From time to time I'll send my clients and interested others an e-mail update on new or pending regulatory actions and news related to healthcare information privacy and security. I'll also post them here for others to read. If you'd like to be on the e-mail list, please contact me, or, subscribe to the RSS feed. Thanks!
Gathering Storm Clouds on the Audit Front
-- With Apologies to Judy Garland, Harold Arlen, and a Cast of Flying Monkeys --
"Auntie Em! Auntie Em! There's a twister a-comin'!" Well, I won't vouch for the accuracy of the quote, but I see some pretty ugly clouds on the horizon. A few comments from Federal officials, a job posting, and a conversation with someone whose company went through one of the random audits last year, and now I'm concerned. Is there a HIPAA storm cellar? You may want one.
I guess I'm not reporting anything new if I take note of the numerous public comments by HHS officials that in the first round of random audits, they found that entities weren't doing much internal auditing of system and network activity to ensure proper use of systems and data by the appropriate people. It's also nothing new that the folks heading up the HHS Office for Civil Rights have said that enforcing the auditing requirements will be a focus of their work in the coming months. And I'm sure I'm among thousands of people on the HHS mailing list that in the last week received a notice that HHS OCR was looking to hire people to do HIPAA privacy and security audits. That's troubling enough. Those two things mean that if you haven't started to follow up on the HIPAA Security Rule's system monitoring and activity review safeguards, you're leaving yourself open to fines and corrective action plans with a growing workforce dedicated to enforcement, full-time.
But then I had a nice long talk yesterday with someone whose organization was audited by HHS in a random audit last summer. For five days, the hired guns from KPMG lived in a conference room and collected information. Asking questions, verifying answers, verifying the verification, almost like automatons, no emotion, no human interaction, really. The questions they asked were the ones in the HIPAA Audit Protocol (http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/protocol.html), and that's scary enough, but in many ways the audit was like a SSAE16 (formerly SAS70) SOC2 audit, in that they were looking to see how well the organization sticks to its policies, whatever they are. Out of some 300 employees, one had missed their annual required HIPAA training, because that person was out and couldn't attend despite almost heroic efforts to do so, and the auditors wrote it up as a deficiency. They backed down after a letter from the organization's lawyer, but the point is, if you have a policy, you had better be sure you're doing what it says you do, or you will have to defend your actions, and that's just plain expensive, time consuming, and unpleasant.
-- If I Only Had a Brain --
So, let's take that little nugget of truth and apply that to the internal auditing issue. Are you starting to feel a little bit of, "Oh, I haven't really been doing enough," in the pit of your stomach? I know there are plenty of internal auditing policies out there that call for regular reviews, which is what HHS says is necessary, but has everyone been doing those reviews? I doubt it. It's among the most time consuming, boring, annoying tasks in security, and everyone hates it. So, what do you do?
First of all, start doing something and document it. Schedule regular reviews of access lists. Schedule a regular random audit of at least one employee's computer use, and one patient's access history. It doesn't have to be much, but you have to do something and you have to do it on a regular basis, not just when there's a complaint or some other event. See what your policy calls for, and write the procedures, and then, most importantly, audit your auditing compliance to make sure you're doing what your policies and procedures call for! What you can show in documentation and what the policies and procedures call for MUST match! You can have a great auditing policy, and you may have some great audits, but if they don't match, you're going to have some explaining to do. Ugh.
Here is everyone's homework for this week: Look up your HIPAA security internal audit policy -- system activity reviews, access reviews, those kinds of things. Do you have one? Do you have any supporting procedures that say how you, in your facility, will do those audits? If you already have these in writing, start doing them now, and then see how well you can actually do what you're saying you do. Be prepared to make some adjustments in your procedures so you can have a defensible position if you're audited -- and document everything!
"But I have such tight access controls that it would be nearly impossible for someone to access information improperly!" Then your audits will be quick and easy verifications. You can't get out of it -- you have to verify.
-- Somewhere Over the Rainbow --
(Am I going to be getting into trouble with the copyright lawyers for all these references?)
HIPAA compliance does sometimes feel like it's somewhere over the rainbow, but what is it like back in dusty, old, black-and-white Kansas, Dorothy? There are actually things you can do to be prepared. First of all, get to know the HIPAA Audit Protocol. Go to the Web site, check just the "Security" questions, select the popup to show "all", click the button to "Export to CSV", and open the file in your favorite spreadsheet. Do some formatting so you can actually read things and use it, add some columns to show your answers, to identify your documentation, and to say what you need to do to improve things. Go through the questions. Once you go through this exercise, you will know your weaknesses, and you will see what you need to put time into so you can have good answers when the auditors call you.
You will probably see that you have deficiencies in your auditing activities, procedures, and documentation. You will then have justification to spend the time you need to on getting your policies and procedures up to snuff and documented, to begin following them, and to make adjustments so your activity matches your policy and procedure. And make sure everything is properly documented.
And maybe if you're picked for a random audit it won't feel like the flying monkeys are out to get you.
Jim
Policy Changes and the New HIPAA Breach Evaluation Process
I keep chipping away at the issues related to the new final HIPAA rules (aka HIPAA2), looking for insights into the bottom-line question, "Just what needs to happen to become compliant with the new rules?" I provided a little bit of an outline in my last message, but the issues surrounding the changes to Breach Notification need a little more exploration at this point. In upcoming discussions I'm sure I'll be tackling the scope of the changes to the Privacy Rule, but for the moment I'll fill in a few blanks relating to the Security Rule and Breach Notification.
-- Security and Breach Rule Policies
For the most part, changes to the Security Rule consist of adding "...and Business Associates..." to many of the sections, and doing so probably won't affect your Information Security Policies. The changes may need to be reflected in your policy on Business Associates if the policy is specific about BA agreement contents and doesn't refer to the HHS regulations identifying required content (or even better, the Web page for that, http://tinyurl.com/7asm2qj ). If the policy does refer to the regulations, it's probably fine as is.
