Organizations informing data breaches faster to federal agencies

The Department of Health and Human Services’ OCR (Office for Civil Rights) is cracking down on providers that don’t report data breaches of protected health information in a basic timely manner. OCR in the month of March initiated to fine agencies that don’t notify federal agencies of breaches within sixty days as required. The effect has been dramatic—average reporting times for breaches were merely 45 days in the month of March and 59 in the month of April, compared with 478 days in February, in accordance to Protenus, a vendor that offers a cloud platform to monitor and secure the security of hospital electronic health records (EHRs).

“It is complex to know for sure with limited information, but we might recommend 2 reasons for this trend of reduced breach reporting time,” claims Robert Lord, co-founder and CEO at Protenus. “One potential reason is that initiating earlier this year, HHS has arguably stepped up enforcement on healthcare agencies that don’t report breaches within the required 60-day window. Organizations are informing data breaches faster to federal agencies.

“An extra potential reason is that healthcare agencies are becoming more diligent in their analysis and reporting of breaches, as awareness of the significance of reporting grows,” Lord continues. “While these tragedies are unfortunate, they can be utilized as a learning experience to educate other covered entities on best practices.”

The number of days between when a breach occurred and when it was discovered in the month of April ranged from almost instantly to 228 days. Organizations are informing data breaches faster to federal agencies.

In April, 16 hacking tragedies accounted for 47% of all breaches. Additionally, another 29% were caused by insiders; 15% involved lost or stolen information and 9% by unknown means. The total number of records breached in the April attacks for which Protenus has numbers includes 171,268 patients.

The kinds of breaches reported last month involve providers (79% of all incidents), health insurers (5.8%), business associates or vendors (5.8%) and other (8.8%). Data from the monthly Protenus Breach Barometer report comes from DataBreaches.net.

 

Memorial Hermann Health System to pay $2.4M Fine for HIPAA violations

Memorial Hermann Health System in the region of Texas will pay a fine of $2.4 million and enter into a 2-year corrective action plan after revealing a sufferer’s protected health information without the patient’s authorization.

In the year of September 2015 a sufferer at a MHHS clinic presented a fraudulent identification card to office staff, which contacted police, and the sufferer was arrested.

MHHS released multiple press releases to fifteen media outlets on the incident and added the sufferer’s name in the title of the release; it also revealed the sufferer’s protected information during 3 meetings with an advocacy group, state representatives and a state senator, as well as on its website.

Moreover, the HHS Office for Civil Rights found during an investigation that the agency also failed to document in a timely manner the sanctioning of workforce members that revealed the patient’s name.

“Senior management should have known that revealing a sufferer’s name on the title of a press release was a clear privacy violation that would induce a swift OCR response,” OCR Director Roger Severino claimed in a statement. “This case reminds us that agency can readily cooperate with law enforcement without violating HIPAA, but that they must nevertheless sustain to secure patient privacy when making statements to the public and elsewhere.”

Among other requirements, the corrective action plan, available here, needs all MHHS facilities to attest their understanding of permissible uses and disclosures of protected health information, involving disclosures to the media.

Memorial Hermann Health System refused to comment.

 

Cardiology vendor pays $2.5M Fine for HIPAA violation

CardioNet, a cardiology vendor of ambulatory cardiac monitoring products, has paid a fine of $2.5 million and will execute a two-year corrective action plan under a settlement agreement with the Office for Civil Rights of the Department of Health and Human Services, which implements the HIPAA privacy and security rules.

The sanction follows the 2012 theft of a laptop from a worker’s car that compromised the security of electronic protected health information for 1,391 people.

OCR’s inquiry, in accordance to the agency, discovered that Cardiology vendor had poor risk analysis and risk management procedures in place at the time of the theft; policies and procedures to comply with the security rule still were in draft form and hadn’t been implemented, the enforcement agency asserts.

In its inquiry, OCR further learned that CardioNet, now a part of BioTelemetry, had no final policies or procedures to execute safeguards for protected information, involving those for mobile devices.

“CardioNet failed to enforce the specifications needed to develop a security management process to stop, detect, contain and correct security violations,” OCR pointed out in the resolution agreement.

The company, OCR added, didn’t have procedures governing receipt and removal of media containing electronic protected health information, encryption and movement of these items within its facilities until the year of March 2015. That means CardioNet didn’t take action until it was in trouble, a situation that is usually happening when OCR investigates breaches.

Representatives of CardioNet or BioTelemetry didn’t respond to a request for extra information. The corrective action plan is available here.

 

Feds punishes Metro community provider network with $400,000 Fine for HIPAA violations

Unsuccessful to undertook a risk analysis and establish a risk management plan as required under the HIPAA privacy and security rules has landed a provider agency in trouble with the HHS Office for Civil Rights, leading to a $400,000 fine and imposition of a 3-year corrective action plan. Metro Community Provider Network is a huge federally qualified health center with 21 clinics serving 43,000 primarily poor sufferers in 5 counties throughout the Denver region. Its services involve primary care, pharmacy, dental, social work and behavioral health.

