HIPAA Security NWOAHU Presented by Barb Gerken 11/12/2013
Jan 19, 2016
HIPAA Security
NWOAHU
Presented by Barb Gerken11/12/2013
Omnibus Rule Updates of 2013 to the HITECH Act under ARRA
ARRA of 2009, Federal Stimulus Bill (February 17, 2009)
HITECH requirements deadline was February 17, 2010
Omnibus Rule Updates of 2013 Final Ruling by HHS January 17, 2013 Detailed guidance with 500+ pages of
legislation. Final rule was effective March 26, 2013. Covered Entities and Business Associates
compliance deadline as September 23, 2013
What is the Security Rule?The HIPAA Security Rule is a technology neutral, federally
mandated “floor” of protection whose primary objective is to protect the confidentiality, integrity and availability of individual identifiable health information in electronic form when it is stored, maintained, or transmitted.
Confidentiality: ePHI concealed from people who do not have the right to see it
Integrity: Information not improperly changed or deleted Availability: Information can be accessed when needed
Federally Mandated “Floor” of Protection Comprehensive Scalable Technology Neutral
Flexibility in the Security Rule Technology Neutral (does not specify
particular technologies to use) and organizations may use any security measures that will allow it to reasonably and appropriately implement the rule.
Allows organizations to take into account: Their size, complexity and capabilities Their technical infrastructure, hardware, and
software security capability The costs of security measures The probability and criticality of potential risks
to ePHI Their access to and use of ePHI
Security Rule Objective Ensure the confidentiality, integrity and
availability of all ePHI that an organization creates, receives, maintains or transmits
Protect against reasonably anticipated hazards to the security or integrity of ePHI (floods, fires, etc.)
Protect against any reasonably anticipated uses or disclosures of ePHI not permitted by the Privacy Rule
Ensure compliance by the organization’s workforce.
What is protected by the Security Rule?
Electronic Protected Health Information (ePHI) which is individually identifiable health information relating to the past, present or future health condition of the individual in electronic form when it is stored, maintained, or transmitted.
Examples Electronic Claims Computer Databases with PHI Emails Paper printouts of electronic information
Who Must Comply with the Security Rule? Covered Entities
Healthcare Providers Health Plans
Health Insurance Companies, HMOs, Employer group health plans, Government programs: Medicare, Medicaid, VA programs
Business Associates: All third party vendors and business partners that create, receive, maintain or transmit PHI on behalf of a Covered Entity Accountants, Lawyers, Consultants, Software
Companies, Asset Recyclers, IT Consultants, PBMs A Broker is a Business Associate of their Employer
Group Client’s health plan. An employer should have a signed Business Associate Agreement with their Broker.
Who Must Comply with the Security Rule?
Any person or organization that stores or transmits individually identifiable health information electronically.
This includes both Covered Entities and Business Associates.
With the wide spread use of computers, most organizations will need to comply with the Security standards. The only organizations that won’t need to comply are those that only store individually identifiable health information on paper and do not utilize computer systems.
Required vs. AddressableSecurity Standards
Covered Entities and Business Associates are required to comply with every Security Rule “Standard.” However, the Security Rule divides the implementation specifications within those standards into two types: Required Addressable
***It is important to emphasize that addressable does not mean optional!!!!!!!
Required vs. Addressable Implementation Specs
Required –must be implemented by the organization
Addressable – permits organizations to determine whether the addressable implementation specification is reasonable and appropriate for that organization. If a specification is reasonable and appropriate
it must be implemented. If a specification is not reasonable and
appropriate an organization has two options: Implement an equivalent alternative measure that
accomplishes the same purpose as the addressable spec
Document how the overall standard can be met without implementation of the standard and an alternative measure
Penalties for Non-Compliance Non-compliance is a civil offense that carries a penalty
ranging from $100-$50,000 per violation with caps of $25,000 to $1.5 million for all identical violations of a single requirement in a calendar year. Enforced by Office of Civil Rights (OCR) within HHS.
Unauthorized Disclosure or Misuse of Protected Health Information under false pretenses or with intent to sell, transfer, or use for personal gain, or malicious harm is a criminal offense. Penalties for criminal offenses can be up to $250,000 in fines and up to 10 years in prison. Enforced by the Department of Justice
Penalties may apply to the individual violator but may also apply to an organization or even to its officers.
Penalties for Non-ComplianceThere are 4 categories for penalties Did Not Know
This is when you did not know or would not have known through exercise of reasonable discretion that the disclosure or breach was a violation of HIPAA Rules.
Reasonable Cause This is when you should have known what was going on,
but you had a violation. Willful Neglect – Corrected
This is when you ignored the Law, and you got caught, but you corrected the issue within 30 days.
