to the insurance company each month during the tax year.

When filing his/her tax return, the taxpayer must compare the prepaid credit against the actual credit allowed.  If there is a difference in the prepayments and the actual credit, the taxpayer could be owed more Premium Tax Credit or alternatively, the taxpayer could be required to repay the IRS the amount of any excess prepaid credit.  A qualified individual could also choose to pay premiums out-of-pocket each month and collect the full credit when he/she files taxes.

The amount of credit available for prepayment is calculated by the Health Insurance Marketplaces, known as the Exchanges.  During enrollment through the Marketplace, using information that the taxpayer provides about his/her projected income and family composition for 2014, the Marketplace will estimate the amount of the Premium Tax Credit he/she will be able to claim for the 2014 tax year that he/she will file in 2015.  It is important to report changes and income to the Marketplace through the year.  Reporting changes will help assure a taxpayer that they will have the accurate amount of credit.  Changes in family size can include the birth or adoption of a child, a child moving out of the household, parents moving into the household, marriage or divorce.

The Premium Tax Credit is not allowed if the taxpayer files using the Married Filing Separately status, if they are eligible for coverage under their state’s Medicaid program (which is free), or if they are enrolled in an insurance plan through their employer.

If a taxpayer does not have insurance after February 15, 2014, he/she may be assessed a tax penalty under the Shared Responsibility Provision, which allows a penalty assessment on certain taxpayers and qualified employers who do not offer insurance.  In 2014, the penalty is either $95 for adults and $47.50 for children or one percent of taxable income, whichever is greater.  The penalty will increase annually and by 2016, it will be the greater of $695 or 2.5 percent of the total household’s taxable income, whichever is greater. The penalty will show up as tax owed when the taxpayer files his/her income tax return.

For tax year 2013, contributions to flexible spending accounts are limited to $2,500, which previously had no cap.  However, employers can offer employees a choice between rolling over up to $500 to use in the next year or a 2.5 month grace period to spend it.  In 2014 and after, the contribution cap will increase with inflation.

For those who itemize deductions for out-of-pocket medical expenses, the expenses must total 10 percent of their adjusted gross income, which is up from 7.5 percent in prior years.  There is an exception until 2016 for taxpayers age 65 and older or if one spouse reaches age 65 for married couples filing jointly.

Furthermore, there is an additional 0.9 percent Medicare tax for married couples filing jointly earning above $250,000, $200,000 for single filers, and $125,000 for married couples filing separately. This applies to wages, compensation and self-employment income.

For high income taxpayers, there is an additional 3.8 percent net investment income tax, which includes interest, dividends, and rental income.  Tax is owed if the taxpayer has net investment income and modified adjusted gross income over $250,000 (married filing jointly); $125,000 (married filing separately); $200,000 (single); $200,000 (head of household with a qualifying person); and $250,000 (qualifying widow or widower with a dependent child).  It applies only to net profits that exceed $500,000 for married couples filing jointly and $250,000 for single filers.

Small Employers

Small employers are defined as fewer than 50 full-time employees or equivalents.  Fewer than 25 full-time equivalent employees may be eligible for a Small Business Health Care Tax Credit to help cover the cost of providing coverage.  Generally, employers with 50 or fewer employees may be eligible to buy coverage through the Small Business Health Options Program (SHOP).  Small businesses may be eligible for tax credits up to 50 percent of their cost of employee premiums through the SHOP.

Large Employers

For large employers, who are generally defined as those with 50 or more full-time time equivalent employees, effective for calendar year 2015, they may be subject to a non-deductible excise tax under Internal Revenue Code §4980H.  Full-time employee is defined as an employee who is employed on average 30 hours of service per week, per month.