So, with a little review (make sure you do actually review your policies, please), you'll probably decide your Security policies need little, if any, modification to meet the new rules, except when it comes to Breach Notification. I suspect most policies refer to the old "harm standard" (I know the ones I've supplied in the past did), and those paragraphs will need to be replaced with consideration of the new four-factor risk assessment for probability of disclosure. It's well worth your taking a moment to read through the new definition of a breach, under §164.402, FR page 5695, or page 131 of the PDF version, http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf .
-- How to Evaluate a Breach
The key here is to change your thinking about breach evaluation. Instead of "we don't have to report unless there's harm," the new rules say "we have to report unless there's a defined exception, or unless there's a low probability of compromise." The process to decide whether an incident is a reportable breach is this:
Step 1) Was the data encrypted according to the HHS guidance with strong passwords and are the passwords still secure? If so, not a breach. Document and done. Note that if you did use some kind of encryption but it doesn't meet the official requirements, it may still get you some points to use in step 3.
Step 2) OK, so if it wasn't properly encrypted; does it meet one of the defined exclusions in §164.402's definition of Breach? i) For unintentional, good-faith acquisition or use within the scope of authority and no further use or disclosure, ii) for inadvertent disclosure by someone ordinarily authorized to access the information within the same covered entity, business associate, or organized health care arrangement, or iii) if the disclosed information could not be retained by the unauthorized recipient. If you meet an exclusion, document and done. But do note that the exclusion under ii applies only to the same entity. If you inadvertently fax to another office not part of the same entity, that does NOT qualify for the exclusion. But it may get you points to use in step 3, compared to faxing to the hardware store.
Step 3) Well, it wasn't encrypted according to the guidance, and it doesn't meet an exclusion, so it's a reportable breach, UNLESS you can show a "low probability of compromise" based on a risk assessment considering at least the four factors identified in the regulation. Whereas before it was, "there's a hole, do we have to jump in?" now it's "we're in a hole, how can we dig our way out of it?"
An issue with any one of the Four Factors (didn't they have a Motown hit back in the 60s?) can be enough to raise the risk of a compromise above the "low" level. All four must be well controlled. The factors are, 1) what is the data (nature and extent, and likelihood of identification), 2) to whom was the disclosure made, 3) was the information actually acquired or viewed, and 4) have the risks been mitigated.
-- How Can You Implement This?
I'd recommend your policy point to the regulation (45 CFR §164.400 et seq.), and you implement procedures to support the policy that will take you through the Three Steps and the Four Factors (is this becoming a battle of the bands?)
Let's run through a quick set of examples: Let's say someone in your office faxes some health information to another office within your covered entity, but it is not the intended office. Well, it's on the fax machine, so it's not secured, so go to step 2. In this case, it meets the exception under ii, so it's not a reportable breach. Document and done.
What if it's faxed to another doctor's office that happens to be a different covered entity from yours? In this case, you have to go to Step 3, and evaluate the Four Factors. Let's say this is information about a dermatology skin patch test that went to the wrong dermatologist, was not actually viewed, and was shredded.
- Factor 1: The data is not sensitive, not extensive, just one simple test result. Sounds OK, not too risky.
- Factor 2: The disclosure was to another doctor's office also under HIPAA rules to protect all PHI no matter the source. Sounds OK there, too.
- Factor 3: Was the information viewed? In this case, let's say the receiving person realized the fax was misdirected and did not look at the pages behind the cover sheet and learned nothing other than that a fax was sent from an office erroneously. In that case, sure, that sounds OK too.
- Factor 4: The fax was shredded and the risk was fully mitigated. Also good news.
In this case, document your analysis, and you'd be justified in coming to a conclusion of there being a "low risk or compromise".
-- Some Variations on the Factors
But how about if, instead of a skin patch test result, it's HIV/AIDS test results? BAM! There goes factor 1. VERY sensitive information. Must report. Likewise if it's a complete record with lots of detail.
Or, how about if it's the hardware store instead of a HIPAA-covered entity that receives the fax? BAM! There goes factor 2. Must report.
Or, if the person receiving the fax discusses the contents with someone in their office? BAM again. Factor 3. Report.
Or, if you don't actually know that the fax was shredded? Factor 4. Report.
Any one of the factors can push your risk assessment above the "low probability of compromise" level.
-- So What Does That Leave?
At this point, we've covered what needs to happen for Security and Breach Notification Rule compliance. Do note, though, that the new requirements do not go into effect until March 26, 2013, and are not required to be used until September 23, 2013. Until March 26, you must still use the "harm standard". Between March 26 and September 23 you can use EITHER the old standard, or the new process. After September 23, you must use the new rules.
Next time I'll start digging into some of the many Privacy Rule issues.
And, as always, let me know if you have any questions, and do keep up with my list of upcoming seminars and Webinars at http://www.lewiscreeksystems.com/upcoming_public_seminars.html
Thanks!
Jim
Nuances of the New HIPAA Rules, New BAA Template
As time goes by and we in the compliance community have the opportunity to digest the new rules a bit more and dig deeper into some of the tidbits hidden in the Preamble to the changes, new details will emerge, new understanding will develop, and framework for HIPAA update implementation will emerge. Here's how it looks so far:
-- A Framework for Implementing the HIPAA Changes
1) Policies will need to be modified or adopted to deal with the changes to business associates, individual access, breach notification, marketing and fundraising, and lots more. This will not be a simple job, depending on the complexity of your current policies, and must be executed by September 23, 2013.