Willful Neglect – Not Corrected This is when you ignored the Law, your were caught,
and you decided not to correct the issue.
Non-Compliance Penalties from Omnibus Ruling
Violation Category 1176(a)(1)
Each Violation Maximum fine for an identical violation in a
calendar year
(A) Did Not Know $100-$50,000 $1,500,000
(B) Reasonable Cause $1,000-$50,000 $1,500,000
(C)(i) Willful Neglect-Corrected $10,000-$50,000 $1,500,000
(C)(ii) Willful Neglect-Not Corrected
$50,000 $1,500,000
Criminal Penalties Direct at individuals
Knowingly obtaining or disclosing PHI: Fine of up to $50,000 plus up to one year in prison
Offenses committed under false pretenses: Fine up to $100,000 plus up to five years in prison
Offenses committed with the intent to sell, transfer or use for commercial advantage, personal gain or malicious harm: Fines of $250,000, and up to ten years in prison
Implementation Lag Healthcare Industry in General
95 percent of organizations have internet connectivity
25 percent have no firewalls 65 percent intend to integrate web
applications 24 percent conduct security awareness
programs 71 percent provide internal system-wide
computerized client information
General Requirements & Structure
Increasing Security with each safeguard Privacy Rule
Reasonable Safeguards for all PHI Administrative Safeguards
P&Ps designed to show how the entity will comply with the security rule
Physical Safeguards Controlling physical access to protect against
inappropriate access to protected data Technical Safeguards
Controlling access to computer systems and the protection of communications containing PHI transmitted electronically over open networks
General Requirements & Structure
Within the security categories, there are 18 standards, 12 with implementation specifications, six without implementation specifications.
A standard defines what an organization must do; Implementation specifications describe how it must be done.
Security Management Process Requires an organization to implement
policies and procedures to prevent, detect and contain and correct security violations Risk Analysis Risk Management Sanction Policy Information System Activity Review
All are required, not addressable.Risk analysis and sanction policy must be
documented, retained for six years and should be periodically reassessed and updated as needed.
Assigned Security Responsibility Required, not Addressable Must designate a security official (one
individual, not an organization) Responsible for development and
implementation of the policies and procedures and having overall responsibility for the security of the organizations ePHI. HIPAA Privacy Officer generally the best candidate Do not just assign to IT department, it is much
more than just a technical solution.
Information Access Management IAM standard requires an organization to implement
P&Ps to access ePHI on when such access is appropriate based on a user’s or recipient’s role. Includes following implementation specifications Isolation of Healthcare Clearinghouse Function
(required) Protect ePHI appropriate for access to a portion of a
larger organization from unauthorized access by persons of that larger organization
Access Authorizations (addressable) P&Ps with specific access levels for all personnel
Access Establishment and Modifications (addressable) P&Ps to specify how to access to ePHI is granted and
modified.
Information Access Management: Guidelines for Levels of Access Restrict access rights to the minimum necessary Define types of users, roles and access labels Verify the identity of individuals who attempt to
access information Establish criteria for when access rights should
change Never allow access rights to be transferred among
users Communicate policies to every person that has access
to ePHI Review policies and procedures annually
Security Awareness and Training
Standard requires an organization to train all members or their workforce on its security policies and procedures and includes the following implementation specifications (all are addressable): Security Reminders Protection from Malicious Software Log-in Monitoring Password Management
Security Incident Procedures Requires an organization to implement policies and
procedures to address security incidents (the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems operations in an information system) and includes a single implementation specifications, which is required: Response and Reporting
Relates to internal reporting of security incidents and does not specifically require the organization to report the incident to any outside entity, except if they are dependent upon business or legal considerations.
Develop P&Ps to identify and respond Mitigate harmful effects known to the organization Document security incidents and their outcomes
Contingency Plan
Requires an organization to implement P&Ps for responding to an emergency or other occurrence (i.e. fire, vandalism, system failure, nature disaster) that damages systems that contain ePHI
Contingency Plan5 Implementation Specs
Data Backup Plan (required) Should be kept offsite to protect them from fire,
flood or other disaster at the facility
Disaster Recovery Plan (required) Emergency Mode Operation Plan (required) Testing & Revision Procedure (addressable) Applications and Data Criticality Analysis
(addressable)
Evaluation (Required) Perform periodic technical and non-technical
evaluations that determine the extent to which the organization meets the ongoing requirements of the Security Rule.
Organization must: Verify adherence to the HIPAA Security Rule Verify that the necessary P&Ps have been developed Verify that the employees have been trained Verify that contingency plans are in place Verify that adequate access rights are in place Periodically evaluate computer systems and/or
network design to ensure proper security has been applied
Business Associate Contracts/Agreements
Implement contracts/agreements that ensure vendors and subcontractors that create, receive, maintain or transmit ePHI on the organization’s behalf will appropriately safeguard the information and includes the following implementation specifications: Written Contract or Other Arrangement
(required)
Physical Safeguards
Physical measures and P&Ps to protect electronic information systems and related buildings and equipment from natural/environmental hazards and unauthorized intrusions.
