Learning: Privacy and Security Monitoring, Audits and Investigations

On November 13, 2007, I will be speaking at a Lorman Eduational Services seminar to be held in Charleston, West Virginia. The seminar topic is "Health Care Information Privacy and Security Monitoring, Audits and Investigations: How to avoid an investigation and what you should expect if the state or federal officials call". You can register online here.

Also speaking at the seminar will be (read full bios):

• Terri Barrett, the assistant chief privacy officer at the West Virginia Health Care Authority in Charleston

• Mike Harmon, compliance officer for the West Virginia Public Employees Insurance Agency who oversees HIPAA compliance for PEIA and the Department of Administration

• Jack Shaffer, CIO for the Community Health Network of West Virginia who has experience in all aspects of technology, including systems development, enterprise application integration, networking, telecommunications, data center operations, database administration, disaster recovery, security and mobile computing.

Below is a copy of the seminar agenda:

9:00 am – 10:30 am	Legal Overview of HIPAA Privacy and Security Enforcement
	Robert L. Coffield, Esq.
	HIPAA Refresher on Enforcement Rules and Penalties OCR Privacy Investigation Statistics Best Practices on Conducting Internal Investigations Responding to OCR/CMS Investigation
10:30 am – 10:45 am	Break
10:45 am – 11:30 am	Preparing for an Audit
	Michael T. Harmon, CIPP/G
	Auditing vs. Monitoring Other Governmental Auditors – e.g., OIG, Legislature Elements of the OIG Audit of Piedmont Hospital in Atlanta New Kennedy/Leahy Legislation and Changes to Current Practice Privacy and Security Accreditation
11:30 am – 12:30 pm	Lunch (On Your Own)
12:30 pm – 2:30 pm	Technologies and Procedures for HIPAA Compliance
	Jack L. Shaffer Jr.
	Acceptable Use Policies and Enforcement Protecting PHI With Encryption Technologies Auditing and Monitoring Tools
2:30 pm – 2:45 pm	Break
2:45 pm – 3:45 pm	The Role of the Privacy Officer
	Terrisita Barrett, CIPP
	The Changing Privacy and Security Landscape Role and Responsibilities: Past, Present and Future Challenges Affecting the Privacy Officer Role
3:45 pm – 4:30 pm	Panel Discussion, and Questions and Answers
	Terrisita Barrett, CIPP, Robert L. Coffield, Esq.,
	Michael T. Harmon, CIPP/G, and Jack L. Shaffer Jr.

OCR Designates HIPAA Regional Office Privacy Advisors

The Acting Director and Principal Deputy Director for the Office for Civil Rights, Robinsue Frohboese, has designated Office for Civil Rights Regional Managers in each of the HHS Regional Offices to serve as the Regional Office Privacy Advisors. On July 27, 2009, Secretary Sebelius authorized the Director of the Office for Civil Rights to carry out the designation required under the Health Information Technology for Economic and Clinical Health (HITECH) Act (Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA).

The designation of these Regional Office Privacy Advisors was mandated by the ARRA-HITECH provisions under Section 13403(a). The Regional Office Privacy Advisors will offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related to the HIPAA Privacy and Security Rules

The names, addresses, and contact information for each of the Regional Managers are listed together with a list of the States for which each Regional Manager has responsibility are listed below:

Region I - Boston (Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont)
Peter Chan, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Government Center
J.F. Kennedy Federal Building - Room 1875
Boston, MA 02203
Voice phone(617)565-1340
FAX (617)565-3809
TDD (617)565-1343

Region II - New York (New Jersey, New York, Puerto Rico, Virgin Islands)
Michael Carter, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Jacob Javits Federal Building
26 Federal Plaza - Suite 3312
New York, NY 10278
Voice Phone (212)264-3313
FAX (212)264-3039
TDD (212)264-2355

Region III - Philadelphia (Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia)
Paul Cushing, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
150 S. Independence Mall West
Suite 372, Public Ledger Building
Philadelphia, PA 19106-9111
Main Line (215)861-4441
Hotline (800) 368-1019
FAX (215)861-4431
TDD (215)861-4440

Region IV - Atlanta (Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee)
Roosevelt Freeman, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Atlanta Federal Center, Suite 3B70
61 Forsyth Street, S.W.
Atlanta, GA 30303-8909
Voice Phone (404)562-7886
FAX (404)562-7881
TDD (404)331-2867

Region V - Chicago (Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin)
Valerie Morgan-Alston, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
233 N. Michigan Ave., Suite 240
Chicago, IL 60601
Voice Phone (312)886-2359
FAX (312)886-1807
TDD (312)353-5693

Region VI - Dallas (Arkansas, Louisiana, New Mexico, Oklahoma, Texas)
Ralph Rouse, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
1301 Young Street, Suite 1169
Dallas, TX 75202
Voice Phone (214)767-4056
FAX (214)767-0432
TDD (214)767-8940

Region VII - Kansas City (Iowa, Kansas, Missouri, Nebraska)
Frank Campbell, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
601 East 12th Street - Room 248
Kansas City, MO 64106
Voice Phone (816)426-7277
FAX (816)426-3686
TDD (816)426-7065

Region VIII - Denver (Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming)
Velveta Howell, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
1961 Stout Street -- Room 1426 FOB
Denver, CO 80294-3538
Voice Phone (303)844-2024
FAX (303)844-2025
TDD (303)844-3439

