Monitoring Access to ePHI: Building a Business Case

June 9th, 2011

View the Replay

• Houston’s oldest Accountable Care Organization

• More than 350 physicians practicing in over 50 specialties

• 21 Clinical locations

Why Now? What is the urgency?

Who is accessing your patient’s information?

Ask yourself the following:

Do you know?

Should you know?

Do you have the ability to determine?

Very Recent Headlines

AL Hospital Data Theft Affects Thousands

A Birmingham woman was arrested by U.S. Postal Inspection Service authorities and charged Thursday with felony theft of five years' worth of medical information for thousands of patients treated at Trinity Medical Center, formerly Montclair Baptist Medical Center, in Birmingham, AL.

Allina hospitals fire 32 over privacy violation

Two Allina hospitals in Anoka County have fired 32 employees for improperly accessing the medical records of patients who were hospitalized in March in the wake of a massive drug overdose at a party in Blaine.

* Clarification: During the presentation, the speaker referred to a data breach at Trinity Medical Center in Birmingham, AL. It was stated the breach occurred continuously over a five year period and the impression was the culprit was an employee of the hospital. This was incorrect. The breach was a onetime theft of 5 years of paper records from a storage location. Additionally, the culprit was not an employee of the hospital.

U.S. Regulatory Framework

• HIPAA Security Rule (2003 / 2005): • § 164.308 (a)(1)(ii)(D) Information system activity review. Implement procedures to regularly review records of information system activity, such

as audit logs, access reports, and security incident tracking reports.

• § 164.312(b) Technical safeguards. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

• ARRA HITECH Privacy (2009):• Definition of privacy breach

• Willful neglect

• Patient disclosure

• Governmental notification required

• Media Notification (500 or more)

• Increased fines and precedent

• Ability of state attorney general offices to bring lawsuits against care providers

• Increased systemic audits

• Meaningful Use Criteria (2010): Level 1 certification requires an EHR to produce an audit log HITECH 45 CFR 170.302(r). Conduct a security risk analysis per HIPAA 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies…

• Proposed Accounting of Disclosure Rule (2011): Under the May27th, 2001 proposed accounting of disclosure rule care providers will be responsible for providing access reports for disclosures of information even for treatment, payment and healthcare operations. Providers, plans and their business associates will be required to maintain for 3 years the information required to produce the reports. The rule is available for public comment in the Federal Register through July 2011

Audit reports hit HHS on digital security

“Our audits of 7 hospitals throughout the Nation identified 151 vulnerabilities in the systems and controls intended to protect ePHI, of which 124 were categorized as high impact. These vulnerabilities placed the confidentiality, integrity, and availability of ePHI at risk. Outsiders or employees at some hospitals could have accessed, and at one hospital did access, systems and beneficiaries' personal data and performed unauthorized acts without the hospitals' knowledge.”

Proposed Accounting of Disclosure RuleAudit logging becoming unavoidable

• “Access Report” requirement focused on who and includes electronic access to designated record sets – medical, billing, enrollment, payment, claims adjudication, other

• Audit logging core requirement to fulfill “Access Reporting” in Proposed Accounting of Disclosure Rule

• If compliant with HIPAA security rule already, not a big challenge

• Retention period reduced from 6 years to 3 years

• Response time reduced from 60 days to 30 days

• For more information see Adam Greene’s HIMSS presentation -http://www.dwt.com/portalresource/lookup/wosid/contentpilot-core-6-81506/media.name=/Greene_HIMSS.pdf

HHS proposes privacy rule on medical records

"We need to protect people's rights so that they know how their health information has been used or disclosed," said Georgina Verdugo, director of the HHS Office for Civil Rights, which is proposing the changes, in a statement.

A patient’s perspective

A nurse recently related to me the following situation: she knew a patient was withholding information that could impact her outcome. She pressed the young woman for the information. Finally the patient told her “I don’t want to tell you that, because it will go in my medical record and my mom works for you-all. I know she reads my record after every appointment.”

Difference Between Paper and Electronic Records

In the days of paper records it was much harder to gain access to hundreds or thousands of patient’s information without notice. In the age of electronic medical record the information is at your fingertips. A few clicks and you have all the Mr. Smiths or Ms. Jones personal information in your system.

Lost Revenue

Lastly, what about potential lost revenue due to bad or dishonest business practices? What you ask? How will monitoring detect that? How many of your billing office staff or “posting payments” or making adjustments to their or family members accounts? Do you know?