2) Your Notice of Privacy Practices will need to be updated to reflect the new patient rights, and may be modified to remove language no longer required pertaining to some marketing activities that now will require an authorization instead. This also will need to be implemented by September 23, 2013. Providers will NOT have to mail out a new one to patients, but will need to use it and make it available and properly posted in their offices and on their Web sites.
3) Update your Business Associate Agreements to meet the new standards, and while you're at it, add in beefier protections for breaches, liability and indemnifications, so you don't get caught holding the bag if a BA plays fast and loose with your PHI. Luckily, the big news is that upon official publication of the new rules on January 25, 2013, they also released updated HIPAA Business Associate Agreement template provisions, available at the same Web address as the old, ancient, obsolete version: http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html (Shorter link: http://tinyurl.com/7asm2qj )
Now, just as before, this language is hardly stuff your lawyer would like you to sign as is, but it does identify the elements that must be in a modern BAA meeting the new standards. Do not adopt it as is, but use it to look at your current template and agreements, identify needed changes, and work with your attorney to implement those changes in a way that is legally correct for you, in your state.
Compliant BAAs under the old rules in place as of January 25, 2013 have until September 23, 2014 to be updated, and this includes "evergreen" contracts that auto-renew without intervention. Any new or manually renewed contracts must meet the new requirements by September 23, 2013.
4) And then once you implement the new policies, NPP, and BAAs, you'll need to make sure the proper procedures are developed and training takes place so it all works.
-- Speaking of Business Associates...
I've long spoken of the issues of the proposed rules for Business Associates, providing an example of how the shredding company for a business associate that provides services using PHI on behalf of a covered entity could unwittingly find itself under the regulations of the US Department of Health and Human Services, with significant compliance obligations and penalties for non-compliance. I spoke of how difficult it would be to educate all the business associates and their subcontractors all the way down the chain to implement the rules fully.
Well, it's even more complicated than that. Here's a scenario: You have an official e-mail system that your office uses for all professional communications and you have a policy that says staff should ONLY use that system. One staffer goes outside of the policy and uses G-mail to send someone in another office some PHI. Under the new rules? BAM! Google is a Business Associate because they have access to your firm's PHI. Without any notice or intervention, and despite any terms of service they might wish to implement. With that one act, both you and Google are in violation of the HIPAA BA rules, without your or their knowledge.
Needless to say, there are some serious issues that result from this interpretation, and we will just have to see how this shakes out. Will there be forthcoming guidance that softens the blow? That doesn't seem likely given the wording in the preamble to the new rules, but it could happen. Here is a link to a good article by Health IT lawyer John Christiansen discussing this topic and the impacts in some cloud and ISP circumstances: http://christiansenlaw.net/2013/01/do-the-hitech-rules-really-make-all-healthcare-asps-and-cloud-services-providers-business-associates/ (Or use this short link: http://tinyurl.com/b29f4x2 )
Isn't HIPAA fun?
-- And if I've provided you any BAA or policy language in the past...
It probably needs updating. I'll try to be proactive and let you know, although a lot of policies and agreements have been developed over the last ten years of HIPAA. If you have questions about yours, please let me know and we can set up a review. Also, I have four Webinars this week and next, on Breach Notification, E-mail and Texting, the new Final Amendments, and Business Associates -- I'll be including the new rules in all of these. See my page for more information on these and many more: http://www.lewiscreeksystems.com/upcoming_public_seminars.html
Please let me know if you have questions -- I'm always happy to help!
Jim
New Final HIPAA Rule Released -- a few surprises!
Well, the big news is that we've finally been treated to a new final HIPAA rule, issued last Thursday, true to form, just before a holiday weekend, all 563 pages. A great deal is "as proposed" but there are some significant changes and some significant insights provided in the preamble. Here's a link to the pre-publication version https://s3.amazonaws.com/public-inspection.federalregister.gov/2013-01073.pdf The actual date of issue of the official version in the Federal Register will be this Friday, January 25, whereupon the link above may stop working and links to the official version will be announced.
DISCLAIMER! I am not a lawyer and everyone in the HIPAA world is still sorting out all the impacts and changes, and I'd be a fool to think that I know what all the issues are and have everything interpreted correctly at this early stage. This is not a complete analysis, but just a few observations, and I'll have more information as things develop.
So, what's up with the final rule? For the most part, it's being finalized as proposed, but with some significant exceptions. Here are some tidbits.
-- Business Associate Agreement Compliance Timing
The new rule, as proposed, extends the HIPAA regulations to Business Associates, and there are changes in what is required in a Business Associate Agreement to reflect the new status of BAs. The sequence of compliance in HIPAA is usually that the rule is officially Published (as this one will be on Friday the 25th), it goes into effect 60 days later, and is enforceable 6 months after that. The proposed rule said that if your BA agreement was in compliance with the old rules as of the effective date, you'd have 18 months to get your BA Agreement up to snuff, not just 6 months, so you'd have some time, once it was published, to at least nail down what you could under the old requirements and not have to look at it again for 18 months.
Well, surprise, surprise, the final rule says that if your BA agreement is compliant as of the day of publication, not the effective date, you get the extra year to get your agreements updated. You don't get that 60 days before it goes into effect to sign agreements under the old rules and put off revisiting them for 18 months. In other words, you have until this Friday to sign any agreements that are compliant with the old rules and not have to revisit them for 18 months. Starting next week, you'll have to use agreements meeting the new requirements, or you'll have to revise them by September 23, 2013.
I've been recommending that folks include language that meets the new requirements for some time now, so if you have, you may be all set to continue into the future and have until September 24, 2014 to revise all the older ones.
