Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

BlueCross BlueShield of Tennessee (BCBST) was the victim of a theft in 2009 when an intruder stole 57 hard drives which contained protected health information (PHI) of more than 1 million customers.&nbsp; The information on the hard drives included names, Social Security Numbers, diagnosis codes, dates of birth, and health plan identification numbers.&nbsp; Reports suggest that the information would be very difficult to extract from the hard drives and BlueCross BlueShield of Tennessee undertook great efforts and significant expense to identify their customers.&nbsp; Indeed, over 800 people may have worked on the efforts to identify the customers.&nbsp; After the incident, BCBST undertook efforts to encrypt all data at rest.
Still, BCBST entered into a <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/resolution_agreement_and_cap.pdf" target="_blank" rel="noopener">resolution agreement&nbsp;</a>(.pdf) on March 13, 2011, by which it agreed to pay $1.5M.&nbsp; BCBST also&nbsp;entered into a corrective action plan (CAP) which sets out a period of compliance obligations and has a term of 450 days.&nbsp; The CAP requires:
<ul>
<li>BCBST implement policies and procedures (to be reviewed by HHS) which require: </li>
</ul>
-&nbsp; A risk assessment be performed to identify potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI when it is created, received, maintained, used, or transmitted on or off-site
-&nbsp; A risk management plan be implemented to respond to the risks identified in the risk assessment;
-&nbsp; Use of facility access controls and a facility security plan to limit access to areas where ePHI is located;
-&nbsp; Physical safeguards governing the storage of electronic storage media containing ePHI;
<ul>
<li>Training on policies and procedures;</li>
<li>Random monitoring by BCBST&rsquo;s Chief Privacy Officer for compliance with the policies;</li>
<li>Biannual reports to HHS over the CAP period describing compliance with policies and procedures, training efforts, and reportable events that occurred.</li>
</ul>
When dealing with regulators, such as OCR, keep these principles in mind:
<ul>
<li>Regulators expect transparency.</li>
<li>Your investigation should be prompt, thorough, and well documented.&nbsp; If certain investigations are privileged, make certain that you assert that privilege.</li>
<li>A good attitude and cooperation send a message that the organization is committed to compliance and safeguarding PII, PHI, and ePHI.</li>
<li>Notification concerning a breach should be appropriate and prompt.</li>
<li>Know the root cause of the breach and address it through staff training, awareness programs, technical safeguards, and new policies/procedures/physical safeguards.</li>
<li>Provide customers with the appropriate level of mitigation or remediation measures.&nbsp; Credit monitoring does not always address the risk to the customer.&nbsp; Sometimes, it can be as simple as advising a patient to monitor its Explanation of Benefits (EOB) statements or telling a customer to file a report with a credit card&nbsp;company that his or her credit card number has potentiall been exposed.</li>
</ul>
Leon Rodriguez, director of the HHS Office for Civil Rights (OCR) <a href="http://www.hhs.gov/news/press/2012pres/03/20120313a.html" target="_blank" rel="noopener">said</a>, &ldquo;This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program.&rdquo;&nbsp; The safeguard and training requirements of the CAP are very similar to requests for information we see from OCR following a reportable breach.&nbsp; If a healthcare organization does not currently have the above risk management plans and safeguards in place, the&nbsp;warning sent as a result of this settlement is clear&mdash;make these compliance issues&nbsp;a priority before you have a reportable breach.

HHS Settles HIPAA Violations Related to a Breach for $1.5M