Tag: HITECH

Moving to the Cloud: Some Key Considerations for Healthcare Entities

Covington & Burling LLP

Healthcare providers, health plans, and other entities are increasingly utilizing cloud services to collect, aggregate, store and process data.  A recent report by IDC Health Insights suggests that 80 percent of healthcare data is expected to pass through the cloud by 2020.  As a substantial amount of healthcare data comprises “personal information” or “protected health information” (PHI), federal and state privacy and security laws, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, raise significant questions for healthcare providers and health plans utilizing the cloud in connection with such data.  Such questions include whether HIPAA requirements extend to cloud providers, how and if entities storing health data on the cloud will be notified in case of a breach, and whether storage of data overseas by cloud providers triggers any additional obligations or concerns.

Given the complex legal issues at play, any contract between a healthcare provider or health plan and a cloud service provider that involves using the cloud in connection with PHI should therefore address the regulatory restrictions and requirements applicable to PHI.  By way of example, recent guidance from the HHS Office for Civil Rights suggests that health care providers must likely have a business associate agreement in place with their cloud service provider.  Moreover, although cloud providers might not regularly access the data they store and may never “use” or “disclose” that data as those terms are defined under HIPAA, cloud providers probably need to adhere to HIPAA breach notification requirements.  There have also been indications of late that HHS may consider it advisable, if not required, that entities subject to the HIPAA Security Rule encrypt PHI data even when that data is at rest and not being transmitted electronically.  The recent data breaches involving health plans Anthem and Premera highlight the vulnerability of health care data and may lead to additional pressure for providers to implement additional encryption measures.

Even if HIPAA rules do not apply to cloud service provider contracts, healthcare providers and health plans storing data on the cloud should be aware that many states now have privacy and breach notification laws which could come into play.

Finally, in addition to addressing the regulatory requirements and data privacy and security, a healthcare provider or health plan should negotiate appropriate service level terms with the cloud provider that address such issues as the performance requirements for the cloud network and the process and procedures for addressing problems with the cloud network.  The healthcare provider or health plan should also include appropriate back-up and disaster recovery provisions in the contract with the cloud provider, as well as appropriate remedies in the event it suffers losses as a result of the contract.

ARTICLE BY

Paige M. Jennings
Anna Kraus
Ramy Ramadan
Lee J. Tiedrich
Covington & Burling LLP
Covington E-Health

Office for Civil Rights (OCR) to Begin Phase 2 of HIPAA Audit Program

Mcdermott Will Emery Law Firm

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) will soon begin a second phase of audits (Phase 2 Audits) of compliance with Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy, security and breach notification standards (HIPAA Standards) as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. Unlike the pilot audits during 2011 and 2012 (Phase 1 Audits), which focused on covered entities, OCR will conduct Phase 2 Audits of both covered entities and business associates.  The Phase 2 Audit Program will focus on areas of greater risk to the security of protected health information (PHI) and pervasive noncompliance based on OCR’s Phase I Audit findings and observations, rather than a comprehensive review of all of the HIPAA Standards.  The Phase 2 Audits are also intended to identify best practices and uncover risks and vulnerabilities that OCR has not identified through other enforcement activities.  OCR will use the Phase 2 Audit findings to identify technical assistance that it should develop for covered entities and business associates.  In circumstances where an audit reveals a serious compliance concern, OCR may initiate a compliance review of the audited organization that could lead to civil money penalties.

The following sections summarize OCR’s Phase 1 Audit findings, describe the Phase 2 Audit program and identify steps that covered entities and business associates should take to prepare for the Phase 2 Audits.

