CURRENT COMPLIANCE, PRIVACY AND SECURITY ISSUES Tim Timmons GOBHI Corporate Integrity Officer

1. CURRENT COMPLIANCE, PRIVACY AND SECURITY ISSUES Tim Timmons GOBHI Corporate Integrity Officer CCEP, CHP, CHSS

2. COMMON HIPAA PRIVACY QUESTIONS

3. HIPAA Privacy Q&A Question #1: May health care providers share protected health information with developmental disability agencies without the client’s authorization? Answer: Developmental disability agencies are not health care providers and therefore are not HIPAA covered entities. So authorization is necessary unless otherwise permitted by the Privacy Rule or other federal or state law. 

4. HIPAA Privacy Q&A Question #2: Health care providers can share personal health information with public health agencies without the client’s authorization. Answer: Public health agencies meet the definition of “health care providers” under HIPAA, so all the disclosure exceptions in the Privacy Rule apply. 

5. HIPAA Myths and Misunderstandings Question #3: Under the Privacy Rule, does the minimum necessary standard apply to the use and disclosure of PHI for treatment purposes. Answer: Under the Privacy Rule, the minimum necessary standard does not apply to the disclosure of PHI to a health care provider for treatment, but technically, does apply to the use of PHI for treatment.

6. HITECH Imposes Additional Restrictions • HITECH limits covered entities’ discretion for determining what constitutes the minimum necessary and requires a two tiered approach to limit the use, disclosure or request of PHI • Disclosure should, to the extent practicable, be restricted to a limited data set or, if needed, • To the minimum necessary to accomplish the intended purpose of such use, disclosure, or request.

7. HITECH Imposes Additional Restrictions The Privacy Rule allows the disclosing party to rely on the professional judgment of other health care professionals requesting PHI to determine how much information they need. According to HITECH, however, the entity disclosing the PHI (as opposed to the requester) is responsible for making the minimum necessary determination.

8. Determining Who Should Have Access to PHI You should develop role based access controls to determine who should have access to all PHI, regardless of whether it’s electronic or paper based. This is a requirement in the HIPAA Security Rule as well.

9. HIPAA Privacy Q&A Question #4: A covered entity may disclose PHI for health care operations with the patient/client’s authorization for health care operations

10. HIPAA Privacy Q&A • Answer: The exception to the requirement for an authorization applies to disclosures for treatment only if: • Each entity either has or had a relationship with the individual who is the subject of the information, • The protected health information pertains to the relationship; and • The disclosure is for a quality-related health care operations activity or for the purpose of health care fraud and abuse detection or compliance

11. HITECH STATUS ON THE FINAL RULES

12. Final Rules Implementing the 2009 HITECH Act Susan McAndrew, OCR deputy director for health information privacy, said the omnibus rules were accepted for clearance by the Office of Management and Budget on March 24 and are expected to be released after a review of up to 90 days

13. Final Rules Implementing the 2009 HITECH Act Harm standard will be addressed Breach risk assessment highlighted Responsibility and liability of business associates Sample BA agreement Protection for marketing and fundraising

14. Final Rules Implementing the 2009 HITECH Act Ban on sale of PHI with list of exceptions Prohibition of use of genetic information for underwriting Will require the development of a new NPP outlining patient rights and responsibilities

15. Final Rules Implementing the 2009 HITECH Act Lifting of protections for deceased individuals after 50 years in proposed rule will be addressed More liberal provisions for family members to obtain records of decedents

16. Final Rules Implementing the 2009 HITECH Act Guidance on minimum necessary More liberal access to records of decedents for family members involved in the care of the decedent immediately prior to death

17. Are Small Organizations SafeFrom Privacy Sanctions? • Complaint lodged against a small Phoenix cardiac surgical practice • OCR investigation revealed • Surgical appointments posted online with patient names • Emails containing PHI using personal email accounts • No HIPAA training • Role of privacy officer uncertain • Few privacy policies and procedures

18. Are Small Organizations SafeFrom Privacy Sanctions? • Result: • $100,000 fine • Corrective action plan with the OCR • Damage to the practice’s reputation • All it takes is one complaint, prompting an OCR investigation – Just ask Michael Kurtz

19. PRIVACY OF DRUG AND ALCOHOL RECORDS 42 CFR Part 2

20. Who is Covered under Part 2 An individual or entity must be federally assisted and hold itself out as providing, and provide, alcohol or drug abuse diagnosis, treatment or referral for treatment (42 CFR § 2.11).

