Presentation on theme: "HIPAA: Where Are We and Where Are We Going?? A Survey of the Current HIPAA Landscape Gail Edson Halterman Lathrop & Gage L.C. HCCA Region VII Conference."— Presentation transcript:
HIPAA: Where Are We and Where Are We Going?? A Survey of the Current HIPAA Landscape Gail Edson Halterman Lathrop & Gage L.C. HCCA Region VII Conference August 1, 2003
► We have had: 109 Days of Privacy ► We have: 74 Days Until Standard Transactions and Medicare’s Required Electronic Claims Submission (October 16, 2003) 624 Days to Get Secure (April 21, 2005)
PRIVACY: Where are We? ► April 14, 2003: The ENFORCEMENT Date The Office of Civil Rights (OCR) is the ENFORCER OCR has received several hundred complaints ► Some Complaints were not properly filed ► Continual re-emphasis that OCR is the kinder, gentler enforcement agency No indication by OCR that Penalties have been imposed
PRIVACY: COMPLAINTS ► March 20, 2003 – HHS Issues Complaint Process in the Federal Register ► Complaints must: Be filed in writing, either on paper or electronically (OCR Form recommended) Name the entity that is the subject of the complaint and describe the acts or omissions in violation of the statute or regulations; Be filed within 180 days when the complainant knew or should have known that the act or omission occurred; Relate to violations that occurred AFTER April 14, 2003
PRIVACY: COMPLAINTS ► Complaints can be made by anyone – the regulations do not specify that it must be the subject of the information ► Complaints must be mailed, faxed or emailed to the OCR regional office in which the covered entity is located ► Region VII (IA, KS, MO or NE): OCR, 601 E 12 th Street, KC, MO 64106 (816) 426-7278, fax: (816) 426-3686 or OCRComplaint@hhs.gov OCRComplaint@hhs.gov
PRIVACY: Enforcement ► General Approach to enforcement: HHS “intends to seek and promote voluntary compliance with the rules promulgated to carry out the HIPAA Provisions.” OCR “will seek the cooperation of covered entities in obtaining compliance...[and] will seek to resolve matters by informal means before issuing findings of non-compliance. CMS “Enforcement Activities will focus on obtaining voluntary compliance through technical assistance. The process will be primarily complaint driven and will consist of progressive steps that will provide opportunities to demonstrate compliance or submit a corrective action plan.”
Enforcement ► Violations: Civil Penalties – ► up to $100 per violation, not to exceed $25,000 per year ► Defenses - no willfulness involvement; organization exercised reasonable diligence
Enforcement Criminal Penalties ► applies in knowing violations of regulations ► Can be subject to fines of not more than $50,000 or jail time of not more than 1 year or both ► If the offense is committed under false pretenses, can be subject to fines of not more than $100,000 or imprisoned for not more than 5 years or both ► If the offense involves the intent to sell or transfer PHI for commercial gain or malicious harm, can be subject to fines of not more than $250,000 or jail time of 10 years or both.
PRIVACY: Enforcement ► Interim Rules related to civil money penalties (CMPs) issued April 17, 2003 ► Enforcement Regulations are applicable to investigations, imposition of penalties and hearings conducted as a result of proposed CMPs. ► Not a lot of new information ► Waiting for more!