In the month of January 2012, Metro Community Provider Network informed OCR that a hacker accessed workers’ email accounts through a phishing attack and gained electronic protected health information on 3,200 people. “OCR’s investigation disclosed that MCPN took important corrective action related to the phishing tragedy; although, the investigation also unveiled that MCPN failed to conduct a risk analysis until the year of mid-February 2012,” the agency asserts in a statement.

When MCPN ultimately conducted a risk analysis, it and subsequent risk analyses weren’t enough to meet HIPAA security rule requirements, in accordance to OCR.

OCR has now levied huge sanctions against almost 50 HIPAA covered entities. Although, starting in the year of 2016, OCR has ramped up HIPAA enforcement actions and is levying considerably higher fines, concentrating on covered entities’ requirement to have viable risk assessment programs in place. Fines levied against providers in the year of 2016 and 2017 have ranged from $2.14 million to $5.55 million.

However, in the declaration of sanctions against Metro Community Provider Network, OCR appeared to provide the organization a financial break due to the nature of the work it does. “With this settlement amount, OCR considered MCPN’s status as a federally qualified health center when balancing the importance of the violation with MCPN’s capability to maintain sufficient financial standing to make sure the provision of ongoing care.”

In response to an appeal for comment, Metro Community Provider Network released the following statement:

“In the year of 2011, Metro Community Provider Network (MCPN) had a phishing tragedy which was reported to Health and Human Services and the Office for Civil Rights. Since that time, the agency has worked with these entities to assure HIPAA compliance, involving reaching an agreed upon settlement of $400,000. MCPN is happy with the work that has been done and continues to assure that sufferer privacy is protected.”

The resolution agreement and corrective action plan are available here.

Office for Civil Rights (OCR) hits Memorial Healthcare System with $5.5M Massive Fine

Memorial Healthcare System in the region of South Florida is being hit with a massive fine as part of a resolution agreement from the OCR (Office for Civil Rights) of the Department of Health and Human Services.

The healthcare agency was cited for lapses in auditing worker access to protected health information, resulting in data breaches impacting 115,143 people. Now, the six-hospital delivery system has paid a $5.5 million massive fine to OCR as part of the resolution agreement to settle violations of the HIPAA privacy and security rules. The Memorial Healthcare System also has agreed to follow a corrective action plan to stop similar data breaches in the future.

The monetary fine is the 2nd largest ever levied by the agency, second merely to the $5.55 million penalty OCR levied previous August against Advocate Health Care for breach tragedies.

Few of the breached information were used to file fraudulent tax returns, OCR noted.

Enhanced OCR enforcement of HIPAA rules continues, and the size of fines for violations is increasing as well. Before the year of 2016, the last record for total fines that OCR levied in any year was $7.9 million; previous year, settlement payments hit $25.6 million.

In the contract that Memorial Healthcare System signed, OCR asserts employees at Memorial and an affiliated physician practice impermissibly accessed PHI. A former worker at the practice, for example, was provided access to PHI for more than a year.

“On the day of April 12, 2012, MHS submitted a breach report to HHS demonstrating that 2 MHS employees unsuitably accessed patient information, involving names, dates of birth and Social Security numbers,” according to OCR. “On the day of July 22, 2012, MHS submitted an extra addendum breach report to notify HHS that during its internal investigation, it discovered extra impermissible access by twelve users at affiliated physician offices. Few of these incidents led to federal charges related to selling protected health information and filing fraudulent tax returns.”

From the time period of January 2011 to June 2012, MHS failed to execute procedures to regularly review audit logs, access reports and security incident tracking reports, and the system further failed to oversee access authorization policies that develop, document, review and modify user rights of access, OCR charged.

Electronic protected health information must be given merely to authorized users, and “Organizations must execute audit controls and review audit logs regularly,” stated Robinsue Frohboese, acting director for OCR, in a statement declaring the sanctions.

In response to the OCR charges and settlement, Memorial Healthcare System released the following statement:

“Safeguarding health information of patient has always been a top priority at Memorial Healthcare System. More than 5 years ago, Memorial was notified that 2 workers were engaging in criminal conduct including theft of patient confidential information in the year of 2011. Memorial instantly terminated those people and started an in-depth internal investigation. During its investigation, Memorial discovered that people who worked in affiliated physicians’ offices had inappropriately accessed patient data by using legitimate log-in credentials of workers in those physicians’ offices.

“True to its culture of compliance and transparency, Memorial proactively reported the actions of the 2 employees and the findings of its internal investigation regarding the affiliated physicians’ staff to the Department of Health and Human Services’ Office of Civil Rights (OCR). It also simultaneously notified all sufferers who might have been affected and provided them with free credit monitoring. Memorial worked closely with law enforcement to help in their investigations, which finally led to federal prosecution and conviction of the criminals.

