Lewis Creek Systems, LLC

I think I’m gaining — it was more than a year between the last two newsletters, and it’s not much more than nine months now since the last one!  But there is plenty to talk about, no question, including recent enforcement activity, which reflects on one of my pet issues, management of access to external Web sites, and the pace of enforcement actions, which had slowed to a trickle until the recent spate of announcements.  And state Attorneys General are now getting into the HIPAA enforcement game as well.  By the way, did you hear the announcement about the changes to the HIPAA Audit Protocol?  Me neither, but they were made last July.  Also on the agenda is a look at what to expect for changes in the rules.  Will we ever see a new proposed rule for Accounting of Disclosures now that we’re 10 (yes, ten) years out from the passage of the HITECH Act requiring a change?  Will there be changes in the Security Rule for improving the ability to audit and review access and use of data?  Will we dump the acknowledgment signature for the Notice of Privacy Practices?  And how are we going to solve this shameful situation where it is so difficult for patients to access their information and have it shared with any provider they so choose, without friction?  To finish things off, I’m sure we’d all appreciate a quick list of topics to put on your HIPAA list for review, so I’ll try to create that for you.

— “So, what should I DO?” — 

I’m really good at pointing out compliance issues that should be addressed somehow, but the client’s answer is often, “So, what should I DO?  Out of all the issues that are out there, what needs to be focused on first, and what kind of things can I do to address those issues?”  Well, thanks to the Cybersecurity Act of 2015 section 405d, we now have a good advisory document set to provide some distillation of the steps that need most to be taken to meet the numerous rules and standards in information security today.  As you know, I am a big fan of Risk Analysis, but this approach is assumes there are certain universal risks that need to be addressed, and provides actions that can be taken to reduce them.  On December 28, 2018 the Department of Health and Human Services released a guide to voluntary cybersecurity practices for healthcare organizations ranging in size from local clinics to large hospital systems — three sets of practices are provided, for small, medium, and large organizations.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients is a four-volume publication, the result of a two-year public-private partnership between HHS and more than 150 healthcare industry professionals.  The guidance is a mixture of highly technical solutions and common sense practices applicable to a wide range of healthcare facilities. The core of the document explores the five most relevant threats to the healthcare industry and recommends ten cybersecurity practices to mitigate them.  While this may be old news to mature, larger IT organizations, for smaller organizations it provides a useful way to explain the issues and show what needs to be done, to senior managers who may not have a lot of information security expertise at their disposal.  

Note that this does not replace a risk analysis, it supplements it, but if the considerations in the report are addressed, it can make the Risk Analysis a lot less traumatic.  I think it’s definitely worth it for those in charge of privacy and security to spend some time absorbing and addressing the issues included, as a defined project, not just a casual activity.  See:  https://www.phe.gov/Preparedness/planning/405d/Pages/hic-practices.aspx  

— HIPAA Enforcement Pace Increases — 

For a while it seemed that HIPAA enforcement was stalled, with few settlements being announced following the change in the administration a few years ago.  But things picked up considerably at the end of 2018, with four actions being announced, a record $16 million settlement for a breach of 79 million records, a $125K settlement for doctor going public with patient information to refute a claim made publicly by a patient, a $500K settlement for sharing information with a fraudulent business associate (with no BA agreement) who breached the information, and a $111.4K settlement for failing to terminate the access of a former employee to the organization’s scheduling calendar hosted by Google without a Business Associate Agreement.

While the Anthem settlement for $16 million sounds like a lot, we’re taking about 20 cents a record for the breached information.  Sounds pretty limp to me, but it does almost triple the previously high settlement amount.  As for going public with patient information, we now have three settlements with head honchos who couldn’t help themselves, who, in the most recent case, ignored the advice of their own compliance people (what do you pay them for then, eh?), and went public with a patient’s information, in two cases as a response to public statements by the patients.  Let’s make this clear, shall we?  Even if the patient hands out copies of their entire medical record to everyone in the street, the doctor still has to have a HIPAA Authorization from the patient to discuss their information in public.  

In the case of the fraudulent Business Associate, make sure someone you are dealing with is actually a representative of the company they claim to represent, and if they’re acting as a BA, get the BA Agreement in place!  You need to do research on the BA commensurate with the risk involved.  But the most recent enforcement settlement case really caught me by surprise.  As many of my clients know, I have a thing these days about staff access to external Web sites managed by other entities.  It’s easy to have well-controlled access to your own systems and networks, where when someone leaves, you have a process to throw the switch and cut off access.  But it’s less easy to deal with all the access to outside Web sites, which has really blossomed these days with the proliferation of electronic systems for all kinds of communications and transactions.  (And you may have inbound remote access of your own to protect.)

Do you know who has access to external sites that involve Protected Health Information and how to make sure your responsibilities are taken care of upon departure of the staff?  Do you know what your responsibilities are?  Yes, those external resources are responsible for their own security, but there could certainly be seen to be an ethical responsibility, if not contractual, to notify them if a user is no longer on your staff.  If that access might allow access to your own patients’ information, it may certainly be seen as your responsibility.  This settlement involved a former employee’s access to the organization’s calendar, which happened to be hosted improperly under the regulations (no BAA).  If you don’t have a defined process for tracking who has access to what and making sure that access is terminated when the employee is, you are leaving yourself open to a growing risk issue.  The time to deal with it is now.