-- Breach Notification: The Harm Standard is Dead, Long Live the Harm Standard
We all knew that there would be some changes in the Harm Standard in Breach Notification because of the controversy around it, and a perceived lack of uniformity in the industry as to how to interpret it. Well, there sure are some changes. The Harm Standard has been unceremoniously dumped, replaced by the notion of a "low probability of compromise" using a risk assessment of each potential breach, considering four factors: what the information was, to whom it was released, whether or not it was actually accessed, used, or disclosed, and how the incident was mitigated. OK, so far so good...
Interestingly, in the Preamble discussion of the new rule, one of the considerations in evaluating the information potentially breached is whether or not its exposure is adverse to the individual or benefits some other person. It sounds like the "adverse to the individual" is a new harm standard, without the icky name. Now, to be sure, you need to look at more than this to see if it's reportable -- any one of the four factors can drive notification. But it does allow some room for consideration of the impact on the individual.
The big impact here is that you do need to establish a process for assessing the risk of every potential breach to see if it is reportable.
One of the best things I noticed in the new rule was in the Preamble discussion having to do with sending information to the wrong provider by mistake. Under the interim rule there was not an exception for inadvertently sending to the wrong HIPAA-covered entity. There still is no exception, but the Preamble discussion did make it clear that you can use a risk assessment considering the four factors to decide that there is not a reportable breach. Just don't make it automatic! You still need to do the risk analysis every time -- you may have situations where it's not something you can except.
-- Some Guidance on Unencrypted E-mail (and Texting?)
One of the new requirements unchanged from that proposed is that if someone wants an electronic copy of their health information that's held electronically, you must provide that. No news there -- it's in the HITECH Act and in the proposed rule, and also in the Meaningful Use requirements for anyone going for incentive funding for their EHR. What is news is the discussion in the preamble about how to transmit that information to the individual. In short, if the individual wants you to e-mail them any PHI, you need to explain that it is not necessarily secure and that the information may be exposed, and ask if they want to do that anyway. If they say, "yes, e-mail me anyway, I understand and accept the risks," then e-mailing PHI is fine. They note that individuals don't necessarily have the savviness to manage decryption processes, and they have a right to ask for their information however they want it (within reason), so e-mailing is fine. Don't forget: DOCUMENT the discussion and agreement to accept the risk.
This logic may also be extended to texting. If the individual says, "text me my test results", and you explain the risks and they say do it anyway, you may. DOCUMENT it.
Note that this does not exempt professional communications! Any professional exchange of PHI over the Internet MUST be encrypted to avoid breaches. The ability to avoid encryption only applies to communication with the individuals. Also, keep in mind that if you're going for incentive funding for your EHR, you need to provide a secure portal for patient access of information, which would minimize the need for e-mailing of PHI anyway.
Also note that I feel it would be foolish to not consider the content of any unencrypted e-mail or texting. I would resist sending unencrypted information of a particularly sensitive nature, or any information that may be covered by more stringent regulations, such as substance abuse or HIV/AIDS information. I think it is important to show that in your discussion to not encrypt that the nature of the information was considered. If you're just wanting to text someone so you can say you're running 10 minutes late for their appointment, that's a low risk situation, and not the same as telling someone their oncology test was positive. Use your judgement and document it!
-- Is That All, Folks?
Not by a long shot. I'm digging deep into this because I have webinars and seminars on HIPAA this week and next and on into the year. Nothing like having to teach someone else to force you to really know your material! I'm sure we'll all be finding little gems as we in the compliance community come to grips with the new rules. Here is the obligatory link to my page of upcoming sessions: http://www.lewiscreeksystems.com/upcoming_public_seminars.html
Please let me know if you have any questions (how could you not... I certainly do!). I'll do my best to sort things out for you, and I'll try to pass along any insights as they occur to me. There is certainly a lot that can be found in 563 pages, to be sure!
Jim
HIPAA settlements continue, laptop again, small entity again
A Happy New Year to all, and here's to having better compliance with HIPAA in the coming months!
New Rules? What New Rules?
Well, we still have no new regulations yet, and even the head of HHS OCR, the folks making the rules, isn't sure when they'll appear. I mean, come on, the laws behind these rules, for the most part, went into effect more than two years ago. The longer the delay goes on, the more I begin to wonder if they'll throw into the "Omnibus Update" a final rule on the new Accounting of Disclosures provisions. (Yes, the final rule changes are likely to be about as subtle as a bus... or a bull in a china shop...)
The big takeaway from this is it's time for all the HIPAA business associates to face up to the fact that they're going to be covered under the rules, and have already been covered under the law for more than two years, and are subject to enforcement by state attorneys general. The delay in finalizing the rules has presented an opportunity for these entities to get their compliance houses in order before the clock starts ticking. When the final rules go into effect, BAs will have only six months to become compliant, and the competition for resources to get the job done will be fierce. The word from the head of HHS OCR is that BAs need to get ready now, and I would expect vigorous enforcement of the rules once they're enforceable. Here's a link to an interview with Leon Rodriguez that is very illuminating! http://www.govhealthit.com/news/ocr-looking-high-level-sensitivity-data-breaches
Another Settlement for a Laptop Breach, With a Small Hospice Agency
Oh, this one really hurts. Hospice of North Idaho (HONI) uses lots of laptops to provide its services. One got stolen. They hadn't done a risk analysis, and they hadn't implemented any mobile device security policies and procedures. 441 patients' information involved. $50,000 settlement plus corrective action plan.
OK, a few things here:
1) This is going to cost HONI a LOT more than the $50K settlement, and I'd guess they have NO money to spare at an outfit like this. This comes right out of their ability to provide services. Getting into compliance for a relatively straightforward organization like this would have cost a SMALL FRACTION of the costs of the breach and settlement.
2) Note that this is for a breach that's under the threshold of 500 to be reported as a large breach. Yes, folks, they're looking at the small breaches too, taking names, and finding examples to make.