Region IX - San Francisco (American Samoa, Arizona, California, Guam, Hawaii, Nevada)
Michael Kruley, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
90 7^th Street, Suite 4-100
San Francisco, CA 94103
Voice Phone (415)437-8310
FAX (415)437-8329
TDD (415)437-8311

Region X - Seattle(Alaska, Idaho, Oregon, Washington)
Linda Yuu Connor, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
2201 Sixth Avenue - M/S: RX-11
Seattle, WA 98121-1831
Voice Phone (206)615-2290
FAX (206)615-2297
TDD (206)615-2296

HIPAA Security Rule Enforcement Delegated to OCR

Today HHS Secretary Kathleen Sebelius announced that enforcement of the Security Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) will be delegated to the Office for Civil Rights (OCR).

The official delegation occurred on July 27, 2009. More information about the transition of authority for the administration and enforcement of the Security Rule can be found in the OCR press release. The official Delegation of Authority by the Office of the Secretary has been issued and will appear in the August 4, 2009 Federal Register.

Prior to today, administration and enforcement of the HIPAA Security Rule has been the responsibility of the Centers for Medicare & Medicaid Services (CMS).

Providence Health & Services Agrees To $100,000 Voluntary Settlement of Potential HIPAA Violation

The U.S. Department of Health and Human Services (HHS) issued a press release last Thursday that it had entered into a Resolution Agreement with Seattle-based Providence Heath & ServicesHealth Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules. The agreement calls for Providence to pay a voluntary settlement of $100,000 and implement a detailed corrective action plan to ensure against future theft or loss of electronic patient health information (ePHI).

The incidents giving rise to the agreement involved two Providence entities, Providence Home and Community Services and Providence Hospice and Home Care. On or about December 30, 2005, data contained on several computer backup disks and tapes was stolen from the unattended car of a Providence employee. In addition to the theft of disks and tapes, several laptop computers were stolen from Providence employees on September 29, 2005, December 7, 2005, February 27, 2006, and March 3, 2006. The laptops, disks and tapes involved in those thefts contained the unencrypted records of more than 386,000 patients of Providence.

Under the terms of the Resolution Agreement, Providence agrees to pay $100,000 by check or electronic funds to HHS. Providence also agrees to enter into and abide by the terms of the Corrective Action Plan that is incorporated into the agreement. The Corrective Action Plan is effective for three years and requires that Providence submit copies of its written policies and procedures to HHS for approval. The Corrective Action Plan outlines nine categories of minimum content required in the policies and procedures. Specifically, the Corrective Action Plan requires that Providence to:

• Conduct a risk assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI when it is created, received, maintained, used or transmitted off-site;
• Implement a risk management plan that incorporates security measures sufficient to reduce the risks and vulnerabilities identified by the risk assessment to a reasonable and appropriate level; and
• Implement several physical and technical safeguards, including encryption, to ensure the protection of ePHI whenever it is stored or transported off-site by any portable device or electronic media.

The Corrective Action Plan also requires Providence train and monitor its workforce so that all employees are familiar with the policies and procedures. Providence is also required to submit to HHS both a one-time Implementation Report and Annual Reports for three years detailing its compliance to the policies and procedures under the Resolution Agreement.

Initially, HHS officials received more than 30 complaints about the stolen tapes and disks after Providence, pursuant to state notification laws, informed patients of theft. Providence also reported the stolen media to HHS. Providence faced a pending class action lawsuit alleging that the health system failed to safeguard the data as required by HIPAA and violated Oregon’s Unfair Trade Practices Act. The proposed class action was dismissed in November, 2007. The incident was also investigated by the Oregon Attorney General’s Office resulting in an Assurance of Voluntary Compliance Agreement requiring Providence to provide credit monitoring services, credit restoration services, implement security program enhancements and pay $95,764 into the Consumer Protection and Education Revolving Account.

Providence settlement and corrective action plan sends a signal that OCR and CMS are taking a stronger position against privacy and security incidents. The settlement should prompt providers who are required to comply with HIPAA to reexamine their privacy and security policies, procedures, employee training protocols and ongoing monitoring of compliance.

University of California Settles Potential HIPAA Privacy and Security Violations with OCR for $865,500

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) announced that the University of California at Los Angeles Health System which includes UCLA Ronald Reagan Medical Center, UCLA Santa Monica Medical Center, and Orthopedic Hospital, Resnick Neuropsychiatric Hospital, and the Faculty Practice Group of UCLA (UCLAHS) has agreed to settle potential violations under the HIPAA Privacy and Security Rules for $865,500. Read the OCR press release.

The settlement highlights that hospitals, physicians, and other covered entities must understand the importance of monitoring the level of access workforce members have to medical and health information. Covered entities must have policies and procedures in place and educate workforce members about only accessing records for necessary and permissible purposes. This settlement resulted from an investigation by OCR after certain celebrity/VIP patients at the UCLA facilities complained that hospital staff, including unauthorized physicians, had inappropriately accessed their health and medical information.

UCLAHS agreed to a Corrective Action Plan for a period of three years under the terms of the Resolution Agreement. The Corrective Action Plan requires UCLAHS to review/update its current HIPAA policies and procedures, conduct follow up workforce training, monitor compliance and submit a monitoring plan, and submit an implementation report and annual reports to OCR. of can be found attached to the Resolution Agreement.