Let me give you a quick example that may make your ears ring, about unterminated remote access into an organization.  A client of mine recently hired a new CFO who used to work at another facility some years ago.  While at the prior facility, the person needed to get remote access into some system or other, and at the time the organization did not have a defined remote access process, and the IT staff set up a special access method allowing the access that was needed.  As time passed, the IT staff and management turned over, and the individual needing the access moved on to another organization and eventually became the CFO I know today.  Based on the CFO’s awareness of the issue of remote access left open, the CFO checked, and yes, the CFO still has access to systems and networks at an organization they no longer work for, and haven’t for many years.  In fact, the recently-hired current IT staff at the old organization either isn’t aware of the access allowed, or is aware of it but is afraid to turn it off because they don’t know what it does and don’t want to break any existing processes.  Because the old access was never properly established and managed according to a documented process, it has been forgotten over time and now exists as a back door into systems that IT doesn’t know about, and that could potentially be discovered by hackers, depending on the security of the access, which is completely unknown by the IT staff.  The easiest fix is probably to rip everything out and start from scratch for networks and access.  Wouldn’t it have been easier to know who has access and how, and manage the access before it becomes a liability?

And even as HHS slowed its enforcement for a while, state attorneys general have been busy picking up the slack, with New Jersey hitting the headlines most recently in November with a $200K penalty and ban from ever working in New Jersey again for a transcription company that didn’t protect information properly, on top of a $414K penalty last April for the medical group that hired them.  New York had a $575K settlement last March for a health information breach exposing social over 80,000 social security numbers.  Clearly, even if HHS disappears form the scene, the state AGs are prepared to carry on in enforcement using HIPAA as the standard.

— Update to the HIPAA Audit Protocol — 

Did you see the announcement last July about the updated HIPAA Audit Protocol?  Me neither, because it wasn’t made, and HHS still hasn’t released an announcement or an overview of what’s different in the protocol.  So, here’s the scoop: there are a dozen questions changed, numbers 4, 58, 163, 164, 165, 170, 172, 173, 174, 175, 177, and 178, which translates to a few in the privacy realm and several in the breach notification section, updating the questions based on the experience gained in the 2016 Audit round.  There are no changes to the Security Rule questions.  This is all very nice, but in re-publishing the HIPAA Audit Protocol, they put it up on the Web site in such a way that copying it into some actually usable tool like a spreadsheet or database is a royal pain and takes a day of work to fix once you copy and paste.  This is same the problem the original 2016 protocol had, that was finally fixed after many months, and is now broken again, oh thanks.  

But, lucky you!  I have updated my spreadsheet copy with the changes, discovered by laboriously examining every one of the 180 questions for changes, since a direct comparison isn’t possible because of the insane formatting.  If you’d like to see the HHS HIPAA Audit Protocol, it’s still at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html and if you want an updated spreadsheet copy with the changes, please send me a message and I’ll be happy to send you one.  (See? This is the test to see if you’ve read this far — of course you want a copy!)  Please be aware that because of limitations in Excel, and the size of some entries, it may require double-clicking on a cell and/or reducing the font size to see or print the cell contents fully.  Make sure you look at ALL the details of each question.

— New Accounting of Disclosures Rule Coming — 

So, for you old-timers in HIPAA, we’re coming up on the 10th anniversary of the HITECH Act amending HIPAA, which might be nice, except that HHS still hasn’t come up with a decent plan for the required new rule for Accounting of Disclosures that the HITECH Act calls for.  The law requires some substantial changes, and HHS’s initial proposal was met with derision and laughter, as it went way beyond the requirements of the law and the capability of technology to reasonably support the proposed rule.  In short, no, it couldn’t possibly work, and was finally formally withdrawn earlier this year.  But the law still exists, and with it the obligation to make Accounting of Disclosures actually relevant to patients.  I mean, has anyone ever actually asked your organization for an Accounting of Disclosures, and would you even know what to do if they did?

So the development of the new rule is under way, with HHS asking for initial comments in a December 12 announcement of the Request For Information.  Based on the recommendations developed some years ago there are likely also to be changes recommended for the Security Rule to improve the ability to audit and review access and use of data, in support of the new Accounting rule.  (You can’t account for what you don’t know!)  That will make the first substantive change to the Security Rule since it was adopted, not counting the expansion of coverage to Business Associates, and probably about time.  When the government reopens, the RFI will be available at: https://www.federalregister.gov/public-inspection/ — comments are due by February 11, but who knows if the government will be open by then.

— Changes to Signature Requirement for the NPP? — 

Will we dump the acknowledgment signature for the Notice of Privacy Practices?   Really, that’s the best we can do for finding ways to reduce the administrative burden of HIPAA?  Well, that’s the idea, but it’s not all that simple, since the signature for the NPP counts as a signature for consent under the Telephone Consumer Protection Act of 1991 to contact someone using their cell phone, which is how just about everyone communicates these days.  If you don’t have documented consent under TCPA, you can’t call or text someone’s cell phone for payment purposes AT ALL, and there are also limitations on uses for healthcare operations, like appointment reminders.  A judge ruled about a year ago that signing the NPP that says how your contact information may be used counts as a TCPA consent.  If that signature goes away, you’ll have to get a signature instead for TCPA consent, resulting in zero reduction in administrative burden and an expense of changing processes.  There is also some consideration of changing the TCPA rules to allow contact for treatment, payment, and healthcare operations as defined by HIPAA without consent, but unless that happens if and when the HIPAA rules are changed, there will be a net negative effect.  This is also an area ripe for comments on the RFI, if we can ever get a copy and submit the comments.