PRIVACY: Enforcement ► Requires HHS to provide written notice to Covered Entity of proposed penalty ► Notice must contain: A description of the findings of fact Reasons why the penalty is being proposed Instructions for response to the Notice, including the right to request a hearing
PRIVACY: Enforcement ► If a hearing is requested, it is heard before an administrative judge. ► The request for hearing must meet certain specifications ► Secretary of HHS has authority to settle disputes
PRIVACY: Enforcement ► What We Know CMPs only for Knowing Violations CMPs can be reduced or waived 6 year statute of limitations on violations for CMP purposes Due process issues exist in current rule ► What We Don’t Know Does a HIPAA violation have an impact on compliance with Medicare Conditions of Participation? Details of how CMPs will be determined
PRIVACY: Certification of Business Associates ► Joint Commission on Accreditation of Health Care Organizations (JCAHO) and the National Committee or Quality Assurance (NCQA) will be certifying business associates ► 8 Organizations have committed to seeking certification ► Any type of BA is eligible for certification ► Once certification application is submitted, a survey of practices is conducted to see compliance with JCAHO and NCQA standards
PRIVACY: Certification ► Standards for Certification of Business Associates issued and are intended to address: Privacy protections the business associate uses for oral, written and electronic health information Employee training in protecting PHI Consumer access to health information held by the business associate Contracting between covered entities and the business associate ► Standards were not available at the time of presentation material deadline
PRIVACY: IMPLEMENTATION QUESTIONS ► Biggest areas of questions/concerns thus far: BUSINESS ASSOCIATES ► Are they or aren’t they? ► Remember “extension” deadline for all contracts is April 14, 2004 RESEARCH ► When can we use PHI for Reviews Preparatory to Research RESPONDING TO SUBPOENAS ACCOUNTING OF DISCLOSURES LAW ENFORCEMENT COMMUNICATIONS
BUSINESS ASSOCIATES ► No need for Business Associate Agreement in TREATMENT situations ► COVERED ENTITY has the obligation to obtain the Business Associate Agreement ► TWO PART TEST: Do they perform a service or function on behalf of a COVERED ENTITY? Do they receive PHI in doing so?
REVIEWS PREPARATORY TO RESEARCH REVIEWS PREPARATORY TO RESEARCH ► A covered entity can use or disclose PHI to a researcher IF the researcher represents: The use or disclosure is requested solely to review PHI as necessary to prepare a research protocol or for a similar purpose; The PHI will not be removed from the covered entity in the course of the review (including notes of the researcher); and The PHI requested is necessary for the researcher
RESPONDING TO SUBPOENAS ► Generally – No disclosure pursuant to a subpoena UNLESS: Qualified Protective Order Written assurances from party seeking the information: ► Of a good faith attempt to provide notice to the subject and no objection was made; or ► That a request for a Qualified Protective Order has been submitted to the Court. ► Workers Compensation If state law allows party issued subpoenas – may disclose PHI pursuant to subpoena
ACCOUNTING FOR DISCLOSURES ► Right to an Accounting patient may request accounting of uses and disclosures made within the last 6 years (beginning 4/14/03). An Accounting must be given within 60 days of request.
Disclosures NOT included in Accounting ► Disclosures made for TPO ► Disclosures for which there has been an opportunity to object (as permitted) ► Disclosures made incidental to permissible disclosures ► Disclosures made pursuant to an authorization
Disclosures NOT included in Accounting ► Disclosures for national security or intelligence purposes ► Disclosures made to correctional institutions and law enforcement officials ► Disclosures made as part of a limited data set ► Disclosures that occurred prior to 4/14/03
So What Must Be Included in an Accounting?! ► Uses or Disclosures made by mistake (i.e. violations) ► Most of the PERMITTED uses and disclosures: Except for disclosures made: ► For National Security or Intelligence Purposes ► To Law Enforcement ► To Correctional Facilities
So What Must Be Included in an Accounting?! ► PERMITTED DISCLOSURES = all other disclosures (not included in an exception above) listed in 45 CFR § 164.512
LAW ENFORCEMENT COMMUNICATIONS ► Can Provide PHI to Law Enforcement IF: Required by Law to Do So (e.g. reporting gunshot wounds) In compliance with court, grand jury or administrative agency- ordered warrant or subpoena or request Limited info for identification and location purposes (suspect, fugitive, material witness or missing person) Victim of a Crime and individual agrees or it is in the best interest of the individual For purposes of alerting to the death of individual if death resulted from crime Reporting a crime on the premises Reporting crime in emergencies
Transactions and Code Sets A Quick Overview ► The Standards regulate the transmission of electronic data and require standard formatting for the transmissions. ► Accredited Standards Committee’s Insurance Subcommittee (ANSI X12N): define how electronic data is to be structured to accurately and consistently represent data contained in paper based documents.
