HIPAA Security

1. HIPAA Security NWOAHU Presented by Barb Gerken 11/12/2013

2. Omnibus Rule Updates of 2013 to the HITECH Act under ARRA • ARRA of 2009, Federal Stimulus Bill (February 17, 2009) • HITECH requirements deadline was February 17, 2010 • Omnibus Rule Updates of 2013 • Final Ruling by HHS January 17, 2013 • Detailed guidance with 500+ pages of legislation. • Final rule was effective March 26, 2013. • Covered Entities and Business Associates compliance deadline as September 23, 2013

3. What is the Security Rule? The HIPAA Security Rule is a technology neutral, federally mandated “floor” of protection whose primary objective is to protect the confidentiality, integrity and availability of individual identifiable health information in electronic form when it is stored, maintained, or transmitted. • Confidentiality: ePHI concealed from people who do not have the right to see it • Integrity: Information not improperly changed or deleted • Availability: Information can be accessed when needed • Federally Mandated “Floor” of Protection • Comprehensive • Scalable • Technology Neutral

4. Flexibility in the Security Rule • Technology Neutral (does not specify particular technologies to use) and organizations may use any security measures that will allow it to reasonably and appropriately implement the rule. • Allows organizations to take into account: • Their size, complexity and capabilities • Their technical infrastructure, hardware, and software security capability • The costs of security measures • The probability and criticality of potential risks to ePHI • Their access to and use of ePHI

5. Security Rule Objective • Ensure the confidentiality, integrity and availability of all ePHI that an organization creates, receives, maintains or transmits • Protect against reasonably anticipated hazards to the security or integrity of ePHI (floods, fires, etc.) • Protect against any reasonably anticipated uses or disclosures of ePHI not permitted by the Privacy Rule • Ensure compliance by the organization’s workforce.

6. What is protected by the Security Rule? Electronic Protected Health Information (ePHI) which is individually identifiable health information relating to the past, present or future health condition of the individual in electronic form when it is stored, maintained, or transmitted. • Examples • Electronic Claims • Computer Databases with PHI • Emails • Paper printouts of electronic information

7. Who Must Comply with the Security Rule? • Covered Entities • Healthcare Providers • Health Plans • Health Insurance Companies, HMOs, Employer group health plans, Government programs: Medicare, Medicaid, VA programs • Business Associates: All third party vendors and business partners that create, receive, maintain or transmit PHI on behalf of a Covered Entity • Accountants, Lawyers, Consultants, Software Companies, Asset Recyclers, IT Consultants, PBMs • A Broker is a Business Associate of their Employer Group Client’s health plan. An employer should have a signed Business Associate Agreement with their Broker.

8. Who Must Comply with the Security Rule? Any person or organization that stores or transmits individually identifiable health information electronically. This includes both Covered Entities and Business Associates. With the wide spread use of computers, most organizations will need to comply with the Security standards. The only organizations that won’t need to comply are those that only store individually identifiable health information on paper and do not utilize computer systems.

9. Required vs. AddressableSecurity Standards • Covered Entities and Business Associates are required to comply with every Security Rule “Standard.” However, the Security Rule divides the implementation specifications within those standards into two types: • Required • Addressable ***It is important to emphasize that addressable does not mean optional!!!!!!!

10. Required vs. Addressable Implementation Specs • Required –must be implemented by the organization • Addressable – permits organizations to determine whether the addressable implementation specification is reasonable and appropriate for that organization. • If a specification is reasonable and appropriate it must be implemented. • If a specification is not reasonable and appropriate an organization has two options: • Implement an equivalent alternative measure that accomplishes the same purpose as the addressable spec • Document how the overall standard can be met without implementation of the standard and an alternative measure

11. Penalties for Non-Compliance • Non-compliance is a civil offense that carries a penalty ranging from $100-$50,000 per violation with caps of $25,000 to $1.5 million for all identical violations of a single requirement in a calendar year. • Enforced by Office of Civil Rights (OCR) within HHS. • Unauthorized Disclosure or Misuse of Protected Health Information under false pretenses or with intent to sell, transfer, or use for personal gain, or malicious harm is a criminal offense. Penalties for criminal offenses can be up to $250,000 in fines and up to 10 years in prison. • Enforced by the Department of Justice Penalties may apply to the individual violator but may also apply to an organization or even to its officers.

12. Penalties for Non-Compliance There are 4 categories for penalties • Did Not Know • This is when you did not know or would not have known through exercise of reasonable discretion that the disclosure or breach was a violation of HIPAA Rules. • Reasonable Cause • This is when you should have known what was going on, but you had a violation. • Willful Neglect – Corrected • This is when you ignored the Law, and you got caught, but you corrected the issue within 30 days. • Willful Neglect – Not Corrected • This is when you ignored the Law, your were caught, and you decided not to correct the issue.