The Resolution Agreement described the events that occurred that lead to the settlement as follows:

On June 5, 2009 and June 30, 2009, HHS began investigations of two separate complaints alleging that the Covered Entity was in violation of the Privacy and/or Security Rules. The investigations indicated that the following conduct occurred (“Covered Conduct”):

(i) During the period from August 31, 2005 to November 16, 2005, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of Covered Entity patients, and during the period from January 31, 2008 to February 2, 2008, numerous Covered Entity workforce members repeatedly and without a permissible reason examined the electronic protected health information of a Covered Entity patient.

(ii) During the period 2005-2008, a workforce member of Covered Entity employed in the office of the Director of Nursing repeatedly and without a permissible reason examined the electronic protected health information of many patients.

(iii) During the period 2005-2008, Covered Entity did not provide and/or did not document the provision of necessary and appropriate Privacy and/or Security Rule training for all members of its workforce to carry out their function within the Covered Entity.

(iv) During the period 2005-2008, Covered Entity failed to apply appropriate sanctions and/or document sanctions on workforce members who impermissibly examined electronic protected health information.

(v) During the period from 2005-2009, Covered Entity failed to implement security measures sufficient to reduce the risks of impermissible access to electronic protected health information by unauthorized users to a reasonable and appropriate level.

 More information and background can be found in the iHealthBeat article, UCLA Health System Agrees to Pay $865K over Privacy Breaches, including a link to a statement on the settlement issued by UCLH Health System.

ONC-Coordinated Federal HIT Strategic Plan: 2008-2012

Today the Office of the National Coordinator for Health Information Technology (ONC) released "The ONC-Coordinated Federal Health Information Technology Strategic Plan: 2008-2012". Find more information here, including a synopsis of the full report.

The plan is meant to serve as a guide to coordinate the federal government's health IT efforts to achieve a nationwide implementation of an interoperable health information infrastructure.

Robert Kolondner, MD, National Coordinator for Health Information Technology states in the synopsis summary:

Looking toward the future, we can envision a health care system that is centered on each and every individual patient. Clinicians will have at their fingertips all of the information needed to provide the best care; individuals will have access to this and other information that can help them engage and insert their values in the decision-making process about their health and care; and, secure and authorized access to health data will provide new ways that biomedical research and public health can improve individual health, and the health of communities and the Nation.

The synopsis goes on to state that the plan has two goals -- "patient focused health care and population health" and describes them as follows:

Patient-focused Health Care: Enable the transformation to higher quality, more cost-efficient, patient-focused health care through electronic health information access and use by care providers, and by patients and their designees.

Population Health: Enable the appropriate, authorized, and timely access and use of electronic health information to benefit public health, biomedical research, quality improvement, and emergency preparedness.

Each goal has four objectives and the themes of privacy and security, interoperability, adoption, and collaborative governance recur across the goals, but they apply in very different ways to health care and population health.

I've only had a chance to scan the synopsis and the 115 page full report but should make for interesting reading for anyone involved in the ongoing evolution of our health care system and the impact that health technology is having on the industry.

HIPAA Privacy Rule Accounting of Disclosures under HITECH

Today's Federal Register includes the Office of Civil Rights (OCR) Notice of Proposed Rulemaking (NPRM) modifying the HIPAA Privacy Rule's Accounting of Disclosure requirements for protected health information. OCR was required to make these modifications to the HIPAA Privacy Rule to implement the requirements under the Health Information Technology for Economic and Clinical Health Act (HITECH) section of the ARRA.

HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act, Office for Civil Rights, Notice of Proposed Rulemaking (76 FR 31426, May 31, 2011)

The regulations greatly expand the responsibility for health care covered entities and business associates to document and track the use and disclosure of health information held in an electronic health record (EHR). Health care providers and business associates should plan to thoroughly review these new regulations to understand the impact on their existing policies and procedures.

The regulations outline new procedures for accounting of disclosures of health information held in an electronic health record and disclosed for treatment, payment, and health care operations (as defined under HIPAA). The accounting period under the proposed regulations is three years. The proposed regulations focus on two rights for individuals -- a right to an accounting of disclosure and a "new" right to an access report. The new access report does not distinguish between a use (think internal use by a health care provider) and disclosure (providing the information to a third party). Instead the new right to an access report focuses on whether someone "accessed" the information in the EHR.

Previously under HIPAA, uses and disclosures for treatment, payment, and health care operations (commonly referred to as "TPO") were exempt from the accounting of disclosures requirements. The requirement for accounting for some limited uses and disclosures has always been a part of the HIPAA Privacy Rule.

The rule proposes separate compliance dates for the changes to the accounting of disclosures requirements (180 days after the effective date of the final rule - 240 days after publication of the final rule) and for the right to receive an access report (beginning January 1, 2013, for any EHR system acquired after January 1, 2009 and January 1, 2014, for any EHR system acquired on or before January 1, 2009).

My initial comments above are based upon a quick review of the proposed regulations. Official comments on the NPRM must be submitted on or before August 1, 2011.

