1. AND CE-Prof, Inc. January 28, 2011 The Greater Chicago Dental Academy 1 Copyright CE-Prof, Inc. 2010

2. CE-Prof, Inc. – Seminars Speaker: Petra von Heimburg, DDS, JD HIPAA – the Animal is Getting Bigger 2 Copyright CE-Prof, Inc. 2010

3. YOU CAN REACH ME AT: 3 Petra von Heimburg, DDS, JD Ph.: (847) 382-2832 Fax: (847) 382-2924 E-mail: CEProf@aol.comCEProf@aol.com www.PetravonHeimburgDDSJD.com Copyright CE-Prof, Inc. 2010

4. PREFACE 4 This presentation, including comments and handouts, if any, do not constitute legal advice but are for educational purposes only. Copyright CE-Prof, Inc. 2010

5. HIPAA is Growing Copyright CE-Prof, Inc. 2010 5 Background: Addresses: Privacy, Security, Transaction Standards HIPAA Rules: Privacy Rule Security Rule Enforcement Rule

6. Copyright CE-Prof, Inc. 2010 6 HIPAA regulates the use and disclosure of PHI (“Protected Health Information”) by “Covered Entities” and “Business Associates” (through BACs); Exceptions on use and disclosure: Treatment, Payment and Healthcare Operations of the Office (TPO); Plus some public welfare exceptions

7. Copyright CE-Prof, Inc. 2010 7 Some Important Changes to the Rules: a. Increases rights of patients regarding PHI and “marketing” communication; b. Applies Privacy and Security Standards directly to Business Associates; c. Establishes the Health Information Exchange; d. Allows individuals to recover damages; e. Increases federal enforcement and penalties.

8. TOPICS: Copyright CE-Prof, Inc. 2010 8 A. The Health Information Exchange (HIE) B. Patient’s Rights C. BACs D. Breaching E. Enforcement

9. A. THE HEALTH INFORMATION EXCHANGE Copyright CE-Prof, Inc. 2010 9 Part of the nationwide Health Information Network Tying together of all PHI (but no storage or control) through electronic exchanges Secure communication and message routing To be in place by the end of 2014

10. Planned HIE Services Copyright CE-Prof, Inc. 2010 10 Master Patient Index Record Locator Service Provider Directory Payer Directory Public Health Entity Directory Authentication Services Consent Management Auditing Services

11. B. PATIENT’S RIGHTS Copyright CE-Prof, Inc. 2010 11 To restrict PHI disclosure to a health plan, if the patient paid privately for the health care service (unless the disclosure is for treatment or required by law) To requests that an entity make information available in EHR format, provided the entity stores information in that format Effective Date: 2-17-10

12. Copyright CE-Prof, Inc. 2010 12 To request an accounting of disclosures of PHI even if done for TPO purposes (3years for EHR; 6 years other) – anticipated effective date: 1-1-11 To restrict “marketing” pitches from his/her provider

13. C. BAC-CANEERS Copyright CE-Prof, Inc. 2010 13 BACs or Business Associate Contracts have been used in the past by the Covered Entity to tie in business associates (BAs)

14. Modifications Copyright CE-Prof, Inc. 2010 14 As of 2-17-2010, the BA is directly responsible for adherence to the privacy & security rules needs to adopt admistrative safeguards can be assessed penalties and fines BUT So far, the BA does not have to adhere to the breach notification requirements, but the covered entity does!

15. D. BREACHING Copyright CE-Prof, Inc. 2010 15 Requirement: “a covered entity shall, following the discovery of a breach of unsecured PHI, notify each individual whose unsecured PHI has been or is reasonably believed by the covered entity to have been accessed, acquired, used or disclosed as a result of such breach.” 45 CFR 164.404(a)(1)

16. Definition - Breach Copyright CE-Prof, Inc. 2010 16 A breach has occurred if a covered entity discovers that there has been an acquisition, access, use or disclosure of PHI, which was not encrypted, and this event poses a significant financial, reputational or other harm to the individual. NOTE: “Snooping” by a staff member can be considered a breach.

17. A Breach does not Include Copyright CE-Prof, Inc. 2010 17 unintentional acquisition, access or use of PHI by a member of the workforce in his/her scope of authority done in good faith and where the PHI was not further used or disclosed.

18. Examples of Possible Breaches Copyright CE-Prof, Inc. 2010 18 Lost laptop Files left in a coffee shop, but may be not if left at another provider Fax to the wrong number, but may be not if to or within an affiliated covered entity (ex. covering insurance company)

19. What to Do in Case of Breach: Risk Assessment Copyright CE-Prof, Inc. 2010 19 a. Whether the lost PHI was encrypted or not b. If encrypted → no breach c. If not encrypted, determine, if there is a significant risk of financial, reputational or other harm to the individual

20. Risk Assessment Copyright CE-Prof, Inc. 2010 20 The rules do not require a risk assessment, BUT.. It is a way to possibly extricate yourself from the notification provision

21. Breach Notification Requirement Copyright CE-Prof, Inc. 2010 21 If the risk assessment reveals a significant breach, the covered entity has to do compile a report Notification to be made asap but no later than 60 days after event

22. Copyright CE-Prof, Inc. 2010 22 Notification has to be made to every individual In addition: If fewer than 500 persons involved: - Covered Entity must maintain a log and annually submit the log to HHS If more than 500 persons involved - Notification has to be made to the media and to HHS at the same time

23. Information to be Reported to HHS: Copyright CE-Prof, Inc. 2010 23 Date of breach (if breach by BA, obtain date) Type of breach Location of breached information Type of PHI breached Brief description of breach Safeguards prior to breach Actions taken in response to breach

24. Information to be Reported to Individuals: Copyright CE-Prof, Inc. 2010 24 All the information which needs to be reported to HHS, PLUS Steps individuals should take to protect themselves from potential harm Contact information for individuals to ask questions or learn additional information

25. E. ENFORCEMENT Copyright CE-Prof, Inc. 2010 25 Penalties increase depending on infractions from “unaware of breach” through “uncorrected willful neglect” For “willful neglect” fines are mandatory (effective 2-17-11) Fines range from $100 to $50,000 per violation, with a maximum limit of $1,5mil. for identical violations per calendar year

26. Copyright CE-Prof, Inc. 2010 26 Individuals can be held criminally liable for receipt and disclosure of PHI Patients will have the ability to obtain financial compensation if suit is brought by the Attorney General NOTE: Enforcement is through the HHS Office for Civil Rights

27. BE CAREFUL OUT THERE! 27