3) I'm sure you can fill this one in yourself by now, if you've been listening to me... Do your risk analysis, implement some policies and procedures and encrypt all your mobile devices! Almost every day another breach is reported involving thousands of patient records on a laptop. Portable data is a clear, obvious, documented serious risk that is WAY cheaper to protect than recover from a breach thereof. STOP THE MADNESS! Do your homework and encrypt your laptops and any mobile health information. Do it NOW. No more excuses!
Here's the link to the HHS OCR news release on the settlement, with links to the agreement, and to guidance on how to protect mobile data: http://www.hhs.gov/news/press/2013pres/01/20130102a.html
And About That Guidance On Mobile Device Security...
The nice folks at the Office of the National Coordinator for Health IT have put together a good set of resources that everyone using any portable devices holding Protected Health Information should take a look at! With all the problems of breaches of mobile devices, this is a welcome addition to the educational arsenal. Use this to educate yourself, and to help show your bosses why putting in the time and money to protect these devices is such a good idea, and so much less expensive than not doing so. There are documents, FAQs, videos, and more. Check it out at http://www.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security
Seminars, Webinars, and Conferences, Oh My!
Hokey Smokes, Bullwinkle, here it is only the fourth of January, and I already have 27 speaking engagements set for 2013! 2012 saw a total of 62 sessions, some from my desk, some across the country -- I'm not sure I can do more and meet client needs at the same time. But I do cover a variety of topics and issues related to HIPAA. See the ever-evolving list at http://www.lewiscreeksystems.com/upcoming_public_seminars.html
And On That Note...
Please let me know if you have any questions or need any assistance with HIPAA compliance -- I'm always happy to have a conversation and do my best to get you headed in the right direction.
Thanks!
Jim
Plenty of HIPAA Action but Regs in Holding Pattern
Greetings, All,
If I keep waiting for the new rules to send a client message out, it may never happen, or so it seems. So here's a summary of the latest goings on in the world of HIPAA.
Final HIPAA Rules Expected Maybe Someday
OK, so it's gotten so bad that I've about given up updating my slides in HIPAA presentations with the latest expected dates for release of the final HIPAA changes in the big Omnibus rule, and now it's clear we'll hear nothing before the election, so we'll see. All of the uncertainty is causing a lot of inaction and stalling a lot of work that really needs to be done to get healthcare down the road to at least the present day, if not the future. When will we see the regs? Someday, maybe, maybe not. Meanwhile, state attorneys general have sued business associates for violations under the HITECH act, even without the regulations in place. So we continue in regulatory limbo -- both the old and new rules apply...
HIPAA Audit Protocol Updated
At some point during September, without announcement, the HIPAA Audit Protocol was updated, improved, and moved to a new web page, leaving the old one still active without any notice that a new version had been published elsewhere. Hey thanks for the heads up! http://www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/protocol.html Anyway, it's up from 165 to 169 questions, but the big news is the "Export" button that makes it possible to export the contents to something useful like a spreadsheet, where you can add columns for Item Number (so you can always sort things back to the original order!), unresolved questions, issues to be addressed, supporting documentation, and priority for resolution. Once you do this, you can format the cells so the contents are readable (what a concept!) and use the HIPAA Audit Protocol as a master HIPAA compliance guide and documentation record. Sort of like a simpler, less detailed, lightweight version of the NIST HIPAA Security Rule Toolkit. It's still not perfect, and there are still some wonky questions, but it can be actually used. Let me know if you'd like a copy of the protocol (as published on October 15, 2012) in a formatted .xlsx spreadsheet something like what I described, and I'll e-mail you one.
And the Settlements Go On
Is this starting to sound like a broken record? Organization loses a laptop, HHS OCR investigates, finds no laptop encryption, no real information security management process, no risk analysis, no polices and procedures, or training on using laptops, etc., etc., and a one-point-something million dollar settlement and an expensive Corrective Action Plan are the result. This time it's Mass. Eye and Ear Infirmary (and Mass. Eye and Ear Associates) on the hook, for $1.5 million, plus a nice fat CAP. http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/meei-agreement.html So, do we all get the message yet? Repeat after me: No unencrypted PHI on laptops or portable devices. Otherwise, you are SO looking for trouble.
New Risk Assessment Guide Great for Federal Agencies, Not So for Health Care
Sorry, but the new NIST SP 800-30 Revision 1 is clumsy, fat, overwrought, and just about useless. Use the old one. The new one will make your head hurt. So warned, the new version is available at: http://csrc.nist.gov/publications/nistpubs/800-30-rev1/sp800_30_r1.pdf, and the old version (recommended) is still available at: http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf
New Incident Handling Guide Great for Everybody
This new update from NIST is a winner, and there's even a ITL (NIST's Information Technology Laboratory) Bulletin with more discussion and guidance. NIST SP 800-61 Revision 2 is strongly recommended, available at: http://csrc.nist.gov/publications/nistpubs/800-61rev2/SP800-61rev2.pdf and the September ITL Bulletin is available at: http://csrc.nist.gov/publications/nistbul/itlbul2012_09.pdf Take note! If you have an incident and HHS investigates, they will want to see your incident management plan and the report from the incident. Get to know SP 800-61 Rev 2 -- it is your friend.
More News and Resources
Yes, there's more -- announcements from Verizon about BAA-quality cloud services, new free privacy training resources from the Office of the National Coordinator, and the beat goes on. See the Lewis Creek Systems site http://www.lewiscreeksystems.com for more.
And Training Sessions
Don't forget to check the Upcoming Pubic Seminars schedule at http://www.lewiscreeksystems.com/upcoming_public_seminars.html to see what's coming up in person and on the Web. If you need a serious HIPAA hit in the next week, I'm doing an intense 2-day session in DC on October 25 and 26 at the Marriott Courtyard Embassy Row -- see http://www.globalcompliancepanel.com/control/s_product/~product_id=900012SEMINAR
But life is not all HIPAA...
