1. 1 Privacy and Security Enforcement: An In-Depth Exploration of Federal Civil Enforcement Gerald “Jud” E. DeLoss Krahmer & Bishop, P.A. Fairmont, MN

2. 2 Enforcement Authority Secretary of HHS Delegated to the Administrator, CMS Authority to Investigate Noncompliance and Enforcement of Certain Regulations: Secretary of HHS Delegated to the Administrator, CMS Authority to Investigate Noncompliance and Enforcement of Certain Regulations: Transaction and Code Set Rule Transaction and Code Set Rule National Employer Identifier Number (“EIN”) Rule National Employer Identifier Number (“EIN”) Rule Security Rule Security Rule National Provider Identifier Rule National Provider Identifier Rule National Plan Identifier Rule National Plan Identifier Rule Delegation Does Not Include Authority with Respect to the Privacy Rule Delegation Does Not Include Authority with Respect to the Privacy Rule Delegated to the Office for Civil Rights Delegated to the Office for Civil Rights

3. 3 Privacy Complaints Approximately 19,420 Privacy Complaints Filed With OCR Approximately 19,420 Privacy Complaints Filed With OCR Most Common Allegations Have Been: Most Common Allegations Have Been: Personal Medical Details Wrongly Disclosed Personal Medical Details Wrongly Disclosed Information Was Poorly Protected Information Was Poorly Protected More Details Were Disclosed Than Necessary More Details Were Disclosed Than Necessary Proper Authorization Was Not Obtained Proper Authorization Was Not Obtained Patients Frustrated in Attempting to Get Their Own Records Patients Frustrated in Attempting to Get Their Own Records Washington Post June 5, 2006 Washington Post June 5, 2006

4. 4 Security Complaints CMS Has Received Approximately 106 Security Complaints CMS Has Received Approximately 106 Security Complaints Also Inappropriately Received 28 Privacy-Related Complaints – To be Directed to OCR Also Inappropriately Received 28 Privacy-Related Complaints – To be Directed to OCR CMS Has Received Approximately 450 Transaction & Code Set Complaints CMS Has Received Approximately 450 Transaction & Code Set Complaints 129 Remain Open 129 Remain Open Majority Involve Private Sector Organizations Majority Involve Private Sector Organizations Health Information Privacy/Security Alert, Melamedia LLC May 22, 2006 Health Information Privacy/Security Alert, Melamedia LLC May 22, 2006

5. 5 First Stage - Investigation Upon Receipt of Complaint [§ 160.306(c)] Upon Receipt of Complaint [§ 160.306(c)] Contact Complainant to Determine Whether Investigation Necessary Contact Complainant to Determine Whether Investigation Necessary May Resolve Without Even Contacting Covered Entity May Resolve Without Even Contacting Covered Entity First Written Communication With Covered Entity Must Describe Basis of Complaint First Written Communication With Covered Entity Must Describe Basis of Complaint May Conduct Compliance Reviews [§ 160.308] May Conduct Compliance Reviews [§ 160.308] No Complaint Necessary No Complaint Necessary May Initiate on Own Discretion May Initiate on Own Discretion

6. 6 Investigation May Issue Subpoenas [§ 160.314(a)] May Issue Subpoenas [§ 160.314(a)] Attendance of Witnesses Attendance of Witnesses Production of Evidence Production of Evidence May Issue When Conducting a Compliance Review May Issue When Conducting a Compliance Review Investigational Inquiries [§ 160.314(b)] Investigational Inquiries [§ 160.314(b)] Non-public Non-public Testimony Under Oath Testimony Under Oath Legal Representation and Objections Allowed Legal Representation and Objections Allowed Proceedings are Recorded & Transcribed Proceedings are Recorded & Transcribed

7. 7 Investigational Powers Covered Entity Must Permit HHS to Have Access During Normal Business Hours to Facilities Books, Records, and Other Information But, if the Secretary Determines ‘‘Exigent Circumstances” Exist, Covered Entity Must Permit Access at Any Time Without Notice [§ 160.310] Example: When Documents May be Hidden or Destroyed