Phase 1 Audit Findings

OCR audited 115 covered entities under the Phase 1 Audit program, with the following aggregate results:

  • There were no findings or observations for only 11% of the covered entities audited;
  • Despite representing just more than half of the audited entities (53%), health care providers were responsible for 65% of the total findings and observations;
  • The smallest covered entities were found to struggle with compliance under all three of the HIPAA Standards;
  • Greater than 60% of the findings or observations were Security Standard violations, and 58 of 59 audited health care provider covered entities had at least one Security Standard finding or observation even though the Security Standards represented only 28% of the total audit items;
  • Greater than 39% of the findings and observations related to the Privacy Standards were attributed to a lack of awareness of the applicable Privacy Standard requirement; and
  • Only 10% of the findings and observations were attributable to a lack of compliance with the Breach Notification Standards

The Phase 2 Audit Program

Selection of Phase 2 Audit Recipients

Unlike the Phase 1 Audit Program, which focused on covered entities, OCR will conduct Phase 2 Audits of both covered entities and business associates.  OCR has randomly selected a pool of 550–800 covered entities through the National Provider Identifier database and America’s Health Insurance Plans’ databases of health plans and health care clearinghouses.  OCR will issue a mandatory pre-audit screening survey to the pool of covered entities this summer.  The survey will address organization size measures, location, services and contact information.  Based on the responses, the agency will select approximately 350 covered entities, including 232 health care providers, 109 health plans and 9 health care clearinghouses, for Phase 2 Audits.  OCR intends to select a wide range of covered entities and will conduct the audits between October 2014 and June 2015.

OCR will notify and send data requests to the 350 selected covered entities this fall.  The data requests will ask the covered entities to identify and provide contact information for their business associates.  OCR will select the business associates that will participate in the Phase 2 Audits from this pool.

Audit Process

OCR will audit approximately 150 of the 350 selected covered entities and 50 of the selected business associates for compliance with the Security Standards, 100 covered entities for compliance with the Privacy Standards and 100 covered entities for compliance with the Breach Notification Standards.  OCR will initiate the Phase 2 Audits of covered entities by sending the data requests this fall and then initiate the Phase 2 Audits of business associates in 2015.

Covered entities and business associates will have two weeks to respond to OCR’s audit request.  The data requests will specify the content, file names and other documentation requirements, and the auditors may contact the covered entities and business associates for clarifications or additional documentation.  OCR will only consider current documentation that is submitted on time.  Failure to respond to a request could lead to a referral to the applicable OCR Regional Office for a compliance review.

Unlike the Phase 1 Audits, OCR will conduct the Phase 2 Audits as desk reviews with an updated audit protocol and not on-site at the audited organization.  OCR will make the Phase 2 Audit protocol available on its website so that entities may use it for internal compliance assessments.

The Phase 2 Audits will target HIPAA Standards that were sources of high numbers of non-compliance in the Phase 1 Audits, including:  risk analysis and risk management; content and timeliness of breach notifications; notice of privacy practices; individual access; Privacy Standards’ reasonable safeguards requirement; training to policies and procedures; device and media controls; and transmission security.  OCR also projects that Phase 2 Audits in 2016 will focus on the Security Standards’ encryption and decryption requirements, facility access control, breach reports and complaints, and other areas identified by earlier Phase 2 Audits.  Phase 2 Audits of business associates will focus on risk analysis and risk management and breach reporting to covered entities.

OCR will present the organization with a draft audit report to allow management to comment before it is finalized.  OCR will then take into account management’s response and issue a final report.

What Should You Do to Prepare for the Phase 2 Audits?

Covered entities and business associates should take the following steps to ensure that they are prepared for a potential Phase 2 Audit:

  • Confirm that the organization has recently completed a comprehensive assessment of potential security risks and vulnerabilities to the organization (the Risk Assessment);
  • Confirm that all action items identified in the Risk Assessment have been completed or are on a reasonable timeline to completion;
  • Ensure that the organization has a complete inventory of business associates for purposes of the Phase 2 Audit data requests;
  • If the organization has not implemented any of the Security Standards’ addressable implementation standards for any of its information systems, confirm that the organization has documented (i) why any such addressable implementation standard was not reasonable and appropriate and (ii) all alternative security measures that were implemented;
  • Ensure that the organization has implemented a breach notification policy that accurately reflects the content and deadline requirements for breach notification under the Breach Notification Standards;
  • Health care provider and health plan covered entities should ensure that they have a compliant Notice of Privacy Practices and not only a website privacy notice;
  • Ensure that the organization has reasonable and appropriate safeguards in place for PHI that exists in any form, including paper and verbal PHI;
  • Confirm that workforce members have received training on the HIPAA Standards that are necessary or appropriate for a workforce member to perform his/her job duties;
  • Confirm that the organization maintains an inventory of information system assets, including mobile devices (even in a bring your own device environment);
  • Confirm that all systems and software that transmit electronic PHI employ encryption technology or that the organization has a documented the risk analysis supporting the decision not to employ encryption;
  • Confirm that the organization has adopted a facility security plan for each physical location that stores or otherwise has access to PHI, in addition to a security policy that requires a physical security plan; and
  • Review the organization’s HIPAA security policies to identify any actions that have not been completed as required (e.g., physical security plans, disaster recovery plan, emergency access procedures, etc.)
ARTICLE BY

Patrick Callaghan
Daniel F. Gottlieb
Edward G. Zacharias
Of:
McDermott Will & Emery

Health Care Information Privacy and Security Forum

The National Law Review is pleased to inform you of American Conference Institute’s Health Care Information Privacy and Security Forum Conference on Monday, December 05 to Tuesday, December 06, 2011 at the Union League, Philadelphia, PA.

ACI

Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda… [I]t is more important than ever to ensure consumer trust in theprivacy and security of their health information and in the industry’s use of new technology.

Statement on Privacy and Security, Building Trust in
Health Information Exchange, July 8, 2010.
We Have Entered the Era of Health Information Technology and Face New and Daunting Challenges in Keeping Health Information Private and Secure. Assess Your Current HIPAA Compliance Program to Ensure Best HIT Practices as You Prepare for New Privacy and Security Responsibilities in the Age of HITECH.

Privacy and security of health care information are critical concerns for HIPAA covered entities and an ever expanding circle of business associates.  Knowing the basics of the HIPAA are no longer enough in the age of HITECH when mandates giving rise to the predominance of EHRs and HIEs are taking center stage in the privacy and security challenges with which privacy, information, and security officers, and their counsel must contend every day.  The modes and modalities for storing health care information are becoming more and more complex in the age of HIT — as are the safeguards for keeping this information from unauthorized disclosure.

Now is Not the Time for Regulatory Paralysis, but for Action.

Industry stakeholders are analyzing their obligations under the draft accounting and disclosure rule and awaiting the release of the final HIPAA privacy rule. However, they know that they cannot remain paralyzed with anticipation, but must act upon the information they have and that which they are already obligated to do. Now is the time to ensure that all systems are in compliance with existing law and regulation and flexible enough for reconciliation with new requirements.

Attend ACI’s Health Care Privacy and Security Forum and Get the Critical Information that You Need to Meet Your HIPAA
and HITECH Privacy and Security Challenges Head-On. 

ACI’s Health Care Privacy and Security Forum has been designed to help you navigate the legal and business complexities associated with HIPAA, HITECH (as well as state privacy and security laws and regulations) and the ever evolving legal and regulatory privacy and security landscape. Our faculty of privacy and security experts will walk you through legal and business challenges associated with the anticipated regulations; HIT infrastructure and EHRs; HIEs; business associates; breach; encryption; and enforcement.

Benefit from Special Training and Strategy Sessions that Will Address the Essentials of HIPAA and HITECH and Critical Privacy and Security Compliance Audit Competencies.