13. Non-Compliance Penalties from Omnibus Ruling

14. Criminal Penalties • Direct at individuals • Knowingly obtaining or disclosing PHI: Fine of up to $50,000 plus up to one year in prison • Offenses committed under false pretenses: Fine up to $100,000 plus up to five years in prison • Offenses committed with the intent to sell, transfer or use for commercial advantage, personal gain or malicious harm: Fines of $250,000, and up to ten years in prison

15. Implementation Lag • Healthcare Industry in General • 95 percent of organizations have internet connectivity • 25 percent have no firewalls • 65 percent intend to integrate web applications • 24 percent conduct security awareness programs • 71 percent provide internal system-wide computerized client information

16. General Requirements & Structure Increasing Security with each safeguard • Privacy Rule • Reasonable Safeguards for all PHI • Administrative Safeguards • P&Ps designed to show how the entity will comply with the security rule • Physical Safeguards • Controlling physical access to protect against inappropriate access to protected data • Technical Safeguards • Controlling access to computer systems and the protection of communications containing PHI transmitted electronically over open networks

17. General Requirements & Structure Within the security categories, there are 18 standards, 12 with implementation specifications, six without implementation specifications. A standard defines what an organization must do; Implementation specifications describe how it must be done.

18. Security Management Process • Requires an organization to implement policies and procedures to prevent, detect and contain and correct security violations • Risk Analysis • Risk Management • Sanction Policy • Information System Activity Review All are required, not addressable. Risk analysis and sanction policy must be documented, retained for six years and should be periodically reassessed and updated as needed.

19. Assigned Security Responsibility • Required, not Addressable • Must designate a security official (one individual, not an organization) • Responsible for development and implementation of the policies and procedures and having overall responsibility for the security of the organizations ePHI. • HIPAA Privacy Officer generally the best candidate • Do not just assign to IT department, it is much more than just a technical solution.

20. Information Access Management • IAM standard requires an organization to implement P&Ps to access ePHI on when such access is appropriate based on a user’s or recipient’s role. Includes following implementation specifications • Isolation of Healthcare Clearinghouse Function (required) • Protect ePHI appropriate for access to a portion of a larger organization from unauthorized access by persons of that larger organization • Access Authorizations (addressable) • P&Ps with specific access levels for all personnel • Access Establishment and Modifications (addressable) • P&Ps to specify how to access to ePHI is granted and modified.

21. Information Access Management: Guidelines for Levels of Access • Restrict access rights to the minimum necessary • Define types of users, roles and access labels • Verify the identity of individuals who attempt to access information • Establish criteria for when access rights should change • Never allow access rights to be transferred among users • Communicate policies to every person that has access to ePHI • Review policies and procedures annually

22. Security Awareness and Training • Standard requires an organization to train all members or their workforce on its security policies and procedures and includes the following implementation specifications (all are addressable): • Security Reminders • Protection from Malicious Software • Log-in Monitoring • Password Management

23. Security Incident Procedures • Requires an organization to implement policies and procedures to address security incidents (the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems operations in an information system) and includes a single implementation specifications, which is required: • Response and Reporting • Relates to internal reporting of security incidents and does not specifically require the organization to report the incident to any outside entity, except if they are dependent upon business or legal considerations. • Develop P&Ps to identify and respond • Mitigate harmful effects known to the organization • Document security incidents and their outcomes

24. Contingency Plan • Requires an organization to implement P&Ps for responding to an emergency or other occurrence (i.e. fire, vandalism, system failure, nature disaster) that damages systems that contain ePHI

25. Contingency Plan5 Implementation Specs • Data Backup Plan (required) • Should be kept offsite to protect them from fire, flood or other disaster at the facility • Disaster Recovery Plan (required) • Emergency Mode Operation Plan (required) • Testing & Revision Procedure (addressable) • Applications and Data Criticality Analysis (addressable)

26. Evaluation (Required) • Perform periodic technical and non-technical evaluations that determine the extent to which the organization meets the ongoing requirements of the Security Rule. • Organization must: • Verify adherence to the HIPAA Security Rule • Verify that the necessary P&Ps have been developed • Verify that the employees have been trained • Verify that contingency plans are in place • Verify that adequate access rights are in place • Periodically evaluate computer systems and/or network design to ensure proper security has been applied

27. Business Associate Contracts/Agreements • Implement contracts/agreements that ensure vendors and subcontractors that create, receive, maintain or transmit ePHI on the organization’s behalf will appropriately safeguard the information and includes the following implementation specifications: • Written Contract or Other Arrangement (required)

28. Physical Safeguards • Physical measures and P&Ps to protect electronic information systems and related buildings and equipment from natural/environmental hazards and unauthorized intrusions.

