ARE YOU HIP WITH HIPAA?

ARE YOU HIP WITH HIPAA? Scott C. Thompson 214.651.5075 scott.thompson@haynesboone.com February 11, 2016

HIPAA SECURITY WHY SHOULD I CARE? Health plan fined $1.2 million for HIPAA breach. Health plan fined $1.7 million after USB drive containing ephi stolen. Covered entity fined $150,000 for using outdated, unsupported security software.

AGENDA HIPAA Security Rule Breaches Trigger Investigations and Other Ways HIPAA is Enforced HHS Investigation Examples Employer Responses Controlling Risk Under HIPAA

HIPAA SECURITY RULE It s Not Just Privacy 4

GENERAL RULE Ensure confidentiality, integrity, and availability of ephi created, received, maintained, or transmitted Protect against reasonably anticipated: Threats to ephi security and integrity Improper use or disclosure of ephi Ensure workforce compliance 5

WHAT SECURITY MEASURES TO USE Use security measures that reasonably and appropriately implement security standards In deciding what security measures to use, consider: Size, complexity, and capabilities of the covered entity Technical infrastructure, hardware, and software security capabilities Costs of security measures Probability and criticality of potential risks to ephi 6

SECURITY STANDARDS: REQUIRED / ADDRESSABLE Some security standards are required Some security standards are addressable Assess whether safeguard is reasonable and appropriate Likely contribution to protecting ephi If reasonable and appropriate, implement it If not, document why and implement an equivalent alternative, if it is reasonable and appropriate Review and modify security measures as needed to provide reasonable and appropriate protection of ephi Maintain / update documentation of security measures 7

ADMINISTRATIVE SAFEGUARDS Security Management Process Risk analysis Assess potential risks and vulnerabilities Risk management Implement security measures to reduce risks and vulnerabilities Sanction policy Sanction employees who fail to comply with security policies System activity review Regularly review records of information system activity Security Official Develop and implement security policies and procedures 8

ADMINISTRATIVE SAFEGUARDS Workforce Security Ensure appropriate access to ephi and prevent unauthorized access Authorization or supervision of employees who work with ephi or in locations where it may be accessed (Addressable) Workforce clearance procedure to access ephi (Addressable) Procedures for terminating access to ephi (Addressable) Information Access Management Access authorization (Addressable) Granting and modifying access (Addressable) 9

ADMINISTRATIVE SAFEGUARDS Security Awareness and Training Security awareness and training program for all employees including management Security reminders (Addressable) Protection from malicious software (Addressable) Log-in monitoring (Addressable) Password management (Addressable) Security Incident Procedures Identify and respond to suspected incidents Mitigate harmful effects Document incident and outcome 10

ADMINISTRATIVE SAFEGUARDS Contingency Plan Policies for emergency situations that damage systems containing ephi Data backup plan Disaster recovery plan Protection of ephi during emergency mode Testing and revision of contingency plans (Addressable) Applications and data criticality analysis (Addressable) Periodic Security Evaluations Periodic evaluation of compliance with Security Rule 11

PHYSICAL SAFEGUARDS Facility Access Controls Limit physical access to ephi systems Contingency operations (Addressable) Facility security plan (Addressable) Safeguard from authorized physical access, tampering, theft Access control / validation procedures (Addressable) Control and validate person s access based on their role Maintenance records (Addressable) Workstation Use and Security Polices regarding use of workstations that can access ephi Physical safeguards for such workstations 12

PHYSICAL SAFEGUARDS Device and media controls Disposal of ephi and hardware or media containing ephi Removal of ephi before reusing hardware or electronic media Tracking movements and possession of hardware and electronic media (Addressable) Data backup and storage before moving equipment (Addressable) 13

TECHNICAL SAFEGUARDS Access Control Unique user IDs Emergency access procedures Automatic logoff (Addressable) Encryption / decryption (Addressable) Audit Controls Record / examine activity on systems containing ephi Integrity of ephi Protect from improper alteration or destruction Authentication of ephi (Addressable) Authentication Verify person / entity attempting to access ephi Transmission Security Integrity controls (Addressable) Encryption (Addressable) 14

BREACHES TRIGGER INVESTIGATIONS And Other Ways HIPAA Is Enforced 15

ENFORCEMENT OF HIPAA Employer reports breach affecting over 500 individuals HHS investigates Employee complains to HHS HHS investigates HHS conducts random audit State attorney general files civil action on behalf of state residents Criminal penalties for knowing violations 16

