RECognition & Health IT 2.0 Expo HIPAA Audit Program and Omnibus Rule

1. RECognition & Health IT 2.0 Expo HIPAA Audit Program and Omnibus Rule Tuesday, June 25, 2013 Sheraton Dover Hotel Dover, DE Barbara J. Holland, Esq. DHHS,Office of Civil Rights Regional Manager, Region III

2. HIPAA Audit Program • Mandated by HITECH Act, Section 13411 ‐ Audits • HHS must conduct periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification Standards. • Program Opportunity • Examine mechanisms for compliance • Identify best practices • Discover risks and vulnerabilities that may not have come to light through complaint investigations and compliance reviews • Encourage renewed attention to compliance activities

3. Multi‐year Audit Plan

4. 2011/2012 Implementation • Audit Protocol Design • Created a comprehensive, flexible process for analyzing entity efforts to provide regulatory protections and individual rights • Resulting Audit Program • Conducted 115 performance audits through December 2012 to identify findings in regard to adherence with standards. • Two phases: • Initial 20 audits to test original audit protocol • Final 95 audits using modified audit protocol

5. What is a Performance Audit? • An audit service conducted in accordance with GAGAS, Generally Accepted Government Auditing Standards (The Yellow Book) • Provides findings, observations, or conclusions based on an evaluation of sufficient, appropriate evidence against established audit criteria • Can include a limitless range of objectives driven by the needs of users • Can entail objective assessments of a variety of attributes: – Program effectiveness, economy, and efficiency – Internal control – Compliance – Other questions of interest to management (e.g. value of assets, determination of pension benefits)

6. Who Can Be Audited? • Any Covered Entity • For 2011‐2012, OCR sought wide range of types and sizes • Health plans of all types • Health care clearinghouses • Individual and organizational providers • Any Business Associate TBD after September 23, 2013 (HITECH Final Rule compliance date)

7. Breakdown of 2012 Auditees Level 1 Entities • Large Provider / Health Plan • Extensive use of HIT ‐ complicated HIT enabled clinical /business work streams • Revenues and or assets greater than $1 billion Level 2 Entities • Large regional hospital system (3‐10 hospitals/region) / Regional Insurance Company • Paper and HIT enabled work flows • Revenues and or assets $300 million to $1 billion Level 3 Entities • Community hospitals, outpatient surgery, regional pharmacy / All Self‐ Insured entities that don’t adjudicate their claims • Some but not extensive use of HIT – mostly paper based workflows • Revenues $50 Million to $300 million Level 4 Entities • Small Providers (10 to 50 Provider Practices, Community or rural pharmacy) • Little to no use of HIT – almost exclusively paper based workflows • Revenues less than $50 million

8. Auditees by Type & Size LEVEL 1 2 3 4 Total Health Plans 13 12 11 11 47 Health Care Providers 11 16 10 24 61 Health Care Clearinghouses 2 3 1 1 7 _________________________________________________ Total 26 31 22 36 115

9. Overall Cause Analysis For every finding and observation cited in the audit reports, audit identified a “Cause.” • Most common cause across all entities: entity unaware of the requirement. • 39% (115 of 293) of Privacy Requirements • 27% (163 of 593) of Security Requirements • 12% (11) of Breach Notification Requirements • Most of these related to elements of the Rules that explicitly state what a covered entity must do to comply. • Other causes noted included but not limited to: • Lack of application of sufficient resources • Incomplete implementation • Complete disregard

10. What have the audits discovered so far? • 65 % of the violations are in the security area • 42.70% of the security violations involve administrative safeguards • 16.70% involve physical safeguards • Policies and procedures exist but are outdated or not implemented • HIPAA compliance programs were not a priority • Larger institutions continue to have security problems • Entities are not conducting regular risk assessments • Entities are not managing third party risks

11. What does this mean for you as a covered entity? • Your odds of being audited have now increased • OCR is under Congressional pressure to enforce HIPAA/HITECH • You need to have current policies and procedures that are implemented • You need to have updated risk assessments • You need to be aware of the findings and actions taken by OCR in its recent enforcement actions • You must have an up-to-date risk assessment of your compliance with the Privacy and Security Rules.  If you had a breach or security incident, an additional risk assessment has to be performed specifically addressing those factors that resulted in breach or violation

12. Omnibus HIPAA Final Rule • Issued January 17, 2013, Effective March 26, 2013 • Compliance Date September 23, 2013 • Major Changes: • Expands Liability • Business Associates/Subcontractors and Agents of Covered Entities • Presumption of Breach unless low probability of data compromise • CE must make assessment of risk following breach • Use PHI for marketing and fundraising (opt-out) • individual’s right of access to electronic PHI • Enforcement Penalties

13. Expanded Liability • HITECH made BAs subject to Security Rule and certain Privacy Rule provisions • New regs implement HITECH requirements • BA definition amended to add • patient safety organizations, • HIOs/data transmission entities (cloud vendors), • vendors who provide PHRs on behalf of covered entities and • Subcontractors (law firms)

14. Expanded Liability • BAs now directly Liable • Subcontractors to BAs also subject to HIPAA • BAA must spell out delegated authority • Agreement is also required between BA and subcontractor that contains all required BAA provisions • Law of Agency applies even when no BAA -- “No matter how far ‘down the chain’ the information flows”

15. Revised definition of Breach • Prior definition: • Acquisition, access, use or disclosure of PHI in a manner not permitted by Privacy Rule which compromises the security or privacy of the PHI • Interim final rule defined “compromise” • Poses a significant risk of financial, reputational or other harm

16. New Definition • An acquisition, access, use or disclosure of PHI in a manner not permitted is presumed to be a breach • Unless the CE or BA can demonstrate (via documentation) that there is a low probability that the PHI has been compromised

17. CE must conduct a risk assessment to determine probability of compromise • Factors that must be weighed in assessing probability of compromise • The nature and extent of the PHI involved • The unauthorized person who used the PHI or to whom the disclosure was made • Was the PHI actually acquired or viewed, and • Has the risk to the PHI been mitigated

18. Enforcement provisions adopted and clarified • Regulations adopt HITECH increased penalty structure: • Did not know: $100-$50,000 per violation • Reasonable cause: $1,000-$50,000 per violation • Willful neglect* if corrected: $10,000-$50,000 per violation • Willful neglect if uncorrected: $50,000 per violation • $1,500,000 maximum for all violations of an identical provision per year*Conscious, intentional failure or reckless indifference to a compliance obligation

19. Enforcement Provisions: new clarifications • Factors government must now consider when determining penalties • Nature and extent of violation, now includes number of affected individuals • Nature and extent of harm resulting, now includes reputational harm • History of compliance, now includes indications of non-compliance (vs. formal findings of violations) • Financial condition of the organization • If willful neglect, HHS • Required to investigate • Must conduct a compliance review • May (but probably won’t) resolve informally

20. Areas for CEs and BAs to focus on in the future • Risk assessments – ongoing • Training of personnel • Policies and procedures – especially w/respect to mobile devices and encryption

21. OCR’s future focus • Not giving entities a 2nd, 3rd, 4th chance to comply • May start to look at repeat violators • Complaints may trigger broad review • Now required to do compliance review where willful neglect • Breach reports may trigger compliance investigations even where not required. • Additional audits may be undertaken following evaluation of initial program