Modern Day Hatfield-McCoy: Google Health and Microsoft HealthVault

The Hatfields and McCoys, a metaphor for a modern day high-tech industry rivalry centered on personal health records (PHRs) involving Google Health, Microsoft HealthVault and other PHR vendors. An image that a West Virginia health care lawyer can really appreciate.

Thanks to a tweet by @2healthguru for pointing out the CNET article, Microsoft, Google in healthy competition. The article provides a good overview of the developing PHR movement and some insight into the future. However, I'm a bit concerned by the accuracy of the article when I see two of the individuals mentioned in the article (Matthew Holt and Dave deBronkart) tweeting (here and here) that they weren't really interviewed for the article.

Later this week I will be in D.C.along with others testifying at the Hearing on Personal Health Records before the National Committee on Vital and Health Statistics (NCVHS), Subcommittee on Privacy, Confidentiality and Security . The Subcommittee is looking at the future of the PHR marketplace and consumer-facing health information technology.

The story of the Hatfield-McCoy feud is woven into the fabric of southern West Virginia lore along the Tug River and well known by all West Virginians. Above is a photo of the West Virginia Hatfield clan around 1897, led by Devil Anse Hatfield, second from the left. For more history and photos check out the West Virginia Division of Culture and History.

Note: If you are into off-road vehicle trails, come visit West Virginia and check out the modern day version -- the Hatfield-McCoy Trails.

HITECH Final Regulations Update: Coming Soon!

Susan McAndrew, deputy director for health information privacy at the Office for Civil Rights (OCR) indicated this week that various final regulations modifying the HIPAA privacy and security rules required by the Health Information Technology for Economic and Clinical Health Act (HITECH) will be issued soon. Health lawyers have been waiting on these regulations to better understand the full impact of the HITECH changes to HIPAA, including whether the "harm standard" will remain a part of the Interim Final Rule on breach notification.

According to a Health Information Security News article, McAndrew made this announcement this week while speaking at the 2011 NIST HIPAA Conference, Safeguarding Health Information: Building Assurance through HIPAA Security, held in Washington.

The article also indicated that a separate NPRM will be issued announcing the approach OCR plans to take regarding the accounting for disclosure modifications under the HITECH Act. The HITECH Act modified the traditional rule regarding those types of uses and disclosures that must be accounted for by health care providers and covered entities. Under the traditional rule -- health care providers did not have to provide an accounting of disclosure for uses and disclosures for treatment, payment, and health care operations. However, the modification by the HITECH Act now requires health care providers who utilize an electronic health record system (EHR)to provide, upon request, an accounting of disclosure of all uses and disclosures including those for treatment, payment, and health care operations which occurred within the last three year period. Of further interest will be how the NPRM suggests how business associates who obtain PHI from health care providers must also track and maintain a list of uses and disclosures for accounting of disclosure requests.

Virginia Department of Health Professions Breach: Extortion Demand Regarding 8M Patient Records and 35M Prescriptions

Information Week is covering a story involving an extortion letter sent last week to the Virginia Department of Health Professions seeking $10M to return more than 8M patient records and 35M prescriptions allegedly stolen from the Virginia Department of Health Professions.

The extortion demand was posted on WikiLeaks. The WikiLeaks website states:

May 3, 2009
Summary

On Thursday, April 30, the secure site for the Virginia Prescription Monitoring Program (PMP) was replaced with a $US10M ransom demand:

"I have your shit! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(For $10 million, I will gladly send along the password."

The site, https://www.pmp.dhp.virginia.gov/pmpwebcenter/login.aspx appears to have been entirely disabled and is presently unavailable.
The linked file provides the full ransom message.
The PMP is used by pharmacists and others to discover prescription drug abuse.
The PMP declined to comment, although when contacted, appeared to be aware of the issue, instantly referring inquiries to the director of the DHP, who is presently unavailable.

The Virginia Department of Health Professions website indicates that they are "currently experiencing technical difficulties which affet computerand email systems."

Sandra Whitely Ryals, Director of Virginia Department of Health Professionals, responded to the inquiry by Information Week stating that "a criminal investigation is under way by federal and state authorities."

The Washington Post Security Fix blog is also covering this story. Follow more news on this story via Google News.


UPDATE (5/5/09): At the bottom of his follow up post, John Chilmark asks the question: "Now the question is, under HIPAA, does the VDHP have to send out breach notifications to all consumers whose records have been compromised?

Here is my quick assessment. The HIPAA privacy rule (pre-ARRA HITECH) does not contain provisions that require a covered entity to notify individuals impacted by an alleged breach. However, when I have assisted clients with these types of data breach situations in the past I typically discuss with the client whether it is good practice to provide notification. The HIPAA privacy rule provisions do contain a requirement that a covered entity should mitigate potential harm to patients/individuals when there is a violation of the privacy rule. My interpretation is that this might, under certain circumstances, include providing notice to such individuals whose data has been compromised. Also, a question that factors into the equation is whether or not the Virginia Department of Health Professsions qualifies as either a covered entity or business associate under the HIPAA privacy rule. Handling these situations are very fact specific and depend upon a number of factors.

The new federal breach notification requirements contained in the HITECH section of the American Recovery and Reinvestment Act (ARRA) do not apply because the provisions do not go into effect until 30 days after the Department of Health and Human Services (HHS) publishes the interim final data breach notification regulations which has not yet occurred. The new federal breach notification law will be implemented in conjunction with the Federal Trade Commission's (FTC) proposed health breach notification rule that will apply to PHRs, PHR related vendors and other third party providers. The proposed rule is currently out for comment.

