Franklin J. Hickman Janet L. Lowder David A. Myers Elena A. Lidrbauch Judith C. Saltzman Mary B. McKee Amanda M. Buzo Lisa Montoni Garvin Andrea Aycinena Penton Building 1300 East Ninth Street Suite 1020 Cleveland, OH 44114 Telephone (216) 861-0360 Fax (216) 861-3113 5062 Waterford Dr. Sheffield Village, OH 44035 Telephone (440) 323-1111 Fax (440)323-4284 OVERVIEW OF RECENT CHANGES IN HIPAA AND OHIO PRIVACY LAWS Elena A. Lidrbauch Franklin J. Hickman September, 2010 This is a summary only and is not intended to provide legal advice. For individual issues, you should consult your attorney.
OVERVIEW OF RECENT CHANGES IN HIPAA AND OHIO PRIVACY LAWS There have been two major sets of changes during 2009 which affect privacy and confidentiality rules for DD Boards. Ohio law has been amended to permit disclosure of the identity of an individual served by a DD Board if the individual s identity is needed for treatment or payment for services provided to the individual. 1 The same bill removed the duty to provide accountings for all disclosures of an eligible individual s identity. The American Recovery and Reinvestment Act of 2009 (ARRA) enacted on February 17, 2009 adds additional requirements to HIPAA privacy and security rules. 2 DD Boards, COGs and Providers are subject to these new regulations, whether they function as a Covered Entity or a Business Associate 3. The ARRA changes include enhanced notice requirements in the event of a breach and expanded civil sanctions for violations of HIPAA requirements. The ARRA imposes significant new requirements for Business Associates. In response to the ARRA directive, the Department of Health and Human Services (HHS) recently issued two sets of interim final rules: Rules governing notification of breaches of unsecured protected health information. This rule went into effect on September 23, 2009; Rules explaining the enhanced penalties for breach of HIPAA requirements. These rules are effective on November 30, 2009. There are a number of additional HIPAA requirements enacted through the ARRA which will become effective in future years. Further information will be provided as regulations regarding these requirements are enacted. 1 Ohio Rev. Code ( RC ) 5126.044(B)(4) as amended by H.B. 1, effective 10/16/09. 2 These requirements were part of the Health Information Technology for Economic and Clinical Health (HITECH) Act which is a section of the ARRA. 3 DD Boards are Covered Entities subject to HIPAA requirements as both Health Plans and Health Care Providers. In some situations, DD Boards may also function as Business Associates. Most Providers are Covered Entities as Health Care Providers. To the extent that COGs are doing specific tasks for each DD Board, the COG is acting as a Business Associate. This is a summary only and is not intended to provide legal advice. For individual issues, you should consult your attorney.
Page 2 I. Changes in Ohio Law HB 1 made two significant changes in the confidentiality rules applicable to DD Boards, effective October 16, 2009. RC 5126.044. The identity of an eligible individual may be disclosed without the individual s consent, if the identity of the individual is necessary for treatment or payment. RC 5126.044(B)(4). Treatment is defined as provision, coordination, or management of services provided to an eligible person. Payment is defined as activities undertaken by a service provider or governmental entity to obtain or provide reimbursement for services to an eligible person. RC 5126.044(A). A strict construction of the language of statute as amended permits disclosure only of the identity of an individual for treatment or payment purposes; the language as currently enacted does not clearly permit release of records or reports on an individual without a written consent for the release. 4 HB1 also removed the requirement to maintain records of when and to whom a disclosure or release was made. Summary of the New HIPAA Regulations on Notice of Breach Effective September 23, 2009, all HIPAA Covered Entities and their Business Associates are required to provide notice in the event of a breach of unsecured protected health information (PHI). Covered Entities must notify the affected individual, the Secretary of HHS and under some circumstances even the media. Business Associates must provide notice of a breach to the Covered Entity. Failure to comply may lead civil penalties which have been significantly increased under the ARRA revisions. Additionally civil penalties for HIPAA violations are being extended to Business Associates as well as Covered Entities. A. Breaches Subject to Notification Under the new regulations, notification requirements apply to breaches of unsecured PHI. To determine whether notification is required, the Covered Entity or Business Associate must first determine (1) whether there is a breach, and (2) whether the breach includes unsecured PHI. If the answer to both is yes, then notification is required. 4 There may be an amendment in the future which will specifically permit release of reports and records on eligible individuals for treatment or payment purposes. Until the statute is changed, however, we believe that the current practice of obtaining consent for release of all information should continue, except for the explicit exceptions in RC 5126.044 (info needed for direct services contracts and for placement on waiting list).
