HIPAA

1. HIPAA Health Insurance Portability and Accountability Act

2. Why did HIPAA come about? • HIPAA passed by Congress in 1996 to lower healthcare costs by encouraging electronic transactions • HIPAA gave Congress until August 21, 1999 to pass a comprehensive health privacy legislation. • Congress failed in November 1999. • A final rule took effect on April 14, 2001. • The rule contains three parts a. Privacy b. Code Sets c. Security • Privacy broken into four parts a. Administrative Procedures b. Physical Safeguards c. Technical Security Services (“data at rest”) d. Technical Security Mechanisms (“data in transmission”)

3. Privacy • Established to protect patient privacy and allow greater access to own records • HIPAA covered Entities a. Health plans b. Clearinghouses c. Healthcare providers who conduct financial and administrative transactions • HIPAA specifically addresses patient’s Protected Health Information (PHI) • Covered entity must receive permission from patient to share PHI

4. Code Sets • Any set of set of codes used for encoding data elements. Includes tables of terms, medical concepts, medical diagnosis codes, and procedure codes. • Required for data elements in administrative and financial transaction standards

5. Security • Protection of PHI • Contains four parts: a. Administrative b. Physical safeguards c. Technical security services and mechanisms d. Technical security mechanisms

6. HIPAA Components

7. Discussion • Title 1 a. Protects health insurance coverage for workers and their families when they change or lose their jobs. • Title 3 b. Certain deductions for medical insurance and makes other changes to health insurance law. • Title 4 c. Conditions for group health plans • Title 5 d. Provisions related to company-owned life insurance, treatment of individuals who lose U.S. Citizenship for income tax purposes and repeals the financial institution rule to interest allocation rules.

8. Overview of Title 2 • Preventing Health Care Fraud a. Preventing Health Care Fraud b. Medical Liability Reform c. Administrative Simplification

9. Risks • Civil Liability – Tiered • Criminal Liability • Recent Breaches and Fines

10. Administrative Simplification “Congress passed the Administrative Simplification provisions of HIPAA, among other things, to protect the privacy and security of certain health information and promote efficiency in the health care industry through the use of standardized electronic transactions.” • Security: Applies only to Electronic Patient Health Information (EPHI) • Privacy: Applies to Patient Health Information (PHI) in all forms (paper and electronic). • Electronic Data Interchange: Standardization of the format in which PHI is transmitted electronically (ePHI) to the American National Standards Institute (ANSI) standard.

11. Security Rule • Why: CIA – Confidentiality (prevent unauthorized access); Integrity (prevent unauthorized changes/destruction; Availability (ensure authorized access when needed) of electronic protected health information (EPHI). • What: “The provisions of Security Rule apply to EPHI.” • Who: All covered entities (Health Care Plans, Health Care Providers, and Health Care Clearing Houses) must comply. • How: Realizing that the Security Standards provide flexible guidelines, covered entities select appropriate security measures to satisfy Required implementation specifications and make appropriate determination on Addressable implementation specifications by taking into account its size, capabilities, the costs of the specific security measures and the operational impact. • Security Standards: General Rules • Organizational Requirements

12. Privacy Rule • Patient sign-in sheet does not include PHI • Patient schedules not in areas viewable by patients/non-staff. • Confidential conversations take place in areas where it cannot be overheard by others. • Patients/non-staff cannot gain access to computers, fax machines, or view computer screens • Each staff computer user has personal computer password, passwords change on a regular basis, and passwords of terminated employees get deleted immediately. • Patients/non-staff cannot access patient medical records, lab reports, and faxes. • Formal documented procedures for acceptance of confidential patient info. • Confidentiality statements in place, patients are aware of confidentiality policies. • Formal privacy and security procedures with regards to: access to confidential info to computer information, and access to areas that may contain confidential info • The return of all keys and other items that allow access to office and computer files, when an individual is no longer authorized access. • Formal privacy/security policies and documented training, for office personnel. • Laptops and other portable equipment that contain PHI, are secure and can only be accessed by authorized personnel. • Policies and procedures to ensure patient confidentiality by off-site contractors, such as billing and accounting services. • Comprehensive survey of all computer systems, including all software. • Disaster plan to protect patient information, contingency plans in the event of a computer system failure, and regular virus checks are performed. • Both paper and electronic PHI is stored with appropriate safeguards. • Secure internet transmissions including emails, and telephone conversations. • Consent forms are used and signed by patients. • Confidentiality statements on all faxes and email sent by staff.

13. Password Security • Protect your user ID and password. Do not share, write down, or post your password under any circumstances! • Commit your password to memory. • At a minimum, when creating your password, incorporate a combination of letters and numbers. Avoid dictionary words and personal information. • Immediately change your password if it is accidentally exposed or compromised. • Report all password exposures to your department supervisor or manager. • Always keep computers password-protected and locked or logged off when not in use.