“Upon learning of the breaches, Memorial rapidly acted to execute new, sophisticated technologies developed to monitor use and access of patient data, further restricted access to protect patient data, and enacted new policies and processes to enhance password security. Memorial employed IBM, a global leader in cybersecurity, to give assessment, response, and monitoring services. IBM sustains to provide cybersecurity services to Memorial today. Memorial also hired an independent technology firm to conduct network audits and scans.

“Memorial’s February 2017 settlement with the OCR resolves entire allegations surrounding these breaches. While Memorial powerfully disagrees with several of OCR’s allegations, has admitted no liability and has opted to settle this case, it nevertheless agrees with the significance OCR places on maintaining the security of patient data.

“Memorial…will sustain to vigorously monitor access and use of patient data and maintain rigorous cybersecurity and internal safeguards.”

 

Children’s Medical Center of Dallas pays $3.2M fine after lost device, HIPAA non-compliance

The Children’s Medical Center of Dallas has paid $3.2 million (£2.58m) to the United States government after a lost device in the year of 2009 was found to have breached HIPAA protocol or HIPAA non-compliance.

The inquiry came about after Children’s Health filed a breach report with the Office for Civil Rights (OCR) in the year of January 2010 which demonstrated the loss of an unencrypted, non-password protected BlackBerry device at the Dallas/Fort Worth International Airport 2 months earlier. In the year of July 2013, the hospital submitted a separate report stating an unencrypted laptop had been stolen from its premises during April of that year. Children’s Medical Center of Dallas has paid $3.2 million fine after lost device and HIPAA non-compliance.

A statement confirming the payment released by the Department of Health and Human Services (HHS) claimed that the OCR investigation had disclosed Children’s Health’s “HIPAA non-compliance rules, particularly, a failure to execute risk management plans, contrary to prior external suggestions to do so, and a failure to deploy encryption or an equivalent alternative measure on all of its laptops, work stations, mobile devices and removable storage media until the day of April 9 2013.”

It added that “despite Children’s information about the risk of maintaining unencrypted ePHI (electronic protected health information) on its devices as far back as the year of 2007, [it] issued unencrypted BlackBerry devices to nurses and permitted its workforce members to continue using unencrypted laptops and other mobile devices until the year of 2013.”

Children’s Medical Center of Dallas has paid $3.2 million fine after lost device and HIPAA non-compliance.

“Ensuring precise security precautions to secure health information, involving recognizing any security risks and instantly correcting them, is important,” claimed Robinsue Frohboese, OCR acting director.

Back in the year of 2013, the Information Commissioner’s Office (ICO) in the UK laid down the law following a data breach from the Royal Veterinary College (RVC). An RVC employee lost a camera which consisted of passport images of 6 potential job applicants in its memory card. In terms of healthcare, one of the more recent customer wins for VMware was to bring LCMC Health on board; a blog post at the time noted how the healthcare provider was ‘moving toward innovations like self-serve kiosks in lobbies…and bring your own device models for medical professionals.’

“However OCR prefers to settle cases and assist entities in executing corrective action plans, a deficiency of risk management not merely costs individuals the security of their data, but it can also cost covered entities a sizable fine,” added Frohboese.

 

HIPAA privacy violations, stolen USB drive costs MAPFRE $2.2M

MAPFRE Life Insurance Company of Puerto Rico has accepted to pay a fine of $2.2 million and enter into a settlement with the HHS Office of Civil rights for violations of the HIPAA privacy violations and security rules that resulted in a breach in the year of August 2011.

MAPFRE had a USB drive consisting of protected health information stolen from its information technology department. Data on the drive involved member names, dates of birth and Social Security numbers, impacting 2,209 individuals.

But it was prior representations to OCR of MAPFRE’s HIPAA agreement that got the company in trouble, with an actual level of non-compliance, in accordance to OCR that triggers multi-million dollar fines.

“The investigation of OCR disclosed MAPFRE’s noncompliance with the HIPAA privacy violations rules, particularly a failure to conduct its risk analysis and implement risk management plans, contrary to its prior representations, and a failure to deploy encryption or an equivalent alternative measure on its laptops and removable storage media until the day of Sept. 1, 2014,” OCR asserts in a statement. “MAPFRE also failed to execute or delayed implementing other corrective measures it informed OCR it would undertake.”

In a resolution agreement that MAPFRE accepted, OCR points out the company further failed to execute a security awareness and training program for all workers, failed to implement encryption and failed to execute reasonable and suitable policies and procedures to comply with HIPAA privacy violations rule.

Now, MAPFRE will step into a 3-year corrective action program that involves a risk analysis, a risk management plan and an initiative to implement procedures to evaluate environmental or operational changes that could impact the security of electronic protected health information.

In the last year, OCR has importantly ramped up HIPAA enforcement and the size of financial penalties, having determined that the industry wasn’t taking protection of patient data seriously enough and required a wake-up call.

