The IT Vendor: HIPAA Security Savior for Smaller Health Plans?

Milliman USA Agenda Definitions Definitions Problem Problem Expectations Expectations Responsibilities by specification Responsibilities by specification Collaboration Benefits Collaboration Benefits Implementation process Implementation process

Milliman USA Vendor Defined Benefits System vendor Benefits System vendor TPA TPA

Milliman USA Smaller Health plan defined Self-insured with 100 to 100,000 participants Self-insured with 100 to 100,000 participants Activities Activities – Enrollment – PHI management – Claims – Miscellaneous other Often single employer or multi- employer plans Often single employer or multi- employer plans

Milliman USA Flexibility in Rule Covered entities may use any security measures that allow the covered entity to reasonably and appropriately implement the standards and implementation specifications -- § (b)(1) -- § (b)(1)

Milliman USA Problem: Issue I What measures are: “Reasonable and Appropriate”?

Milliman USA Problem: Issue II Are the costs of determining “reasonable and appropriate,” measures reasonable and appropriate?

Milliman USA Problem: Issue III HIPAA requires Actions and Documentation

Milliman USA Problem: Health Plan Perspective Limited internal capabilities Limited internal capabilities Consultants too expensive Consultants too expensive Boilerplates general and open- ended Boilerplates general and open- ended Vendor dependency for IT Vendor dependency for IT Document, document, document Document, document, document Who cares? Who cares?

Milliman USA Problem: Vendor Perspective Not the covered entity Not the covered entity Assume compliance Assume compliance Other client service priorities Other client service priorities Who pays? Who pays? Who cares? Who cares?

Milliman USA Expectations Health plan: vendor has solved this Health plan: vendor has solved this Vendor: health plan is the covered entity Vendor: health plan is the covered entity Both: little chance of enforcement Both: little chance of enforcement

Milliman USA Single Systems According to NIST Be under the same direct management control Be under the same direct management control Have the same function or mission objective Have the same function or mission objective Have essentially the same operating characteristics and security needs Have essentially the same operating characteristics and security needs Reside in the same general operating environment Reside in the same general operating environment

Milliman USA Opportunity Overlapping features among installations and similar clients Overlapping features among installations and similar clients Half of requirements technical Half of requirements technical Vendor natural focus for plans Vendor natural focus for plans Documentation similar among installations Documentation similar among installations

Milliman USA Shortcoming of Collaborative approach Management control divided between vendor and healthplan Management control divided between vendor and healthplan Installation specific issues Installation specific issues Coordination of implementation process Coordination of implementation process Responsibility = liability? Responsibility = liability? Still not resource free Still not resource free

Milliman USA Responsibility by Specification Administrative (shared) Administrative (shared) Physical (primarily healthplan) Physical (primarily healthplan) Technical (primarily vendor) Technical (primarily vendor)

Milliman USA Administrative Safeguards Security management process (V/HP) Security management process (V/HP) Assigned security responsibility (HP) Assigned security responsibility (HP) Information access management (V/HP) Information access management (V/HP) Training (HP) Training (HP) Incident procedures (V/HP) Incident procedures (V/HP) Contingency plan (V/HP) Contingency plan (V/HP) Evaluation (V/HP) Evaluation (V/HP) Business associate contracts (HP) Business associate contracts (HP)

Milliman USA Physical Safeguards Facility access controls (HP) Facility access controls (HP) Workstation use and security (HP) Workstation use and security (HP) Device and media controls Device and media controls (HP primarily—vendor may provide DB backup)

Milliman USA Technical Safeguards Access controls (V) Access controls (V) Audit controls (V) Audit controls (V) Data integrity (V) Data integrity (V) Entity authentication (V) Entity authentication (V) Transmission security (V) Transmission security (V)

Milliman USA Example: Risk Assessment Exceeds technical capabilities of smaller healthplansExceeds technical capabilities of smaller healthplans Much of assessment similar for comparable plans with same systemMuch of assessment similar for comparable plans with same system

Milliman USA Example: Risk Assessment: Components 1.EPHI boundary definition 2.Threat identification 3.Vulnerability identification 4.Security control analysis 5.Risk likelihood determination 6.Impact analysis 7.Risk determination 8.Security control recommendations

Milliman USA Example: Assigned responsibility Boilerplate job description can be edited by each healthplan

Milliman USA Example: Security Management Process Risk analysis focuses on vendor system Risk analysis focuses on vendor system Risk management focuses on vendor system Risk management focuses on vendor system Healthplan determines sanction policy Healthplan determines sanction policy Vendor provides tool or performs system activity review Vendor provides tool or performs system activity review

Milliman USA Example: Security Awareness and Training Vendor could provide: Vendor could provide: – Security reminders – Protection from malicious software – Log-in monitoring – Password management controls Training program options Training program options

Milliman USA Example: Device and Media Controls Disposal and media reuse; accountability systems Disposal and media reuse; accountability systems – Vendor provides proposed guidelines to clients – Clients edit and implementation guidelines Data backup and storage: Vendor may propose Internet and ASP options Data backup and storage: Vendor may propose Internet and ASP options

Milliman USA Example: Access Controls Vendor system includes: Vendor system includes: – Unique User Identification – Emergency Access Procedure – Automatic Logoff – Encryption and Decryption

Milliman USA Collaboration Benefits: Vendor Leadership Leadership Value added service to client Value added service to client Controlling healthplan consultants Controlling healthplan consultants Resolution of system security issues Resolution of system security issues Improved market positioning Improved market positioning

Milliman USA New vendor opportunities Secure backup services Secure backup services Installation specific assistance Installation specific assistance Intrusion detection services Intrusion detection services Secure messaging and encryption Secure messaging and encryption Ongoing security management Ongoing security management

Milliman USA Collaboration Benefits: Health Plan Spreading costs Spreading costs Managing HIPAA realistically Managing HIPAA realistically Synergies Synergies

Milliman USA Vendor Implementation Options Serial Approach: Implement internal solution then involve clients Serial Approach: Implement internal solution then involve clients Group solutions Group solutions – User groups – Target clients – Workshops

Milliman USA Stumbling Blocks Variations on installs Variations on installs Health plan specific issues Health plan specific issues Coordination Coordination Vendor apathy Vendor apathy Resources Resources

Milliman USA Implementation Process Vendor acceptance Vendor acceptance Determine strategy Determine strategy Assess resource needs Assess resource needs Evaluate vendor system Evaluate vendor system Modify system as needed Modify system as needed Prepare template policies Prepare template policies Implement policies at installations Implement policies at installations

Milliman USA Strategic issues Healthplan or vendor centered approach Healthplan or vendor centered approach Security program structure Security program structure Implementation sequence Implementation sequence Cost structure Cost structure Kick-off Kick-off

Milliman USA Next Steps: Vendor Conduct preliminary system assessment Conduct preliminary system assessment Develop client participation strategy Develop client participation strategy Develop cost strategy Develop cost strategy Prepare boilerplate materials Prepare boilerplate materials Communicate program Communicate program

Milliman USA Next Steps: Healthplan Develop proposal Develop proposal Approach vendor Approach vendor Approach other vendor users Approach other vendor users

Questions? The IT Vendor?

John L. Phelan, Ph.D. Health Management and Technology Consultant Telephone: 818/