The regulations are currently in the works and HHS has now issued initial guidance on what data is classified as unsecured protected health information (not secured by technology that renders it "unusable, unreadable or indecipherable"). See the April 27, 2009 guidance for more on what this means. The guidance outlines the types of technologies that, if used, create a safe harbor for HIPAA privacy covered entities adn business associates to avoid having to provide notice in a situation where there has been a breach.

Also, the VDHP will likely have to assess the Virginia Data Breach Act (state-by-state survey of state breach laws by the National Conference of State Legislatures) to see whether notification or other action is required under state law.Over 40 states now have distinct state laws governing breach notification that extend to and cover everything from traditional personal information (name, social security number, etc.) to health related information. I've not dealt nor reviewed the Virginia Act but suspect a strong likelihood that notification will be required.

UPDATE (5/6/09): The Roanoke Times provides an update on the status of the pending investigation with comments from Governor Tim Kaine. The article states:

Gov. Tim Kaine said today that a hacker’s reported access to patient prescription records from a state database was “an intentional criminal act against the commonwealth by somebody who was trying to harm others” . . .

The FBI and the Virginia State Police are investigating the matter. Kaine said he could not discuss the probe.

“Right now our goal is to make sure that the investigation and criminal process works so that the person who is responsible is caught and prosecuted . . . and that we protect people whose data has been compromised,” Kaine said this morning.

The article also indicates that under Virginia law notification is required and that Virginia's breach notification law requires, like many state laws, that notice must be provided "without unreasonable delay."

The article also indicates that Virginia law requires notification of individuals whose personal information may have been accessed due to a computer security breach. The law states that notification must be provided “without unreasonable delay.”

New HIPAA Privacy Compliance and Enforcement Website

Yesterday I received an email via the OCR-Privacy listserv announcing the launch of a new HHS web site on HIPAA Privacy Compliance and Enforcement.

I haven't had time to check out the new website but plan to in the coming days. While scanning the website I found the "Enforcement Highlights" and "Case Examples" section very interesting. In the meantime, here is the press release issued in the email by HHS.

To coincide with the fourth anniversary of the enforcement of the HIPAA Privacy Rule, the Department of Health and Human Services (HHS) announced today the launch of an enhanced Web site that will make it easier for consumers, health care providers and others to get information about how the Department enforces health information privacy rights and standards. In launching the website, Winston Wilkinson, the Director of the HHS Office for Civil Rights, noted: "HHS has obtained significant change in the privacy practices of covered entities through its enforcement program. Corrective actions obtained by HHS from these entities have resulted in change that is systemic and affects all the individuals they serve."

The Health Information Privacy Web site provides comprehensive information about the Privacy Rule, which creates important federal rights and requirements to protect the privacy of personal health information. The enhanced Web site, http://www.hhs.gov/ocr/privacy/enforcement provides information for consumers, health care providers, health plans and others in the health care industry about HHS’s compliance and enforcement efforts. The new information describes HHS activities in enforcing the Privacy Rule, the results of those enforcement activities, and statistics showing which types of complaints are received most frequently and the types of entities most often required to take corrective as a result of consumer complaints. The other information on the Web site covers consumers’ rights to access their health information and significantly control how their personal health information is used and disclosed, as well as guidance about how to submit complaints about possible violations of the law and extensive guidance for entities who must comply with the rule.

HHS issued the patient privacy protections pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The first and only comprehensive federal privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers took effect on April 14, 2003. Developed by HHS, these standards provide patients with access to their medical records and more control over how their personal health information is used and disclosed. The regulation covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions (e.g., enrollment, billing and eligibility verification) electronically. HHS has conducted extensive outreach and provided guidance and technical assistance to providers and businesses to help them to implement the new privacy protections. These materials are available at http://www.hhs.gov/ocr/hipaa.

FTC Proposed Health Breach Notification Rule for PHRs and Electronic Health Information

Yesterday, April 16, 2009, the Federal Trade Commission released its proposed Health Breach Notification Rule for Vendors of Personal Health Records (PHRs) and Electronic Health Information.

The official title of the proposed rule is: 16. C.F.R. Part 318: Notice of Proposed Rulemaking and Request for Public Comments Concerning Proposed Health Breach Notification Rule, Pursuant to the American Recovery and Reinvestment Act of 2009.

The FTC is seeking written comments electronically or in paper form. The comments must be submitted by June 1, 2009 and will be placed on the public record and made accessible at the FTC website at: http://www.ftc.gov/os/publiccomments.shtm.

The FTC's press release states:

The Federal Trade Commission today announced that it has approved a Federal Register notice seeking public comment on a proposed rule that would require entities to notify consumers when the security of their electronic health information is breached.

The American Recovery and Reinvestment Act of 2009 (the Recovery Act) includes provisions to advance the use of health information technology and, at the same time, strengthen privacy and security protections for health information. Among other things, the Recovery Act recognizes that there are new types of Web-based entities that collect or handle consumers’ sensitive health information. Some of these entities offer personal health records, which consumers can use as an electronic, individually controlled repository for their medical information. Others provide online applications through which consumers can track and manage different kinds of information in their personal health records. For example, consumers can connect a device such as a pedometer to their computers and upload miles traveled, heart rate, and other data into their personal health records. These innovations have the potential to provide numerous benefits for consumers, which can only be realized if they have confidence that the security and confidentiality of their health information will be maintained.

