MU and HIPAA Compliance 101 Robert Morris VP Business Services Ion IT Group, Inc

Agenda: 2

3 Sometimes we have to do things even when we don’t want to… Odie 12/15/2011

4 HIPAA Components Title 1 Portability Title II Admin Simplification Title III Med Savings Account Title IV Group Health Plan Provisions Title V Revenue Offset Provision Privacy since 4/03 EDI Security Compliant since 4/05 Transactions Code Sets Identifiers Use/Disclosure of PHI Individual Rights Administrative Requirements Admin Procedures Physical Safeguards Organizational Requirements Technical Safeguards HIPAA Components (est. 1996)

5 HIPAA Components (est. 1996) Title 1 Portability Title II Admin Simplification Title III Med Savings Account Title IV Group Health Plan Provisions Title V Revenue Offset Provision Privacy Compliant since 4/03 EDI Security Compliant since 4/05 Transactions Code Sets Identifiers Use/Disclosure of PHI Individual Rights Administrative Requirements Admin Procedures Physical Safeguards Technical Security Mechanisms Technical Security Service

Why Should We Care about Network Security? Potential for downtime and impact on patient care It’s both a State and Federal law The dreaded blank check scenario Possible fines for security breaches HIPAA requires we implement security measures to protect PHI on paper and electronically! Damage to reputation for security breaches (newspaper headlines) 6

Headlines July 07, 2010 Conn. AG, Health Net Reach Settlement Over Medical Data Breach On Tuesday, insurer Health Net reached a $250,000 settlement with Connecticut Attorney General Richard Blumenthal (D), who sued the company after it lost a computer hard drive in 2009, Dow Jones/Wall Street Journal reports. T he hard drive contained medical and financial information on about 500,000 members from the state. (Solsman, Dow Jones/Wall Street Journal, 7/6). 7

Headlines June 2, 2010 “Many of the major healthcare information breaches reported since last September, when the HITECH Breach Notification Rule took effect, have involved the theft or loss of unencrypted laptops and other portable devices.” Terrell Herzig is HIPAA security officer at UAB Health System in Birmingham, Ala. 8

Agenda: 9

10 Conduct or review a security risk analysis in accordance with the requirements under 45 CFR (a)(1) and implement security updates as necessary and correct identified security deficiencies as part of its risk management process. Meaningful Use Core Set verbiage says…

11 Aaaannd that means what??… Administrative Safeguards 1.You must have a Security Management Process - a)Implement Policies and procedures to prevent, detect contain and correct security violations. 2.Risk Analysis - a)Conduct and accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the covered entity. 3.Risk Management - a)Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with (a). 4.Sanction Policy – a)Apply appropriate sanctions against workforce members who fail to comply with the security policies of the covered entity. 5.Information System Activity Review – a)Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. PS. Breach notification was effective 9/2009 Covered entities and business associates have the burden of proof to demonstrate that all required notifications have been provided or that a use or disclosure of unsecured protected health information did not constitute a breach. This section also requires covered entities to comply with several other provisions of the Privacy Rule with respect to breach notification.

How You Can Help Your Organization Keep the Network Secure 12

User Access Control and Password Guidance Unique User ID All system access with your ID is YOUR responsibility. Password Guidelines Passwords must be a combination of upper and lower case letters, number and special characters. 13 Automatic Logoff Your EHR session should terminate after 15 minutes of inactivity.  Always save your work before leaving your workstation !

Accounting for Disclosures Always indicate why treatment, payment, or authorization information is being disclosed. Minimum Necessary Rule: “…take reasonable steps to limit the use or disclosure of, and requests for, [PHI] to the minimum necessary to accomplish the intended purpose.” 14

Tasks for the IT Dept Role-Based Access: Manage who gets access to what. Firewall Review: Make sure that communication with the outside world is secure. Wireless Security: Manage who gets WiFi access. Antivirus: Manage software to keep viruses and malware at bay. Server/Workstation Updates: Make sure all software gets appropriate updates to mitigate problems. 15

Tasks for the IT Dept Backup: Keep a backup of all data, just in case! Backup Encryption: Make backup data unreadable to snoopers. Recovery: Have a plan in case disaster strikes! 16

Summary Protecting data is everyone’s responsibility. Understand HIPAA. Hold each other accountable. 17

18 Thank you for your time today! Robert Morris