Your Keys to Compliance: From HIPAA to Meaningful Use

1. Your Keys to Compliance:From HIPAA to Meaningful Use Virginia Brooks VHIT Director Mark Watson Director, Hancock, Daniel, Johnson & Nagle, PC January 15, 2014

2. Today’s Presentation • Focus on Privacy & Security • Know the Rules • Meaningful Use • Risk Assessment • Be Prepared • How Can VHIT Help You?

3. Why Focus on Privacy & Security? • Key to building patients’ trust • Important for patient safety • Essential for realizing full benefits of EHRs • Avoid penalties for breaches • Necessary to comply with federal, state and local laws

4. HIPAA & HITECH Act • Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects confidentiality and privacy of healthcare information • American Recovery and Reinvestment Act of 2009 (“stimulus package”) of 2009 includes Health Information Technology for Economic Clinical Health (HITECH) Act • Promotes adoption of EHRs by offering Medicare & Medicaid incentives to physicians demonstrating Meaningful Use

5. Be Advised This presentation is for informational purposes only and is not intended to suggest or offer legal advice.

6. Know the Rules • How do the new HIPAA regulations change things? • Updated terms/standards on: • Notice of privacy practices • Business associate agreements (and business associates) • Breach notification • Patient requests for restrictions • Access rights for patients • Marketing • Sale of PHI, Research, PHI of decedents, and more ...

7. Know the Rules • Notices of Privacy Practices • Must state authorization typically required for: • most uses and disclosures of psychotherapy notes • most uses and disclosures for marketing • most uses of PHI • Must include statement on right to breach notification

8. Know the Rules • Notices of Privacy Practices • Has your NPP been updated regarding requested restrictions?

9. Know the Rules • Business Associates • HIPAA rule now includes entities and individuals that create, receive, maintain or transmit health information on behalf of the covered entity • Prior definition applied only to entities and individuals that used or disclosed health information

10. Know the Rules • Business Associates • “Conduit” exception • Regulatory comments say it’s narrow to exclude “only those entities providing mere courier services” such as the post office and ISPs. • Random or infrequent access to PHI doesn’t eliminate the “conduit” exception, BUT • If the entity requires access regularly, or is involved in something other than just transmission, the conduit exception doesn’t apply

11. Know the Rules • Business Associates • “Conduit” exception cont’d • Data storage company ( digital or hard copy) is a BA even if it does not view the information • Document disposal company is a BA even if it does not view the information • BAAs should address subcontractors

12. Know the Rules • Business Associates • Timing for updates / changes • New arrangements on or after Jan. 25, 2013, new BAA standards apply • If the arrangement was in place before Jan. 25, 2013 and isn’t modified or renewed between March 26, 2013 and Sept. 23, 2013 – you have until Sept. 22, 2014 • If the arrangement is modified or renewed after March 26, 2013 – new BAA standards apply

13. Know the Rules • HIPAA • Security Rule: establishes requirements for protecting electronic PHI • Confidentiality / Integrity / Availability • Physical / Technical / Administrative Safeguards • Develop and maintain policies and procedures • Back up / disaster recovery / emergency plans • Risk Assessment • Record incidents

14. Know the Rules • HIPAA • Breach Notification Rule: unauthorized acquisition, access, use or disclosure of PHI which compromises the security or privacy of the information • Prior regulations defined a “Breach” as a compromise involving a significant risk of financial, reputational or other harm

15. Know the Rules • Breach • “Risk” criteria has technincally been eliminated, BUT • Situation may not be a “compromise” if the CE or BA demonstrates that there is a “low probability” that the PHI has been compromised

16. Know the Rules • Breach • “Compromise” assessment based on: • The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification • The unauthorized person who used the PHI or to whom disclosure was made • Whether the PHI was actually acquired or viewed • The extent to which the risk to the PHI has been mitigated

17. Know the Rules • HITECH Act changed things • CEs are required to agree to requests for restrictions in certain cases • New regulations finalize these standards • CEs must agree to restrict disclosure of PHI to a health plan if • The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law • The PHI pertains solely to a health care item or service for which the individual, or someone other than the health plan, has paid in full