To enhance and complete your conference experience, we are pleased to offer the following training and strategy sessions:

•    HIPAA and HITECH Boot Camp: Intensive Training in Privacy and Security Essentials for Health Care Professionals which will provide you with the legal and regulatory backdrop for the more in-depth HIPAA and HITECH controversies discussed in the main conference. This is the perfect course for attendees who are new to health care privacy and security matters or for more experienced professionals who are in need of a refresher; and

•    The Working Group on Auditing, Updating and Perfecting Your Existing HIPAA / HITECH Privacy and Security Compliance Program which will help you implement best practices to ensure that your current health care privacy and security program is in-check with current law and regulations and prepare you for HITECH-mandated HHS compliance audits applicable to both HIPAA covered-entities and business associates.

As an added bonus, your conference registration includes
your choice of one of these sessions.

Reserve Your Place Now at this Critical HIPAA and HITECH Event.
Clearly, this is the health care privacy and security conference that every legal or business advisor to a HIPAA covered entity or business associate cannot afford to miss. Register now by calling 1-888-224-2480, faxing your registration form to 1-877-927-1563 or logging on to www.AmericanConference.com/HIPAA-HITECH.

Health Care Information Privacy and Security Forum

The National Law Review is pleased to inform you of American Conference Institute’s Health Care Information Privacy and Security Forum Conference on Monday, December 05 to Tuesday, December 06, 2011 at the Union League, Philadelphia, PA.

ACI

Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda… [I]t is more important than ever to ensure consumer trust in theprivacy and security of their health information and in the industry’s use of new technology.

Statement on Privacy and Security, Building Trust in
Health Information Exchange, July 8, 2010.
We Have Entered the Era of Health Information Technology and Face New and Daunting Challenges in Keeping Health Information Private and Secure. Assess Your Current HIPAA Compliance Program to Ensure Best HIT Practices as You Prepare for New Privacy and Security Responsibilities in the Age of HITECH.

Privacy and security of health care information are critical concerns for HIPAA covered entities and an ever expanding circle of business associates.  Knowing the basics of the HIPAA are no longer enough in the age of HITECH when mandates giving rise to the predominance of EHRs and HIEs are taking center stage in the privacy and security challenges with which privacy, information, and security officers, and their counsel must contend every day.  The modes and modalities for storing health care information are becoming more and more complex in the age of HIT — as are the safeguards for keeping this information from unauthorized disclosure.

Now is Not the Time for Regulatory Paralysis, but for Action.

Industry stakeholders are analyzing their obligations under the draft accounting and disclosure rule and awaiting the release of the final HIPAA privacy rule. However, they know that they cannot remain paralyzed with anticipation, but must act upon the information they have and that which they are already obligated to do. Now is the time to ensure that all systems are in compliance with existing law and regulation and flexible enough for reconciliation with new requirements.

Attend ACI’s Health Care Privacy and Security Forum and Get the Critical Information that You Need to Meet Your HIPAA
and HITECH Privacy and Security Challenges Head-On. 

ACI’s Health Care Privacy and Security Forum has been designed to help you navigate the legal and business complexities associated with HIPAA, HITECH (as well as state privacy and security laws and regulations) and the ever evolving legal and regulatory privacy and security landscape. Our faculty of privacy and security experts will walk you through legal and business challenges associated with the anticipated regulations; HIT infrastructure and EHRs; HIEs; business associates; breach; encryption; and enforcement.

Benefit from Special Training and Strategy Sessions that Will Address the Essentials of HIPAA and HITECH and Critical Privacy and Security Compliance Audit Competencies.

To enhance and complete your conference experience, we are pleased to offer the following training and strategy sessions:

•    HIPAA and HITECH Boot Camp: Intensive Training in Privacy and Security Essentials for Health Care Professionals which will provide you with the legal and regulatory backdrop for the more in-depth HIPAA and HITECH controversies discussed in the main conference. This is the perfect course for attendees who are new to health care privacy and security matters or for more experienced professionals who are in need of a refresher; and

•    The Working Group on Auditing, Updating and Perfecting Your Existing HIPAA / HITECH Privacy and Security Compliance Program which will help you implement best practices to ensure that your current health care privacy and security program is in-check with current law and regulations and prepare you for HITECH-mandated HHS compliance audits applicable to both HIPAA covered-entities and business associates.

