Navigating HIPAA & Recent Healthcare Reform:

What You Need to Know

What is HIPAA?

• The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, was enacted on August 21, 1996.

• HIPAA is federal legislation designed to improve the efficiency of the healthcare system and to protect the security & privacy of a patient’s health information

What Does HIPAA Do?

• Gives patients more control over their health information

• Sets boundaries on the use and release of patient information

• Establishes that covered entities and their business associates must have appropriate safeguards to protect the privacy and security of PHI

• Limits release of PHI to the minimum reasonably needed for the purpose of the disclosure

• Holds violators accountable with civil and criminal penalties

Who Needs to Comply?

• HIPAA applies to “covered entities.”• A covered entity is:

– A health plan.– A health care clearinghouse.– A health care provider that transmits health

information in electronic form in connection with health care transactions.

• Examples: doctors, clinics, psychologists, dentists, chiropractors, nursing homes, health insurance companies, HMOs and Company health plans

What does HIPAA Protect?• The Privacy Rule protects all “individually identifiable

health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral.

• Individually identifiable health information is information that– is created or received by a covered entity; – relates to the past, present, or future physical or mental

health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual

– identifies the individual or there is a reasonable basis to believe the information can be used to identify the individual.

• The Privacy Rule calls this information “protected health information” or PHI.

Examples of PHI

• Medical Records• Billing Information• Insurance Forms• Authorizations and

Notices• Conversations with

covered entity about PHI

• Prescriptions• Patient Charts• Patient Registry• Correspondence

about a patient• Medical Records

Summaries• Correspondence

discussing PHI

General Rules for Disclosure

• The privacy rule governs how a covered entity may disclose PHI to persons outside of the covered entity.

• HIPAA prohibits covered entities from disclosing PHI without a patient’s authorization unless an exception exists.

Permitted Uses and Disclosures

• A covered entity is permitted, but not required, to use and disclose PHI, without an individual’s authorization, for the following purposes or situations: – To the Individual (unless required for access or accounting

of disclosures); – Treatment, Payment, and Health Care Operations;– Opportunity to Agree or Object (i.e., Facility Directories); – Incident to an otherwise permitted use and disclosure; – Public Interest and Benefit Activities (i.e., Required by Law,

Judicial and Administrative Proceedings, Law Enforcement) and

– Limited Data Set for the purposes of research, public health or health care operations

Authorized Uses and Disclosures

• A covered entity must obtain the individual’s written authorization for any use or disclosure of PHI that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. Examples include: Psychotherapy Notes and Marketing.

• A covered entity may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances.

• An authorization must be written in specific terms.

Privacy Practices Notice

• Each covered entity, with certain exceptions, must provide a notice of its privacy practices.

• The Privacy Rule requires that the notice contain certain elements.

Other Individual Rights • Access. Except in certain circumstances,

individuals have the right to review and obtain a copy of their PHI in a covered entity’s designated record set.

• Amendment. The Rule gives individuals the right to have covered entities amend their PHI in a designated record set when that information is inaccurate or incomplete.

• Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their PHI by a covered entity or the covered entity’s business associates.

Business Associates• In general, a business associate is a person or

organization, other than a member of a covered entity’s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information.

• Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.

• Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.

Business Associate Agreement

• There must be a contract between the covered entity and the business associates.

• There are specific requirements that must be included in business associate agreements.

Health Care Reform

• The American Recovery and Reinvestment Act of 2009 signed into law on February 17, 2009.

• Enactment of Health Information Technology for Economic and Clinical Health (“HITECH”) Act

Definition of Breach

• Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPPA Privacy Rule which compromises the security or privacy of the PHI.– Compromises the security or privacy of the PHI

means poses a significant risk of financial, reputational, or other harm to the individual.

– A use or disclosure of PHI that does not include the 16 direct identifiers (“limited data set”), date of birth, and zip code does not compromise the security or privacy of the PHI.

Significant Risk of Harm

• Who Impermissibly used or to whom the information was impermissibly disclosed

• Type of PHI involved• Number of Individuals Affected• Likelihood the Information is Accessible

and Usable• Likelihood the Breach May Lead to Harm

– Broad Reach of Potential Harm– Likelihood Harm Will Occur

• Ability to Mitigate the Risk of Harm

Breach excludes . . . • Any unintentional acquisition, access, or use of PHI by a

workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the Privacy Rule.