29. Physical Safeguards4 Standards • Facility Access Control • Workstation Use • Workstation Security • Device & Media Controls Examples: • Computer servers in locked rooms • Data backups stored offsite • Employee badges • Door locks • Locked cabinets • Screen savers/screen locks • Fireproof storage

30. Facility Access Controls • Limit physical access to facilities ensuring authorized access is allowed and includes: • Contingency Operations (addressable) • Facility Security Plan (addressable) • Access Control and Validation Procedures (addressable) • Maintenance Records (addressable)

31. Workstation Use (Required) • Develop P&Ps to specify: • The proper functions to be performed • The manner in which those functions are to be performed • The physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI • Encompasses portable devices, such as tablets, PDAs, laptops • Conventional desktop – could include log-off requirement, updating anti-virus • For portable devices – can limit what can be stored on these devices

32. Workstation Security (Required) • Implement physical safeguards for all workstations that can access ePHI in order to restrict access to authorized users. • Examples: • Positioning monitors so they cannot be viewed by passers by • Using password-protected screen savers • Limiting access to buildings, offices, workstations, printers, faxes and remote devices

33. Device and Media Controls • Implement P&Ps that control the receipt and removal of hardware and electronic media that contain ePHI and includes the following implementation specifications • Disposal (Required) • Media Re-Use (Required) • Accountability (Addressable) • Data Backup and Storage (Addressable)

34. Technical Safeguards • Technology and the P&Ps for its use that protect ePHI and control access to it. • 5 Standards • Access Control • Audit Control • Integrity • Person or Entity Authentication • Transmission Security • Examples • Usernames and passwords • Security logs • Firewalls • Data Encryption

35. Access Control • Implement technical P&Ps that allow authorized persons or software programs to access ePHI and includes the following specifications: • Unique User ID (required) • Emergency Access Procedure (required) • Automatic Logoff (addressable) • Encryption and Decryption (addressable)

36. Audit Controls (Required) • Requires an organization to implement hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. • Create a process to monitor data access that includes reviews of audit logs for failed logon attempts or security incidents, the frequency of such reviews and the desired escalation process.

37. Integrity • Implement security measures that ensure that ePHI is not improperly modified without detection until disposed of and includes the following implementation specifications: • Mechanism to Authenticate Electronic Protected Health Information (addressable) • P&Ps to protect ePHI from improper alteration or destruction • For most operating systems and hardware, integrity is already built in as standard features such as error-correcting memory and magnetic disc storage.

38. Person or Entity Authentication (Required) • Implement procedures to verify that a person or entity seeking access to electronic PHI is the one claimed. • Simple approach = password at login • More sophisticated approach = biometric ID system, digital signatures

39. Transmission Security • Implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network and includes the following implementation specifications: • Integrity Controls (addressable) • Encryption (addressable) • Applies when using an open network such as internet and when deemed appropriate.

40. Implementation:Implications of Non-compliance • Increased operating costs • Financial penalties • Public exposure leading to loss of customers • Loss of Accreditations / Licenses • Litigation Damages • Imprisonment

41. Making an Organization HIPAA Security Compliant • Typical High-Level Steps • Determine if organization is subject to HIPAA Security Rule (store or transmit ePHI?) • Appoint a HIPAA Security Officer • Detailed HIPAA Security Training Course for HIPAA Security Officer and technical IT staff • Perform risk assessment • Develop risk management plan • Draft necessary P&Ps required by the Security standards • Work with IT to implement security standards contained in new policies and procedures • Train employees on new security P&Ps and systems • Monitor compliance, perform periodic evaluation of security systems and take corrective actions, as needed.

42. Reasonable, Scalable and Common Sense • Privacy & Security rules specified by HIPAA are reasonable and scalable to account for the nature of each organization’s culture, size and resources. • Each organization will determine its own privacy policies and security practices within the context of the HIPAA requirements and its own capabilities and needs. • A good rule of thumb to remember is “when in doubt, use common sense.”

43. Keys to Success • Education • Corporate Culture • Commitment

44. Embracing HIPAA • Many HIPAA requirements are just best practices already implemented in other industries. • HIPAA can be considered a common federal “floor” for everyone to achieve. • Many HIPAA requirements would be things you would want the implement anyway to safeguard the confidentiality of your clients’ records and protect your organization data from loss or theft. • We are all patients with our own PHI and would want many of the same protections for our own personal health information. • With the move toward electronic records management, it is even more critical that we all come to terms with securing our organization’s information as it is all too easy for data to be stolen by hackers or for an organization to lose its records because regular backups were not performed.

45. Thank you for joining us today.