After Advocate Health Care in Illinois was hit in the year of August 2016 with a $5.5 million fine—the largest to date—OCR director Jocelyn Samuels had a stern message for the industry. “We expect this settlement sends a powerful message to covered entities that they must include in a comprehensive risk analysis and risk management to make sure that individuals’ electronic protected health information is safe and secure.”

The resolution agreement and corrective action plan are available here.

 

Presence Health agrees to pay HIPAA fine for slow breach response

Presence Health has accepted to pay $475,000 for slow breach response and execute a corrective action plan for failures to comply with the HIPAA breach notification rule.

The sanctions applied on the agency by the HHS Office for Civil Rights are the 1st enforcement action focused on the deficiency of timely breach notification or slow breach response, in accordance to OCR.

“Covered entities require having clear policies and processes in place to respond to the Breach Notification Rule’s timeliness requirements,” claims OCR Director Jocelyn Samuels. “Individuals require prompt notice of a breach of their unsecured PHI so they can take action that could assist to reduce any potential harm caused by the breach.”

Presence operates eleven hospitals across the Illinois, as well as physician practices and long-term care facilities.

OCR became aware of worse consumer breach notification provisions or slow breach response at Presence in the year of late January 2014 after one of its hospitals, Presence St. Joseph Medical Center, notified the agency of a breach of paper records in the month of October 2013. In its report, the hospital claimed that, due to the miscommunication between workforce members, “there was a delay in its provision of breach notifications,” in accordance to OCR.

In inquiring the October 2013 breach, OCR discovered 3 violations of the requirement to notify affected individuals and the media within sixty days of discovery. Presence did not notify affected individuals of the breach until 104 days after discovery, didn’t notify media until 106 days after discovery and didn’t notify HHS and OCR until 101 days after discovery. OCR also came to know that Presence didn’t release notifications following smaller breaches in the year of 2015 and 2016.

Presence Health released the following statement:

“Because patient privacy is a top priority at Presence Health, we’re working diligently with the OCR on all measures needed under the corrective action plan, involving extra associate training in HIPAA policies and processed. This is the culmination of a several-year procedure working with the OCR to resolve a matter we voluntarily reported to the OCR in the year of 2014 related to an isolated tragedy including paper records at a surgery center situated in Joliet, Illinois. This tragedy didn’t include any electronic records and didn’t involve any disclosure of patient contact or financial data. We’re confident that reports on our progress to rapidly execute revised policies and processes will be positive.”

 

HIPAA imposes fine on unprotected files for St. Joseph Health

St. Joseph Health, a 14-hospital delivery system serving parts of Texas, California and New Mexico, is the greatest agency to agree to execute a corrective action plan with the HHS Office for Civil Rights following a violation or beach of protected health information. That’s why HIPAA imposes fine on unsecured files for St. Joseph Health.

Along with the corrective actions, St. Joseph Health will pay a settlement fine of $2,140,500. The agency reported a breach in the year of February 2012 after files created for its EHR meaningful use program were approachable on the Internet for about half of that month. For this purpose, HIPAA imposes fine on unsecured files for St. Joseph Health.

“The server SJH bought to store the files involved a file sharing application whose default settings permitted anyone with an Internet connection to access them,” in accordance to an OCR statement. “Upon execution of this server and the file sharing application, SJH didn’t analyze or modify it. As an outcome, the public had unrestricted approach to PDF files containing the electronic protected health information of 31,800 people, involving sufferer names, health statuses, diagnoses and demographic data.”

 “Entities must not just perform a comprehensive risk analysis, but also must determine and deal potential security risks when implementing enterprise changes affecting ePHI,” OCR Director Jocelyn Samuels claimed in a statement. That’s why HIPAA imposes fine on unsecured files for St. Joseph Health.

The agency appreciated the settlement and released the following statement:

“St. Joseph Health is glad that we could come to a settlement on this problem and we thoroughly regret any undue concern to our sufferers. The facts to remember about this case are that information didn’t include Social Security (numbers), addresses or financial information. Furthermore, there is no indication that the data was utilized by unauthorized persons. Since the situation was discovered, we have contributed in a number of initiatives to make sure the continued security of sufferer data, involving $17 million in enhanced data security infrastructure. These steps and more are intended to provide for the safety and security of our sufferers’ information.”

The resolution agreement and corrective action plan are available here.

 

OCR seeks reasons and solutions for Small Breaches

The Office for Civil Rights (OCR) at the Department of Health and Human Services is clearly becoming dispirited and fed up with the several big and small breaches in the healthcare industry.

This sentiment is developed apparent by OCR’s declaration on the day of August 18 that it, through its regional offices, will more aggressively inquire and pursue the so-called “small” breaches or violations, which are those that affect fewer than 500 people.