• Any inadvertent disclosure by a person who is authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the Privacy Rule.

• A disclosure of PHI where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Notification of Breach

• A covered entity shall, following the discovery of a breach of unsecured PHI, notify each individual whose unsecured PHI has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

• Content Requirements.

Definition of Unsecured PHI

• Unsecured PHI means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary.

• Unsecured PHI can include information in any form or medium, including electronic, paper, or oral form.

Discovery of Breach

• A breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity.

• A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity.

Timing of Notice

• All required notifications shall be made without unreasonable delay and in no case later than 60 days after the discovery of a breach by the covered entity involved.

• Exception – Notification shall be delayed if a law enforcement official determines that the required notification would impede a criminal investigation or cause damage to national security.

Methods of Notice• Individual notice. Written notification must

be provide by first class mail to the individual, or next of kin or personal representative, if the individual is deceased, at the last known address.– Email notification possible.– Other methods of notification if emergency or

covered entity does not have sufficient contact information.

• Media notice. For a breach of unsecured PHI involving more than 500 individuals in a State or jurisdiction, a covered entity notify prominent media outlets in the State or jurisdiction.

Duty to Notify Secretary• A covered entity shall, following the discovery

of a breach of unsecured PHI.– For breaches involving 500 or more individuals,

than such notice must be provided contemporaneously with notification to individuals.

– For breaches involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each year, submit such log to the Secretary.

• http://transparency.cit.nih.gov/breach/index.cfm

Duty to Notify Secretary

Posting on HHS Website

• Secretary will post a list on the HHS website that identifies each covered entity involved in a breach in which the unsecured PHI of more than 500 individuals is acquired or disclosed.

• http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/postedbreaches.html

Posting on HHS Website

Notice by Business Associate

• A business associate shall, following the discovery of a breach of unsecured PHI, notify the covered entity of such breach.

• If BA is an agent of covered entity, then the BA’s discovery of the breach will be imputed to the covered entity.

Documentation

In the event of a use or disclosure in violation of the HIPAA Privacy Rule, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required or that the use or disclosure did not constitute a breach.

Restricted Disclosures

In the case that an individual requests that a covered entity restrict the disclosure of the PHI, the covered entity must comply with the requested restriction if—– the disclosure is to a health plan for purposes of

carrying out payment or health care operations (and is not for purposes of carrying out treatment or required to be disclosed by law); and

– the PHI pertains solely to a health care item or service for which the health care provider has been fully paid out of pocket.

Minimum Necessary• When using or disclosing PHI or when requesting PHI from

another covered entity, a covered entity must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

• A covered entity shall be in compliance with this requirement if the covered entity limits the use, disclosure or request of PHI, to the extent practicable:– To a limited data set, or– if needed by the covered entity, to the minimum necessary to

accomplish the intended purpose of the use, disclosure, or request.

• By August 18, 2010, the Secretary will issue guidance on what constitutes “minimum necessary.”

• The covered entity disclosing such information shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure.

Minimum Necessary Cont.The minimum necessary requirement is not imposed in any of the following circumstances: – Disclosure to or a request by a health care

provider for treatment;– Use or disclosure made to the individual, or the

individual’s personal representative; – Use or disclosure made pursuant to an

authorization; – Disclosure to HHS for complaint investigation,

compliance review or enforcement; – Use or disclosure that is required by law; or – Use or disclosure required to comply with HIPAA.

Accounting of PHI Disclosures

If a covered entity uses or maintains electronic health records with respect to PHI, then an individual has a right to receive an accounting of disclosures of PHI through the EHR made by a covered entity to carry out treatment, payment and health care operations for only three years prior to the date of request.

Accounting of PHI Disclosures

OCR published a request for information seeking comments to help better understand the interests of individuals with respect to learning of such disclosures, the administrative burden on covered entities and business associates of accounting for such disclosures, and other information that may inform the Department’s rulemaking in this area.– What are the benefits to the individual of an accounting

of disclosures, particularly of disclosures made for treatment, payment, and health care operations purposes?

– If you are a covered entity, how do you make clear to individuals their right to receive an accounting of disclosures? How many requests for an accounting have you received from individuals?