I'm off for a three-day Electric Bass Workout (see http://www.bassworkout.com ) so I can concentrate on something other than HIPAA for a few days. I find I am much more productive and work much better when I take the time out to concentrate on something other than what I concentrate on every day, which is HIPAA. For me, it's music, for some it's fishing or working on their old car or gardening or something, but the message is, you'll be happier and get more work done if you remember to take care of your self and spend time focusing on your joys. So, if you need to reach me from this afternoon through the weekend, be prepared for a delay -- I'm taking care of some important business.
And as always,
If you have any questions, please let me know, and I'll be happy to do my best, though perhaps not until next week!
Jim
HIPAA Audit Protocol, items from the NIST/OCR HIPAA Security Conference, and more
Hi All,
-- The NIST/OCR HIPAA Security Conference --
Oh how I wish I had more news to report from the annual NIST/OCR (National Institute of Standards and Technology / US Department of Health and Human Services Office for Civil Rights) HIPAA Security conference down in DC on June 6 and 7. Presentations from the conference are available at http://csrc.nist.gov/news_events/hiipaa_june2012/presentations.html
Well, the big news I was hoping to hear more about was the release date for the final rule changes to HIPAA (except Accounting of Disclosures), and the best "official" word, expressed by senior officials at OCR (and by folks informed of the official line over at the big Privacy conference happening almost concurrently in DC) is that the new rules will be out by the "end of the summer", whatever that means.
But while that's the official word, the remarks by Leon Rodriguez, the head of HHS OCR, were slightly different, and if anyone's slightly different words should be considered, it's the head guy's. Rodriguez used phrasing like, "I wish I could give you a date, but it's very, very, very soon." Now, in my family, when you repeat something three times, you really mean it. Leon's not one of our kids, but if he's the top guy at OCR, the nuances of his speech can't be ignored. I still think it will be out soon -- what do you bet, just in time for the 4th of July holiday -- wouldn't that be just like them... But I'll probably be wrong again.
Another choice tidbit is that the folks who are implementing the incentive funding for EHRs are planning to audit the meaningful use attestation of, hold on for this, 10% of all entities receiving funding. Yikes! 10%?? That's a LOT of audits, and I know there are some who are doing a skimpy job on meeting Objective 15 (requiring a HIPAA Security Risk Analysis) who will get snagged. My advice (and it's not legal advice because I'm not a lawyer and I don't play one on TV) is to make sure you have a real risk analysis done, one that you can point to and show you've been paying attention to. 10%?? Wow. Hey, a real risk analysis is the smartest thing you can do anyway.
Other items from the conference:
-- Breaches caused by lost, stolen, or improperly disposed of PHI are holding steady at about 2/3 of all breaches; about half of all breaches could be avoided through proper use of encryption and access controls. No big news there, just a confirmation of what's been happening for quite some time now.
-- Breaches by hacking are on the increase. No question. Health data IS a rich target, identified by international identity thieves. The hacking breach at Utah Medicaid led to 700,000 records being exposed and the state CIO's turning in his resignation. Health information security has recently become a much more serious game. Less Keystone Cops and more James Bond. IT staffs will have to adjust, and fast.
-- Have an incident that might be a breach? Calm down, stop the damage, and do the research. It's not a breach until you decide it is, indeed, a breach. If you decide too soon, without complete evidence, you may wind up notifying incorrectly. Have a good INCIDENT handling policy and procedure that tells you what to do and how to proceed, and how to get to the point where you say, OK, yes, it is actually a breach, and we have to treat it as such, or not. You will have both regulatory and technical considerations as to how you call it; don't jump to conclusions.
-- The Office of the National Coordinator has done a great analysis of smart phone security, available in the sessions listed for June 6, "ONC Mobile Device Project". Find your devices there and see if you're doing all you can to protect PHI.
-- The HIPAA Audit Protocol --
Of course, there's a lot more to report. One biggy is that OCR would be publishing its audit protocol for the HIPAA privacy and security compliance audits now taking place, and the protocol was just announced yesterday -- see http://ocrnotifications.hhs.gov/hipaa.html Take a look, and see how you'd do. (Don't Panic!)
Now, this audit protocol is just what we've all been waiting for, so we can know how to be prepared for an audit, but I have to admit it is something of a disappointment. It has 165 questions, most with several sub-questions, and multiple references of comparisons to "established performance criteria" and "specified criteria". I can write the questions they've written myself, and so can anyone familiar with the regulations, but what are these mysterious "criteria"? THAT's what we all want to know.
In my cursory review, I've found some questions that don't seem to relate to the regulations they specify. For instance, one question on §164.308(a)(7)(i), the Contingency Planning standard, is all about identifying preventive measures. That section of the regulation calls for a response to various disasters, but says absolutely nothing about preventing them. Preventive measures would be covered under other safeguards. Very disturbing.
And there is no way to simply download the entire table with all the cell contents showing so you can create your own tool or table and use their questions in a more accessible way.
But it is a great way to see just what kind of documentation you might be asked to produce. There is plenty of call for explanations and justifications for variations under addressable specifications, so it's clear that full documentation of your compliance decisions is necessary. It can certainly be overwhelming to look at the level of detail they're asking about.
Overall, on first review, what a let down, but we'll all have to work with it as best we can. It IS the protocol currently. At least it will be good for scaring the heck out of clients, CEOs, CFOs...