21. What are the Restrictions on Disclosure The Part 2 regulations “impose restrictions upon the disclosure and use of alcohol and drug patient records which are maintained in connection with the performance of any federally assisted alcohol and drug abuse program.” (42 CFR § 2.3(a)) The restrictions on disclosure apply to any information disclosed by a Part 2 program that “would identify a patient as an alcohol or drug abuser …” (42 CFR §2.12(a) (1))

22. What Does Disclosure Mean “Disclose or disclosure” means the “communication of patient identifying information, the affirmative verification of another person’s communication of patient identifying information, or the communication of any information from the records of a patient who has been identified.”

23. What is Considered PHI Under Part 2 “Patient identifying information” means the “name, address, social security number, fingerprints, photographs of similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information.”

24. When May PHI be Shared Unlike HIPAA, which generally permits the disclosure of protected health information without patient consent or authorization for the purposes of treatment, payment, or health care operations, Part 2, with limited exceptions (i.e., medical emergencies and audits and evaluations), requires patient consent for such disclosures (42 CFR §§ 2.3, 2.12, 2.13).

25. When May PHI be Shared Some types of exchange, however, may take place without patient consent when a qualified service organization agreement (QSOA) exists or when exchange takes place between a Part 2 program and an entity with administrative control over that program.

26. What is a Qualified Service Organization • A qualified service organization (QSO) means a person or organization that: • Provides services to a [Part 2] program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, medical, accounting or other professional services or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and

27. What is a Qualified Service Organization • A qualified service organization (QSO) means a person or organization that: • Has entered into a written agreement with a program under which that person acknowledges that in receiving, storing, processing or otherwise dealing with any patient records from the programs, it is fully bound by these regulations; and • if necessary, will resist in judicial proceedings any efforts to obtain access to patient records, except as permitted by these regulations.

28. STATUS OF OPT OUT REQUIREMENT FOR THE DISCLOSURE OF ePHI

29. Status of Opt Out Requirement Question: Does the HITOC Subcommittee recommend an indefinite deferral or have any affirmative recommendation on whether consent should be required for the disclosure of all electronic PHI? Answer: The Subcommittee has expressed concern, which it strongly reiterated in its last meeting, that an opt-out policy, at this time, could harm the development of coordinated care organizations (CCOs) and/or their use of health IT.

30. Status of Opt Out Requirement SB 1580 provides that information transfer within a CCO does not require patient authorization. Question: How can one reconcile an opt-out consent model with SB 1580? Answer: The Subcommittee did not see a feasible way to do so at this time.

31. Senate Bill 1580 • SECTION 16. (1) Notwithstanding ORS 179.505, a health care provider that is a participant in a coordinated care organization, as defined in ORS 414.025, shall disclose protected health information: • (a)To other health care providers participating in the coordinated care organization for treatment purposes, and to the coordinated care organization for health care operations and payment purposes, as permitted by ORS 192.558; and

32. Senate Bill 1580 • SECTION 16. (1) Notwithstanding ORS 179.505, a health care provider that is a participant in a coordinated care organization, as defined in ORS 414.025, shall disclose protected health information: • (b) To public health entities as required for health oversight purposes.

33. Senate Bill 1580 (2) The disclosures described in subsection (1) of this section may be provided without the authorization of the patient or the patient’s personal representative. (3) Subsection (1) of this section does not apply to psychotherapy notes, as defined in ORS 179.505.

34. Senate Bill 1580 (2) The disclosures described in subsection (1) of this section may be provided without the authorization of the patient or the patient’s personal representative. (3) Subsection (1) of this section does not apply to psychotherapy notes, as defined in ORS 179.505.

35. CURRENT PRIVACY AND SECURITY CHALLENGES

36. Current Privacy Challenges • Use of social media by staff containing PHI • Facebook • Twitter • Off-site “friending” and “tweets” • Medical identity theft • World Privacy Forum pegged growth at 3% to 7% a year • AHIMA reported that a purloined medical identity has a street value of about $50 compared to $1 for a Social Security number

37. Current Privacy Challenges • Sharing PHI in integrated care without patient/client authorization • Disclosure of PHI for QA/QI purposes if the patient/client doesn’t have an established relationship with all parties within the CCO • Consent restrictions for A&D providers • Absence of policies and procedures to comply with the HIPAA Security Rule

38. Current Privacy Challenges • Business associate compliance with the Privacy Rule and HITECH • Breach notification is still the covered entity’s responsibility, according to HHS • Breach responsibilities should be spelled out in the BA agreement • What do you do when the BA wants you to use its BA agreement and it doesn’t contain all the necessary assurances you need, and the BA is vital to your operation?

39. QUESTIONS??