In the declaration, OCR indicates that it needs to “more widely inquire the root causes of small breaches or violations affecting fewer than 500 people.” Fascinatingly, the agency recommends that it needs to find “entity and systemic noncompliance” regarded to the reported violations.

Attempting to read between the lines, the statements recommend that OCR considers there are fundamental problems regarding HIPAA agreement among entities. If that assessment is true, then it gives a very obvious or clear understanding and basis for the latest declaration and encouragement to more completely investigate the small breaches.

When determining a small breach, OCR will consider the following elements:

• The size of the breach


• The amount, nature and sensitivity of the PHI included


• Breaches that included unwanted intrusions to IT networks


• Theft of unencrypted PHI


• Instance in which various breach reports from a specific entity raise similar problems

Breaking down the components, few are similar to what goes into breach risk assessment when attempting to evaluate whether there is a low probability of compromise. Although, a couple of the elements depict the increasing uncertainties from recent breach settlements.

The 1^st such component is theft or disposal including the unencrypted PHI. All too frequently, a thumb drive, laptop or other mobiles that isn’t encrypted leads to the exposure of PHI. Provided the relative convenience with which devices can be encrypted and the rate of attention being concentrated on encryption, it is clear why OCR has uncertainties.

Accordingly, task on the encryption front requires changing. From OCR’s opinion, in the absence of a change in the regulations, it can motivate execution of the addressable encryption by striking entities in their pocketbooks. After all of the initial settlements and latest stories concentrating on the deficiency of encryption, this might be the last warning before money will be owed.

The 2^nd component of interest is the concentration on breaches including unwanted intrusions, like hacking or ransomware attacks. It’s no secret that the healthcare industry is hugely observed as very susceptible and ripe for the picking among cybercriminals. The frequency and significance of attacks indicates this reality.

Rather the open season on healthcare, it is very vague that what measures have been taken to step up security. One the other hand, cybercriminals will always be alert of the defensive steps that entities can put into place. Although, that doesn’t mean entities can’t take proactive steps, and it is the basis of those steps, at least from OCR’s view, that is an outworking of the detailed risk analysis called for by HIPAA.

The risk analysis instructs entities in evaluating entire threats and susceptibilities as well as the likelihood of a violation appearing from each of those threats and susceptibilities. If entities honestly observe operations, then arguably entities would be capable to close few of the windows that cyberattacker come in through.

Cyberthreats won’t be going away any time soon, and unless entities need to ignore the double harm of suffering both an attack and enforcement of a penalty from OCR, then entities would be well advised to concentrate on cybersecurity.

Shifting beyond the components of what OCR will inquire with regard to small breaches, the practical effect of these inquiries should also be observed. Curiously, the declaration follows earlier critique that OCR wasn’t doing enough to openly deal breaches impacting a small number of people. The reports faulted the private nature of resolutions as refusing “victims” an understanding of how their loss was sorted out and possibly not doing enough to indicate to entities that there are consequences to not complying with HIPAA agreement.

If the latest plan is a response to those proposed reports, then entities should be wary of what is to come.

Finally, one of the huge points about the declaration is that privacy and security are necessary to trust and the modernization of digital healthcare. Any violation or breach, whether 1 person or millions, affects the real people. Those people might feel betrayed about what will come. If that message is reinforced and a human side to the violations can be forced to the fore, then maybe more visible measure will appear when it comes to securing healthcare data.

Nonetheless how much fines or public settlements are released by OCR, it is up to every business associate, covered entity, and subcontractor managing secured health data to take the essential steps every day to make sure the privacy and security. Agreement with HIPAA isn’t easy and needs ongoing attempt that might not result in clear results. Although, when data remains secure, then everyone will be satisfied.

U-Miss Medical Center receives $2.75M fine for HIPAA breaches

The HHS Office for Civil Rights is continuing its frustrating attempt of sanctioning covered entities and business associates who’ve run afoul of HIPAA security principles, this time taking target at University of Mississippi Medical Center.

UMMC will pay a $2.75 million penalty and stepped into the resolution compliance and corrective action policy after an OCR inquiry determined the hospital was aware of susceptibilities to protected health data since at least the month of April 2005—the compliance information of the HIPAA Security Principle. The agency asserts that the agency took no meaningful action to reduce threat until after the theft of a laptop in the year of 2013. While the computer was password secured, it wasn’t encrypted.

OCR also referred the fact that, while the hospital gave notice of the violation on its web site and to regional media, it didn’t notify sufferers whose data was on the stolen laptop.

“OCR’s inquiry disclosed that ePHI stored on a UMMC network drive was susceptible to unauthorized approach through UMMC’s wireless network because consumers could access an active directory consisting of 67,000 files after giving a generic username and password,” in accordance to an OCR statement. “The directory involved 328 files consisting of the ePHI of an assumed 10,000 sufferers dating back to the year of 2008.”