As an added bonus, your conference registration includes
your choice of one of these sessions.

Reserve Your Place Now at this Critical HIPAA and HITECH Event.
Clearly, this is the health care privacy and security conference that every legal or business advisor to a HIPAA covered entity or business associate cannot afford to miss. Register now by calling 1-888-224-2480, faxing your registration form to 1-877-927-1563 or logging on to www.AmericanConference.com/HIPAA-HITECH.

Health Care Information Privacy and Security Forum

The National Law Review is pleased to inform you of American Conference Institute’s Health Care Information Privacy and Security Forum Conference on Monday, December 05 to Tuesday, December 06, 2011 at the Union League, Philadelphia, PA.

ACI

Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda… [I]t is more important than ever to ensure consumer trust in theprivacy and security of their health information and in the industry’s use of new technology.

Statement on Privacy and Security, Building Trust in
Health Information Exchange, July 8, 2010.
We Have Entered the Era of Health Information Technology and Face New and Daunting Challenges in Keeping Health Information Private and Secure. Assess Your Current HIPAA Compliance Program to Ensure Best HIT Practices as You Prepare for New Privacy and Security Responsibilities in the Age of HITECH.

Privacy and security of health care information are critical concerns for HIPAA covered entities and an ever expanding circle of business associates.  Knowing the basics of the HIPAA are no longer enough in the age of HITECH when mandates giving rise to the predominance of EHRs and HIEs are taking center stage in the privacy and security challenges with which privacy, information, and security officers, and their counsel must contend every day.  The modes and modalities for storing health care information are becoming more and more complex in the age of HIT — as are the safeguards for keeping this information from unauthorized disclosure.

Now is Not the Time for Regulatory Paralysis, but for Action.

Industry stakeholders are analyzing their obligations under the draft accounting and disclosure rule and awaiting the release of the final HIPAA privacy rule. However, they know that they cannot remain paralyzed with anticipation, but must act upon the information they have and that which they are already obligated to do. Now is the time to ensure that all systems are in compliance with existing law and regulation and flexible enough for reconciliation with new requirements.

Attend ACI’s Health Care Privacy and Security Forum and Get the Critical Information that You Need to Meet Your HIPAA
and HITECH Privacy and Security Challenges Head-On. 

ACI’s Health Care Privacy and Security Forum has been designed to help you navigate the legal and business complexities associated with HIPAA, HITECH (as well as state privacy and security laws and regulations) and the ever evolving legal and regulatory privacy and security landscape. Our faculty of privacy and security experts will walk you through legal and business challenges associated with the anticipated regulations; HIT infrastructure and EHRs; HIEs; business associates; breach; encryption; and enforcement.

Benefit from Special Training and Strategy Sessions that Will Address the Essentials of HIPAA and HITECH and Critical Privacy and Security Compliance Audit Competencies.

To enhance and complete your conference experience, we are pleased to offer the following training and strategy sessions:

•    HIPAA and HITECH Boot Camp: Intensive Training in Privacy and Security Essentials for Health Care Professionals which will provide you with the legal and regulatory backdrop for the more in-depth HIPAA and HITECH controversies discussed in the main conference. This is the perfect course for attendees who are new to health care privacy and security matters or for more experienced professionals who are in need of a refresher; and

•    The Working Group on Auditing, Updating and Perfecting Your Existing HIPAA / HITECH Privacy and Security Compliance Program which will help you implement best practices to ensure that your current health care privacy and security program is in-check with current law and regulations and prepare you for HITECH-mandated HHS compliance audits applicable to both HIPAA covered-entities and business associates.

As an added bonus, your conference registration includes
your choice of one of these sessions.

