Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-3981 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/06/Healthcare_bigstock-Stethoscope-On-Computer-Keyboa-6382850-300x200.jpg" alt="Stethoscope on Computer Keyboard" width="300" height="200" />The day before Thanksgiving, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) <a href="http://www.hhs.gov/about/news/2015/11/25/hipaa-settlement-reinforces-lessons-users-medical-devices.html">announced</a> the largest resolution agreement of 2015, against Lahey Hospital and Medical Center (Lahey). The incident giving rise to the $850,000 settlement was apparently an isolated theft involving 599 patients with electronic protected health information (ePHI) on a radiology laptop used for CT scans in an unlocked treatment room.

As with all investigations conducted by OCR following a reported breach, OCR identified several areas where the hospital purportedly failed to comply with HIPAA:
<ul>
	<li>Failure to conduct a thorough risk analysis of all of its ePHI</li>
	<li>Failure to physically safeguard a workstation that accessed ePHI</li>
	<li>Failure to implement and maintain policies and procedures regarding the safeguarding of ePHI maintained on workstations utilized in connection with diagnostic/laboratory equipment</li>
	<li>Lack of a unique user name for identifying and tracking user identity with respect to the workstation at issue in this incident</li>
	<li>Failure to implement procedures that recorded and examined activity in the workstation at issue in this incident</li>
	<li>Impermissible disclosure of 599 individuals’ PHI</li>
</ul>
Moreover, in addition to the payment of the settlement amount, OCR has in place a two-year <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/LAHEY/lahey.pdf">corrective action plan</a> (CAP), which requires the hospital to conduct an enterprisewide risk analysis, enhance policy procedures and training, and report policy violations (not just breaches) to OCR for review. Oftentimes the CAP is the most difficult piece of the settlement to address because it sometimes goes beyond what HIPAA actually requires.

After working with clients through over 100 breach investigations by OCR, we have identified several areas that have consistently remained “hot buttons” since the implementation of HITECH in 2009:
<ul>
	<li>Mobile device and transmission security.
<ul>
	<li>Encryption</li>
	<li>Device Inventory, Tracking, and Monitoring</li>
	<li>Facility Security and Theft Prevention</li>
</ul>
</li>
	<li>Risk Analyses and risk management/mitigation plans.</li>
	<li>Third-party access to PHI (Business Associates).</li>
	<li>Staff education and sanctions.</li>
</ul>
Additionally, there has been a recent focus on safeguards in place to help mitigate or prevent cyberattacks, which include:
<ul>
	<li>Intrusion Detection Software</li>
	<li>Antivirus Software</li>
	<li>Logging</li>
	<li>Updating</li>
	<li>Access Controls</li>
	<li>Training</li>
</ul>
Don’t wait until you are in the crosshairs of OCR during a breach investigation to address and document these activities. Additional guidance from HHS on how to protect ePHI on mobile devices can be found <a href="https://www.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security">here</a>.

OCR Continues Waving Its HIPAA Enforcement Flag: Don’t Forget About Medical Devices