— 2019 is The Year of Sharing Health Information — 

Well, I’m calling it that anyway.  So, how are we going to solve this shameful situation where it is so difficult for patients to access their information and have it shared with any provider they so choose, without friction?  HIPAA is NOT the issue; misinterpretation of HIPAA is often the issue.  Doctor’s offices have always been shy about sharing their intellectual capital, their medical records, and their patients with other doctors.  Of course a doctor wants to keep his patients!  But now simple reluctance has turned into outright blocking of information transfers to protect an office’s business, contrary to HIPAA.  In so many of these cases, HIPAA is used as an excuse for not sharing information with other providers, when the rule explicitly allows such sharing.  MAKE SURE you are sharing information as requested by your patients, and as required by HIPAA.  If your organization is resisting this, fix it!  If you are dealing with another organization that won’t share what they should, it’s time to start making noise, with the organization’s leadership, with HHS, and with the Press (though be sure not to include any patient identifiable information in Press communications).  When you complain publicly, patients will start asking questions and putting pressure on their doctors to do the right thing.  We need to shake up the entire industry to make this happen, and we all need to step up for our patients’ and the nation’s health.

— Your 2019 HIPAA To-Do List — 

1. Review/update/establish your external Web site and remote access management processes

2. Check your termination processes and make sure they work

3. Review your access and use of systems and data

4. Update your Risk Analysis

5. Plan out your Risk Management Activities

6. Be ready to respond if there is a change in the rules

And please let me know if you have any questions.  

Thanks!

Jim

I know, those of you who know me are surprised to see another newsletter so soon after my last one, but there is just so much going on!  New lessons are being taught in HIPAA enforcement settlements, the changes to 42 CFR Part 2 (pertaining to substance abuse treatment information) have just been finalized this week, and there are HIPAA impacts resulting from the 21st Century Cures Act as well as the impending repeal or defunding of the Affordable Care Act.  On top of all that, I’ve begun offering free short PowerPoint show-based security reminders you can download and use with your staff.  The first one is posted with more to come over the coming year.

 — What’s in the HIPAA News?  — 

Looks like the trickle of HIPAA Settlements is becoming a wave — two new settlements for potential HIPAA violations were announced in just the last two weeks.  The lessons?  Report your breaches on time ($475K + action plan https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/presence).  Implement your safeguards, such as risk analysis, encryption of portable devices, and follow through with whatever you have promised OCR you’d do following a breach ($2.2 million + action plan https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/MAPFRE). 

Also new is updated guidance and FAQs from HHS on disclosures to loved ones.  I don’t think this is the anticipated new guidance on sharing information with family and friends involved with an individual’s care, but it contributes to knowledge in that realm.  OCR’s updated guidance and FAQ may be found at:  https://www.hhs.gov/hipaa/for-professionals/special-topics/same-sex-marriage/index.html and the FAQ is also available at https://www.hhs.gov/hipaa/for-professionals/faq/2086/does-hipaa-privacy-rule-permit-doctor-discuss-patient-s-health-status.html  I still have hope the more complete guidance is on the way, because this is an area of some sensitivity for patients.

One of the more useful and relevant guides released by NIST is the new Special Publication 800-184, which is an excellent overall Guide for Cybersecurity Event Recovery that now incorporates incident handling and contingency planning.  The press release (at https://www.nist.gov/news-events/news/2016/12/nist-guide-provides-way-tackle-cybersecurity-incidents-recovery-plan) provides a good overview, and the Guide is available at:  http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-184.pdf  

From the press release: "The publication supplies tactical and strategic guidance for developing, testing and improving recovery plans, and calls for organizations to create a specific playbook for each possible cybersecurity incident. The guide provides examples of playbooks to handle data breaches and ransomware.”  This approach supports my view that developing and working through drills on various scenarios is one of the best ways to be prepared for a nasty security event. 

And what’s this?  Yet another security framework from our friends at NIST?  The new Draft 1.1 of the NIST Cybersecurity Framework is out (https://www.nist.gov/cyberframework/draft-version-11), and while it is indeed useful, I echo the sentiments of security expert Stephen Northcutt as he commented in the SANS NewsBites newsletter of January 13 (https://www.sans.org/newsletters/newsbites/xix/4), “In one sense, another framework makes me want to puke. However this organized security framework is the path to better risk management. Why NIST could not read and use the critical security controls is beyond my understanding.”  [sigh]  Yes, it is useful, at least as far as some of the simple rubrics contained within are concerned (Identify, Protect, Detect, Respond, and Recover) but again, I feel this kind of work should be coming from government-funded university research (at least partly because so many computer science programs barely acknowledge security and need this kind of a boost) not NIST.  This framework comes from a clean sheet and doesn’t consider other valuable, established processes much, so it’s just a bit annoying.  Please, no more new frameworks.

 — Final Changes to 42 CFR Part 2 — 

If you don’t know what 42 CFR Part 2 is, you probably don’t care much about this, but in the world of mental health and substance abuse treatment, this is news.  Basically, 42 CFR Part 2 puts limitations on the sharing of information related to drug abuse treatment.  Each disclosure requires a consent, and information cannot be re-disclosed by a recipient without another consent.  It’s burdensome, especially in the new world of information sharing and coordinated treatment among providers.  