To address these issues, the Recovery Act requires the Department of Health and Human Services to conduct a study and report, in consultation with the FTC, on potential privacy, security, and breach notification requirements for vendors of personal health records and related entities. This study and report must be completed by February 2010. In the interim, the Act requires the Commission to issue a temporary rule requiring these entities to notify consumers if the security of their health information is breached. The proposed rule the Commission is announcing today is the first step in implementing this requirement.

In keeping with the Recovery Act, the proposed rule requires vendors of personal health records and related entities to provide notice to consumers following a breach. The proposed rule also stipulates that if a service provider to one of these entities experiences a breach, it must notify the entity, which in turn must notify consumers of the breach. The proposed rule contains additional requirements governing the standard for what triggers the notice, as well as the timing, method, and content of notice. It also requires entities covered by the proposed rule to notify the FTC of any breaches. The FTC can then post information about the breaches on its Web site, and notify the Secretary of Health and Human Services.

More information over at info.rmatics blog who appear to have done a quick summary of the proposed rule. I have only had a chance to quickly scan the proposed rule but will add addition comments once I have a chance to read the entire proposed regulations. Comments and thoughts of others are welcomed - please post your comments.

ONCHIT Issues Nationwide Privacy and Security Framework for Electronic Exchange of Health Information

Today the Office of the National Coordinator for Health Information Technology (ONCHIT) issued The Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. The summary states that the framework creates a set of consistent principles to:

". . .address the privacy and security challenges related to electronic health information exchange through a network for all persons, regardless of the legal framework that may apply to a particular organization. The goal of this effort is to establish a policy framework for electronic health information exchange that can help guide the Nation's adoption of health information technologies and help improve the availability of health information and health care quality. The principles have been designed to establish the roles of individuals and the responsibilities of those who hold and exchange electronic individually identifiable health information through a network."

Along with the Nationwide Privacy and Security Framework the Department of Health and Human Services (HHS) has issued The Health IT Privacy and Security Toolkit. The Toolkit includes new HIPAA Privacy Rule guidance documents developed by the ONCHIT and the Office for Civil Rights (OCR) to help facilitate the electronic exchange of health information.

Of particular interest to many interested in PHRs will be the OCR's guidance on Personal Health Records and the HIPAA Privacy Rule and the draft Draft Model Personal Health Record (PHR) Privacy Notice & Facts-At-A-Glance (the "Leavitt Label").

The Toolkit provides information and guidance focused around these key areas:

• Individual Access Principle - Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a readable form and format.
• Correction Principle - Individuals should be provided with a timely means to dispute the accuracy or integrity of their individually identifiable health information, and to have erroneous information corrected or to have a dispute documented if their requests are denied.
• Openness and Transparency Principle - There should be openness and transparency about policies, procedures, and technologies that directly affect individuals and/or their individually identifiable health information.
• Individual Choice Principle - Individuals should be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their individually identifiable health information.
• Collection, Use, and Disclosure Limitation Principle - Individually identifiable health information should be collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately.
• Data Quality and Integrity Principle - Persons and entities should take reasonable steps to ensure that individually identifiable health information is complete, accurate, and up-to-date to the extent necessary for the person's or entity's intended purposes and has not been altered or destroyed in an unauthorized manner.
• Safeguards Principle - Individually identifiable health information should be protected with reasonable administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure.
• Accountability Principle - These principles should be implemented, and adherence assured, through appropriate monitoring and other means and methods should be in place to report and mitigate non-adherence and breaches.

I have only made an initial pass though the information and guidance documents. There is a lot to read and digest over the holidays. Please post in the comments your thoughts on the new federal principles and guidelines.

Recent HIPAA Enforcement Stats

for the latest on HIPAA enforcement statistics by OCR click over to Mike Cassidy's post at the Med Law Blog: HIPAA Criminal Verdict and Enforcement Statistics. The post also contains some stats on the number of matters reported to the DOJ for investigation.

The post includes a summary of United States v. Ferrer, S.D. Fla., No. 06-CR-60261-CR-Cohn, the first criminal HIPAA verdict entered in January 2007. The case involved the wrongful disclosure of individually identifiable health information and identity theft of 1,100 patients from the Cleveland Clinic which were used to fraudulently bill Medicare claims to the tune of $7M.

WVHIN: Public Comment Period on Proposed Privacy and Security Policies

The West Virginia Health Information Network (WVHIN), West Virginia's health information exchange, has issued proposed privacy and security policies and is seeking public comments on the proposed policies from December 3, 2010 through January 3, 2011. The WVHIN is a public/private partnership created in 2006 under W.Va. Code 16-29G-1 et seq. and is charged with building a secure electronic health information system for the exchange of patient data among physicians, hospitals, diagnostic laboratories, other care providers, and other stakeholders.