Reserve Your Place Now at this Critical HIPAA and HITECH Event.
Clearly, this is the health care privacy and security conference that every legal or business advisor to a HIPAA covered entity or business associate cannot afford to miss. Register now by calling 1-888-224-2480, faxing your registration form to 1-877-927-1563 or logging on to www.AmericanConference.com/HIPAA-HITECH.

Health Care Information Privacy and Security Forum

The National Law Review is pleased to inform you of American Conference Institute’s Health Care Information Privacy and Security Forum Conference on Monday, December 05 to Tuesday, December 06, 2011 at the Union League, Philadelphia, PA.

 

ACI

 

Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda… [I]t is more important than ever to ensure consumer trust in theprivacy and security of their health information and in the industry’s use of new technology.

Statement on Privacy and Security, Building Trust in
Health Information Exchange, July 8, 2010.

 

We Have Entered the Era of Health Information Technology and Face New and Daunting Challenges in Keeping Health Information Private and Secure. Assess Your Current HIPAA Compliance Program to Ensure Best HIT Practices as You Prepare for New Privacy and Security Responsibilities in the Age of HITECH.

Privacy and security of health care information are critical concerns for HIPAA covered entities and an ever expanding circle of business associates.  Knowing the basics of the HIPAA are no longer enough in the age of HITECH when mandates giving rise to the predominance of EHRs and HIEs are taking center stage in the privacy and security challenges with which privacy, information, and security officers, and their counsel must contend every day.  The modes and modalities for storing health care information are becoming more and more complex in the age of HIT — as are the safeguards for keeping this information from unauthorized disclosure.

Now is Not the Time for Regulatory Paralysis, but for Action.

Industry stakeholders are analyzing their obligations under the draft accounting and disclosure rule and awaiting the release of the final HIPAA privacy rule. However, they know that they cannot remain paralyzed with anticipation, but must act upon the information they have and that which they are already obligated to do. Now is the time to ensure that all systems are in compliance with existing law and regulation and flexible enough for reconciliation with new requirements.

Attend ACI’s Health Care Privacy and Security Forum and Get the Critical Information that You Need to Meet Your HIPAA
and HITECH Privacy and Security Challenges Head-On.

ACI’s Health Care Privacy and Security Forum has been designed to help you navigate the legal and business complexities associated with HIPAA, HITECH (as well as state privacy and security laws and regulations) and the ever evolving legal and regulatory privacy and security landscape. Our faculty of privacy and security experts will walk you through legal and business challenges associated with the anticipated regulations; HIT infrastructure and EHRs; HIEs; business associates; breach; encryption; and enforcement.

Benefit from Special Training and Strategy Sessions that Will Address the Essentials of HIPAA and HITECH and Critical Privacy and Security Compliance Audit Competencies.

To enhance and complete your conference experience, we are pleased to offer the following training and strategy sessions:

•    HIPAA and HITECH Boot Camp: Intensive Training in Privacy and Security Essentials for Health Care Professionals which will provide you with the legal and regulatory backdrop for the more in-depth HIPAA and HITECH controversies discussed in the main conference. This is the perfect course for attendees who are new to health care privacy and security matters or for more experienced professionals who are in need of a refresher; and

•    The Working Group on Auditing, Updating and Perfecting Your Existing HIPAA / HITECH Privacy and Security Compliance Program which will help you implement best practices to ensure that your current health care privacy and security program is in-check with current law and regulations and prepare you for HITECH-mandated HHS compliance audits applicable to both HIPAA covered-entities and business associates.

As an added bonus, your conference registration includes
your choice of one of these sessions.

Reserve Your Place Now at this Critical HIPAA and HITECH Event.
Clearly, this is the health care privacy and security conference that every legal or business advisor to a HIPAA covered entity or business associate cannot afford to miss. Register now by calling 1-888-224-2480, faxing your registration form to 1-877-927-1563 or logging on to www.AmericanConference.com/HIPAA-HITECH.