The new final changes to 42 CFR Part 2 (https://www.federalregister.gov/documents/2017/01/18/2017-00719/confidentiality-of-substance-use-disorder-patient-records), among other things, allow release of information to a qualified researcher, but more importantly, allow a patient to consent to disclosing their information using a general designation (such as “my healthcare providers”), to allow patients to benefit from integrated health care systems.  Patients do not have to agree to such disclosures, but patients who do agree to the general disclosure designation have the option to request a list of entities to whom their information has been disclosed.  A nice summary is in the press release, at https://www.samhsa.gov/newsroom/press-announcements/201701131200

 — Hot Off the Presses: Common Rule Update Finalized — 

And if you’re into research, it’s time to look into the finalized Common Rule revisions, also just out this week.  So many new intersections between HIPAA, 42 CFR Part 2, and research!  Those of you who do research with health information relating to substance abuse have some homework to do.  You have a little time, until 2018, to implement the new rule.  See https://www.federalregister.gov/documents/2017/01/19/2017-01058/federal-policy-for-protection-of-human-subjects 

 — HIPAA implications of 21st Century Cures Act — 

While the 21st Century Cures Act doesn’t directly affect HIPAA, it calls for a lot that is related to HIPAA.  On December 8, 2016, AHIMA published an informative guide to the Health IT and HIM related sections.  There are numerous sections pertinent to those in HIPAA compliance, and this overview guide from AHIMA is easy to use and understand.  In fact, many of the things called for relating to HIPAA, such as guidance on sharing information with family, friends, and others involved with an individual’s care, are already in the works at HHS Office for Civil Rights, but the legislation provides a solid foundation for these activities.  The law also reinforces patient access rights, and touches on issues relating to research, mental health, and 42 CFR Part 2.  This legislation has non-trivial, wide ranging impacts on HIPAA.  See the AHIMA guide at:  http://bok.ahima.org/doc?oid=302012  

 — HIPAA implications of ACA Repeal or Defunding — 

As I mentioned in my last newsletter, if the ACA is repealed, there could be huge demand from patients to exercise their right to not tell the insurance company about an encounter if they pay out of pocket.  Now that may be fueled by more than just fears of having your insurance cancelled or your rates quadrupled.  Certain ethnic minorities that may be being targeted by the new Administration will also want to stay out of as many databases as possible.

It seems likely at the moment that ACA will die through de-funding, not outright repeal, but who knows?  What a mess.  Be ready to deal with it.  And write your senators and congressmen if you don’t want to see healthcare denied to a significant portion of the population through lack of insurance — maybe even you!

 — Free Training Reminder PPT on E-mail, Texting, and Mobile Device Hazards — 

I have begun offering a new series of training products, available on my Web site.  First up is a free, nine minute Powerpoint show with audio, on the topic of E-mail, Texting, and Mobile Device Hazards, which you may download and use as a security reminder for your staff.  Over the coming year, I’ll be adding more free reminders, as well as a suite of 90-minute training sessions available for a fee.  Also, I find an increasing number of my clients ask me to prepare a pre-recorded staff training session that is specific to their organization and their policies, which is, after all, the right way to do it.  See what’s up at http://www.lewiscreeksystems.com/hipaa-training-products.html 

As for live training sessions coming up:

SFO can be nice in February, maybe a 1.5 day Privacy Rule session February 23 and 24 would be good — see: http://www.complianceonline.com/hipaa-privacy-rule-compliance-new-rules-and-responsibilities-of-privacy-officer-seminar-training-80142SEM-prdsm  

Washington, DC can be lovely at the end of March, nice enough on March 23 and 24 for a 2-day A to Z session — see: http://www.globalcompliancepanel.com/control/globalseminars/~product_id=900754SEMINAR?HIPAA-privacy-security-compliance-Washington-DC  

And I have other live Webinars scheduled well into 2017 already, so be sure to check my upcoming public seminars page, at: http://www.lewiscreeksystems.com/upcoming_public_seminars.html 

 — Go Forth and Be HIPAA! — 

Please enjoy your winter — it’s been strange here in Vermont so far — ticks in January??  And please let me know if you have any questions.

Thanks!

Jim

Welcome to my first newsletter in more than ten months.  I dare say things have been busy in the world of healthcare information privacy and security regulatory compliance.  Everyone is a bit scared that they’re already in trouble and don’t even know it.  If the introduction of mobile technologies hasn’t created privacy and security issues enough, now the bad guys have finally woken up to the most poorly held secret in healthcare information privacy and security: if you want to steal someone’s identity to commit fraud, healthcare information is pure gold.  

And of course that information is often used to commit health insurance fraud, which can affect the integrity of the patient’s record and present serious safety issues.  On top of that, the complexity of health information handling and processing makes securing it nearly impossible.  It’s just not getting any easier anytime soon.  That’s why we love this work, right?

I’ll cover a few hot topics for you, and then get into some compliance questions and answers that I have received and provided over the last several months.  Some of the best questions come from people who listen to a Webinar or seminar and have a particular wrinkle for which the answer is not immediately obvious.  I can learn a lot from a new question, and many of you may have similar circumstances, so I’ll share a few in these newsletters.  Not surprisingly, a lot of them have to do with communications, and with mobile devices and all the creative ways people use them, and their risks.