-- $1.7 million Settlement with Alaska Medicaid --
Lest you think the folks at HHS OCR have been too busy with audits and conferences to engage in good ol' enforcement, just take a look at the latest installment of OCR's fun game, "Let's go make HIPAA enforcement examples of every kind of entity there is!". A USB drive with PHI was stolen; investigation found inadequate policies and procedures, no risk analysis, incomplete security training, lack of device and media controls, not addressing encryption, and overall insufficient risk management measures. This time? A state Medicaid agency, and the press release ( http://www.hhs.gov/news/press/2012pres/06/20120626a.html ) makes it clear that state agencies are not exempt from HIPAA. The toll? A $1.7 million settlement, a corrective action plan, and monitoring. The message? There are no sacred cows in HIPAA compliance any more, not even up in Alaska. See the HHS OCR page on the settlement agreement at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/alaska-agreement.html
-- California Releases HIPAA Security Toolkit for Small Entities --
Well, I really don't know how I stand on this one. It's an online toolkit provided by the state of California that anyone can use for looking at their HIPAA security compliance, designed for physician offices and smaller entities. It consists of data collection and risk analysis portions. The questionnaire part I like a great deal and is a great way to dive into HIPAA compliance for a smaller organization.
Where I do have issues is with their interpretation of how to take the information collected and turn it into a risk analysis. Their approach is very much oriented toward assigning dollar values to various security events using Annual Loss Expectancy to come up with a way to decide about what actions to take based on financial terms. But much of information security doesn't work based on ALEs and other mathematical approaches -- too many of the risks are too unpredictable and changing too fast for the rigorous methods to be of real value. And I can't imagine a small office suffering through this process when there are less formal, easier to use methods that just plain work better.
Now, keep in mind that the questionnaire in the California toolkit is nowhere near as detailed as the one in the NIST HIPAA Security Rule Toolkit, and unlike the NIST toolkit it is designed to feed into a risk analysis, so a direct comparison between the two toolkits is difficult, but the questions are useful for making sure the issues are considered. However I think if this tool is used without guidance it could be very dangerous, because it can be too easy to say you have safeguards in place when in fact they may be insufficient. If you say you have safeguards, it won't show up as a risk issue in the risk analysis, but if the safeguards are actually insufficient based on a qualified review, the risk analysis is faulty.
So, appreciate it, use it with caution, and be prepared to run screaming from the Risk Analysis portion as though your hair were on fire. The user guide with complete instructions is available at https://www.ohii.ca.gov/securitytool/downloads/CalOHII_HSR_User_Guide.pdf and the toolkit is accessed at: https://www.ohii.ca.gov/securitytool/compliance/login.aspx
-- And in conclusion... --
I used to have to make up stories about HIPAA compliance issues and security issues and breaches and penalties, but no more. It seems there's another example of what not to do with PHI in the press every day. HHS OCR is doing all the explaining now and we'd best pay attention or be prepared to pay the price.
Jim
New HIPAA Rules at OMB, out by July; Breaches get expensive
Hello all,
Well, it seems like a long road, but the new final HIPAA rules with all the changes from HITECH except for the Accounting of Disclosures rules, and including the GINA changes, has finally been submitted to the Office of Management and Budget, the final step before release. Thanks to Ruth Carr, Sue Miller, and my friends on the American Health Lawyers Association list serv, I learned that the rules were noted as submitted to OMB on Saturday, March 24. The final process can take up to 90 days, so we should see a final rule by the end of June, and probably not earlier. I feel like I must be crazy to toss out yet another expected date for release of the final rule changes, but this is based on actual information, and not hopes and expectations. So, fasten your seat belts, and get ready to find out what's changed from the proposed and interim final rules and what's not. Will there be changes to the harm standard in Breach Notification? We'll know, finally, before the end of June. At least it won't be released for the 4th of July weekend. Bite my tongue!
In the meantime, breaches continue to be in the news, with a $1.5 million settlement with Blue Cross and Blue Shield of Tennessee, for having 57 hard drives full of customer service conversations disappear from one of their offices. Lesson 1: If you're going to keep it, physically secure it. Lesson 2: If it's got data on it and can be lost or stolen, encrypt it. Lesson 3: What the heck were they keeping these for anyway? Before you bother to keep it, make sure you need it, and if you don't, get rid of it securely! Beyond the settlement, this breach has cost BCBST more than $17 million. Nowadays they encrypt all data at rest, everywhere. See how easy it is to avoid breaches? Ow! For the article in Modern Healthcare see: http://www.modernhealthcare.com/article/20120313/NEWS/303139960/ The settlement agreement between BCBST and HHS is at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/resolution_agreement_and_cap.pdf
Some other poor company that reviews medical records had one of their offices burglarized last New Year's Eve, and the resulting costs of the breach have pushed them into bankruptcy. See: http://blogs.wsj.com/bankruptcy/2012/03/12/burglary-triggers-medical-records-firm’s-collapse/ And in case you haven't gotten the idea that breaches can be expensive, the American National Standards Institute (ANSI) has released a new report: The Financial Impact of Breached Protected Health Information -- A Business Case for Enhanced PHI Security, available at no charge with registration at: http://webstore.ansi.org/phi/ Forewarned is forearmed!
My five steps to avoid breaches and their costs:
1. Do your information flow analysis and risk analysis so you know where all your data are, and get rid of what you don't need
2. Encrypt all data at rest that can be stolen (especially laptops, memory sticks, etc.) -- encrypted data can't be breached
3. Have good policies, procedures, and processes for managing the encryption and its keys -- know how and when to encrypt
4. Train staff on how to securely handle all data, including technical and physical measures -- don't keep the password attached to the device!
5. Have an incident handling policy and procedure so you know what to do when something DOES go wrong, and have regular drills to test it
I have a ton of seminars and webinars coming up over the next few weeks, including a two-day all-about-HIPAA-privacy-and-security session at the Marriott Long Wharf in Boston May 17-18, so take a look at the list and see if one has the focus you're looking for. See: http://www.lewiscreeksystems.com/upcoming_public_seminars.html
As always, please let me know if you have any questions -- I'm always happy to help.
