TriPoint Healthcare Solutions

Advising, Educating, and Operationalizing Privacy and Security in Healthcare

Ready, Set, HIPAA Enforcement – 2017 is Going to be a Year to Remember

by Leave a Comment

HIPAA Data Breaches and HIPAA Enforcement is definitely off to the races in the first 2 months of 2017.  While previous years have started slower and then gradually increased, 2017 proves to be on an advanced path.  2016 ended with a RECORD year in HIPAA Data Breaches (329 Data Breaches greater than 500 Individuals) as well as HIPAA Enforcement Fines ($23.5 Million), but 2017 is off to a quicker start in both of those categories.

Remember that the government only posts details about the data breaches that impact 500 individuals or more.  Here are some key facts to know about 2017 HIPAA Data Breaches through February 28, 2017:

  • 42 Data Breaches impacting greater than 500 Individuals have been reported
  • Unauthorized Access/Disclosure leads the Type of Breach Category with 17 (40%) – Hacking/IT incident comes in a close second with 13 (31%)
  • 312,827 Individuals have been impacted by the 42 data breaches
  • Unauthorized Access/Disclosure and Hacking/IT Incident account for 289,584 (93%) of the total individual impacted
  • Paper/Films comes in #1 place for the location of data breaches with 10 (21%) with Network Server in #2 place with 8 (19%)
  • Largest Data Breach was from Emory Healthcare due to a Hacking/IT incident impacting 79,930 individual
  • California has had the most reported data breaches with 8, followed by Ohio with 4
  • Business Associates were only involved in 3 of the reported data breaches

So comparing what we are seeing in 2017 to where we were at the end of February 2016, we are slightly up on the number of data breaches greater than 500 individuals reported.  The location of data breaches and type of data breaches remains consistent with what was seen in the beginning of 2016. 

HIPAA Enforcement has been active in 2017 as well.  We continue to hear about the HIPAA Audits with on-site audits starting some time in 2017 to 2018.  You can prepare for your HIPAA audits by comparing your organization’s HIPAA policies and procedures as well as practices and safeguards with the HIPAA Audit Protocol.

HIPAA corrective action plans (CAP) with monetary fines have made a fast and furious start in 2017.  In the first 2 months of the year, 4 HIPAA CAP with monetary fines have been assessed resulting in a total $11.4 Million.  In 2016 we only saw 1 HIPAA fine in the first 2 months of the year.  Of course the monetary fines and CAPs are always concerning for organizations; however, your organization can learn from what others are being held accountable for.  Review the information on the CAPs and see where the non-compliance with HIPAA occurred.  Then, as necessary, make changes within your organization.  The main categories for the 2017 CAP with monetary fines are:

  • Inappropriate delay in data breach reporting (reported after 60 days from the date of discovery)
  • Inappropriate implementation of information activities reviews
  • Inappropriate oversight into user set up and user management
  • Lack of implementation of encryption technology on mobile devices
  • Lack of current HIPAA Risk Analysis
  • Insufficient policies and procedures for HIPAA Compliance

Ask yourself a question – do you view HIPAA as out of sight, out of mind in your organization?  If the answer is YES – now is the time to make a change.  Implementing a strong HIPAA Compliance Program can help your organization.  A strong HIPAA Compliance program isn’t just about written policy and procedures that collect dust on the shelf.  A strong HIPAA Compliance program consists of:

  • HIPAA Policies and Procedures
  • HIPAA Requests Forms for Patient’s Rights
  • A Complete Notice Of Privacy Practices
  • Established Technical, Physical, and Administrative Safeguards
  • Conducting a regular HIPAA Risk Analysis
  • Strong Workforce Education
  • Effective User Management and Oversight into systems with Protected Health Information
  • Auditing practices for verification of compliance
  • Ongoing evaluation of current safeguards established by the organization

Let me know if you ever have any questions – anything HIPAA goes!! 

