Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Privacy And Data Security topic
No spam. Unsubscribe anytime.
Wapello County delays HIPAA renewal after vendor presents compliance comparison with ISAC
Summary
The Wapello County Board of Supervisors heard a presentation from a HIPAA vendor detailing training and audit results, costs and indemnification terms, and tabled action while seeking more information and an ISAC proposal comparison.
The Wapello County Board of Supervisors on an unspecified October date heard a vendor presentation on the county’s HIPAA compliance package and voted to table a renewal decision until members receive additional information, including a proposal from the Iowa State Association of Counties (ISAC).
The vendor representative, identified in meeting materials and by first name as Steph, told the board the county’s current completion rate for required HIPAA training was 56.54 percent as of Oct. 15 and that the vendor’s target completion rate is 80 percent. “We have a total of 149 current active trainees, and your completion rate is currently at 56.54 percent. Our goal is to always have that completion rate at 80 percent,” Steph said.
The vendor described three audit sections — security, privacy and breach — and said most protocols were complete except certain technical safeguards that require IT logs. The vendor also described attestation materials the county would receive, including a certificate of attestation, a website seal and a detailed audit report. The vendor noted the county’s renewal date is Nov. 15.
The vendor described an indemnification arrangement it enforces and a cost the vendor quoted for the existing service package. “Your all-in cost if you had one single breach in a year would be in excess of $330,000” in fines and related expenses, the vendor said, and listed the vendor’s HIPAA Select package price at $11,052 for the coming year.
Board members discussed an alternative program offered by ISAC and a lower-cost vendor tier called HIPAA Express. The vendor presenter said ISAC’s program provides templates and guidance but does not perform some of the hands-on services the vendor provides, such as customized remediation plans and business-associate management. The presenter described the difference between the county’s current package (which the presenter characterized as vendor-heavy) and a lower-cost option that would shift most compliance work back to county staff.
After discussion, Supervisor (unnamed in the record) moved to table the renewal and the ISAC proposal until the board receives more information; the motion was seconded and passed unanimously.
The board did not take a final procurement or renewal action at the meeting. Staff were directed to provide the additional materials discussed and the ISAC proposal for a future meeting.