In the resolution compliance, OCR claimed the hospital failed to execute suitable policies and procedures to comply with HIPAA and protect information. UMMC got agreed to the resolution agreement, but pointed out that the acceptance isn’t an admission of liability.

OCR charged that UMMC had not executed security steps enough decrease the threats and susceptibilities to reasonable and suitable levels; failed to execute safeguards for all workstations approaching ePHI; failed to allocate a distinctive username or number for recognizing and detecting users; permitted workers to access ePHI on a shared department network drive through a generic account that stopped tracking; and failed “to notify each person whose unprotected ePHI was reasonably considered to have been accessed, acquired, utilized or revealed as an outcome of the violation” after the discovery of the violation.

In a 3-year corrective action policy, UMMC commits to designate a qualified worker to be the internal monitor of agreement with the plan, with at least 46 particular milestones of agreement hoped to be completed.

In a statement, UMMC notes it has began substantial improvements in data security in recent years. Improvements involve encryption of entire laptops; remaking of the role and reporting relationships of the chief information security officer; and executing an external assessment and overhaul of its information technology security program.

“Our sufferers should never have to doubt that their security or privacy is a divine trust that we’re devoted to securing as part of our primary ethical values,” claims LouAnn Woodward, MD, vice chancellor for health affairs, in the statement. “We’ve learned from this experience and are working hard to make sure that our data security program meets or exceeds the largest standard.”

2nd phase of HIPAA audits moves into high gear

The long-awaited 2^nd phase of the HIPAA audit program of the HHS Office for Civil Rights is now in complete swing. In accordance to OCR, few covered entities have gained notification letters regarding their inclusion in the desk audit portion.

OCR declared that letters were delivered on the day of July 11 through email to 167 health policies, healthcare contributors and clearinghouses. The agency claimed that desk audits will investigate the selected covered entities’ HIPAA agreement.

“These entities have ten business days, until the day of July 22, 2016, to respond to the document appeals,” OCR stated in the announcement. “Desk audits of business associates will follow this fall.”

Phase Two of OCR’s audit program is significantly concentrated on desk audits of policies and processes, compared with Phase 1. OCR expects this approach will enable the agency to be more effective in audits with lesser resources than would be needed to support complete onsite audits for all agencies.

“The desk audits are focused examinations of documentation of entity agreement with some needs of the HIPAA rules,” in accordance to the declaration. “OCR chose these provisions for focus during the desk audits because our pilot audits, as well as our enforcement activities, have surfaced these provisions as frequent places of noncompliance.”

Those HIPAA needs chosen for desk audit review involve:

• Breach Notification Rule—Timeliness of Notification, and Content of Notification.


• Privacy Rule—Notice of Privacy Practices and Content Requirements, Provision of Notice–Electronic Notice, and Right to Access.


• Security Rule—Security Management Process (Risk Analysis), and Security Management Process (Risk Management).

Daniel Gottlieb, a healthcare law attorney and partner at McDermott Will & Emery, asserts that the Phase Two audit program is placing more attention on places of higher threat to the security of secured health data and on pervasive non-agreement, deployed on OCR’s Phase I audit findings and observations, instead of a detailed review of all of the HIPAA standards.

“In situations where an audit unveils a serious agreement concern, OCR might initiate a compliance review of the audited agency that could lead to civil money penalties,” stated Gottlieb. “OCR’s declaration that it has introduced the Phase 2 HIPAA audit program isn’t surprising in light of recent critique of OCR’s HIPAA imposition attempts by the Office of Inspector General and following the various cyber attacks on the healthcare industry.”

Gottlieb suggests various steps that covered entities and business associates should take to make sure that they are ready for a potential Phase 2 audit, involving:

• Confirming that the agency has recently completed a brief assessment of potential security threats and susceptibilities to the agency, in other words, perform a risk assessment.


• Confirming that entire systems and software that transfer electronic PHI employ encryption technology or that the agency has a documented risk analysis motivating the decision not to employ encryption.


• Making sure that the agency has executed a breach notification policy that rightly depicts the content and deadline needs for breach notification under the Breach Notification Standards.


• Confirming that entire action items recognized in the Risk Assessment have been completed or are on a reasonable timeline to completion

In Phase Two of the audit program, covered entities will be observed for HIPAA agreement, regardless of whether a complaint has been submitted against them. When it comes to business associates, Phase Two is the 1^st time that OCR’s audit program will be straight searching at business associates.

 

Most 2016 Healthcare Data Violations From Unauthorized Approach

While most of the top healthcare data violations in the year 2015 were because of hacking, the majority of the greatest breaches so far this year stem from other problems.

Last year is often referred to as the “Year of the Hack” for healthcare, with the majority of healthcare data violations being caused by third-party cyber attacks. The top 3 tragedies alone combined to potentially affect almost 100 million individuals, and were all involved hacking.

So far, 2016 is not immune from healthcare data violations, but the leading cause of incidents is unauthorized access, according to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) data breach reporting database.