Until Next Time,

Danika

Are you prepared? The HIPAA Audits are COMING! Six Simple Steps to Create a Solid Foundation of HIPAA Compliance.

by 2 Comments 

It is that time of year – the weather in many places is all over the place.  From 80 degrees to 28 degrees in a few days in the Midwest, cool comfortable air on the east coast, from green leaves to an array of oranges, yellows, reds, and greens.  From trees full of summertime and leaves to bare branches and leave piles on the ground.  With the changing in the seasons, it’s time to prepare for the next season.  Creating a solid HIPAA compliance program can be like braving the weather and embracing the change in the seasons – but instead we focus on the change in the culture within our organization.   
There has been a lot of news regarding HIPAA over the past couple weeks.  Continued data breaches, the Office of Inspector General (OIG) stating that there has been a lack of HIPAA oversight and enforcement, and Phase 2 of the HIPAA Audits beginning in early 2016.  The stage has been set, the world has been notified – there is going to be a change in the enforcement of HIPAA and NOW is the best time to prepare your organization. 
Here are Six Simple Steps you can take to prepare your organization for success with the upcoming changes in enforcement and Phase 2 HIPAA Audits.
  • Conduct a Risk Assessment/Analysis – if you haven’t conducted a risk analysis recently, it might be a great idea to conduct one again soon. Make sure to have a risk analysis report that provides information on how the audit was conducted, what systems were evaluated and what the identified risks were.  Remember – don’t stop there.  You must create a risk management plan and mitigate and/or address all the risks identified. 
  • Review and update all policies and procedures – policies and procedures create the foundation for success with HIPAA compliance. Conduct a gap analysis on your policies and procedures.  Look for policies that you may be missing or policies that don’t meet minimum compliance.  Then ensure that your organization is following the policies you have created.  Look for evidence such as documents, logs and audit forms that can prove you are in compliance with your policies.
  • Know who your Business Associates Are – evaluate who you are paying as third party contractors and what tasks they are performing for your organization. If they are creating, receiving, transmitting or storing any protected health information on your behalf – ensure that you have an updated business associate agreement in place with them.  Consider creating an easily accessible list or spreadsheet of all your business associates within your organization. 
  • Review and become familiar with the Audit Protocol – although the new HIPAA audit protocol hasn’t been officially published, it is good practice to review and become familiar with the HIPAA audit protocol that was used on the HIPAA audits of 2011-2012. This will help an organization understand what will be looked for as far as evidence of compliance with the regulations. 
  • Conduct internal HIPAA audits – practicing audits and helping staff become comfortable with answering questions regarding HIPAA compliance should be done. If an on-site HIPAA audit is conducted, the auditors will not only be talking to the HIPAA Privacy and Security Officers, but also all workforce members that take part in providing proper protection of patient information (A.K.A. – EVERYONE)
  • Educate all staff and leaders on the importance of HIPAA Compliance – education of your entire workforce becomes an essential step in HIPAA compliance. Your workforce should know and understand what HIPAA is and the processes and procedures that are established within your organization for proper HIPAA compliance!
While this list isn’t a complete list of what an organization can do – it is a few simple steps that can definitely help create a solid HIPAA program and prepare for the increase in enforcement and Phase 2 HIPAA Audits.  Don’t be one of the healthcare organizations that states “We didn’t know that was a requirement” or “We thought we had more time to be compliant.”  Be prepared and feel confident in the way that you are protecting your patient’s information.  Your healthcare organization will benefit and your patients will be satisfied knowing that they are receiving great care and their information is properly protected and secured!
TriPoint Healthcare Solutions will be launching an online course soon that will guide healthcare organizations through preparing for a HIPAA Audit!  Want to be the first to know about this new class? Sign up here and receive the information and access to this class!