8. 8 Investigation Testimony or Other Evidence Obtained During an Investigational Inquiry, May be Used in Any HHS Activities and May be Offered Into Evidence in Any Proceeding [§ 160.314(c)] Testimony or Other Evidence Obtained During an Investigational Inquiry, May be Used in Any HHS Activities and May be Offered Into Evidence in Any Proceeding [§ 160.314(c)] Could be Used in Later, Separate Proceedings Could be Used in Later, Separate Proceedings Transcribed and Under Oath - Permanency Transcribed and Under Oath - Permanency Important When Negotiating Informal Resolution Important When Negotiating Informal Resolution

9. 9 Informal Resolution If Evidence Indicates Noncompliance [§ 160.312(a)] If Evidence Indicates Noncompliance [§ 160.312(a)] Will Attempt to Resolve via Informal Means Will Attempt to Resolve via Informal Means Review of Demonstrated Compliance by Covered Entity Review of Demonstrated Compliance by Covered Entity Corrective Action Plan in Place Corrective Action Plan in Place If Then Resolved, Notification to Covered Entity and Any Complainant If Then Resolved, Notification to Covered Entity and Any Complainant

10. 10 Mitigating Factors & Affirmative Defenses If Matter Not Resolved Informally, Notification to Covered Entity That May Submit Evidence of Mitigating Factors and Affirmative Defenses [§ 160.312(a)(3)] If Matter Not Resolved Informally, Notification to Covered Entity That May Submit Evidence of Mitigating Factors and Affirmative Defenses [§ 160.312(a)(3)] Party Must Submit Within 30 Days Party Must Submit Within 30 Days If No Violation Found, Notification to Covered Entity and Any Complainant If No Violation Found, Notification to Covered Entity and Any Complainant

11. 11 Basis For Civil Money Penalty Impose CMP Upon Covered Entity if Determines That Covered Entity Has Violated an Administrative Simplification Provision [§ 160.402(a)] Impose CMP Upon Covered Entity if Determines That Covered Entity Has Violated an Administrative Simplification Provision [§ 160.402(a)] Violation Attributed to a Covered Entity [§ 160.402(c)] Violation Attributed to a Covered Entity [§ 160.402(c)] Follows Federal Common Law of Agency Follows Federal Common Law of Agency Act or Omission of Agent Act or Omission of Agent Unless Agent is a Business Associate Unless Agent is a Business Associate Importance of Business Associate Agreements! Importance of Business Associate Agreements!

12. 12 Amount of Civil Money Penalty Amount of CMP to be Determined in Consideration of Mitigating Factors and Affirmative Defenses [§ 160.404] Amount of CMP to be Determined in Consideration of Mitigating Factors and Affirmative Defenses [§ 160.404] Limited to $100 for Each Violation or $25,000 for Identical Violations During a Calendar Year Limited to $100 for Each Violation or $25,000 for Identical Violations During a Calendar Year If Administrative Simplification Provisions Repeat Requirements, Then Only One CMP Imposed If Administrative Simplification Provisions Repeat Requirements, Then Only One CMP Imposed

13. 13 Violations of Identical Requirement The Number of Violations of an Identical Requirement or Prohibition (“Identical Violations”) Will be Determined Based On: The Number of Violations of an Identical Requirement or Prohibition (“Identical Violations”) Will be Determined Based On: Nature of Covered Entity’s Obligation to Act or Not Act With Respect to Certain Persons Nature of Covered Entity’s Obligation to Act or Not Act With Respect to Certain Persons Continuing Violations – a Separate Violation Deemed to Occur on Each Day Such Violation Continues [§ 160.406] Continuing Violations – a Separate Violation Deemed to Occur on Each Day Such Violation Continues [§ 160.406]

14. 14 Failing to Address Standards (Security Rule) As applied to Addressable Standards, Definition of Violate Includes Failure to Document Reasons Implementation Was Not Reasonable or Appropriate and the Equivalent Alternative Measure Implemented in Its Place As applied to Addressable Standards, Definition of Violate Includes Failure to Document Reasons Implementation Was Not Reasonable or Appropriate and the Equivalent Alternative Measure Implemented in Its Place Two Violations Occur: Two Violations Occur: Failure to Implement Standard and Failure to Implement Standard and Failure to Document Implementation Failure to Document Implementation

