1

HIPAA Privacy & Security Overview

Know HIPAA Presents

Agenda

2

• HIPAA Overview• Privacy Practices• Security definitions• Security standards• Security safeguards• Security incidents• Sanctions• Breach notification• Enforcement update

3

Overview of HIPAA

We Focus on This

Portion of HIPAA only.

HIPAA

Title I — Health

Care Access,

Portability and

Renewability

Title II —

Preventing

Health Care

Fraud and Abuse

Title III — Tax-

Related Health

Provisions

Title IV — Group

Health Plan

Requirements

Title V —

Revenue Offsets

Subtitle F — Administrative Simplification

PrivacyElectronic

Transactions

Unique

Identifiers

Information

Security

Employer IdentifierCode Sets

• Covered Entities - Must Comply #1 – Health care providers

#2 - Group health plans (fully or self-insured employer sponsored plans & health insurance issuers)

#3 - Clearinghouses

• Business Associate - Should Comply#4 – Firms working with covered entities.

Examples include Billing Services, Transcription Services, TPA’s, brokers

Who Does HIPAA Impact?

4

• Protected Health Information (PHI) is information relating to past present or future physical or mental health of an individual (employee) whether they are active or terminated.

• Individually Identifiable PHI is that which identifies an individual. This could include: name, address, date of birth, Social Security number, telephone numbers, e-mail address, account numbers, Group Health Plan beneficiary number, or any other unique identifying number, characteristic or code.

Protected Health Information (PHI)Individually Identifiable Health Information

5

• Applies to paper/oral/electronic records• Sets boundaries on the Use and

Disclosure of health information• Gives “individuals” more control over their

own health information• Establishes safeguards for protecting the

privacy of health information.• Holds covered entities accountable for

violations of privacy requirements.

Privacy Rule

6

Some requirements that a covered entity must comply with include, but is not limited to the following:• Designating a Privacy Official.• Designating a Contact for handling Complaints.• Developing policies and procedures on the use and

disclosure of individually identifiable health information.• Providing training to all workforce members on the

policies and procedures that affect their job duties.• Providing a Notice of Privacy Practices to individuals

Privacy Regulation

7

• They share this information with other healthcare providers. They are permitted to use and/or disclose information for treatment, payment or health care operations without getting permission from an individual.

• To use information for any other reason or to disclose it to any one other than the patient or Covered Entity may require a signed and verified authorization.

How Does Covered Entity Use Protected Health Information?

8

• What is an authorization• When is it used

Authorizations

9

• Individual has the right to access their protected health information, receive an accounting, amendment their protected health information, file a complaint, request confidential communications or restrict access to their protected health information.

Other Aspects of HIPAA Administration

10

• All Covered Entity employees that have access to protected health information agree that at no time, during or after their employment with Covered Entity, will they use, access or disclose protected health information to anyone except as required or permitted in the course and scope of their duties.

• Unauthorized use/disclosure may result in disciplinary action up to and including termination.

• Civil or criminal penalties may also apply.

Confidentiality

11

Covered entities must implement appropriate safeguards to protect an individual’s protected health information. – Remember to do the following:

• Records that contain protected health information should be maintained in a secure location or locked away.

• Records that contain protected health information should be shredded before discarding the information.

• Passwords should not be shared with anyone. Electronic protected health information needs to be safeguarded as well.

Safeguards

12

HIPAA Security

13

• May 21, Purdue University• May 21, Jackson Community

College (Michigan)• May 19, Westborough Bank

(Florida)• May, Business Week On-line

forum• May 14, MTSU • May 5, Wharton school (MSU)• May 2, Time Warner• April 28, Bank of America,

Commerce Bankorp, PNC Bank• April 21, Carnegie Mellon

University• April 20, AmeriTrade• April 8, San Jose Medical

Group• March 28, University of

California, Berkley

• March 20, Kellogg MBA program

• March 17, Boston College• March 17, Chico State

University• March 16, Kaiser

Permanente• March 8, DSW• March, LexisNexis (Seisint)• February 15, Bell v.

Michigan Council 25 • February, Bank of America• February, Choice Point• February, PayMaxx• November, Wells Fargo• November, Gibson

Sentencing US District Court

• November, Minneapolis School District

Individually identifiable health information:– Transmitted by electronic media– Maintained in electronic media– Transmitted or maintained in any other

form or medium

What is Electronic PHI?

14

• Only those that need access• Physical access• Technical access

• The covered entity is responsible for the confidentiality, integrity and availability of EPHI

• The covered entities safeguards are the first line of defense

Security Standards

15

• Must have Policies & Procedures• Security measures are appropriate

and reasonable• Considerations:

• Size• Complexity• Mission• Purposes of the EPHI created, maintained and

transmitted

Security Standards - General rules

16

• Risk Analysis• Risk Management• Sanction Policy• Information System Activity Review

Security Management Process

17

• Workforce security• Information access• Facility Security plan• Workstation use• Device & Media controls• Access controls (technical)• Administrative requirements

Safeguards

18

• Training• Security reminders• Protection against malicious

software• Password management

Security Awareness

19

• Data backups• Disaster recovery• Emergency operation plan• May have

– Critical applications and data– Testing and revisions

Contingency Plans(Availability)

20

• Who • When• New employees or contractors• Due to changes

Workforce Security Training

21

• Security Incidents• Sanctions• Breach Notification

Events requiring action

22

• What are they?• What should you do?

– Actions depend on the incident– Who was responsible, third party?– Are Sanctions required?

Security Incidents

23

• Workforce members who violate health plans Privacy or Security Policies may be subject to disciplinary actions, up to and including termination.

• The amount and type of corrective action used in any particular situation will depend on the facts and circumstances. The company maintains the discretion to determine whether corrective action is appropriate.

Sanctions/Violations

24

• Notification to individuals• Notification to the media• Notification to the Secretary• Notification by a business associate• Law enforcement delay• Burden of proof

Specifics

25

• Annual guidance regards technology• Random audits• Reports to congress• Increased fines• 2013 changes

Guidance & Enforcement

26

Problem General Penalty

Civil Violation $100/offense; up to 1.5mil/ year

Wrongful Action $50,000/offense; 1 year in prison

False Pretense $100,000/offense; 5 years in prison

Intent to Sell $250,000/offense; 10 years in prison

Why Comply?

27

The price for non-compliance:

Questions

28

?