Click Here to Be the First to Know

Danika

Breaking Down a HIPAA Corrective Action Plan and Settlement: It’s Not All About the Money

by 2 Comments 

Healthcare NewsThe headlines over the last week highlighted that an Oncology Practice in Indiana, Cancer Care Group, P.C., received a $750,000 fine for HIPAA non-compliance by the Office for Civil Rights.  After a laptop bag was stolen out of an employee’s car in 2012, the information of approximately 55,000 patients was breached, including names, addresses, date of birth, social security number, clinical information, and insurance information.  The laptop didn’t have any safeguards such as encryption applied to it, creating risk for those 55,000 patients.  In the settlement, the organization must pay a hefty $750,000 fine; HOWEVER, it is only part of the correction action settlement.  The organization must do a lot more than just pay the fine – causing additional costs and time commitments to the organization.  In addition, the corrective action plan is valid for 3 years from the effective date!!
Looking deeper into the corrective action plan (CAP) between Cancer Care Group and Department of Health and Human Services (HHS), they are also required to:
  • Conduct a HIPAA Risk Analysis within 90 days of the CAP effective date
    • Submit the Risk Analysis Report for approval to the HHS
    • If the Risk Analysis is not approved, Cancer Care Group will have 60 days to revise the Risk Analysis and submit to the HHS for approval
  • Implement an organization-wide risk management plan to address and mitigate any risks and vulnerability found during the risk analysis
    • Within 90 days of approval of the Risk Analysis from HHS, Cancer Care Group must submit the Risk Management Plan to HHS for approval.
    • If the Risk Management Plan is not approved, Cancer Care Group must update the Risk Management Plan and resubmit to HHS within 60 days.
    • One approved, Cancer Care Group must begin the implementation of the Risk Management Plan.
  • Review and revise policies and procedures relating to the HIPAA Security Rule
    • Based on the findings from the HIPAA Risk Analysis, Cancer Care Group must review and revise all policies and procedures relating the to the HIPAA Security Rule
    • All policies and procedures must be forward to HHS within 60 days of the approval of the Risk Management Plan
    • If policies and procedures are not approved by HHS, Cancer Care Group will have to revise and resubmit the policies and procedures within 30 days.
    • Within 30 days of approval of the policies and procedures from HHS, Cancer Care Group must implement the new policies and procedures.
  • Review and revise security rule training program based on the risk analysis findings
    • Revise and update the training program and submit for approval to HHS within 60 days of the approved Risk Analysis from HHS.
    • Within 30 days of approved training program from HHS, administer the approved training program to all Cancer Care Group workforce.
  • Any reportable events (failure of workforce member to comply with policies and procedures, security incident, potential data breach, etc.) must be promptly investigated and reported to HHS within 30 days of the awareness of the incident.
    • Notification must include: 1) a description of the event including relevant facts individuals involved and policies and procedure(s) impacted AND 2) description of actions taken and future actions planned
  • Provide HHS Annual Reports of the following for the CAP Timeframe (3 Years)
    • Updates or changes to the approved Risk Analysis or Risk Management Plan
    • Updates or changes to Cancer Care Group’s approved HIPAA policies and procedures
    • Summary of all Reportable Privacy and Security Events
    • Attestation by the appointed officer/owner at Cancer Care Group that he/she has appropriately reviewed the annual report to HHS and verification that the information is truthful and accurate.
In the event that you find your organization in the middle of a data breach that is being submitted to HHS, the proper steps should be taken to evaluate your current level of compliance.  It is best to try and identify risks and vulnerabilities to your organization immediately rather than waiting for the HHS to come and mandate that you evaluate your compliance.  From the above information, HHS doesn’t just ‘go away’ after the fine is appropriately paid.  Being linked and connected to the HHS for 3 years post settlement is intense and challenging.  Relying on approval from HHS of all aspects of the HIPAA Security Rule can overwhelming and stressful.  Don’t find yourself in this situation. 
Remember – your organization is the one responsible for compliance with the federal privacy and security requirements.  With the verge of Phase 2 of the HIPAA Audits starting soon, now is the time to get out and evaluate.  Waiting for the HHS to come in and tell you what to do, or worse, assess a fine is something that should be avoided!
Take time to evaluate your compliance, plan your mitigation strategies and take action for compliance!
Danika