There have been 114 tragedies reported to OCR between Jan. 1, 2016 and June 1, 2016. Of those, 47 were classified as being caused by unauthorized access or disclosure. The rest of the classification breakdown is as follows:

• 34 - hacking/IT incident


• 26 - theft


• 5 - loss


• 2 - improper disposal

However, the greatest healthcare data breach so far this year was because of a hacking incident.

Malware Tragedy in MI Makes Potential PHI Data Breach

A recent potential PHI data breach appeared after malware infected a server, while another possible healthcare data violation was caused by a hacking incident.

Michigan-based Complete Chiropractic and Bodywork Therapies has notified sufferer of a possible PHI data breach after a server was accessed by an unauthorized entity.

In accordance to the OCR’s data breach portal, approximately 4,082 individuals were affected by the healthcare data security event.

Complete Chiropractic and Bodywork Therapies reported that an outside party had acquired access to a server containing PHI starting on the day of November 19, 2015. The practice did not discover the intrusion until after the server malfunctioned on March 19, 2016.

The security event likely occurred after malware infected the practice’s systems, stated the notice on its website. With the help of IT forensic experts, the practice determined that the malware probably scanned its systems to gain login and password data.

The server held patient data, involving treatment, billing and EHR data.

NYP punished with $2.2M fine for HIPAA breach in filming TV series

New York-Presbyterian Hospital has been punished with $2.2 million under sanctions given by the HHS Office for Civil Rights and has stepped into a corrective action policy for unauthorized filming of 2 sufferers while engaging in the “NY Med” television series.

It was the 2^nd HIPAA violation for the New York-Presbyterian Hospital (NYP), which 2 years ago paid $3.3 million and Columbia University paid $1.5 million following a 2010 violation in which protected health data on a shared data network was discovered to be approachable on Google and other various Internet search engines.

The HHS Office for Civil Rights claimed the greatest violation was an outcome of errors in NYP’s judgment in permitting filming of the TV series.

 “In specific, OCR discovered that NYP permitted the ABC crew to film someone who was dying and another person in important distress, even after a medical expert emphasized the crew to stop,” an agency stated.

Overall, OCR discovered that NYP offered the network “virtually unfettered approach to its healthcare facility,” which made an atmosphere where PHI could not be secured. “This case sends a significant message that OCR won’t allow covered entities to compromise their sufferers’ privacy by permitting news or TV crews to film the sufferers without their authorization,” OCR Director Jocelyn Samuels claimed in the announcement.

Under a proposed resolution agreement with OCR, the hospital has stepped into a two-year corrective action policy that involves establishing the new policies and processes to make sure that photography, video or audio recordings—for purposes not regarded to the provision of medical care—can just be done with authorization from a sufferer or the patient’s personal representative.

A range of other compulsory policies and processes will govern various problem regarded to such recordings. Particular workforce HIPAA privacy training policies also are spelled out.

NYP released the following statement on the regulatory sanctions:

“New York-Presbyterian reached agreement with the Office for Civil Rights in case to bring closure to OCR’s review procedure.

“Our involvement in the ABC News documentary program “NY Med” was proposed to educate the public and give insight into the complications of medical care and the regular challenges confronted by our dedicated and compassionate medical professionals. This program, and others that preceded it, garnered much acclaim, and raised the public’s consciousness of significant public health problems, involving organ transplantation and donation. It also vividly expressed how our emergency department medical team operates tirelessly each day to save sufferers’ lives. The hospital sustains to maintain that the filming of this documentary program didn’t violate the HIPAA Privacy Rule.”

 

OCR now concentrating on the official business associate agreements

Since the year 2015, the HHS Office for Civil Rights has sanctioned 6 healthcare covered entities with corrective action policies and financial fines for huge violations of the HIPAA privacy and security principles.

While OCR’s operations are partly funded through HIPAA fines, the ramped up activity seems to be more over clearing out a backlog of HIPAA inquires of breaches prior to the year 2013, claims Valerie Breslin Montague and Laurie Cohen, and both partners at the Nixon Peabody law firm.

Clearing the backlog of previous inquiries will let OCR move on to investigations of breaches that happened after the new rules in the year 2013 that provided the agency authority to regulate business associates, which are a huge source of breaches and a present focus of OCR for compliance or agreement with HIPAA. The 2013 rules also included latest needs or requirements in such places as marketing and genetic testing.

As this new sector of HIPAA compliance enforcement starts, it is significant for covered entities and business associates to identify that how they respond to initial OCR questions goes a long way toward how OCR will respond in kind.

When OCR inquires breach, it looks at the totality of compliance or agreement and whether there is a culture in the agency around privacy and security. Agencies responding rapidly to a breach and to OCR inquiries as it investigates the breach are indicating the suitable culture, Breslin Montague notes.