Transactions and Code Sets ► Any time you are engaging in these 8 activities electronically (or someone is on your behalf) you must comply. ► 8 Standard Transactions health care claims or equivalent encounter information (including Medicaid claims) (837); eligibility for a health plan (270/271); referral certification or authorization (278); health care claim status (276/277);
Transactions and Code Sets ► 8 Standard Transactions (con’t): enrollment and disenrollment in a health plan (834); health care payment and remittance advice (835); health plan premium payments (820); and coordination of benefits (837)
Code Sets Required ► Current Procedure Terminology (CPT-4) For Physician and other related services ► International Classification of Diseases, Clinical Modification (ICD-9-CM) For diagnosis and inpatient hospital services ► HCFA Common Procedure Coding Systems (HCPCS) For physician and other related services ► Code on Dental Procedures and Nomenclature (CDT-2) For dental services ► NCPDP OR NDC For Retail Drug Claims
Electronic Transactions ► After October 16, 2003, Medicare will no longer accept paper claims (some exceptions apply) ► Likely Medicaid and Private Payors will follow!
Implementation Guides ► What are they? Format: how information should be arranged Content: what information should be included Code Sets: how information should be reported Order or Download from: ► http://www.wpc-edi.com/hipaa/HIPAA_40.asp http://www.wpc-edi.com/hipaa/HIPAA_40.asp ► Many, many pages (For example: Implementation Guide for 837 Professional Claims is 768 pages)
TRANSACTIONS & CODE SETS ► 74 days until the “TRAIN WRECK” ► AHA and other associations have great concern about the ability to go about our business on and after October 16, 2003 and have urged Congress to consider another extension, or at least remedial efforts to address payment issues ► National Committee on Vital and Health Statistics recommends no delay but “flexible enforcement” ► Where are you in your readiness?
SECURITY: The New Kid On the Block ► Enforcement Date: April 21, 2005 ► Requires physical, administrative and technical safeguards be in place to protect ELECTRONIC PHI (EPHI) ► HOWEVER – Privacy Rule requires that covered entities have physical, administrative and technical safeguards in place to protect PHI in any form or medium
SECURITY ► No answer from HHS as to whether standards for security will be required for privacy RIGHT NOW.
Intent of the Security Rule ► Ensure confidentiality, integrity and availability of all electronic PHI ► Protect against reasonably anticipated threats or hazards ► Protect against any reasonably anticipated use or disclosure not required or permitted by the Privacy Rule
Intent of Security Rule ► Use any security measure deemed appropriate by the entity to reasonably implement the Security standards – Each entity MUST make documented security implementation decisions that take into account its Risk analysis Structure, etc. Cost Technical capabilities
Security Regulations Overview ► All standards are required (18) ► Some implementation specifications are required, some are merely “addressable” (i.e. suggested) ► “Addressable” should allow for flexibility ► There is no distinction between data at rest and data in transmission
Security Regulations Overview ► Paper-to-paper faxes, person-to-person telephone calls, video teleconferencing, or messages left on voicemail are not covered by the Security Regulations
Standards: Administrative Safeguards ► Standard: A covered entity must implement policies and procedures to prevent, detect, contain and correct security violations ► REQUIRED Implementation: Risk Analysis Risk Management Sanctions Policy Information System Activity Review (i.e. internal audit)
Standards: Administrative Safeguards ► Standard: Assign Security Responsibility ► REQUIRED Implementation: Identify the security official who is responsible for the security practices
Standards: Administrative Safeguards ► Standard: Information Access Management Implement policies and procedures for authorizing access consistent with the Privacy Rule ► REQUIRED Implementation: Isolating health care clearinghouse functions ► ADDRESSABLE Implementation: Access authorization Access establishment and modification
