1. What to Expect and How to Prepare: Healthcare Security & Privacy Regulation and Enforcement in 2015 and Beyond

5. 2014  Data breaches  Settlements & Resolution Agreements  Approximately $5.5 million collected  Greatest number of HIPAA settlements  HIPAA Audits  Leadership changes  Complaints, compliance reviews & investigations

6. “OCR’s strong enforcement of the HIPAA privacy, security, and breach notification rules, remains very much on track.”

7. 2015  HIPAA Audits  Enforcement  Complaints, compliance reviews & investigations

8. HIPAA Audits  Policies & procedures – daily activities  Staff knowledge & training  Cybersecurity – Risk assessments, breach notification & access controls  Privacy notice practices  Audit protocol  http://www.hhs.gov/ocr/privacy/hipaa/enfor cement/audit/protocol.html http://www.hhs.gov/ocr/privacy/hipaa/enfor cement/audit/protocol.html

9. Enforcement  6,000+ open investigations  Increased focus on negotiating settlements  Various methods for enforcement

10. Complaints & Investigations  Complaints volume increases each year  Record number expected for 2015  Inconsistency between regional offices  Request policies & procedures (mini audits)  Culture of compliance

11. How to Prepare 1. Cybersecurity 2. Business Associate Agreements

12. Cybersecurity  Gap analysis  Staff training  Inventory of systems & devices  Regular review of policies & procedures

13. Business Associate Agreements  HITECH Act  Increased negotiation surrounding BAAs  Indemnity  Which entity is responsible for breach notification & responding to patient requests  Subcontractor BAAs  Termination rights for material breach

14. Takeaways  Audit first  Review and negotiate BAAs  Dust off Policies & Procedures  Addressable Elements  Compliance Culture

15. Questions ?

16. Carrie S. Gilbert Dressman Benzinger LaVelle psc cgilbert@dbllaw.com 859-341-1881