HHS INVESTIGATION HHS notified: within 60 days of any breach affecting 500 or more individuals in a state or jurisdiction, and annually of breaches affecting fewer individuals HHS investigation triggered by: breach notifications employee complaints to HHS If investigation shows HIPAA compliance efforts are lacking, HHS may require a resolution agreement to resolve the violations Over 20 resolution agreements (which are public) with covered entities Resolution agreements include: Payment of settlement amount Compliance with a corrective action plan 17

CIVIL PENALTIES Knowledge or Intent of Violation Did not know, and by exercising reasonable diligence would not have known, that violated HIPAA $Amount Per Violation $100 - $50,000 Due to reasonable cause and not willful neglect $1,000 - $50,000 Due to willful neglect Corrected 30 days: $10,000 - $50,000 Not corrected 30 days: $50,000 Up to $1,500,000 for identical violations in a calendar year For continuing violations, a separate violation occurs each day the health plan is in violation of the provision No penalty if violation not due to willful neglect and corrected within 30 days or to the extent penalty would be excessive relative to the violation HHS has 6 years to assess penalty HHS can settle for reduced penalty through a resolution agreement 18

HHS CORRECTIVE ACTION PLAN Risk Assessment and Risk Management Program Policies and Procedures Submit P&P to HHS for approval Make changes to P&P requested by HHS Distribute HHS-approved P&P to employees who will have access to PHI Obtain employee certifications that they received, understand, and will abide by the P&P Ensure employee cannot access PHI until certification received Update P&P at least annually Training Train all employees with access to PHI on HHS-approved P&P Obtain employee certifications that they received the training Ensure employee cannot access PHI until certification received Update training at least annually May also require annual refresher training 19

HHS CORRECTIVE ACTION PLAN Ongoing Monitoring of HIPAA Compliance Privacy Officer or independent monitor Quarterly / semi-annual review may include: Assessment of compliance with the corrective action plan Random sampling of employees to assess familiarity and compliance with HIPAA P&P Audit of persons having access to ephi Audit of how ephi on portable devices is secured Additional Reporting to HHS Must report to HHS within 30 days any time an employee violates any HIPAA policy or procedure Annual / biannual report Copies of all training materials Schedule of training topics covered and length of each session Attestation by Privacy Officer that all employee certifications have been obtained 20

HHS AUDITS HITECH requires HHS to perform periodic audits of compliance with the HIPAA Privacy, Security, and Breach Notification Rules Pilot Audit Program In 2011 and 2012, 115 covered entities (47 health plans) audited under pilot audit program Types of Violations Only 11% had no violations Smallest covered entities struggled with all three HIPAA components 60% of all violations were security related 2/3 incomplete or inaccurate risk assessment Privacy Rule violations 44% - uses and disclosures 20% - notice of privacy practices Only 10% of violations were breach related 21

HHS AUDITS Causes of Violations Unaware of requirement Privacy Rule 35% Notice of Privacy Practices Access of Individuals Minimum Necessary Authorizations Security Rule 27% Risk Analysis Media Movement and Disposal Audit Controls and Monitoring Breach Notification 12% Insufficient resources Incomplete implementation 22

HHS AUDITS Second Round of Audits Beginning in 2016 Focus on: risk analysis and risk management (the Security Rule) content and timeliness of breach notifications (the Breach Notification Rule) notice of privacy practices and access rights (the Privacy Rule) Comprehensive audit protocol available http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/protocol.html Documents and information submitted may be subject to FOIA requests Label Confidential, redact, on-site review of highly sensitive documents 23

ATTORNEY GENERAL SUITS / CRIMINAL PENALTIES Lawsuits HITECH gave State Attorneys General the authority to bring civil actions and obtain damages on behalf of state residents for HIPAA violations Connecticut, Vermont, Massachusetts, Minnesota Damages = $100 per violation Criminal Penalties Criminal actions can be brought against any individual who wrongfully discloses PHI $50,000 fine and one year in prison for a knowing violation Up to a $250,000 fine and 10 years prison if the violation was for personal gain or maliciously 24