The proposed privacy and security policies that are available for review and comment are as follows:

• Patient Consent - General
• Patient Consent - Permissible Purpose
• Patient Consent - Sensitive Health Information
• User Authorization
• User Authentication
• Patient Amendment of Protected Health Information
• Patient Access to Protected Health Information
• Minimum Necessary
• Breach Notification

Pursuant to a press release from the WVHIN on the proposed privacy and security policies:

“WVHIN has been developing our core privacy and security policies that will guide us in our initial health information exchange implementation and pilot for 2011. We expect to have changes to the policies as a result of learning how to improve our operations through testing in the pilot period.“

“The policies have been developed over the past few months by the WVHIN Privacy and Security Committee and legal counsel, and are based upon an established WVHIN Privacy Framework and national best practices recommendations in Health Information Exchange (HIE). The committee is made up of stakeholder organizations including provider groups, state government, and consumer groups. The committee followed a cycle of reviewing and vetting the policies that have resulted in our drafts.”

“We have established a public comment period for the draft policies and would like to invite any member of the public to comments on these policies. Thus, we would like to request your assistance in forwarding this e-mail to any parties you may feel would like to comment on the policies. We welcome all feedback”, according to Business Development Manager Samantha Stamper.

Written comments on the proposed privacy and security policies may be submitted to Samantha Stamper, Business Development Manager by January 3, 2011 at sstamper@wvhin.org.

Google Health: Google Partners with Cleveland Clinic

The New York Times Technology Section reports on a pilot project between Gooogle and the Cleveland Clinic in an article, Google to Store Patients' Health Records.

The article indicates the pilot project will involve a volunteer patient group transferring their personal health records so that they are available via Google Health, a new health record product being developed by Google. The article quotes Pam Dixon of the World Privacy Forum concerning privacy issues under HIPAA (incorrectly referenced by the Times as HIPPA).

I don't necessarily agree with the scope of the comments regarding the applicability of HIPAA in this situation. Although I don't know the full details of the relationship for the proposed project but it would appear that Google in this situation might be serving as a business associate of the Cleveland Clinic for the project. As a business associate it is likely that Google would be held contractually to many of the HIPAA privacy standards.

Tip to Matthew Holt at Health 2.0 Blog for noticing the NYT article.

UPDATE (2/22/08): ZDNet's Larry Dignan at Between the Lines has more on the pilot project including the Cleveland Clinic's press release.

The comments to Dignan's post are interesting reading especially a couple with a legal perspective. The comment, two misconceptions, highlights the overall light enforcement efforts by OCR and lack of penalties, whether Google might fit the "healthcare clearinghouse" definition under the "covered entity" definition, entering into a contract with the health care provider (business associate requirement) and discusses the subpeona and marketing misconceptions.

Also, more from NYT's Steve Lohr, Google Health Begins Its Preseason at Cleveland Clinic which indicates that Google Health will be made available to the public following completion of the pilot project (appoximately 2 months). The article also has a quote from fellow health care blogger and CIO of Beth Israel Deaconess Medical Center in Boston, John Halamka, who indicates that the hospital is also interested in linking its EMR with Google Health. As a board member of the West Virginia Health Information Network I would like to explore the idea of utilizing and integrating Google Health into our statewide effort to bring about an integrated/interoperable health information system.

Jane Sarasohn-Kahn at HealthPopuli shares her thoughts and additional link commentary on the Google/Cleveland Clinic project. Jane highlights a recent report, Personal Health Records: Why Many PHRs Threaten Privacy, by the World Privacy Forum looking into privacy issues for PHRs.

Matthew Holt's follow up post taking a closer glimpse at the privacy questions, motives and opportunities both pro/con surrounding the Google Health project.

UPDATE (2/24/08): For the latest article covering the Google Health project check out Newsweek's article, Web Surfer, Health Thyself, out in the March 3 edition.

Also, MSNBC provides some additional insight on how Google Health will interact with the existing Cleveland Clinic EHR (or PHR) in Google Goes to the Doc's Office. The article describes the pilot project as follows:

. . . The Cleveland Clinic already keeps electronic records for all its patients. The system has built-in smarts, so that it will alert doctors about possible drug interactions or when it's time for, say, the next mammogram. In addition, 120,000 patients have signed up for a service called eCleveland Clinic MyChart, which lets patients access their own information on a secure Web site and electronically renew prescriptions and make appointments.

The system has dramatically cut the number of routine calls to the doctor and boosted productivity, though it has yet to effectively deal with information from an outside physician, Harris says. Those records are typically still on paper, and have to be laboriously added to the Cleveland Clinic system. It is a big problem, especially for the clinic's many patients who spend winters in Florida or Arizona, where they see other doctors.

Adding Google's technology lets patients jump from their MyChart page to a Google account. Once on Google, they'll see the relevant health plans and doctors that also keep electronic medical records. That means the patient can choose to share information between, say, the Arizona doctor and the Cleveland Clinic . . .

UPDATED 2/26/08: Scott Shreeve goes Giga over Google Health. Read his first impressions of the Google PHR after his test drive at HIMSS.

However, Dmitriy at TrustedMD makes some great points, including this quote:

Yet, even with free PHRs out there, consumers simply do not care for spending their time to learn and use them. Who would bother entering and checking their medical records if you are healthy and would rather go see a movie? And once you get sick, you do not want to enter them either. You just want your doctors and hospitals to hand your medical records to you. But you see, the providers have different priorities that a mere piece of software just cannot solve . . . PHRs' real problems are not technical, usability or even privacy. The real problem is consumer and provider motivation . . .