15. 15 Mitigating Factors Factors Which May Be Utilized in Determining Amount of CMP [§ 160.408] Factors Which May Be Utilized in Determining Amount of CMP [§ 160.408] Nature of Violation, in Light of Purpose of Rule Nature of Violation, in Light of Purpose of Rule Circumstances, Such as Circumstances, Such as Time Period During Violation Occurred Time Period During Violation Occurred Whether Violation Caused Physical Harm Whether Violation Caused Physical Harm Whether Violation Hindered Health Care Whether Violation Hindered Health Care Whether Violation Resulted in Financial Harm Whether Violation Resulted in Financial Harm Degree of Culpability (Intentional, Beyond Control) Degree of Culpability (Intentional, Beyond Control) History of Prior Compliance With Administrative Simplification Provisions (Similar, Corrections) History of Prior Compliance With Administrative Simplification Provisions (Similar, Corrections) Financial Condition of Covered Entity (Size) Financial Condition of Covered Entity (Size) Other Matters as Justice Requires Other Matters as Justice Requires

16. 16 Affirmative Defenses Affirmative Defenses -- May Not Impose a CMP if Established – Includes the Following: [§ 160.410]: Affirmative Defenses -- May Not Impose a CMP if Established – Includes the Following: [§ 160.410]: Act is Punishable Criminally Act is Punishable Criminally Covered Entity Had No Knowledge Covered Entity Had No Knowledge Covered Entity Would Not Have Known Using Reasonable Diligence Covered Entity Would Not Have Known Using Reasonable Diligence Violation Result of Reasonable Cause, Not Willful Neglect and Corrected Within 30 Days or Such Additional Time as Determined Violation Result of Reasonable Cause, Not Willful Neglect and Corrected Within 30 Days or Such Additional Time as Determined

17. 17 Limitations Period No Action May be Entertained Unless Commenced within 6 Years From the Date of the Occurrence of the Violation [§ 160.414] No Action May be Entertained Unless Commenced within 6 Years From the Date of the Occurrence of the Violation [§ 160.414]

18. 18 Notice of Proposed Determination If Finds Basis for Action, Issues Notice of Proposed Determination to Covered Entity [§ 160.420] If Finds Basis for Action, Issues Notice of Proposed Determination to Covered Entity [§ 160.420] Where HHS Bases Proposed Penalty on Statistical Sampling, a Copy of HHS’s Expert Report Must Accompany Notice Where HHS Bases Proposed Penalty on Statistical Sampling, a Copy of HHS’s Expert Report Must Accompany Notice

19. 19 Notice to Public and Agencies When Proposed Penalty Becomes Final, Will Notify, in a Manner Deemed Appropriate of The Penalty and Reason it was Imposed, the Public and the Following Entities [§ 160.426]: When Proposed Penalty Becomes Final, Will Notify, in a Manner Deemed Appropriate of The Penalty and Reason it was Imposed, the Public and the Following Entities [§ 160.426]: State or Local Medical or Professional Organizations State or Local Medical or Professional Organizations State Agency Administering State Health Care Programs State Agency Administering State Health Care Programs Utilization and Quality Control Peer Review Organizations Utilization and Quality Control Peer Review Organizations State or Local Licensing Agency State or Local Licensing Agency Could Include Posting to HHS Web Site and/or Federal Register Publication Could Include Posting to HHS Web Site and/or Federal Register Publication

20. 20 FOIA and Public Notice Basis for Public Notice is Not HIPAA, Rather FOIA Basis for Public Notice is Not HIPAA, Rather FOIA FOIA Requires Final Opinions and Orders Made in Adjudication Cases to be Available for Public Inspection FOIA Requires Final Opinions and Orders Made in Adjudication Cases to be Available for Public Inspection Would Not Apply to Informal Resolutions Would Not Apply to Informal Resolutions Mandatory, Not Able to Withhold Information if Released After Conclusion of Proceedings Mandatory, Not Able to Withhold Information if Released After Conclusion of Proceedings Another Reason to Consider Informal Resolution! Another Reason to Consider Informal Resolution!