 — HIPAA Changes — 

 ••• As part of the executive branch implementation of federal gun control measures, on January 6, 2016, a new final rule was published to modify HIPAA §164.512, adding a new section (k)(7) to allow use or disclosure of PHI for purposes of reporting to the National Instant Criminal Background Check System the identity of an individual who is prohibited from possessing a firearm.  The impact of this rule is limited to certain organizations, “only covered entities with lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes.”  

In other words, this is for the most part focused on government entities such as county courts, for instance.  Disclosures may include only the limited demographic and certain other information needed for purposes of reporting to the NICS, and may not include diagnostic or clinical information.  The new rule is available at:  https://www.federalregister.gov/articles/2016/01/06/2015-33181/health-insurance-portability-and-accountability-act-hipaa-privacy-rule-and-the-national-instant   

 ••• Speaking of changes, HHS has updated its Web site and it is much easier to use, much easier to find things on, more mobile-friendly, a huge improvement.  But.  In the process they’ve broken a lot of the links that led to many, many guidance documents and resources.  I have looked through my links on the Resources pages of www.lewiscreeksystems.com and fixed dozens, and I keep checking them in my presentation and handouts, so I think I have them pretty well nailed down on my end, but if you find any faulty ones, please let me know.  If you have older materials with now-broken links, you can find the new ones on my resources pages at http://www.lewiscreeksystems.com/resources.html or you can try fixing it by inserting "/sites/default/files" right after "hhs.gov", which works most of the time.

 — HIPAA Guidance — 

 ••• If you’re looking for guidance (and couldn't we ALL stand a little guidance these days?), one link that sure does work, and ain’t it grand, is for the new guidance from the HHS Office for Civil Rights on individuals’ rights to access their health information. The guidance includes general information and specifics about the details of proper implementation, and also includes an extensive Q&A section providing additional information.  If this guidance is an indication of the quality of information we should expect from HHS on the Web, it’s a good sign.  

The guidance is clear, well written, and well organized, and directly addresses one of the issues that has been consistently identified as a weakness in HIPAA compliance: patient access of records.  The regulation is presented in detail and the Q&A section addresses many of the questions I have gotten from all of you.  Providing access properly, and handling denials of access properly, have been identified by HHS enforcement leadership as an area where it is time for there to be better compliance, so we can expect to see this as a target issue in the upcoming round of HIPAA audits, expected “real soon now."

If you have questions on providing access under HIPAA, look here first.  http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html  If you don’t have questions, look it over anyway, and you may learn an important detail relevant to you.  Are you prepared to handle denials of access properly?  Make that your HIPAA compliance task of the week, and document it to show your consideration of compliance.  See?  Wasn’t that easy?

 ••• A little trickier is the work needed if you want to actually de-identify data for one purpose or another.  The question is often, “what if I de-identify the data?”  Well, what does that mean?  Sure you can remove all 18 identifiers listed in the regulation, but context still remains, and context can reveal a lot about the identity associated with a piece of data.  While the ultimate answer is far from always clear, NIST has announced a report on De-Identification of Personal Information, NIST Internal Report 8053.  

The report summarizes two decades of de-identification research, discusses current practices, and presents opportunities for future research, including discussion of HIPAA methods for de-identification, and the effectiveness of the HIPAA Safe Harbor method.  The report is available at http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf  If you are dealing with any issues of de-identifying PHI, READ THIS REPORT!  Also, see HHS’s guidance from 2012 on De-identification of PHI, available at:  http://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/De-identification/hhs_deid_guidance.pdf  (And yes, I fixed that link.)

 ••• If you’re thinking about how your mobile device connects to your cloud-based EHR (and let’s face it, isn’t just EVERYbody these days?) best to take a look at the first industry specific special publication in draft from NIST in SP 1800-1, focusing on the use of mobile devices in health care.  The idea is, use multiple layers of security in controlling access (a.k.a. strong authentication), and ask your EHR vendor some hard questions — a good questionnaire is included in part “e” of the guidance.  With the alarming increase in the number of breaches by hacking, caution is indicated.   https://nccoe.nist.gov/projects/use_cases/health_it/ehr_on_mobile_devices

 — Q&A — 

Here is a question I get frequently in one variation or another, and my reply, regarding texting with patients.

Question: Are offices allowing their clinical and/or front desk staff to text with patients? We want to allow our providers to text for scheduling and location purposes. All of our patients are homeless or recently rehoused and sometimes they go off the radar. They tell our providers, nurses, case managers over and over again "Just text me - I ran out of minutes." So they are asking for this form of communication.  We're a small practice and want to make sure we aren't doing anything "crazy" if we start allowing texting.

Answer: The short answer is yes you can use texting, but you need to be prepared to handle it properly as a communication medium.  That is, you need to be sure you document any text exchanges that could be considered part of the record, just as you would any communication.  And you need to be ready to deal with people wanting to text 24/7, and the proper handling of those.

The idea is, the Security Rule requires you to consider encryption of all transmissions, but doesn’t outright require encryption.  When you do the risk analysis, you see that you really should encrypt all communications like e-mail and texting that contain any PHI, because the information is not secured and could be exposed, and that would be a breach.  For business communications involving PHI, yes, encryption is basically necessary.