18. HITECH Civil Monetary Penalties

19. Know the Rules Access to ePHI • If ePHI is in a designated record set and the individual requests an electronic copy, the CE must provide the individual with access in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual

20. Know the Rules Marketing • Has always required authorization, But • Has also included “carve outs” for communications to describe other services by the CE and for case management/care coordination • New regulations include similar terms, but many carve outs do not apply where the CE receives “ financial remuneration” • Financial remuneration means direct or indirect payment from or on behalf of a third party whose product is being described

21. Know the Rules Sale of PHI • Strict prohibition on sale of PHI without authorization with limited exceptions • Authorization must state that the disclosure will result in remuneration to the CE • Sale does not include (i.e. authorization isn’t required) for: • Research • The sale or transfer of all or part of the CE and related due diligence

22. Action Items • Review and update your policies and procedures, including: • Breach notification • Requests for restrictions • Access rights • Marketing? • Research? • Sale of PHI? • Decedents? • Immunization records?

23. Action Items • Are other updates/revisions appropriate? • Are your security policies, procedures and actual security measures appropriate?

24. Enforcement Examples • Rite Aid (2010) • Improper disposal of prescriptions and pill bottles • $1 million settlement, CAP, training for employees • Massachusetts General (2011) • Employee took billing encounter forms home; 192 paper records lost • OCR settlement for $1 million, 3 year CAP • Phoenix Cardiac Surgery (2012) • Patient appointments posted on Internet-based calendar • Practice implemented few policies/procedures, limited safeguards • OCR settlement for $100,000

25. Meaningful Use Standards for Privacy & Security • HITECH promotes adoption of EHRs by offering Medicare & Medicaid incentives to physicians demonstrating Meaningful Use • MU Core Objectives require providers to protect health information created and maintained by an EHR. • Having an ONC certified EHR vendor is not enough

26. Data Security Safeguards • Conduct security risk analysis • Perform a thorough compliance audit • Safeguards may include: • Documented policies and procedures that govern physical and environmental security of data, to include firewalls and more • Visitors are authenticated and escorted at all times, and there are detailed records of visits • Mobile devices are vulnerable and require much more than password or PIN to be secure

27. Safeguards Continued • Secure areas are physically protected, such as monitoring by a receptionist, and security by locked doors and cameras • Keys and combinations are password protected or otherwise secure, and locks are changed when keys are lost or stolen and when employees are terminated • Adequate fire detectors exist and powered by an independent energy source • And many more safeguards …

28. Risk Assessment vs. Risk Analysis • Risk assessment must be completed per HIPAA Security Rules to address reasonably anticipated risks to protect health information • Risk analysis of EHR environment for Meaningful Use is necessary per HITECH to assess damage related to Breach Notification

29. Perform a HIPAA Risk Assessment Top 5 Privacy Issues Identified by OCR: • Impermissible uses and disclosures • Insufficient safeguards of PHI • Failure to provide patient access to PHI • Use/disclosure of more than minimum necessary PHI • Insufficient notice to patients of use/disclosure of PHI

30. Resources are Available • Risk Analysis Now = Future Time + Savings • Checklists & self-help tools can help you get ready • Thorough risk analysis that will pass a compliance review requires expert knowledge • VHIT is ready to help you!

31. How VHIT Will Help • Privacy & Security Risk Assessment • Verify physical, administrative and technical safeguards • Verify current Privacy & Security policies and procedures, BAA agreements, and business contingency plan • Risk mitigation plan based on findings

32. What You Will Get • Privacy & Security Risk Assessment results in hard copy and CD-ROM • Policy templates and supporting documents • Additional materials, including incident logs, cyber security tips, and FAQ tip sheets • HIPAA/HITECH Security training certificates

33. VHIT Expertise and Experience • A Top 5 Regional Extension Center • Supporting 4,000+ providers • Helped 2,200+ qualify for federal EHR incentive payments • Uniquely qualified

34. Questions / Contact Us • Virginia Brooks, MHA, CPHQ (804) 289-5343 vbrooks@vhqc.orghttp://vhitrec.org • Mark C. Watson, JD (866) 967-9604 mwatson@hdjn.comhttp://hdjn.com Hancock, Daniel, Johnson & Nagle, P.C.