Here comes Peter Cottontail – Hopping Down the HIPAA Trail!

by Leave a Comment

Easter BunnyWhen we think about the Easter Holiday and Spring that has found us, the focus shifts from existing in a dull, mundane world into a new world full of new life and new excitement.  The snow melts (if you have snow), the rivers and lakes open, the birds chirp more, and the temperature rises.  At the same time, we prepare for one of our favorite furry friends to come and visit, the Easter Bunny.  With the hope and intent of new and fresh goodies in our bag, the anticipation of the little bunny visiting creates entertainment and excitement!

It is easy for a HIPAA Compliance program to be ordinary and unexciting.  HIPAA consists of many different kinds of regulations that you must comply with just to make the government happy and that might not really work in your organization.  Many organizations focus on writing and creating a process for in order to meet compliance, but over time that process becomes outdated and doesn’t really meet the intent behind the HIPAA regulations. 

It is time to head down the HIPAA Trail and focus on HIPAA in a new way.  As Peter Cottontail comes to provide treats and goodies to everyone’s baskets, it is time to provide your compliance program with a new basket of tools and tricks to make HIPAA fun and enjoyable.  Rather than focusing on HIPAA as something that is forced and mandated just to comply with regulations, change the focus to be something the organizations does to protect the patients they see and the information stored and maintained by the healthcare organization. 

Here is a list of a few ideas to help provide your HIPAA Basket with new and fresh goodies:

  1. Conduct a HIPAA Risk Analysis – the risk analysis allows an organization to review and see potential risks so that they can be mitigated before an unauthorized use or disclosure of health information exists. Get everyone involved – see how your entire organization can help and support the risk analysis process.  Something fun is to go on a HIPAA scavenger hunt for employees – give them a walk through document and send them to another department to see what they can find that might be risks to your organization! 
  2. Refresh HIPAA Training – so often organizations use the same training for HIPAA or the same format for training year after year. While it is important to create consistency and assure proper training is occurring, providing a refresh on the format or content of the training can support a better compliance among employees and a better understanding of the importance of protecting patient information.
  3. Review and Update Policies and Procedures – while no regulations or processes have changed, it is always good to give the policies and procedures that help manage HIPAA compliance a review on a regular basis. While there is not mandate on how often, best practice is to review yearly or upon changes of technology, regulations, or physical space.  Set a timeline for each year to review policies and procedures and commit to that timeline! 
  4. Create a Culture of Privacy and Security Protections – organizations that are most successful with HIPAA compliance create a culture of privacy and security protections. While policies and procedures as well as technical and physical safeguards are a necessity for HIPAA Compliance, workforce members need to buy into the philosophy and intent of protecting and securing patient information.  Many times your employees become the front line defense to the safeguard and protection of patient information.  If they don’t buy in or understand the importance, an organization will struggle for success with their HIPAA compliance. 
  5. Create a HIPAA Governance Structure – there is that word – governance – again! A strong governance and oversight into the management of HIPAA at an organization will help transform from a department or person who manages privacy and security of patient information to an organization who knows the importance of protecting patient information and acts upon it throughout each day and every task.  Have specific leaders through the process and assure that roles are clearly defined!   

Office for Civil Rights (OCR) HIPAA Audits are coming in 2015 – take the time that has been given to fill your HIPAA Compliance Basket with new goodies and tools to be successful.  Figure out how you can breathe new life into your HIPAA program and make it successful in protecting the valuable patient information that the organization is trusted with.  HIPAA can be fun and exciting – just like the change in the season and a full basket of goodies!  Hopefully you will bump into Peter Cottontail hopping down the HIPAA Trail!    