But when it comes to communication with patients/clients, they have certain rights under the Privacy Rule to communicate in the way they see fit so long as you can reasonably do that.  The guidance says, if they want to use insecure e-mail (and by extension, texting), let them know that it is not a secure communication and it could be exposed, and if they want to go ahead, you can.  It’s a good idea to document their consent to use an insecure method, either through having a good process, or getting a signature, or both.

And that gets us back to the issue I mentioned at the top, that you need to be prepared to handle it properly.  Always have a secure, documented method of communication you can start from, and then allow insecure ones as necessary to provide services, with consent.  If it’s more than you feel you can handle, you don’t need to do it.  But if you want to, you can; just explain the risks and get a consent to do so, and document your exchanges.

———— 

Here is a question on texting of reminders of appointments, which is a growing practice.

Question: We [a dental office] periodically text appointment reminders to our patients using a web based text system. We do NOT include their names in the text, just the day and time of their appointment. Is this OK? If we were to move to texting phi in the future, how do we do this securely?

Answer: This is one of those gray areas.  The phone number can be an identifier, so it depends on the detail in the reminder.  If you don’t explicitly identify the organization, but use its initials, you’d be better off than if you used the entity name, which could provide some information about the kind of services being provided.  Of course, a dental appointment is not the same as an appointment for cancer treatment or reproductive health, so the actual risk of a real issue is small [for a dental office].

Nonetheless, I would also secure consent from the individuals to send reminders by text message, advising them of the insecurity of text messages.  Even if you have consent, keep the content to a minimum and as de-identified as you can.  [The most secure reminders do not identify the office or the nature of the appointment, they come from a reminder company and only say for what time the appointment is scheduled.]  The consent doesn’t need to be terribly complicated, but should be documented somehow. 

Also, take a moment to document your accepted practices for this, so you can help prevent the use of texting for other purposes that you haven’t protected.

———— 

And finally, a question on Business Associates and Risk Analysis.

Question: My concern is getting business associates to comply with doing a risk analysis.  How have you seen other CE’s do this? Also, if there is a breach by a business associate, would HHS hold the CE or the business associate accountable? Or both?

Answer: CE’s are beginning with making sure they have the right kind of a BAA in place first, and that calls for the BA to be in compliance with the HIPAA rules, including the Security Rule, which requires a risk analysis.  You need to feel sure that the BA is in compliance, which ties into your second question.  If you feel you have assurances that the BA is in compliance (which begins with the BAA, but doesn’t necessarily end there), chances are that any breach will be their responsibility.  But if you don’t have sufficient assurances that they’re meeting the requirements in their BAA, you could also be held liable for breaches — the new rule doesn’t let you off the hook entirely.

This is a very difficult situation, as there are many BA relationships in which the BA does not realize what they’re signing when they sign a BAA with the CE.

While the entirety of the security rule applies, the place to begin is for them to do a risk analysis and make sure they have breach notification policies and procedures.  I suggest you let them know that they need to follow the rules according to the regulations and the BAA, and that they have a period of time (60-90 days) within which to provide you some kind of documentation that they have actually done something to be in compliance with the rules.  You’d like to see a summary of their risk analysis report or the table of contents to their HIPAA policies, things like that.

This will take time, but it is being tackled, slowly, by the industry.  [You can also ask to see a third-party evaluation such as an SSAE 16 SOC Type 1 or 2 Report, or submit a questionnaire similar to that presented by NIST in their draft guidance in SP 1800-1 part e, available at: https://nccoe.nist.gov/projects/use_cases/health_it/ehr_on_mobile_devices ]

I wish it was easier, but with the high profile breaches these days on the increase in health care, these are good things to do.

————

I have a lot more questions I can answer, but this is a start, and I hope to get to the next newsletter in something less than ten months so I’ll save some.  I also hope to get the next one out using a modern newsletter management platform, so expect to see a different look and feel, but the same attitude inside.

This is a time of change in HIPAA and a change in the privacy and security landscape the likes of which we’re not likely to fully comprehend for some time.  It’s a good time to keep your eyes open and look for ways to protect privacy and security before you discover you haven’t.

I don’t want to turn this into a promotional newsletter, but my mission is to make HIPAA easier for the world, so I have to mention that I have several Webinars and seminars scheduled around the country coming up — check in at http://www.lewiscreeksystems.com/upcoming_public_seminars.html  And I’m working on a book on the "10 Day HIPAA Compliance Plan," for which I have been asked by many, and which I hope to have completed in the next few months.  Would it be of interest to you?  Something to answer the question, “Yeah Jim, but where do I start and what do I actually do?”  Would you prefer a hard copy or electronic or both?

And of course, if you have any questions for me in the meantime, I always learn as much from you as you do from me, so please let me know.

Thanks.

Jim

 — Encrypting Medical Records Sent On Electronic Media — 

One of the most frequent questions I hear these days involves sending out medical records that used to go out in the mail on hard copy, but now go on electronic media, such as flash drives or CDs.  In the old days you’d just put the records in the envelope and hope for the best.  If you can do that, why would you need to encrypt electronic media?  It wouldn’t be any less secure than the paper.  But the Security Rule most certainly includes provisions about encryption of electronic PHI, so what should you do?

There is not a strict requirement to encrypt anything, but there are requirements to consider encryption of any PHI at rest and in motion.  One of the most common ways for PHI breaches to occur involves records that are sent and are misdirected or the packaging becomes compromised.  There isn't much you can do with hard copy records other than check addresses and use strong packaging, but a risk assessment of electronic PHI would probably indicate that encrypting records sent on a CD or other electronic medium is a very good idea, because it eliminates the most common cause of breaches, which can be expensive to respond to and lead to enforcement investigations.