14. Document and Workstation Security • Log off or lock access to computers when you leave, even if only for a moment. • Keep computer systems up-to-date with current operating system security patches and antivirus definitions. • Ensure that computer systems meet minimum security standards. • Ensure that computer screens and displays with access to ePHI are not visible to unauthorized individuals or passersby. • Keep confidential or sensitive information locked away when not in use. File documents in locked cabinets or drawers when you have finished with them. • Be alert to recognize and report all privacy and security incidents to your department supervisor or manager.

15. EDI • Transactions – HIPAA calls for a standard in the way health information is transferred and in the use of standard codes to identify each disease, illness, and other patient health problems. • Identifiers a. The standard Unique Employer Identifier is the standard employer identification number (EIN) that appears on an employee’s federal IRS form W-2, Wage and Tax Statement received from their employer. b. The National Provider Identifier (NPI) is a unique identification number for covered health care providers. c. The National Health Plan Identifier (NHI) is a proposed identifier to uniquely identify health plans and payers that is under consideration. d. The National Individual Identifier is no longer being pursued, as the government is not allotting funding for its development.

16. Health Information Technology forEconomic and Clinical Health Act (HITECH) • Stimulus Package a. Allows health care providers who demonstrate meaningful use of certified electronic health records will receive incentive payments through Medicaid and Medicare. States can receive a 90% federal funding match for incentive payments distributed to Medicaid providers who adopt EHRs under the meaningful use criteria. • Notification of Breach a. The HITECH Act now imposes data breach notification requirements for unauthorized uses and disclosures of unsecured PHI. • Electronic Health Record Access a. In the case where a provider has implemented an HER system, the Act provides individuals with a right to obtain their PHI in an electronic format (i.e. ePHI). • Business Associates and Business Associate Agreements a. Under the HITECH Act, business associates are now directly required to comply with the safeguards contained in the HIPAA Security Rule (SR).

17. HITECH Continued • Basic Check List for Meaningful Use 1. Use Computerized Provider Order Entry (CPOE) for medication orders 2. Implement drug-drug and drug-allergy interaction checks 3. Maintain an up-to-date problem list of current and active diagnosis 4. Generate and transmit permissible prescriptions electronically (eRx) 5. Maintain active medication list 6. Maintain active medication allergy list 7. Record Demographics 8. Record Vital Signs 9. Record smoking status for patients 13 years old or older 10. Report ambulatory clinical quality measures to CMS 11. Implement one clinical decision support rule 12. Provide patients with an electronic copy of their health information upon request 13. Provide clinical summaries for patients for each office visit

18. Basic Meaningful Use Guide Continued 14. Exchange key clinical information electronically 15. Protect electronic health information 16. Implement drug formulary checks 17. Incorporate clinical lab-test results as structured data 18. Generate patient lists by specific conditions 19. Send patient reminders for preventive or follow-up care 20. Provide patients with timely electronic access to their health information 21. Provide patient-specific education resources 22. Perform medication reconciliation 23. Provide summary of care record for each transition of care of referral 24. Submit electronic data to immunization registries 25. Submit electronic syndromic surveillance data to public health agen

19. Criminal Liability • Covered entities and specified individuals whom “knowingly” obtain or disclose individually identifiable health information in violation of the Administrative Simplification Regulations face a fine of up to $50,000, as well as imprisonment up to one year. Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine, with up to five years in prison. Finally, offenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to 10 years.

20. Recent Breaches & Fines 49% Physical Theft, 16% Unauthorized Access, 14% Physical Loss, 9% Combination, 6% Hacking/IT, 5% Improper Disposal, 1% Other/Unknown 1. Howard University Hospital – Over a 17 month period, Laurie Napper used her position at the hospital to gain access to patient’s names, addresses and Medicare numbers in order to sell their information. If convicted, Napper faces up to 10 years in prison. 2. Another Howard University incident – The hospital notified more than 34,000 patients that their medical data had been compromised. A contractor working with the hospital had downloaded the patient’s files onto a personal laptop, which was stolen from the contractor’s car. The data on the laptop was password-protected but unencrypted, which means anyone who guessed the password could have accessed the patient files. 3. A jury in Waukesha, Wisconsin, found that an emergency medical technician invaded the privacy of an overdose patient when she told the patient’s co-worker about the overdose. The co-worker then told the nurses at West Allis Memorial Hospital, where both she and the patient were nurses. The EMT claimed that she called the patient’s co-worker out of concern for the patient. The jury, however, found that regardless of her intentions, the EMT had no right to confidential and sensitive medical information, and directed the EMT and her employer to pay $3,000 for the invasion of privacy.

21. Recent Breaches & Fines 4. March 13, 2012 Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the U.S. Department of Health and Human Services (HHS) $1,500,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, Leon Rodriguez, Director of the HHS Office for Civil Rights (OCR), announced today. BCBST has also agreed to a corrective action plan to address gaps in its HIPAA compliance program. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule. The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.