Although the ACA does not require an employer to offer coverage to its employees, a large employer can be subject to the excise tax if at least one full-time employee receives a premium tax credit for Exchange coverage, and the employer:

•    Fails to offer coverage to full-time employees and their dependents (tax equals $2,000 times the total number of full-time employees)

Or

•    Offers coverage to full-time employees that does not meet the law’s affordability or minimum value standards (tax equals $3,000 times the number of full-time employees receiving tax credits for Exchange coverage) To be considered affordable, an employee’s share of the self-only premium for the employer’s lowest-cost plan that provides minimum value cannot exceed 9.5 percent of household income, or the employee may be eligible for a premium tax credit to purchase health insurance exchange coverage. The Treasury Department has proposed a safe harbor based on the employee’s current W-2 wage.
Employers also will face a host of new reporting requirements to the IRS under the ACA in order to demonstrate the value of coverage offered to employees, communicate to employees’ their coverage options, and certify compliance with the employer coverage provisions. Large employers will need to file an annual return reporting whether and what health insurance they offered employees. In addition, they are subject to the Employer Shared Responsibility provisions.  Many employers are undertaking compliance reviews to have their health plan offerings audited and certified to mitigate the potential risk for tax penalties.

 By Pamela Tahim of Tredway, Lumsdaine & Doyle

 

 

COVERED CALIFORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on which hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.

FORNIA: WHAT’S A PROVIDER TO DO?

Several issues arise from the proposed agreements for providers from Qualified Health Plans (“QHP”) under Covered California. Some issues that physicians and other providers should be watching out for:

1. Payment Schemes. Initial contracts from the various QHP’s are offering low payment options, particularly the “80% of Medicare” option. Physicians should be wary of such agreements. Under QHP contacts with Covered California, the plans have agreed to work on value-based payments in the future, making future contracts even less attractive for providers.

2. Hospital Contracts. There still is no clarity on what hospitals will take part in Covered California and under what plans. Covered California has no listing of participating hospitals at this time. The prospect of narrow networks (fewer providers offered to consumers) makes it troublesome to predict the future on hospital participation.

3. Administrative Burdens. QHPs are imposing difficult and legally thorny administrative tasks on providers, particularly providing information about patients and payments.

4. Populations. Get information on the types of patients expected under contracts. The initial rounds of patients are predicted to be populations that are in fair to poor health. Since they are not used to traditional medical care, they are expected to have a large percentage of missed appointments and compliance issues.

5. Collections. What is the providers obligations to collect? Some Covered California plans leave high deductibles and copays for enrollees. Yet, the newest enrollees are not used to paying such amounts. Also, determine risk for patients who fail to pay premiums to Covered California QHPs. Providers may be on the hook.

With all the problems with exchange products, providers may want to sit out this first round of patients.

HEALTHCARE LAW UPDATE, 2014: PHARMACISTS SEE MORE CLOUT

This is second in a series of new 2024 laws affecting healthcare in California. 

SB 493: New Authority to Pharmacists

One of the key goals of the Accountable Care Act was to to increase utilization of professionals other than doctors.  One way to do that is to expand the authority of pharmacists to perform certain tests and to administer drugs.

This new law gives pharmacists new clout as “health care providers” who can now administer drugs by injection, provide training on drug therapy and disease management and prevention, furnish contraceptives, nicotine replacement products, medications recommended for travel outside the US, order certain tests, and initiate, adjust or discontinue drug therapy (but may not interfere with “as written”).

Devolving  physician authority to other professionals, including nurse practitioners, physician assistants and pharmacists, is an experiment with some risk.  It is clear that these professionals will be able to fill some gaps left by overly busy physicians.  However, there is likely to be less quality and the overall effectiveness of healthcare may follow.  The provision regarding the administration of international travel drugs will likely the pocket books of those physicians who derive economic benefit from this part of their practice.

 

NEW CALIFORNIA HEALTHCARE LAWS: GAY AND LESBIAN DISCRIMINATION FOR FERTILITY TREATMENT

This is the first in a series of posts about new laws for 2014 affecting healthcare.

AB 460: Non-Discrimination for Homosexuals and Lesbians

Summary

This law requires coverage under the Knox-Keene Health Care Service Plan Act and a under a policy of health insurance that provides for coverage for the treatment of infertility.   If such coverage is offered and purchased, it must be provided without discrimination on the basis of age, ancestry, color, disability, domestic partner status, gender, gender expression, gender identity, genetic information, marital status, national origin, race, religion, sex or sexual orientation.