Where is the disconnect?We know

• Regulations require we monitor access

• It’s the right thing to do

• Patients expect us to protect their information

• Not doing so can jeopardize patient safety because patients withhold important information out of fear of who will access the information

• The cost of a breach that becomes public is high -especially to the reputation of the organization

Houston – News Stories

From the news:

• Nov 2009 – Harris County Hospital District fired 16 employees for patient privacy violations

• Aug 2008 – Harris County Hospital District lost an unencrypted USB drive containing complete records of 1200 HIV positive patients. Judge Ed Emmett described the situation as “The Worst Thing Imaginable”

Common Myths to Implementing a Monitoring Program

• It will cost to much

• We don’t have the time or resources (manpower)

• Our people are all trained on the laws and know not to access information without a need

• We trust our people

• What we don’t know can’t hurt us

• If we monitor and find inappropriate access we will have to do something

Breaking down the Myths: Myth #1

It will cost to much to monitor access

• The average cost of a data breach for an organization went up for the fifth year in a row, to $7.2 million, Ponemon Institute found in its sixth annual data breach report.

• Total cost is not the only thing that went up, as the average cost per compromised record increased to $214, according to the 2010 data breach report released by Symantec and Ponemon Institute on March 8.

Myth #2

We don’t have the time or resources

• Based on the previous slide can we afford not to throw resources at this issue?

• Often times the issue seems to really boil down to who should be responsible for the monitoring? IT or Privacy? I say both play a role. We will look at this more later.

Myths #3 and #4

Our people are all trained on the laws and know not to access information without a needWe trust our people

• I need only to refer back to the recent headlines slide.

• Understand with access to Electronic Health Records - staff develop a since of entitlement. “Since I have access I am entitled to look at what I want”, that is unless they know you are monitoring.

Myth #5

What we don’t know can’t hurt us

See the Mass General Hospital Settlement with HHS where they agreed to pay 1 million dollars and enter into a 3 year Corrective Action Plan because an employee took patient information home to work on it and left it on a commuter train. Do you think they knew?

Myth #6

If we monitor and find inappropriate access we will have to do something

This seems to be a common theme among organizations when it comes to monitoring. What if we find something what do we do? I believe this is often driven because the right people are not included in the decision to monitor, what to monitor and how to process findings. We will explore this more momentarily.

Myth #7

False Positives - It is true that a monitoring program that has not been well thought out could overburden staff due to the number of false positives. This impact can be reduced or eliminated by taking some reasonable steps:

• Understand the workflow• Understand what types of activity you are looking

for• Create a good data set

Technology risks to the business case “Weakest link breaks the chain”

Comprehensive and centralized EHR audit log management across all sources of volume

Proven-in-production, turn-key support for broad range of EHRs and healthcare applications

Ability to add new audit sources rapidly and affordably

Context-aware analytics that combines audit logs, user data and patient data

Support for authoritative user data for filtering false-positives (Lawson, PeopleSoft, identity)

Extreme scalability with seamless path to high availability

Zero FTE impact for network & systems operations

Proven speed-to-value supported by technology and well documented deployment methodology

Health-check monitoring of hardware, systems and supporting data processes

Clear path to real-time support

Tools & Resources

Available after today’s webinar:

High availability configurations

FairWarning® and Meaningful Use

Patient Privacy Framework Guides

ROI Calculator on privacy monitoring

Breach Damages Estimator Based on breach monitoring deployments as well as

interviews with health systems, legal counsel and 3rd-parties involved with high-profile breaches and audits

White paper on privacy breach findings

All available by emailingSolutions@FairwarningAudit.com

Selling C – Level Executives

• You are going to need champions. I recommend you educate and enlist the help of the Chief Legal Counsel, Chief Compliance Officer, Chief Privacy Officer, Chief Security Officer at minimum. They own a piece of this pie.

• Train your leadership. Use factual information. Give examples they can relate to. Drive home the cost and benefits of what you are trying to achieve. The next couple of slides are from presentations I did for leadership.

What Would A Breach Cost Kelsey-Seybold?Assumption: 10,000 records breached

TEXAS LAW• $500/record = $5M

• $50,000 fine for law violation (data not encrypted)

• Customer notification – minimum $1 each = $10,000

• Credit monitoring (@30% acceptance @ $30/each) = $100,000

TOTAL MINIMUM TEXAS EXPOSURE$5,160,000

FEDERAL LAW• HIPAA up to $1.5 M

• FTC – No Limit (e.g. CVS case was $2.2M)

FEDERAL EXPOSURE$1.5M to $XX M

Selling C-Level continued

• Be passionate and persistent – you may have to do multiple presentations to leadership to get the buy in.