Physical Safeguards4 Standards Facility Access Control Workstation Use Workstation Security Device & Media ControlsExamples:
Computer servers in locked rooms Data backups stored offsite Employee badges Door locks Locked cabinets Screen savers/screen locks Fireproof storage
Facility Access Controls
Limit physical access to facilities ensuring authorized access is allowed and includes: Contingency Operations (addressable) Facility Security Plan (addressable) Access Control and Validation Procedures
(addressable) Maintenance Records (addressable)
Workstation Use (Required) Develop P&Ps to specify:
The proper functions to be performed The manner in which those functions are to be
performed The physical attributes of the surroundings of a
specific workstation or class of workstation that can access ePHI
Encompasses portable devices, such as tablets, PDAs, laptops
Conventional desktop – could include log-off requirement, updating anti-virus
For portable devices – can limit what can be stored on these devices
Workstation Security (Required)
Implement physical safeguards for all workstations that can access ePHI in order to restrict access to authorized users.
Examples: Positioning monitors so they cannot be viewed
by passers by Using password-protected screen savers Limiting access to buildings, offices,
workstations, printers, faxes and remote devices
Device and Media Controls Implement P&Ps that control the
receipt and removal of hardware and electronic media that contain ePHI and includes the following implementation specifications Disposal (Required) Media Re-Use (Required) Accountability (Addressable) Data Backup and Storage (Addressable)
Technical Safeguards Technology and the P&Ps for its use that
protect ePHI and control access to it. 5 Standards
Access Control Audit Control Integrity Person or Entity Authentication Transmission Security
Examples Usernames and passwords Security logs Firewalls Data Encryption
Access Control
Implement technical P&Ps that allow authorized persons or software programs to access ePHI and includes the following specifications: Unique User ID (required) Emergency Access Procedure (required) Automatic Logoff (addressable) Encryption and Decryption (addressable)
Audit Controls (Required) Requires an organization to implement
hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Create a process to monitor data access that includes reviews of audit logs for failed logon attempts or security incidents, the frequency of such reviews and the desired escalation process.
Integrity Implement security measures that ensure
that ePHI is not improperly modified without detection until disposed of and includes the following implementation specifications: Mechanism to Authenticate Electronic Protected
Health Information (addressable) P&Ps to protect ePHI from improper alteration
or destruction For most operating systems and hardware,
integrity is already built in as standard features such as error-correcting memory and magnetic disc storage.
Person or Entity Authentication (Required)
Implement procedures to verify that a person or entity seeking access to electronic PHI is the one claimed.
Simple approach = password at login More sophisticated approach =
biometric ID system, digital signatures
Transmission Security Implement technical security
measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network and includes the following implementation specifications: Integrity Controls (addressable) Encryption (addressable)
Applies when using an open network such as internet and when deemed appropriate.
Implementation:Implications of Non-compliance
Increased operating costs Financial penalties Public exposure leading to loss of
customers Loss of Accreditations / Licenses Litigation Damages Imprisonment
Making an Organization HIPAA Security Compliant Typical High-Level Steps
Determine if organization is subject to HIPAA Security Rule (store or transmit ePHI?)
Appoint a HIPAA Security Officer Detailed HIPAA Security Training Course for HIPAA
Security Officer and technical IT staff Perform risk assessment Develop risk management plan Draft necessary P&Ps required by the Security
standards Work with IT to implement security standards
contained in new policies and procedures Train employees on new security P&Ps and systems Monitor compliance, perform periodic evaluation of
security systems and take corrective actions, as needed.
Reasonable, Scalable and Common Sense
Privacy & Security rules specified by HIPAA are reasonable and scalable to account for the nature of each organization’s culture, size and resources.
Each organization will determine its own privacy policies and security practices within the context of the HIPAA requirements and its own capabilities and needs.
A good rule of thumb to remember is “when in doubt, use common sense.”
Keys to Success
Education Corporate Culture Commitment
Embracing HIPAA Many HIPAA requirements are just best practices already
implemented in other industries. HIPAA can be considered a common federal “floor” for
everyone to achieve. Many HIPAA requirements would be things you would want
the implement anyway to safeguard the confidentiality of your clients’ records and protect your organization data from loss or theft.
We are all patients with our own PHI and would want many of the same protections for our own personal health information.
With the move toward electronic records management, it is even more critical that we all come to terms with securing our organization’s information as it is all too easy for data to be stolen by hackers or for an organization to lose its records because regular backups were not performed.
Thank you forjoining us today.