Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

&ldquo;HIPAA is a valve, not a blockage,&rdquo; stated HHS OCR Director Leon Rodriguez, at the OCR/NIST <a href="http://www.nist.gov/itl/csd/upload/hipaa-final-agenda-052013.pdf">6th Annual Conference</a> on Safeguarding Health Information:&nbsp; Building Assurance through HIPAA Security.&nbsp; Discussing the tension inherent in HIPAA, between patient access to patient information and an organization&rsquo;s safeguarding of protected health information (PHI), Director Rodriguez characterized OCR&rsquo;s HIPAA guidance as providing the &ldquo;super highways&rdquo; to ensuring patient access to PHI and to safeguarding PHI.&nbsp;&nbsp; An organization, on its own, must figure out the &ldquo;surface streets,&rdquo; emphasizing once again the flexibility and scalability of HIPAA.&nbsp; Regardless of the type or size of an organization governed by HIPAA, the basic rules remain the same.&nbsp; To adequately safeguard PHI, HIPAA defines a process.&nbsp; HIPAA provides an organization with a series of decisions, policies and procedures, analyses, and plans.&nbsp; Above all, patient expectations govern.&nbsp;
Where does an organization draw the line between patient access and protecting PHI, especially in light of increased OCR enforcement of HIPAA/HITECH?&nbsp; To ease a covered entity&rsquo;s and business associate&rsquo;s anxiety, Director Rodriguez reassured organizations that OCR is not playing a game of &ldquo;gotcha.&rdquo;&nbsp;&nbsp; OCR is neither trolling for enforcement actions and civil monetary penalties (CMPs), nor seeking to punish a proactive organization for a single incident.&nbsp;&nbsp; In support of his statement, Director Rodriguez highlighted the fact that of the 74,554 complaints filed since 2003, and the 26,513 total cases investigated by OCR, 17,767 cases resulted in corrective action, and only 13 cases since 2008 resulted in a Resolution Agreement and CMPs.&nbsp;&nbsp;&nbsp;
Director Rodriguez acknowledged that breaches of PHI are going to happen, as risks exist even where organizations are doing everything right.&nbsp;&nbsp; OCR is interested in what an organization is not doing, and whether the proper analysis is being conducted.&nbsp; An organization must identify, remedy and change (if needed).&nbsp;&nbsp;
So what type of action/inaction ends up in an OCR monetary enforcement scenario?&nbsp; Director Rodriguez categorized two culprits:&nbsp; (1) an ongoing failure to comply with the HIPAA Privacy and Security Rules, and (2) an unforgivable disclosure.&nbsp; Regarding the first category, an ongoing failure usually exists over several months and/or years.&nbsp; Often times, a risk analysis is missing, including a lack of routine information system reviews.&nbsp; Director Rodriguez stressed the importance of conducting risk analyses to identify vulnerabilities.&nbsp; Once risk is identified, it must be properly evaluated and addressed.&nbsp; Another reoccurring ongoing failure is the lack of updating of policies and procedures after a change in business operations or a change in technology.&nbsp; Director Rodriguez summarized the routine case OCR falling under monetary enforcement scenario as an incident affecting a large number of records, a vulnerability that exists for a number of months, and a failure to assess risk (e.g. OCR&rsquo;s May 21, 2013 Resolution Agreement with <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/isu-agreement.html">Idaho State University</a>).&nbsp; The second category is an unforgivable disclosure of PHI that is borderline criminal (e.g. <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/uclaagreement.html">UCLA</a> breach of celebrities&rsquo; privacy resulting in OCR&rsquo;s July 6, 2011 Resolution Agreement).&nbsp;
Regarding CMPs, Director Rodriguez highlighted the guidance provided in the Final Rule regarding factors to consider in determining the amount of CMPs to assess.&nbsp; The Resolution Agreement in the <a href="http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/alaska-agreement.html">Alaska DHSS</a>, where there was an alleged lack of remediation over a long period of time, is an example used by Director Rodriguez to demonstrate how the failure to remediate over a prolonged period of time can increase a CMP.&nbsp; In Alaska DHHS, the Resolution Agreement required payment of $1.7M.&nbsp; Accordingly, in addition to identifying, assessing and responding to a breach incident, an organization must also timely remedy any vulnerability in order to keep the amount of any potential CMP low.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Director Rodriguez also commented on the vulnerabilities associated with mobile devices, which remains a topic of interest for OCR.&nbsp; Of the breach reports received by OCR, 25% are related to paper records and vulnerability of mobile devices.&nbsp; Director Rodriguez encourages all organizations to focus on securing mobile devices (a &ldquo;great vulnerability&rdquo;) and to use HHS resources regarding <a href="http://www.healthit.gov/providers-professionals/your-mobile-device-and-health-information-privacy-and-security">mobile device security</a>.&nbsp;&nbsp;&nbsp;
OCR&rsquo;s HIPAA audits were also discussed &ndash; specifically OCR&rsquo;s findings regarding encryption.&nbsp; Not surprisingly, OCR found that encryption, an addressable implementation specification under the Security Rule, was not always implemented by organizations.&nbsp; Director Rodriguez stressed the importance of conducting an analysis &ndash; shopping for technology, evaluating the risks and costs with implementation, and how encryption might affect patient care in the clinical setting.&nbsp; An organization must weigh the pros and cons of encryption in making the final decision to encrypt or not to encrypt.&nbsp; This lack of analysis regarding the adoption of encryption is a red flag.&nbsp;&nbsp;&nbsp;
Director Rodriguez, concluding his dialogue on HIPAA/HITECH compliance, recommended that every organization &ldquo;be smart and implement best practices&rdquo; and remember that the patient is most important.&nbsp; Organizations must determine how to best ensure patient access to PHI while also adequately safeguarding PHI.&nbsp; &ldquo;[A] risk analysis, ongoing risk management, and routine information system reviews are the cornerstones of an effective HIPAA security compliance program.&rdquo;

HHS OCR Director Leon Rodriguez’s Dialogue on HIPAA/HITECH Compliance