AB 460 extended the idea of “non-discrimination” in this context to homosexuals and lesbians regarding fertility. If a health insurance plan is purchased that contains coverage for infertility, then the plan must not discriminate.  This statute is meant to help all people access to treatment of infertility.

Insurance plans are not required to carry such coverage.  There will be a violation of the statute only if the plan does offer such coverage and they attempt discrimination in the utilization of the coverage.

The law makes homosexuals and lesbians eligible for insurance coverage for “treatment of infertility, except in vitro fertilization, under those terms and conditions as may be agreed upon between the group subscriber or the group policyholder and the plan or the insurer.”

An interesting issue arises when the definition of infertility is considered. Under the new law, homosexuals and lesbians will be classified as “infertile” if they are unable “to conceive a pregnancy or to carry a pregnancy to a live birth after a year or more of regular sexual relations without contraception.” Since most sexual relations in a homosexual and lesbian relationship do not result in pregnancy, the law effectively defines all homosexuals and lesbians as “infertile.” Surely this is an unintended result and new legislation will need to be considered in the near future.

HIPAA Settlement Shows How To Comply

HHS’s Office of Civil Rights
recently completed an enforcement action against Wellpoint.  Wellpoint
suffered security breaches and settled with the Office of Civil Rights for $1.7
million.  Wellpoint self-reported the breach to HHS’s, which mitigates the
penalties that it agreed to pay.  The breach was leaving their database
open to unauthorized users over the Internet.  There is no evidence that
the database was accessed or information utilized.

What is
unique is that the OCR has published the actual settlement agreement with
Wellpoint.  From a providers point of view, the settlement shows what to avoid to be HIPAA compliant.  OCR
lists the violations of HIPAA law that caused the fine.  

What
this demonstrates is that it’s the “technical violation” that will get entities
into trouble. In this case, not having all the safeguards in place to safeguard
protected healthcare information (“PHI” or electronic protected healthcare
information, “ePHI”).

Quoting
from the agreement:

“2.
Factual Background and Covered Conduct

On
June 18, 2010, HHS received notification from WellPoint regarding abreach
of certain of its unsecured electronic protected health information (ePHI). OnSeptember
9, 2010, HHS notified WellPoint of HHS’s investigation regardingWellPoint’s
compliance with the Privacy, Security, and Breach Notification Rules.

HHS’s
investigation indicated that the following conduct occurred (“CoveredConduct”):

 (1) Beginning on
October 23, 2009, until March 7, 2010, WellPoint did not adequately
implement policies and procedures for authorizing access to ePHI
maintained in its web-based application database consistent with theapplicable
requirements of the Security Rule.

 (2) WellPoint did
not perform an adequate technical evaluation in responseto
a software upgrade, an operational change affecting the security of ePHI maintained
in its web-based application database that would establish the extent
to which the configuration of the software providing authentication safeguards
for its web-based application met the requirements of the Security
Rule.

 (3) Beginning on
October 23, 2009, until March 7, 2010, WellPoint did not adequately
implement technology to verify that a person or entity seekingaccess
to ePHI maintained in its web-based application database is the one claimed.

(4) Beginning on
October 23, 2009, until March 7, 2010, WellPointimpermissibly
disclosed the ePHI, including the names, dates of birth,addresses,
Social Security Numbers, telephone numbers and healthinformation,
of approximately 612,000 individuals whose ePHI was maintained
in the web-based application database."

 

 ACTION ITEMS

Steps That
Covered Entities Can Take to Protect Against HIPAA Enforcement

  • Review
    relationships and the documentation of such relationships among and
    between Affiliated Covered Entities and other related entities with which
    they share PHI
  • Revisit
    risk analyses, especially following any changes to the underlying
    technology
  • Update
    policies and procedures as necessary to account for changes in technology
    or practices
  • Continue
    workforce training
  • Audit
    ongoing programs
  • Monitor
    security intrusions
  • Implement
    a breach response plan