OCR announcements or declarations of HIPAA fines and corrective action polices send a message to the industry, but also are an instructive moment, in accordance to Cohen. Nixon Peabody uses the announcements to discuss with clients about such problems as who is receiving their protected health data and has the client assessed the recipient’s ability to secure it, and the requirement for the client to regularly reassess their risk analysis.

For example, OCR’s latest sanction of North Memorial Health Care, which included a $1.55 million fine and a corrective action policy, is instructive for other covered entities due to its focus on business associate agreements.

“Various covered entities take a prophylactic access to managing their business associates agreements by sending such agreements to all of their vendors regardless of whether the vendors will be offered approach to PHI,” Nixon Peabody informed the clients in a recent notification. “The North Memorial Resolution Agreement, however, recommends that OCR hopes covered entities to have a more deliberate procedure to assess who is and who is not a business associate.”

Civil rights office seeks review of privacy rule

The Office for Civil Rights at HHS has sent to the White House Office of Management and Budget for review a new privacy rule covering an expanded requirement that healthcare providers track and be able to report to patients any disclosures of their medical records.

Patients have long had limited rights under the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 to demand that providers and other “covered entities” provide them with an accounting of disclosures of their personally identifiable medical information.

Patients have long had limited rights under the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 to demand that providers and other “covered entities” provide them with an accounting of disclosures of their personally identifiable medical information.

The American Recovery and Reinvestment Act of 2009, however, expanded patients' privacy rights and closed a HIPAA exemption that covered entities were not required to audit and account for disclosures for treatment, payment and a broad, catch-all category known as other “healthcare operations,” if the covered entity uses an electronic health-record system. The ARRA eliminated that exemption and the new rule before the OMB provides language to implement the rule change. Patients can demand an accounting of disclosures going back three years from the date the demand is made. The accounting requirement also applies to business associates of covered entities.

In a May 3, 2010, request for public comment on the disclosure rules (PDF), the Office for Civil Rights at HHS noted that the new rule would require covered entities who have acquired an EHR after Jan. 1, 2009, to comply with the new accounting requirement by Jan. 1, 2011, unless the OCR extends the deadline, which is allowed but only no later than 2013.

HHS Adds to List of Data Breaches

Trouble viewing this? Click here to view online.

HHS Adds to List of Data Breaches The Office for Civil Rights in the Department of Health and Human Services has added five more organizations to a Web page listing covered entities that have reported breaches of unsecured protected health information affecting more than 500 individuals. OCR launched the page in February with the listings of 47 organizations. Go to Stimulus >>     Email this story >> Feds Award More MU Planning Grants Six more states will receive matching federal planning funds to implement programs to administer Medicaid incentive payments for meaningful use of electronic health records, bringing the total to at least 16 states and the U.S. Virgin Islands. Go to Stimulus >>     Email this story >> NIST Readies EHR Testing The National Institute of Standards and Technology has released the first of four installments, called Waves, of new test methods and related software for ensuring electronic health records systems comply with meaningful use requirements. Go to Stimulus >>     Email this story >> Paper Studies Patient Consent for HIEs A new white paper from George Washington University's Department of Health Policy examines whether, to what extent, and how patients should have the option to control the sharing of their health information in a health information exchange. Go to Stimulus >>     Email this story >> GE Buy Targets Small Practices GE Healthcare has acquired MedPlexus Inc., a vendor of software for small, independent physician practices, for an undisclosed sum. Go to Stimulus >>     Email this story >> Insurer Adds Breach Protection The Doctors Company, which sells malpractice insurance to physicians, in January started offering additional coverage to solo and small practices to protect them in instances of breaches of protected health information. Go to Stimulus >>     Email this story >> You are currently subscribed to SNap(R) Health Informatics SNap(R) Health Informatics

HHS Adds to List of Data Breaches

The Office for Civil Rights in the Department of Health and Human Services has added five more organizations to a Web page listing covered entities that have reported breaches of unsecured protected health information affecting more than 500 individuals. OCR launched the page in February with the listings of 47 organizations.

The posting is mandated under the HHS breach notification rule that was authorized under the HITECH Act. Under the rule, notification within 60 days to HHS and the media is required when a breach affects more than 500 individuals. Smaller breaches must be annually reported to HHS. Business associates of HIPAA-covered entities must notify the affected covered entity of breaches.

The five new listings are:
* Montefiore Medical Center, New York, 625 affected individuals, theft of a laptop;
* Private Practice, San Antonio, 21,000 affected individuals, theft of a portable device;
* Thrivent Financial for Lutherans, Wisconsin, 9,500 affected individuals, theft of a laptop;
* Wyoming Department of Health, 9,023 affected individuals, unauthorized access of a network server; and
* Aspen Dental Care P.C., Colorado, 2,500 affected individuals, theft of an undisclosed nature.

Private practices are not individually identified in the listing, in compliance with the federal Privacy Act. HHS is working to permit the naming of private practices. The full list of large breaches, which the OCR will regularly update, is available at hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html.
--Joseph Goedert