HHS INVESTIGATION EXAMPLES 25

HHS INVESTIGATION EXAMPLES Leased Copy Machine Affinity Health Plan, a not-for-profit managed care plan, impermissibly disclosed PHI when it returned copy machines to a leasing company without erasing the data contained on the copiers hard drives. Up to 344,579 individuals may have been affected Affinity also failed to include the leased copy machines in its HIPAA security risk assessment and failed to implement policies and procedures when returning the copiers to the leasing company Settlement: $1,215,780 and a corrective action plan requiring Affinity to use its best efforts to retrieve all hard drives that were contained on photocopiers previously leased by the plan that remain in the possession of the leasing agent and to take certain measures to safeguard all ephi 26

HHS INVESTIGATION EXAMPLES Stolen Unencrypted Laptop Concentra reported an unencrypted laptop containing ephi was stolen Concentra previously recognized in multiple risk analyses that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing ephi was a critical risk Although steps were taken to begin encryption, HHS found Concentra s efforts were incomplete and inconsistent over time leaving patient ephi vulnerable throughout the organization HHS further found Concentra had insufficient security management processes in place to safeguard patient information Settlement: $1,725,220 and corrective action plan 27

HHS INVESTIGATION EXAMPLES Unpatched Software Anchorage Community Mental Health Services (ACMHS) reported a breach affecting 2,743 individuals due to malware ACMHS had adopted sample Security Rule policies and procedures in 2005, but these were not followed HHS found the security incident was the direct result of ACMHS failing to identify and address basic risks, such as not regularly updating their IT resources with available patches and running outdated, unsupported software Successful HIPAA compliance requires a common sense approach to assessing and addressing the risks to ephi on a regular basis, said OCR Director Jocelyn Samuels. This includes reviewing systems for unpatched vulnerabilities and unsupported software that can leave patient information susceptible to malware and other risks. Settlement: $150,000 and a corrective action plan that requires ACMHS to report on the state of its compliance to HHS for a two-year period 28

EMPLOYER RESPONSES 29

FULLY-INSURED PLANS HIPAA Employer s group health plan (i.e., as an entity separate from the insurance policy issuer) is also a covered entity subject to HIPAA breach notification requirements Plan could be liable if notifications are not made by the insurer Written confirmation from insurer that it will comply with any HIPAA breach notification requirements in accordance with HIPAA Evidence from insurer that all required notifications were properly made Document the incident in accordance with HIPAA breach policies and procedures State Law Receive written confirmation from the insurer that it will: analyze what state law notification requirements apply to the employer send all notifications required under state law in accordance with state law on the employer s behalf Request evidence from the insurer that all required notifications were properly made 30

SELF-FUNDED PLANS HIPAA Review HIPAA business associate agreements (BAAs) to determine if the plan has delegated responsibility to: Determine whether breach under HIPAA occurred Make any and all required notifications under HIPAA in accordance with HIPAA Request documentation of risk assessment, copies of notifications, and evidence that required notifications were made Document the incident in accordance with HIPAA breach policies and procedures State Law Receive written confirmation from the business associate that it will: analyze what state law notification requirements apply to the employer send all notifications required under state law in accordance with state law on the employer s behalf Request evidence from the insurer that all required notifications were properly made 31

CONTROLLING RISK UNDER HIPAA HIPAA Policies Aren t Just Ugly Paper-Weights 32

CONTROLLING RISK Controlling Risk = reducing the likelihood of: Data breach Penalties during HHS audit or investigation HIPAA Policies and Procedures For privacy and security Compliant and up-to-date (final omnibus HIPAA regulations) Notice of Privacy Practices Up-to-date Accurately reflects how the health plan uses and discloses PHI Distributed in the time and manner required by HIPAA Business Associate Agreements Revised for the final omnibus HIPAA regulations Adequate indemnification provisions (or in the services agreement) Reflect employer s intentions regarding delegation of breach notification responsibilities. BAAs are not boilerplate documents 33

CONTROLLING RISK Risk Assessment and Risk Management Plan Perform a security risk assessment Coordinate with IT department Implement risk management plan Federal government risk assessment tool: http://www.healthit.gov/providers-professionals/security-risk-assessment Training All members of the workforce who may have access to PHI How to handle PHI, especially minimum necessary and portable devices Insurance Coverage Adequate insurance coverage to cover losses from cyber-attacks and HIPAA violations 34

QUESTIONS?