Standards: Administrative Safeguards ► Standard: Security Awareness and Training Implement security awareness training program for all members of the workforce (including management) ► ADDRESSABLE Implementation: Security Reminders Protection from Malicious Software Log-in Monitoring Password Management
Standards: Administrative Safeguards ► Standard: Security Incident Procedures Implement policies and procedures to address security incidents ► REQUIRED Implementation: Response and Reporting (instructions for reporting and responding to security breaches and documentation of security incidents and their outcomes)
Standards: Administrative Safeguards ► Standard: Contingency Plan Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems that contains PHI ► REQUIRED Implementation: Data Backup Plan Disaster Recovery, Emergency Mode Operations Plan ► ADDRESSABLE Implementation: Testing and Revision Procedures Applications and Data Criticality Analysis
Standards: Administrative Safeguards ► Standard: Evaluation Perform periodic technical and non- technical evaluation in response to environmental or operational changes ► No Implementation Specifications, but examples include: Updating software Evaluating performance of system and make necessary adjustments
Standards: Administrative Safeguards ► Business Associate Contracts No more “Chain of Trust” Satisfactory Assurances that business associate will appropriately safeguard information ► REQUIRED Implementation: Written Contract ► Ensure security is also covered in privacy Business Associate Agreement
Standards: Physical Safeguards ► Standard: Facility Access Control Implement policies and procedures to limit physical access to electronic information ► ADDRESSABLE Implementation: Contingency Operations Facility Security Plan Access control and validation Maintenance Records
Standards: Physical Safeguards ► Standard: Workstation Use Implement policies and procedures that specify functions, physical attributes of surroundings and manner in which functions performed ► No Implementation Specifications, but examples include: Moving screens away from common areas, etc.
Standards: Physical Safeguards ► Standard: Workstation Security Safeguards for access ► No Implementation Specifications, but examples include: Restricting Access to authorized users Using Password protections, etc.
Standards: Physical Safeguards ► Standard: Device and Media Controls Govern the receipt and removal of hardware and electronic media into and out of facility, and movement within facility ► REQUIRED Implementation: Disposal (where do your hard drives go?) Media re-use ► ADDRESSABLE Implementation: Accountability Data backup and storage
Standards: Technical Safeguards ► Standard: Access Control Technical safeguards to limit access ► REQUIRED Implementation: Unique User Identification Emergency Access Procedures ► ADDRESSABLE Implementation: Automatic Logoff Encryption and Decryption
Standards: Technical Safeguards ► Standard: Audit Controls Implement mechanisms that record and examine activity in information systems ► No Implementation Specifications, but examples include Using network intrusion detection Performing system wide evaluation
General Safeguards ► Standard: Draft Policies and Procedures ► Standard: Documentation ► REQUIRED Implementation: Record retention of policies and procedures – at least 6 years Availability Updates
Standards: Technical Safeguards ► Standard: Integrity Implement safeguards to protect electronic PHI from improper alteration or destruction ► ADDRESSABLE Implementation: Mechanisms that corroborate that information has not been altered or destroyed
Standards: Technical Safeguards ► Standard: Person or Entity Authentication No Implementation Specifications, but examples include: Verifying that persons or entities seeking access are the ones claimed
Standards: Technical Safeguards ► Standard: Transmission Security Implement technical security measures to guard against unauthorized access transmitted over an electronic communications network ► ADDRESSABLE Implementation: Integrity Controls Encryption
GET STARTED ► SECURITY RISK ANALYSIS Identify potential threats to the organization Evaluate the likelihood that the threat will occur Estimate the harm from such an occurrence Determine whether planned or existing controls exist to reduce or eliminate the risk
Contact Information Gail Edson Halterman Lathrop & Gage L.C. 2345 Grand Boulevard, Suite 2400 Kansas City, Missouri 64108 firstname.lastname@example.org 816.460.5404 816.292.2001 (fax)