In fact, organizations that haven’t adequately considered encryption of data at rest on portable media wind up with some of the biggest HIPAA fines that have been handed out, and risk analysis for encryption of data at rest on portable media is a target area for meaningful use attestation in stage 2.  It’s also expected to be a topic in the 2015 random HIPAA audits.

So, while there is no strict requirement to encrypt, any reasonable risk analysis would indicate that you’d be nuts not to encrypt for professional communications.  It is extremely do-able today with minimal effort and cost, and there are severe consequences if you don’t and something goes wrong.

When it comes to sending records to the patients, though, they do have a right to ask that you send the media unencrypted so they don’t have to deal with passwords.  You should have a plan to accommodate unencrypted records the same way you would a request to communicate via plain e-mail — explain the risks (which also depend on the amount of information and level of detail), ask if they want to do it anyway, and document their assent if that’s what they want.  

But it’s certainly a good idea to have the default behavior be to send records encrypted.  As part of a dialogue about a records release, you may wish to inform your patients that the records will be sent encrypted with the password sent separately, and if they object, let them know they can get them unencrypted, with the explanation of risks and their approval.  

For professional communications, such as between provider offices, encryption is the standard of care for electronic PHI, without question.

 — New NIST Draft SP 800-171 Provides Excellent Summary of Security — 

On November 20, 2015, the National Institute of Standards and Technology released the first public draft of SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, which provides an excellent summary of security actions to take to protect information systems, and provides a great checklist of security considerations.  I recommend every HIPAA Security Officer review this remarkably compact and useful draft document.  It can help every organization working to secure its information systems, without overwhelming anyone.  It is clear, easy to use, and fully digestible.  To view the full announcement and link to the draft document, visit the CSRC Drafts page at: http://csrc.nist.gov/publications/PubsDrafts.html#800-171

The draft is open for comments until January 16, 2015, and I encourage anyone who does have comments to be sure to pass them on, because information received during the comment period can have a tremendous impact in the usefulness of new documents.  If you would like to submit comments on the draft, you can Email your comments by January 16 to: sec-cert@nist.gov

In my estimation, any Health IT shop that fully addresses NIST SP 800-171 and the SANS Top 20 Critical Security Controls ( https://www.sans.org/critical-security-controls/ ) would be one of the more secure Health IT operations in the country.  It’s good to have decent tools to help you prioritize and provide the best protection you can with the resources you have available.

 — Heads Down, Back To The Holidays! — 

Egad!  December?  2015 around the corner?  I’ve already started scheduling seminars and Webinars into next June, no less!  (See: http://www.lewiscreeksystems.com/upcoming_public_seminars.html )  I suppose we all have way too much work to do already so I’ll keep this short, and wish you a happy holiday season!  

Jim

 — Talk About Busy — 

Well, as anyone in HIPAA compliance will tell you, it has been a very busy period since my last missive, way back in May, no less.  The Omnibus compliance deadline of September 23 has come and gone, and the sun still comes up in the morning, well usually, anyway, unless it’s obscured by the latest winter storm.  But the good thing is that the sense of panic is giving out, being replaced by an increase of interest in just plain getting down to work and slaying the HIPAA dragon.  And the good thing for me about this latest winter storm is that it has disrupted my travel plans and allowed me to actually take a few moments to compose an Occasional Client Update Newsletter.  And there is most certainly plenty too talk about!  I won’t cover everything that’s happened since last May — you can see all that on my News page, at http://www.lewiscreeksystems.com/privacy_security_and_compli.html — but here are some important highlights.

 — Accounting of Disclosures Rears Its Ugly Head — 

Well, I think I was a little critical in my prior discussions of the proposed new Accounting of Disclosures rule, and I guess I wasn’t the only one.  The proposed rule has been stopped in its tracks, and in the meantime, HHS gathered a US Department of Health and Human Services Office of the National Coordinator for Health IT Health IT Policy Committee Privacy and Security Tiger Team (the USDHHS-ONCHIT-HITPC-PSTT?) that released a report with its recommendations on the topic, available as a PDF of slides, at  http://www.healthit.gov/FACAS/sites/faca/files/HITPC_PSTT_Accounting%20of%20Disclosures_FINAL_12042013.pdf  or  http://tinyurl.com/lhym4qh   

The recommendations call for a staged implementation relying on available technologies, with pilot projects, an accounting of disclosures outside the organization from certified EHRs as the first step, a new right to request an investigation of internal access, and recommendations to expand the Security Rule to call for more detailed ability to log access for auditing.  Simplifying the question of how to distinguish between uses or disclosures at hospitals by community physicians (in the hospital or from their office), the proposal calls for all such accesses to be treated as disclosures.  Compared with the proposed rule, the recommendations are more reasonable, more implementable, and more likely to satisfy the desires of patients. 

My guess, and we all know how incredibly accurate my guesses are (not!), is that these recommendations will come out as an Interim Final Rule this year at some point, so be ready to hear about it, but don’t panic, as it shouldn’t be too bad.  (Famous last words…)

 — New Changes for Lab Access — 

OK, so who here thinks it’s a good idea for patients to get their lab results without any consultation or interpretation from their doctor?  Not many hands going up…  But who here thinks a patient should have a right to have direct access to the information so they can develop their own personal health record?  More hands up, I’d suspect.