• Speak in terms they can relate to. If physicians control the leadership or money use exams like “What are the Chief Complaints” when discussing privacy complaints and “What are possible diagnosis” when talking about the possible causes.

• Take advantage of situations that happen to help illustrate how monitoring may have helped detect the situation

Sold – Now What

Now the real work begins. Before you start monitoring you need to:

• Develop a plan

• Design a workflow

• Communicate to the staff

• Get H.R. support for sanctions

• Review and revise policies

Developing the Plan

Our Chief Information Security Officer was instrumental in helping to establish the “Information Security Advisory Council”. This group composed of the Chief Information Security Officer, Chief Legal Counsel, Privacy Officer, VP of Operations and VP of H.R. helped design and endorse the entire plan around communication, monitoring and acting on the results.

Developing the Plan - continued

• Start small – decide what you view as your highest risk and monitor that. For example: Supervisor Snooping, Family Member Snooping and VIP Snooping.

• Design a monitoring workflow that shows who is responsible for the monitoring and how results are acted upon. (see next slide for an example)

FairWarning Monitoring - Roles and Responsibilities

Bu

sin

ess U

nit

Ma

na

ge

me

nt

Priva

cy O

ffic

eH

um

an

Re

so

urc

es

Info

rma

tio

n

Se

cu

rity

Conduct routine

and automated

monitoring

Identify

unexplained

activity

Contact Business

unit (B.U.)

management with

unexplained

activity to see if

there is legit

reason

B.U. Management

determines if activity is

explained

Activity explained

Notify Information

Security

Activity not

explained. Notify

Privacy Office and

copy Info Sec

Info Sec

documents and

closes.

Privacy Office

opens an

investigation and

contacts Business

Unit Management

H.R. coordinates

with Business Unit

Management,

documents.

Takes appropriate

action

Determines if

violation occurred

If violation occurred

Coordinates with Business

Unit Management and

H.R. for appropriate

sanction activity

If no violation

occurred

document and

close.

FairWarning Investigations – Roles and Responsibilities

Priva

cy O

ffic

eH

um

an

Re

so

urc

es

Info

rma

tio

n

Se

cu

rity

Bu

sin

ess U

nit

Ma

na

ge

me

nt

Report alleged

inappropriate

access of PHI to

Privacy Office

Cooperate with

Privacy Office on

investigations

Conduct

investigations in

response to patient

complaints

Make determination of whether a

violation occurred based on

investigation

If no violation occurred document and

close investigation

If a violation occurred coordinate

sanction activity with H.R.

Coordinate with the Business Unit

Management and Privacy Office on

Hotline reports of alleged

inappropriate access of PHI

Conduct investigations in

response to reports of alleged

inappropriate access of PHI by

Business Unit management or H.R.

Carry out employee

sanctions required as

result of investigation

and document sanction

activity

Provide support as

requested.

(machine files,

email logs, etc.)

Developing the Plan - continued

• Prepare the Executives for what they are going to find. My experience is no one is prepared for how many violations are going to see

• Communicate, Communicate, Communicate –“Communication is the Heartbeat of Success”

• Let the staff know you are starting a monitoring program and the level of detail you can see. Give them “Fair Warning”

Raising Visibility of Patient Privacy Protections Across the OrganizationThere are a host of ways to accomplish this. Here are a few I have used:

• Leadership Briefings• Staff Briefings• Unannounced Privacy and Security walkthroughs• All staff communications from leadership• Articles and stories on the company intranet• Required training courses (I recommend you design your

own to meet the specifics of your organization• Annual required acknowledgement of policy and fact that

the staff is aware you are conducting monitoring activities targeting certain behavior.

Planning for success

• Buy-in from Executive Stakeholders

• All stakeholders involved in kickoff and periodic updates

• Communicate “why we are deploying privacy breach detection”

• Empowered project management with access to expert data source resources

• Phased approach to deployment of audit sources and analytics

• Prioritize analytics to achieve “first success”

• On-going training of multiple personnel important to lasting success

• Investigation, remediation, sanctions, and training are essential

“Gotchas”

• “Trying out” a range of analytics rather than prioritizing

• Lack of remediation, sanctions, organizational buy-in and work-flows – a Privacy Breach Detection deployment will not fix a broken process, it will only reveal a broken process

• Plan data retention strategy up-front, it can be a “phased approach”, but it needs to be planned and a priority

• Technology that fails to keep pace with growing demands – look for KLAS rankings, www.klasresearch.com

Questions?