Jim
CMS Proposed Meaningful Use Stage 2 Regs: Increased Security
Hi All,
First of all, for all the expected dates for final regulations I gave you in my last missive, add 90-120 days. The HHS calendar is already out of date, as items expected for release shortly have not even made it to OMB for final review, which can take a few months. So, breathe deeply, and relax -- stay the course and keep moving toward what will likely be required in the regulations. Eventually they'll see the light of day.
Well, even if we don't have finalize HIPAA changes from HHS, we do have new proposed Stage 2 Meaningful Use regulations, and those beef up the security requirements by specifically bringing attention to the encryption of data at rest and the use of secure messaging with patients by eligible professionals (EPs) but, curiously, not by hospitals and Critical Access Hospitals (CAHs).
In 42 CFR §495.6(j)(16) (for EPs) and (l)(15) (for hospitals and CAHs) the existing Stage 1 measures calling for a HIPAA Security Rule risk analysis would have added to them a new phrase, "including addressing the encryption/security of data at rest in accordance with requirements under 45 CFR 164.312 (a)(2)(iv) and 45 CFR 164.306(d)(3)" which means you really have to seriously look at encrypting portable devices holding data at rest. The preamble specifically calls out the issue of breaches of data held on portable devices as the reason for the change. It doesn't really change what you should be doing anyway, but does put some teeth into the notion that it's really time to lock down portable data.
In 42 CFR §495.6(j)(17) a new objective for eligible professionals is to use secure electronic messaging with at least 10% of patients. Again, the preamble points out the necessity of security, here to get the trust of patients and get them involved in better communication with their providers. But I'm a little puzzled as to why a requirement like this wasn't also put in for hospitals and CAHs, because they communicate with patients too, you know. The mysteries of the regulatory process...
So what does all this mean? Nothing much has changed, except that the emphasis on securing data at rest and in transit is growing, which shouldn't be a surprise to anyone -- they're only proposing regulations to deal with the clear problems revealed by breach notification.
The proposed regulation is at http://www.ofr.gov/OFRUpload/OFRData/2012-04443_PI.pdf for now, and will be published in the Federal Register shortly. The CMS fact sheet page is at: https://www.cms.gov/apps/media/press/factsheet.asp?Counter=4286&intNumPerPage=10&checkDate=&checkKey=&srchType=1&numDays=3500&srchOpt=0&srchData=&keywordType=All&chkNewsType=6&intPage=&showAll=&pYear=&year=&desc=&cboOrder=date (or http://tinyurl.com/6rvrjex ). I have extracted the relevant language from the NPRM and posted it here: http://www.lewiscreeksystems.com/proposed_mu_stage_2_regs.pdf
Enjoy!
Jim
New HIPAA Rule Release Dates and Enforcement Budgets -- On Your Marks, Get Set...
Hello all,
It seems the crystal ball is clearing a bit...
HHS work plans and budgeting have been announced for the coming year, and here how things shake out, with some surprises, of course!
According to the work plan released January 20, 2012 (see http://www.regulations.gov/#!documentDetail;D=HHS-ASAM-2012-0002-0001), the Big HIPAA Update looks to be on track for release in March, and it includes finalization of the proposed privacy and security rule changes (business associates, disclosure restrictions, access, etc.), and finalization of the interim final enforcement and breach notification rules. It also includes the finalization of changes to HIPAA regarding CLIA (the Clinical Laboratory Information Act), which could have a significant impact on laboratory operations depending on the extent to which individuals would interact directly with labs.
Most of what's in this package should be pretty close to what's been proposed, but there may be some changes to the harm standard in the Brach Notification Rule. As a security purist, I'd say that the harm standard has to go, but as a healthcare information realist, I know that there needs to be something like the harm standard to temper breach notification, because the potential for needless notification of harmless releases under the HIPAA definitions is huge. We'll see what we get.
Probably the biggest surprise is that the expected date for release of final rules for the new Accounting of Disclosures is set to June of this year. This rule has potentially very significant impact on healthcare information operations, to say the least. I wasn't expecting to see a final rule on this until late 2012 at the earliest, based on past performance in the release of final rules. Well, heck, what with all the free time IT and HIM departments will have now that ICD-10 is being pushed back, there should be no problem implementing this, right? (Or, "no probs" as my daughters would say.) Well, at least we have until June to find out how the final rule will differ from the proposed one, which certainly generated its share of controversy. I do hope the implementation timelines are more realistic than those proposed.
The other interesting tidbit is that in the proposed 2013 White House budgets, enforcement of HIPAA has been specifically targeted for spending even though the budget for the Office for Civil Rights at HHS (the enforcers) is down about 5% through improvements in process and cost savings. The HHS Budget-in-brief is available at http://www.hhs.gov/budget/budget-brief-fy2013.pdf . It's kind of funny (but not in a ha-ha kind of way) that there is plenty of mention of the importance of enforcing the rules alongside a budget cut. But I think audits and enforcement are certainly here to stay.
So, stay tuned -- we should have some real regulations to dissect in weeks now. (How many times have I said that? Will I become the HIPAA guy who cried wolf too many times?)
In other news, NIST has released a new draft update of their Security Incident Handling Guide (SP 800-61 Rev 2), available at: http://csrc.nist.gov/publications/drafts/800-61-rev2/draft-sp800-61rev2.pdf . Hint: HHS lists lack of incident handling processes as one of its Top 5 security issues. Hint: Questions asked of entities in HIPAA security audits always include requests to see incident policies, procedures, and reports. Hint: Audits are on the increase. Hint: If you don't have a good incident handling process, now is the time to start, and this guide is a great way to start. Get the hint?
Please let me know if you have questions -- I'm always happy to help.
Jim