Objectives. Definition

Transcription

1 Session 201(Privacy/Security): LoProCo - An Effective Model for Risk Assessments Speaker: Frank Ruelas Facility Compliance Professional St. Joseph s Hospital and Medical Center/Dignity Health Phoenix, Arizona 1 Objectives Breach definition review The four impermissibles Presumption vs conclusion of a breach Application of the four factor analysis Ransomware = Breach Not so fast! 2 Definition Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. 3 1

2 Definition Blah Breach means the acquisition, access, use, or disclosure of protected health information in a manner not Blah permitted under subpart E of this part which compromises the security or privacy of the protected health information. Blah 4 Definition Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. 5 Definition Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. 6 2

3 Title 45 Subtitle B Subtitle A: Regulations Relating to Dept of HHS HIPAA Tree Subchapter A: General Administration Subchapter B: Relating to Health Care Services Subchapter C: Administrative Data Standards and Related Subchapter D: Health Information Technology Part 160 General Administrative Part 162 Administrative Part 163 Part 164 Privacy and Security Parts Subpart A Subpart B Subpart C Subpart D Subpart E General Provisions Security Standards Breach Notification Privacy Standards 7 Title 45 Subtitle B Subtitle A: Regulations Relating to Dept of HHS HIPAA Tree Subchapter A: General Administration Subchapter B: Relating to Health Care Services Subchapter C: Administrative Data Standards and Related Subchapter D: Health Information Technology Part 160 General Administrative Part 162 Administrative Part 163 Part 164 Privacy and Security Parts Subpart A Subpart B Subpart C Subpart D Subpart E General Provisions Security Standards Breach Notification Privacy Standards 8 Title 45 Subtitle B Subtitle A: Regulations Relating to Dept of HHS HIPAA Tree Subchapter A: General Administration Subchapter B: Relating to Health Care Services Subchapter C: Administrative Data Standards and Related Subchapter D: Health Information Technology Part 160 General Administrative Part 162 Administrative Part 163 Part 164 Privacy and Security Parts Subpart A Subpart B Subpart C Subpart D Subpart E General Provisions Security Standards Breach Notification Privacy Standards 9 3

4 Title 45 Subtitle B Subtitle A: Regulations Relating to Dept of HHS HIPAA Tree Subchapter A: General Administration Subchapter B: Relating to Health Care Services Subchapter C: Administrative Data Standards and Related Subchapter D: Health Information Technology Part 160 General Administrative Part 162 Administrative Part 163 Part 164 Privacy and Security Parts Subpart A Subpart B Subpart C Subpart D Subpart E General Provisions Security Standards Breach Notification Privacy Standards 10 Title 45 Subtitle B Subtitle A: Regulations Relating to Dept of HHS HIPAA Tree Subchapter A: General Administration Subchapter B: Relating to Health Care Services Subchapter C: Administrative Data Standards and Related Subchapter D: Health Information Technology Part 160 General Administrative Part 162 Administrative Part 163 Part 164 Privacy and Security Parts Subpart A Subpart B Subpart C Subpart D Subpart E General Provisions Security Standards Breach Notification Privacy Standards

5 13 Four Factors Identify View/Acquired Who Risk Other 14 Four Factors Identify View/Acquired Who Risk Other here s a way to remember 15 5

6 Let s flow this out 16 Access Example: Workforce member has access to EHR for no job related reasons. 17 Acquisition Example: Lost laptop found by someone who is not a workforce member. 18 6

7 Disclosure Example: Fax sent to an unintended recipient. 19 Use Example: Workforce member looks at the PHI of a coworker for curiosity reasons. 20 Does this look familiar I hope not! 21 7

8 Browser tip: FACT SHEET Ransomware 22 Question: Do we have a breach? Funny you should ask!

9 Depends 25 Depends There is an impermissible 26 Depends There is an impermissible You may presume or assess 27 9

10 28 Let s give LoProCo a try 29 10