21. 21 Administrative Hearing Upon Receipt of Notice of Proposed Determination, Covered Entity Must Request Hearing [§ 160.504(a)] Upon Receipt of Notice of Proposed Determination, Covered Entity Must Request Hearing [§ 160.504(a)] Request Mailed Within 90 Days of NPD Request Mailed Within 90 Days of NPD Hearing Before Administrative Law Judge (“ALJ”) Hearing Before Administrative Law Judge (“ALJ”) Must Admit, Deny, or Explain Findings of Fact Must Admit, Deny, or Explain Findings of Fact Must Set Forth Defenses [§ 160.504(c)] Must Set Forth Defenses [§ 160.504(c)] Affirmative Defenses May be Raised at Any Time Affirmative Defenses May be Raised at Any Time

22. 22 Discovery Limited Discovery Allowed [§ 160.516] Limited Discovery Allowed [§ 160.516] Request for Production of Documents Request for Production of Documents No Other Discovery Authorized No Other Discovery Authorized Work Product of Attorney is Protected Work Product of Attorney is Protected Party Receiving Request Has 30 Days to Respond Party Receiving Request Has 30 Days to Respond Discovery Motions are Permitted Discovery Motions are Permitted Within 30 Days of Receipt of Objections Within 30 Days of Receipt of Objections

23. 23 Prehearing Exchange of Information Parties Must Exchange, Not More than 60 and Not Less Than 15 Days Before the Hearing: Parties Must Exchange, Not More than 60 and Not Less Than 15 Days Before the Hearing: Witness Lists Witness Lists Prior Written Statements of Witnesses Prior Written Statements of Witnesses Copies of Proposed Hearing Exhibits Copies of Proposed Hearing Exhibits ALJ May Exclude Evidence if Not Exchanged Unless Extraordinary Circumstances and If So, Whether Substantial Prejudice if Admitted ALJ May Exclude Evidence if Not Exchanged Unless Extraordinary Circumstances and If So, Whether Substantial Prejudice if Admitted Unless Party Objects, Documents Deemed Authentic Unless Party Objects, Documents Deemed Authentic Respondent Must Provide Copy of Statistical Expert’s Report Not Less Than 30 Days Before Hearing Respondent Must Provide Copy of Statistical Expert’s Report Not Less Than 30 Days Before Hearing

24. 24 Post-Hearing Briefs ALJ May Require Parties to File Post-Hearing Briefs and, in Any Event, Any Party May Do So [§ 160.544] ALJ May Require Parties to File Post-Hearing Briefs and, in Any Event, Any Party May Do So [§ 160.544] Must File Within 60 Days From Date Parties Receive Transcript of Hearing or Stipulated Record Must File Within 60 Days From Date Parties Receive Transcript of Hearing or Stipulated Record May Include Proposed Findings of Fact and Conclusions of Law May Include Proposed Findings of Fact and Conclusions of Law ALJ May Permit Reply Briefs ALJ May Permit Reply Briefs

25. 25 ALJ Decision ALJ Issues Decision Within 60 Days After Time For Submission of Post-Hearing Briefs [§ 160.546] ALJ Issues Decision Within 60 Days After Time For Submission of Post-Hearing Briefs [§ 160.546] If Misses Deadline, Must Simply Explain and Set New Date If Misses Deadline, Must Simply Explain and Set New Date Decision Based Solely on Record Decision Based Solely on Record Sets Forth Findings of Fact & Conclusions of Law Sets Forth Findings of Fact & Conclusions of Law May Affirm, Increase, or Reduce Penalties May Affirm, Increase, or Reduce Penalties Unless Appealed, Becomes Final 60 Days From Date of Service Unless Appealed, Becomes Final 60 Days From Date of Service

26. 26 Appeal Party Must File Notice of Appeal Within 30 Days of ALJ Decision [§ 160.548(a)] Party Must File Notice of Appeal Within 30 Days of ALJ Decision [§ 160.548(a)] Appeal is to HHS Departmental Appeals Board Appeal is to HHS Departmental Appeals Board For Good Cause Shown, May Extend Additional 30 Days For Good Cause Shown, May Extend Additional 30 Days ALJ Must Forward Copy of Record [§ 160.548(b)] ALJ Must Forward Copy of Record [§ 160.548(b)] Must be Accompanied by Brief Specifying Objections and Reasons [§ 160.548(b)] Must be Accompanied by Brief Specifying Objections and Reasons [§ 160.548(b)] Opposition Brief May be Filed Within 30 Days of Notice and Brief [§ 160.548(c)] Opposition Brief May be Filed Within 30 Days of Notice and Brief [§ 160.548(c)]