He ends his posts with some questions we should all be discussing. Until we see a reimbursement model that creates incentives for providers to look at more health information and consumers to care about and take an active part in their health -- I'm not sure the PHR/EHR initiatives will fully develop and mature.

Follow the latest news (blog posts) and the Techmeme reaction to the project.

Data Missing on 200,000 West Virginia PEIA Members

WSAZ News, the State Journal and Charleston Gazette are reporting that data on approximately 200,000 past and current members of West Virginia Public Employees Insurance Agency (PEIA) is missing. According to the articles, the data was contained on a computer tape being mailed to a data analyst in Pennsylvania and was reported missing on October 18.

The data tape included names and maiden names, addresses, social security numbers, telephone numbers, and marital status of program participants and their covered dependents. The article indicates that the data tape did not contain medical or prescription claims information.

According to the article, letters will be mailed to impacted members and a hotline will be set up to answer questions about the lost data.

UPDATE: For more information check out the PEIA Data Loss Press Release and the Letter to Affected Policyholders about PEIA's Recent Data Loss.

HIPAA Settlement: Dumping of PHI Results In $2.25M Settlement

This week's settlement by CVS, the nations largest retail pharmacy chain, to pay the U.S. government a $2.25 million settlement and take corrective action highlights the need for providers and other covered entities to focus on the simple privacy protections such as appropriately disposing of patient information in a secure manner.

The first known joint investigation and settlement by the U.S. Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) with CVS was the result of CVS failing to guard patients PHI when disposing of patient information such as identifying information on pill bottle labels. .

The review and settlement under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule by OCR and the FTC indicated that:

• CVS failed to implement adequate policies and procedures to appropriately safeguard patient information during the disposal process
• CVS failed to adequately train employees on how to dispose of such information properly
  

The investigation started after various news media reported fiding prescription drug and other PHI had been dumped into unsecured trash containers at CVS pharmacies. As a result CVS not only violated the HIPAA Privacy Rule but also was brought under the FTC's deceptive business practice guidelines by claiming that CVS represents to consumers that maintaining customer privacy was central to their operations.
For more read the OCR Press Release (related OCR information/summary) FTC Press ReleaseComplaint and Consent Order) and the Resolution Agreement. Also, OCR has posted new FAQs that address the HIPAA Privacy Rule requirements for disposal of PHI. (related FTC

California Health Data Privacy and Security Bills Signed

Last week two new California data privacy and security bills were signed into law. Senate Bill 541 and Assembly Bill 211 set new breach disclosure standards and require security controls for preventing unauthorized access to patient data.

I previously posted about the bills before they were finalized. Computer World, "New health care privacy laws heighten need for HIPAA compliance in California," provides background and a good overview on the scope of the laws with great links to additional information.

Those who do health care business in California should take a close look at these new laws.

Advocating The Need For A Federal Data Breach Disclosure Law

Information Week's Security Blog advocates for a federal data breach disclosure law in this post, The Time Is Now (Better Yet, Yesterday) For A Federal Data Breach Disclosure Law.

Thanks to the HIPAA Blog for point out the article. I agree with Jeff Drummond's conclusion. After having analyzed overlapping and different state disclosure requirements as a part of assisting clients with data breach issue a federal approach is the direction we should go. (caveat: it should require total preemption - not partial preemption like HIPAA privacy).

A federal approach would help set a national industry standard that can be clearly understood, implemented and followed by those who regularly deal in data, health care or otherwise. The state-by-state patchwork of different laws that currently exist create a complexity that is not needed.

For more on the ongoing complexity issue check out California's recently revised law (AB1298) that recently took effect. AB1298 effective January 1, 2008, expands the coverage and protections to medical information and health insurance information under California's State Information Practices Act.

A clear and concise national approach would simplify compliance for those required to maintain and protect data, including health care providers maintaining health information. Customers and patients who expect their data to be maintained would also benefit by a simplified approach and uniform law that provides for a consistent level of breach notification and protection.

For more on state security breach notification legislation/laws check out the National Conference of State Legislatures website page "Breach of Information". Last updated in April 2007, it states "thirty-five states have enacted legislation requiring companies and/or state agencies to disclosure security breaches involving personal information." I suspect this number will increase after the 2008 legislative sessions around the country.

Also, NCSL provides a summary of data breach notification legislation introduced by year. For 2007, they list three bills introduced (but not passed) before the West Virginia Legislature:

WEST VIRGINIA

WV H 2175	Sponsor: Marshall (D) Title: Acquisition of Security Compromising Data Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Relates to the unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2263	Sponsor: Brown (D) Title: Clean Credit Information and Identity Theft Protection Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Ensures clean credit information and identity theft protection (FN). Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2705

Sponsor: Marshall (D) Title: Consumer Right to Impose Freeze on Credit Reports Introduced: 01/30/2007 Location: House Judiciary Committee Summary: Establishes a procedure whereby a consumer may implement a security freeze to prohibit a consumer reporting agency from releasing all or any part of the consumer's credit report. Status: 01/30/2007 INTRODUCED. 01/30/2007 To HOUSE Committee on JUDICIA

As a result of high profile cases like this one that occurred in West Virginia, we will again see activity this year in West Virginia.