Accounting Request

• A covered entity may provide the individual either an—– Accounting for disclosures that are made by

covered entity and by a business associate acting on behalf of the covered entity; or

– Accounting for disclosures that are made by covered entity and provide a list of all business associates acting on behalf of the covered entity.

• A business associate included on a list must provide an accounting of disclosures made by the business associate to the individual.

Accounting of PHI Disclosures

• Effective date of new rules– Covered entity that acquires EHR before

January 1, 2009: January 1, 2014.– Covered entity that acquires EHR after

January 1, 2009: The later of January 1, 2011 or the date that the covered entity acquires the EHR.

• Secretary may set a later effective date.

Sale of EHR or PHI• A covered entity or business associate may not receive payment

(directly or indirectly) in exchange for an individual’s PHI unless the covered entity obtains an authorization that specifies that the PHI can be further exchanged for payment by the receiving entity.

• Authorization is not required if the purpose of the exchange is for:– Public health activities– Research and the price charged reflects the costs of preparation

and transmittal of the data for such purpose– Treatment of the individual, subject to any regulation that the

Secretary may promulgate to prevent PHI from inappropriate access, use, or disclosure

– Health care operations– Payment that is provided by a covered entity to a business

associate for activities involving the exchange of PHI that the business associate undertakes on behalf of and at the specific request of the covered entity pursuant to a business associate agreement

– Providing an individual with a copy of the individual’s PHI– Any other purpose determined by the Secretary in regulations

Individual Access to PHI

• If a covered entity uses or maintains an electronic health record with respect to PHI, the individual shall have a right to obtain from the covered entity a copy of the information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific.

• Any fee that the covered entity may impose for providing such individual with a copy of such information in an electronic form shall not be greater than the entity’s labor costs in responding to the request for the copy.

Marketing• A covered entity must obtain an authorization for

marketing purposes. • Marketing is defined as a communication about a

product or service that encourages recipients of the communication to purchase or use the product or service.

• The following types of communications are not considered marketing (“Marketing Exceptions):– Description of a health-related product or service that is

provided by, or included in a plan of benefits of the covered entity making the communication;

– Communication made for treatment of the individual; or– Information for case management or care coordination

for the individual, or to recommend alternative treatments, therapies, health care providers, or settings.

Marketing Communications Cont.A communication by a covered entity or business

associate as described in one of the Marketing Exceptions shall be considered marketing if the covered entity receives or has received direct or indirect payment in exchange for making such communication, except where such communication:– Describes only a drug or biologic that is currently being

prescribed for the recipient of the communication; and any payment received by such covered entity in exchange for making a communication is reasonable in amount;

– Is made by the covered entity; and the covered entity obtains a valid authorization with respect to such communication; or

– Is made by a business associate on behalf of the covered entity; and the communication is consistent with the written contract between such business associate and covered entity.

Fundraising

• The Secretary shall issue a rule providing that any written fundraising communication must, in a clear and conspicuous manner, provide an opportunity for the recipient of the communications to elect not to receive any further such communication.

• When an individual elects not to receive any further such communication, such election shall be treated as a revocation of authorization to use or disclose such individual’s PHI.

Education• By August 18, 2009, the Secretary shall designate

an individual in each regional office of HHS to offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related to Federal privacy and security requirements for PHI.

• By February 18, 2010, the HHS Office for Civil Rights shall develop and maintain a multi-faceted national education initiative to enhance public transparency regarding the uses of PHI, including programs to educate individuals about the potential uses of their PHI, the effects of such uses, and the rights of individuals with respect to such uses.

Education Cont.

• For the first year beginning after the date of the enactment of this Act and annually thereafter, the Secretary is responsible for issuing annual guidance on the provisions in the HIPAA Security Rule.

• HIPAA Security Standards: Guidance on Risk Analysis – May 7, 2010http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf

Enforcement - Wrongful Disclosure Criminal

Penalties• A person (including an employee or other individual)

shall be considered to have obtained or disclosed individually identifiable health information in violation of HIPAA if the information is maintained by a covered entity and the individual obtained or disclosed such information without authorization.

• A person in violation of this section shall– be fined not more than $50,000, imprisoned not more than 1 year,

or both;– if the offense is committed under false pretenses, be fined not

more than $100,000, imprisoned not more than 5 years, or both; and

– if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.