22. HIPAA Privacy & Security Audit Program If you are a covered entity, you are subject to OCR Audits! • Overview:  The American Recovery and Reinvestment Act of 2009, in Section 13411 of the HITECH Act, requires HHS to provide for periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification standards.  To implement this mandate, OCR is piloting a program to perform up to 150 audits of covered entities to assess privacy and security compliance.   Audits conducted during the pilot phase will begin November 2011 and conclude by December 2012. • Program Objectives:The audit program serves as a new part of OCR’s health information privacy and security compliance program. OCR will use the audit program to assess HIPAA compliance efforts by a range of covered entities, Audits present a new opportunity to examine mechanisms for compliance, identify best practices and discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews. OCR will broadly share best practices gleaned through the audit process and guidance targeted to observed compliance challenges via this web site and other outreach portals. http://www.hhs.gov/ocr/

23. Audits How Will the Audit Program Work? The privacy and security performance audit process will include generally familiar audit mechanisms. Entities selected for an audit will be informed by OCR of their selection and asked to provide documentation of their privacy and security compliance efforts. In this pilot phase, every audit will include a site visit and result in an audit report. During site visits, auditors will interview key personnel and observe processes and operations to help determine compliance. Following the site visit, auditors will develop and share with the entity a draft report; audit reports generally describe how the audit was conducted, what the findings were and what actions the covered entity is taking in response to those findings. Prior to finalizing the report, the covered entity will have the opportunity to discuss concerns and describe corrective actions implemented to address concerns identified. The final report submitted to OCR will incorporate the steps the entity has taken to resolve any compliance issues identified by the audit, as well as describe any best practices of the entity.

24. Audits When Will Audits Begin? The pilot audit program is a three step process. The first step entailed developing the audit protocols. Next, a limited number of audits will be conducted in an initial wave to test these protocols. OCR expects the initial audits to begin in November 2011.The results of the initial audits will inform how the rest of the audits will be conducted. The last step will include conducting the full range of audits using revised protocol materials. All audits in this pilot will be completed by the end of December, 2012. Who Will Be Audited? Every covered entity and business associate is eligible for an audit. Selections in the initial round will be designed to provide a broad assessment of a complex and diverse health care industry. OCR is responsible for selection of the entities that will be audited. OCR will audit as wide a range of types and sizes of covered entities as possible; covered individual and organizational providers of health services, health plans of all sizes and functions, and health care clearinghouses may all be considered for an audit. We expect covered entities to provide the auditors their full cooperation and support and remind them of their cooperation obligations under the HIPAA Enforcement Rule. Business Associates will be included in future audits.

25. Audits What is the General Timeline for an Audit? When a covered entity is selected for an audit, OCR will notify the covered entity in writing. The OCR notification letter will introduce the audit contractor, explain the audit process and expectations in more detail, and describe initial document and information requests. It will also specify how and when to return the requested information to the auditor. OCR expects covered entities and business associates who are the subject of the audit to provide requested information within 10 business days of the request for information. OCR expects to notify selected covered entities between 30 and 90 days prior to the anticipated onsite visit. Onsite visits may take between 3 and 10 business days depending upon the complexity of the organization and the auditor’s need to access materials and staff. After fieldwork is completed, the auditor will provide the covered entity with a draft final report; a covered entity will have 10 business days to review and provide written comments back to the auditor. The auditor will complete a final audit report within 30 business days after the covered entity’s response and submit it to OCR. What Happens After an Audit? Audits are primarily a compliance improvement activity. OCR will review the final reports, including the findings and actions taken by the audited entity to address findings. The aggregated results of the audits will enable OCR to better understand compliance efforts with particular aspects of the HIPAA Rules. Generally, OCR will use the audit reports to determine what types of technical assistance should be developed, and what types of corrective action are most effective. Should an audit report indicate a serious compliance issue, OCR may initiate a compliance review to address the problem. OCR will not post a listing of audited entities or the findings of an individual audit which clearly identifies the audited entity.

26. Audits How will Consumers Be Affected? The audit program represents one more avenue by which OCR ensures compliance with HIPAA protections of health information to the benefit of consumers. For example, the audit program may uncover reasons many health information breaches are occurring and help OCR create tools for covered entities to better protect individually identifiable health information. Concerns about compliance identified and corrected by an audit will serve to improve the privacy and security of health records. The technical assistance and best practices that OCR generates will also assist covered entities and business associates in improving their efforts to keep health records safe and secure. OCR continues to accept complaints from individuals and covered entities continue to have the obligation to accept complaints from persons about their HIPAA Rule activities.

27. Penalties for Non-Compliance Resources • http://lawmedconsultant.com/645/hipaa-violations-not-a-cause-of-action-for-a-lawsuit • http://www.emrandhipaa.com/administrator/2006/06/21/examples-of-hipaa-privacy-violations-more-hipaa-lawsuits-coming/ • http://www.aafp.org/fpm/2002/1100/p35.html Recent Breaches & Fines

28. Team Oceanthorne • What can we do for you? • Initial assessment of compliance • HITECH and Basic Meaningful Use Guide • Independent Audit based on the NIST SP 800-66 Revision 1.