Page 3 B. Definition of a Breach A breach is the acquisition, access, use, or disclosure of PHI in an unauthorized manner which compromises the security or privacy of the PHI 5. The following types of breaches are expressly excluded from this definition: 1. Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner prohibited by HIPAA; 2. Any inadvertent disclosure by a person who is authorized to access PHI to another person authorized to access PHI at the same Covered Entity or Business Associate and the information is not further disclosed in a manner prohibited by HIPAA; or 3. A disclosure of PHI where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. 6 C. Definition of Unsecured PHI Unsecured PHI means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued and made available at http://www.hhs.gov/ocr/privacy/. 7 The regulations require this guidance to be updated annually. PHI which is secured as specified by the guidance will not be subject to notification in the event there is a breach of the secured PHI. 5 45 CFR 164.402 (1)(i) For purposes of this definition, compromises the security or privacy of the PHI means poses a significant risk of financial, reputational, or other harm to the individual. (ii) A use or disclosure of PHI that is part of a limited data set as defined by 164.514(e)(2), does not compromise the security or privacy of the PHI. 6 45 CFR 164.402(2) 7 45 CFR 164.402; The commentary notes that unsecured PHI can include information in any form or medium, including electronic, paper, or oral form. 74 Fed. Reg. 42748
Page 4 D. Notification Requirements Applicable to the Covered Entity 1. Notice of Breach to Individuals. A covered entity shall, following the discovery of a breach of unsecured PHI, notify each individual whose unsecured PHI has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach 8. The notice must be written in plain language and to the extent possible, must include all of the following: (a) (b) (c) (d) (e) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; A description of the types of unsecured PHI involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); Any steps individuals should take to protect themselves from potential harm resulting from the breach; A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and Contact procedures for individuals to ask questions or learn additional information, which shall include a tollfree telephone number, an e-mail address, Web site, or postal address. 9 8 45 CFR 164.404(a)(1); A breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity. A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity. 45 CFR 164.404(a)(2) 9 45 CFR 164.404(c)
Page 5 2. Method of Notice The Covered Entity must provide notice in one of the following three formats, depending on circumstances 10 : (a) Written notice. (i) Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. (ii) If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual, written notification by first class mail to either the next of kin or personal representative of the individual. (b) Substitute notice. In the case that contact information is not available, a substitute form of notice reasonably calculated to reach the individual shall be provided. Substitute notice need not be provided in the case in where the individual is deceased. (i) (ii) In the case in which contact information is not available for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means. In the case in which contact information is not available for 10 or more individuals, then such substitute notice shall: (A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and (B) Include a toll-free phone number that remains active for at least 90 days that an individual can call to learn whether the individual s unsecured PHI may be included in the breach. 10 45 CFR 164.404(d)
Page 6 3. Additional notice in urgent situations. In any case deemed by the covered entity to require urgency because of possible imminent misuse of unsecured PHI, the covered entity may, in addition to providing written notice, contact individuals by telephone or other means, as appropriate. E. Other Parties Required to Receive Notice In addition to providing notice to the individual, the Covered Entity must notify the following entities: 1. Notification to the media 11 For a breach of unsecured PHI involving more than 500 residents, a covered entity shall, notify prominent media outlets serving the State or jurisdiction. The content of the notice shall be the same as the notice provided to the individual. 2. Notification to the Secretary of HHS 12. For a breach of unsecured PHI involving more than 500 residents, a covered entity shall, notify the Secretary of HHS in the manner specified on the HHS Web site. For breaches of unsecured PHI involving less than 500 individuals, the covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide notice to the Secretary of HHS of breaches occurring during the preceding calendar year, in the manner specified on the HHS Web site. F. Timeliness of Notification In general, a Covered Entity must provide the required notice without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. 13 The Covered Entity must delay providing notice if a law enforcement official states to the Covered Entity or Business Associate that providing notice would impede a criminal investigation or cause damage to national security. If such statement is in writing and specifies the time for which a delay is required, the Covered Entity or Business Associate shall delay such notice for the time period specified by the official. If the statement is made orally, the Covered Entity or Business Associate shall document the statement, including the identity of the official 11 45 CFR 164.406 12 45 CFR 164.408 13 45 CFR 164.404(b); 406(b); 410(b)
Page 7 making the statement, and delay the notice temporarily and no longer than 30 days from the date of the oral statement, unless the law enforcement official submits a written statement during that time 14. II. Changes Affecting Business Associates A. General Changes The ARRA 13401(a), 13404(a) now explicitly requires a business associate to meet the privacy standards applicable to covered entities, and following standards for PHI as well as security and management of PHI. These requirements formerly only applied to covered entities and now cover BAs as well. Administrative Safeguards in 164.308 Physical Safeguards in 164.310 Technical Safeguards in 164.312 Policies, procedures and documentation requirements in 164.316 Under the ARRA, If the BA determines that the covered entity has violated HIPAA privacy or security requirements, the BA has an affirmative duty to either terminate the BA agreement or to report violations to the Secretary. ARRA 13404(b). B. Notice of Breach A Business Associate must, following the discovery of a breach of unsecured protected health information, notify the Covered Entity of such breach. 15 The Business Associate is subject to the requirements applicable to a Covered Entity for timeliness of notification including requirements for a delayed notification. 16 14 45 CFR 164.412 15 ARRA 13404(b); 45 CFR 164.410; A breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate. 45 CFR 164.410(a)(2) 16 164.410(b).