27. 27 Appeal Party Has No Right to Appear Personally Before Board [§ 160.548(d)] Party Has No Right to Appear Personally Before Board [§ 160.548(d)] Board May Not Consider Any Issue Not Briefed, Nor Issue Not Raised Before ALJ [§ 160.548(e)] Board May Not Consider Any Issue Not Briefed, Nor Issue Not Raised Before ALJ [§ 160.548(e)] Except for Affirmative Defenses Except for Affirmative Defenses Board May Remand to ALJ [§ 160.548(f)] Board May Remand to ALJ [§ 160.548(f)] Board’s Decision: Board’s Decision: Decline to Review Decline to Review Affirm Affirm Increase or Reduce Penalty Increase or Reduce Penalty Reverse or Remand [§ 160.548(g)] Reverse or Remand [§ 160.548(g)]

28. 28 Appeal Board’s Standard of Review Board’s Standard of Review Issue of Fact: Issue of Fact: ALJ Decision Supported by Substantial Evidence on Whole Record [§ 160.548(h)] ALJ Decision Supported by Substantial Evidence on Whole Record [§ 160.548(h)] Issue of Law: Issue of Law: ALJ Decision Erroneous [§ 160.548(h)] ALJ Decision Erroneous [§ 160.548(h)] Harmless Error Rule Applies as Well [§ 160.552] Harmless Error Rule Applies as Well [§ 160.552] Board Must Issue Decision Within 60 Days of Briefing [§ 160.548(i)] Board Must Issue Decision Within 60 Days of Briefing [§ 160.548(i)] Decision of Board is Final 60 Days After Service, Except if Remanded or if Reconsideration Requested [§ 160.548(j)] Decision of Board is Final 60 Days After Service, Except if Remanded or if Reconsideration Requested [§ 160.548(j)]

29. 29 Reconsideration Party May File Motion for Reconsideration Party May File Motion for Reconsideration Prior to Decision of Board Becoming Final [§ 160.548(j)(3)] Prior to Decision of Board Becoming Final [§ 160.548(j)(3)] Must be Accompanied by Brief Must be Accompanied by Brief Opposition Brief May be Filed Within 15 Days of Receipt Opposition Brief May be Filed Within 15 Days of Receipt Board to Reconsider Only if Clear Error of Fact or Error of Law [§ 160.548(j)(2)] Board to Reconsider Only if Clear Error of Fact or Error of Law [§ 160.548(j)(2)] New Evidence Not Basis Unless Not Previously Available New Evidence Not Basis Unless Not Previously Available Must Rule on Motion within 30 Days Must Rule on Motion within 30 Days Decision Becomes Final Unless Petition for Judicial Review [§ 160.548(j)(4)] Decision Becomes Final Unless Petition for Judicial Review [§ 160.548(j)(4)]

30. 30 Judicial Review Respondent Must File Petition Within 60 Days of Board’s Final Decision [§ 160.548(k)] Respondent Must File Petition Within 60 Days of Board’s Final Decision [§ 160.548(k)] Appeal to U.S. Court of Appeals Appeal to U.S. Court of Appeals Copy Must be Served on HHS General Counsel Copy Must be Served on HHS General Counsel Decision May be Stayed Pending Review [§ 160.550(a)] Decision May be Stayed Pending Review [§ 160.550(a)] Respondent May Request Stay of Penalty Respondent May Request Stay of Penalty Automatically Stays Until ALJ Rules Automatically Stays Until ALJ Rules ALJ Must Rule Within 10 Days ALJ Must Rule Within 10 Days

31. 31 Questions? Please Feel Free to Ask Me Now or After the Session Please Feel Free to Ask Me Now or After the Session Gerald “Jud” E. DeLoss Krahmer & Bishop, P.A. 204 Lake Avenue Suite 201 Fairmont, MN 56031 Office (507) 238-9432 Fax (507) 238-9434 Cell (507) 399-9690 gdeloss@fairmontlaw.com