So, that’s the deal in the new final rule, being published February 6, in effect April 7 and Enforceable October 4, 2014, that allows access of authenticated lab results by authenticated individuals or their authorized representatives under HIPAA.  (That’s a lot of “auth…” words in one sentence.)  Patients will still be able to get their results, with interpretation and counseling, from their care provider, and providers will still have access to the information for treatment.  The change simply allows the individual to ask the lab directly for a copy.

Of course, “simple” is in the eye of the beholder — for the laboratories that must now establish a public-facing operation where there was none before, this is not simple at all, and will require the development of new policies and procedures.  And updated Notices of Privacy Practices.  As usual, it’s worth taking the time to read through the Preamble for all the insights into HHS thinking.

See the new rule here:  https://www.federalregister.gov/articles/2014/02/06/2014-02280/patients-access-to-test-reports-clia-program-and-hipaa-privacy-rule   or  http://tinyurl.com/or63d9q  

 — Proposed Changes for Reporting to Background Check Database — 

Along with recommended new rules and new final rules, of course we have a proposed rule, this one to allow freer flow of information from healthcare providers into the National Instant Criminal Background Check System (sounds Orwellian, eh?), permitting certain HIPAA-covered entities to disclose to the NICS the identities of people prohibited by federal law from possessing or receiving a firearm for mental health reasons.  HIPAA has ALWAYS had a provision for the disclosure of PHI in the event of a threat to health or safety, but this would clarify what information and how it should be disclosed.  

This one is not a final rule, so there is no action to take now, but you should be aware that it may require some modifications to your HIPAA policies once it is finalized.  When?  Oh dear, I don’t want to guess…  Maybe this year?  We’ll see.  Here’s the proposed rule, so you can see what’s being considered:  http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/NICS/index.html  or  http://tinyurl.com/m6xpnwx  

 — New Settlement for Stolen Data Stick and Lack of Breach Policies — 

Have I mentioned before that it is important to encrypt portable devices such as memory sticks?  APDerm, a provider with six offices in New Hampshire and Massachusetts found out the hard way by losing one of theirs and not having it encrypted.  Breach time!  And when you do have a breach, what do you do?  You follow your incident management policies and procedures to see if it’s reportable, and follow through on your established process.  What’s that you say?  You don’t have policies and procedures sufficient to meet the HIPAA Breach Notification Rule requirements?  You might be next in line for a $150,000 settlement and a Corrective Action Plan.  APDerm apparently didn’t have written down what they should have.

Time now to dust off your Breach Notification policies and procedures and make sure you can do what’s necessary when the time comes.  And if you don’t like what you find, check out the NIST Special Publication on Computer Security Incident Management, SP 800-61, Revision 2, at: http://csrc.nist.gov/publications/nistpubs/800-61rev2/SP800-61rev2.pdf  or  http://tinyurl.com/8ouxxsn .  In addition, see the September 2012 NIST ITL Bulletin for additional insights and guidance, at:  http://csrc.nist.gov/publications/nistbul/itlbul2012_09.pdf  or  http://tinyurl.com/kx5empm 

Oh, and did I mention that the HHS Office of Inspector General wants OCR to get off their butts and get busy with some real audits and enforcement?  I just love the title of the report — it says it all:  "The Office for Civil Rights Did Not Meet All Federal Requirements in Its Oversight and Enforcement of the Health Insurance Portability and Accountability Act Security Rule”  Yes, but what did they really think?  See:  http://oig.hhs.gov/oas/reports/region4/41105025.pdf  or  http://tinyurl.com/pj55cnr .  Time to get ready for a HIPAA audit, I’d say.

 — Speaking of Enforcement, Say Hello to the FTC — 

And if that wasn’t enough, now the Federal Trade Commission says that just being a HIPAA Covered Entity doesn’t get you out of obligations under the Deceptive Trade laws that FTC so artfully uses to go after those who allow breaches of personal information.  If you say you will protect someone’s personal information and then you don’t, that’s a deceptive practice and the FTC will make your future a gray one if they decide to go after you, which they can, whether HHS is interested or not.  I’d guess that as a matter of practice FTC won’t step in if they feel HHS OCR is doing their job, but, well, see the OIG report on OCR in the paragraph above.  Here’s a link to a Bloomberg News story on the order:  http://www.bna.com/ftc-affirms-data-n17179881620/  

 — It’s February 4 - do you know where your small breach reports are? — 

And finally, don’t forget that we’re in that magical time before March 1, that 60 days within the end of each year when you must all report all your small breaches (under 500 individuals affected) to HHS, using their Web site, at:  http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/  or  http://tinyurl.com/3z3bj4y .  Of course, you do have a breach reporting policy and procedure, don’t you?  (Is there an echo in here?)

So, Happy HIPAA to all, and let me know if you have any questions.  Also, see the latest in my schedule of upcoming seminars and Webinars.  http://www.lewiscreeksystems.com/upcoming_public_seminars.html  or  http://tinyurl.com/a5gplbr .  Soon to be added are 2-day HIPAA sessions in Sao Paulo, Brazil (!) and Toronto, Canada in March, as well as other sessions.  At least I’m not doing Brazil and Canada in the same week — how would I pack for that?...

Jim