Page 8 The notification provided by the Business Associate shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used, or disclosed during the breach. A Business Associate must provide the Covered Entity with any other available information that the Covered Entity is required to include in notification to the individual at the time of the notification or promptly thereafter as information becomes available. III. Compliance with Minimum Necessary Requirements The ARRA states that, effective February 17, 2010, a covered entity complies with the minimum necessary requirement if the covered entity releases a limited data set or the minimum information necessary to accomplish the purpose of the disclosure. ARRA 13405(b)(1)(A). The Secretary of HHS is required to issue guidance on what constitutes minimum necessary by August, 2010. ARRA 13405(b)(1)(B). Once the guidance is issued, the guidance will be definitive. IV. Accountings While Ohio law no longer requires accountings, HIPAA requires accounting of disclosures from electronic health records for treatment, payment, health care operations for three years prior to the request. Other disclosures, such as breaches, must also be accounted for a period of six years prior to the request. If the record exists on or before January 1, 2009, the new accounting requirements will apply to disclosures made from that record on or after January 1, 2014. If the record exists after January 1, 2009, the new accounting requirements will apply to disclosures made from that record on or after the later of January 1, 2011 or the date the covered entity acquires the electronic health record. BA agreements must include provisions on how accounting requirements will be met. 17 The Secretary may delay the implementation dates for accountings. 17 ARRA 13405 (c)(3).
Page 9 V. Sanctions The ARRA has strengthened the civil sanctions which apply to violations of HIPAA. There were no changes to the criminal penalties. The following table shows categories of violations and respective penalty amounts available: Violation category Section 1176(a)(1) Each violation All such violations of an identical provision in a calendar year (A) Did Not Know... $100 $50,000 $1,500,000 (B) Reasonable Cause... 1,000 50,000 1,500,000 (C)(i) Willful Neglect Corrected... 10,000 50,000 1,500,000 (C)(ii) Willful Neglect Not Corrected... 50,000 1,500,000 For violations occurring on or after February 18, 2009, the following affirmative defenses are available: 1. The violation is subject to criminal penalties, or 2. The covered entity establishes that the violation is (a) Not due to willful neglect and (b) Corrected during either: (i) The 30 day period on which the covered entity knew or reasonably should have known, that the violation occurred; or (ii) Such additional time as the Secretary of HHS determines to be appropriate. VI. Enforcement Procedures The ARRA has given State Attorney Generals the authority to file civil actions on behalf of individuals harmed by breaches of HIPAA requirements. The Attorney General may seek injunctive relief and damages on behalf of the individual. The maximum penalty amounts are substantially lower: $100 per violation with a maximum of $25,000 per year for identical violations. The Attorney General can collect attorney fees. There are provisions for individuals to receive a portion of penalties received by HHS after the GAO conducts and study and HHS adopts rules for such distributions..
Page 10 SUMMARY OF EFFECTIVE DATES FOR ARRA RULES AND REGULATIONS TITLE EFFECTIVE DATE CITE General ARRA privacy and related provisions 02/17/2010 Except as shown below: ARRA 13423 Duty of HIPAA-Covered Entities to notify Individual in the Case of Breach of Unsecured PHI 09/23/2009 13402 Presumptive compliance with standards for minimum necessary requirement. Accounting of Certain PHI Disclosures Required if Covered Entity Uses Electronic Health Record. Prohibition on Sale of Electronic Health Records or PHI Temporary Breach Notification Requirement For Vendors of PHI and Other Non-HIPAA Covered Entities. Civil penalties for willful neglect Tiered Increase in Civil Monetary Penalties Enforcement of Provisions Through Civil Suit By State Attorneys General. 02/17/2010 until Secretary issues guidance on standards for minimum necessary by Aug. 2010. Guidance will then govern. If the record exists on or before January 1, 2009, the new accounting requirements will apply to disclosures made from that record on or after January 1, 2014. If the record exists after January 1, 2009, the new accounting requirements will apply to disclosures made from that record on or after the later of January 1, 2011 or the date the covered entity acquires the electronic health record. At least 6 months after sub- (d) regs promulgated regs by 08/17/2010 05/29/2009 [See Sunset: 13407(g)(2)] 02/17/2011 (for penalties imposed on/after this date) 02/17/2009 (for violations occurring after this date) 02/17/2009 (for violations occurring after this date) 13405(b)(1)(A) 13405(c)(4) 13405(d)(1) 13407 13410(a) 13410(d) 13410(e) Rules governing notification of breach of unsecured protected health information 09/23/2009 74 FR 42740 Rules on sanctions 11/30/2009 74 FR 56123 FTC - health breach notification rule for entities not covered by HIPAA 09/18/2009 (for breaches of security discovered on/after this date) 74 FR 17914 Implements 16 CFR Part 318