Enforcement - Required Penalty and

Investigation• The Secretary is now required to impose a civil

penalty for a HIPAA violation (up to $100 for each violation) due to willful neglect.

• The Secretary shall formally investigate any complaint of a HIPAA violation if a preliminary investigation of the facts of the complaint indicate a possible violation due to willful neglect.

• Any HIPAA violation by a covered entity will now be subject to criminal and civil penalties for each violation.

• Penalties are effective on or after February 18, 2011.• Within 18 months after the enactment date, the

Secretary shall promulgate regulations to implement these requirements.

Enforcement -Civil Penalties

Effective for violations on or after February 18, 2009.

Enforcement -Civil Penalties Cont.

The Secretary may not impose a civil money penalty on a covered entity for a violation if the covered entity establishes that an affirmative defense exists with respect to the violations, including the following:– The violation is an a Wrongful Disclosure Criminal

Act; or– The covered entity establishes to the satisfaction of

the Secretary that the violation is not due to willful neglect; and corrected during either:• The 30-day period beginning on the first date the covered

entity liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred; or

• Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply.

Enforcement Definitions

• Reasonable cause means circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated.

• Reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.

• Willful neglect means conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.

Enforcement

State Attorneys General• If a State attorney general has reason to believe that an

interest of one or more of the State’s residents has been or is threatened or adversely affected by any person who violates HIPAA, may bring a civil action on behalf of such State residents in a US district court:– to enjoin further such violation by the defendant; or– to obtain damages on behalf of such State’s residents.

• The amount of damages shall be determined by multiplying the number of violations by up to $100.– In the case of a continuing violation, the number of violations

shall be determined consistent with the HIPAA privacy regulations.

– The total amount of damages for all violations of an identical requirement or prohibition during a year may not exceed $25,000.

– In the case of any successful action, the court may award the costs of the action and reasonable attorney fees to the State.

State Attorneys General

Audits

The Secretary shall conduct periodic audits to ensure that covered entities and business associates comply with HIPAA’s privacy and security rules.

Business Associates• Under HITECH, business associates are now required by

law to comply with the business associate requirements provided under HIPAA.

• Business Associates are now required to comply with Administrative, Physical and Technical safeguards along with the Policies and procedures and documentation requirements, in the same manner that such sections apply to the covered entity.

• Business Associates are required to comply with any additional requirements of the HITECH Act that relate to security and that are made applicable with respect to covered entities.

• These additional requirements of the HITECH Act shall be incorporated into the business associate agreement between the business associate and the covered entity.

• Business Associates are now subject to the same criminal and civil penalties applicable to a covered entity that violates such security provision.

HHS Rulemaking• On March 15, 2010, OCR stated that it

continues to work on a Notice of Proposed Rulemaking (“NPRM”) regarding the following provisions:– Business associate liability; – New limitations on the sale of PHI, marketing,

and fundraising communications; and – Stronger individual rights to access electronic

medical records and restrict the disclosure of certain information.

• Interim final rules implementing HITECH Act provisions in two areas have already been issued and are currently in effect: enforcement and breach notification.

Timeline

PPACA

The Patient Protection and Affordable Care Act (“PPACA”) is a federal statute that was signed into law on March 23, 2010 along with the Health Care and Education Reconciliation Act of 2010.

Administrative Simplification

Section 1104 of the Act amends HIPAA’s administrative simplification provisions by requiring the Secretary to adopt uniform standards for health care transactions which – Enable determination of individual’s eligibility and

financial responsibility prior to or at point of care; – Minimize the need for paper attachments to claims

submissions;– Provide for timely acknowledgment, response and

status reporting– Describe all data elements (including reason and

remark codes) in unambiguous terms, require that such data elements be required or conditioned upon set values in other fields, and prohibit additional conditions.

HIPAA Compliance• States that participate under Wellness Program

Demonstration Projects shall ensure that consumer data is protected in accordance with HIPAA

• School-Based Health Centers must comply with regulations promulgated under HIPAA

• Any federally conducted or supported health care or public health program activity or survey collected by Secretary is protected under HIPAA

• Secretary shall ensure compliance with HIPAA in pursuing activities under Elder Justice

• Secretary shall ensure that the Congenital Heart Disease Surveillance System complies with HIPAA

• Enhances subpoena authority under HIPAA