“Most of us feel that our health information is private and should be protected. That is why there is a federal law that sets rules for health care providers and health insurance companies about who can look at and receive our health information.”

—Office for Civil Rights

Danika

Your PHI Goes in There and Out Where? Can Understanding your PHI Flow Help Support HIPAA Compliance?

by Leave a Comment

How many organizations can say that they completely understand where all their protected health information exists and where are the inputs and outputs of the data are?  Based on current clients, very few know exactly where all protected health information is being stored and maintained.  It is not uncommon to walk into an organization and hear that they have 2 or 3 systems that store or interact with PHI – then after discussion and analysis, it is determined that there are actually 9 or 10 different systems that interact with PHI within the organization.  Additionally, many organizations don’t fully understand all the areas where PHI may come out of electronic systems.  Example, a transcription system may automatically send a document once it is transcribed or a lab system may send information to the billing system for proper charges.  Without properly understanding where all the data is being stored, what happens to the data, how those systems are protected, and where is the ePHI outputs from the systems are, it creates a challenge on effectively managing the privacy and security of protected health information.  It is the key link from privacy and security to Information Governance in an electronic era.

Sure, everyone knows they have patient data within their electronic health record, stored in their lab system, or on the organization’s file server, right?  Those areas may be obvious and clear; however, organizations must know and understand every system and location where protected health information is being stored.  Without the knowledge of where all protected health information resides within an organization and the systems that use health information, it becomes nearly impossible to manage privacy and security of information and leaves the organization extremely vulnerable to a data breach. 

Privacy and Security Officers at healthcare organizations should start a process of identification of all systems storing, transmitting, or accessing patient information – creating a knowledge and understanding of how protected health information is being stored and used within their organization.  Creating a protected health information flow diagram or documentation is a complex and detailed process.  It is most likely not going to happen in one day or one week.  It is going to take time to understand each specific system, how it may or may not use protected health information, and what other systems it interacts with.

Some suggested steps to create this information at an organization:

  • Conduct a system inventory analysis of all systems that the organizations uses
  • Understand all the hardware being used in the organization and if ePHI is being stored on the hardware
  • Evaluate each system identified to determine what the interaction is with any type of patient information
  • If the system interacts with protected health information, determine
    1. What type of PHI is being stored in the system
    2. What is the intent of the system
    3. Who is the system ‘owner’
    4. Who has access to the system and how is access management managed
    5. Where the system is being stored (local server, cloud based) and backed up
    6. What are the inputs into the system with PHI
    7. What are the outputs from of PHI from the system – both automatic and manual
    8. If the system interfaces and interacts with other systems
    9. Other security measures in place to protect the information
    10. Other pertinent information regarding the system that is important from a security perspective
  • Create documentation to support and understand all systems – Your Protected Health Information Flow!
  • Assure proper management of all systems that contain PHI!!!! It is not the job on the security officer to own the systems, but it is a responsibility to ensure the systems are understood and proper security is maintained so the privacy of the data is properly secured and protected!

This is not an easy process – in some large integrated systems, they could have hundreds of different systems that interact with ePHI in some aspect!

Remember that HIPAA doesn’t just apply to an electronic health record.  Electronic protected health information is any protected health information (PHI) that is produced, saved, transferred or received in an electronic form.  ePHI can be found on computer hard drives, in databases, in e-mail, in the EHR, and many other locations – you need to evaluate and look at your entire system to truly understand and manage ePHI!!

Don’t get caught in an unwanted data breach due to not knowing or understanding how your data flows throughout your organization, what systems have protected health information, where the inputs are, what happens to the data in the system, and where the outputs from the system exist.  Work upstream, understand your PHI data flow, and properly manage and reduce risks to PHI!

Danika

Recent Posts

Connect With Us

TriPoint Healthcare Solutions
dbrinda@tripointhealthcaresolutions.com
Phone: 612.325.9742
Fax: 763.322.5027