Rational HIPAA Woes for the CFO and Business Leaders Kirsten Ruzic Wild Wild Consulting, Inc. May 2017

What is the real risk? Cost of Regulatory (OCR) Investigation Internal Resources, $$$$ Cost of a Breach Regulatory Fines and Penalties Negative Community Perception

Risk Mitigation

What gets you Investigated by OCR? 1. Patient-complaint driven process 2. Breach Compliance Reviews 3. Reports by other individuals 4. Audits and Reviews .

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html?language=es

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html?language=es

Complaint Investigations YEAR INVESTIGATED: NO VIOLATION RESOLVED AFTER INTAKE AND REVIEW INVESTIGATED: CORRECTIVE ACTION OBTAINED TECHNICAL ASSISTANCE TOTAL RESOLUTIONS 2013 994 7% 7,068 49% 3470 24% 2754 19% 14,286 2014 668 4% 10,653 60% 1288 5128 29% 17,737 2015 359 2% 12,785 72% 730 3820 22% 17,694   https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html?language=es

Complaint Investigations YEAR INVESTIGATED: NO VIOLATION RESOLVED AFTER INTAKE AND REVIEW INVESTIGATED: CORRECTIVE ACTION OBTAINED TOTAL RESOLUTIONS 2010 1529 17% 4951 54% 2709 29% 9189 2011 1302 16% 4465 53% 2595 31% 8362 2012 980 10% 5060 3361 36% 9401 https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html?language=es

Enforcement Results By State INVESTIGATED: NO VIOLATION RESOLVED AFTER INTAKE AND REVIEW INVESTIGATED: CORRECTIVE ACTION   Wisconsin 10% 71% 18% Michigan 9% 73% 18%

Top Five Issues in Investigated Year Issue 1 Issue 2 Issue 3 Issue 4 Issue 5 2015 Impermissible Uses & Disclosures Safeguards Administrative Safeguards Access Technical Safeguards 2014 2013 Minimum Necessary 2012 2011 Notice to Individuals

What do you do to mitigate this risk? Patient Complaints are not your greatest risk. You know about most patient complaints. Understand your process for managing complaints – patient safety/quality reporting by employees, grievances and complaints from patients, hotline, etc. Ask for a report from your Safety Reporting System Should be able to mitigate this risk. Never give the government a reason to walk through the door.

Resolution Agreements Impermissible uses and disclosures Your own staff Robust education, scenarios, dialogue Sign a Confidentiality Statement to protect organization Employees should ask Safeguards – protect ePHI

Resolution Agreements Administrative Safeguards – Risk Assessment, employee access rights, training, p&p, etc Access – Patient access to their own medical record Minimum Necessary – Robust education, scenarios, dialogue

2. Breach Reports and Reviews Self-reporting – you know about these too Wall of Shame https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf Largest number of records: 7,880,000 to 63,000 Since October 2009 - 1900 breach reports of 500 or more individuals 2016 = 328 2015 = 269 2014 = 312

2. Breach Reports and Reviews In breach reports of 500 or more individuals: 2013 ~257 resulted in an investigation 152 breach investigations were closed 80% (121) required corrective action 2014 ~ 285 resulted in an investigation 239 breach investigations were closed 90% (216) required corrective action

Sorted top 100 reports for largest number of individuals affected Location of Data Breached 12 – desktop 6 – EMR 7 – email 12 – laptop 36 – server 8 – paper/film 20 – other Type of Breach 34 – hacking 3 – improper disposal 5 – loss 45 – theft of portable device 26 – unauthorized access/disclosure 5 – other

Sorted bottom 100 reports for smallest number of individuals affected Type of Breach 11 – hacking 4 – improper disposal 9 – loss 35 – theft of portable device 15 – unauthorized access/disclosure 7 – other Location of Data Breached 15 – desktop 7 – EMR 6 – email 22 – laptop 10 – server 30 – paper/film 10 – other

Type of Entity Reporting Breach Largest Breaches 25 – Business Associates 21 - Health Plan 54 – Provider *largest number of providers are: private practices, general hospitals, outpatient facilities, and pharmacies Smallest Breaches over 500 15 – Business Associates 11 – Health Plan 74 – Provider *ePHI that is lost that is encrypted is not a breach!

What do you do to mitigate your risk of a Breach Review? Should be receiving an Annual Breach Report Due by March 1st of each year – 500 or more individuals Easier not to report Breach Analysis process Ask questions Be sure the risks are identified and mitigated: Conduct a risk analysis This should be an investigation Policy and procedure reviewed Re-educate employees Take necessary disciplinary action Timely

3. Reports by other individuals Non- patient reports Not really a complaint Usually know about these too

4. Audits and Reviews HITECH/ARRA of 2009 required audits and provided funding Prospectively assess for compliance Ensure Patient Rights are respected CE and BA

4. Audits and Reviews 2011-2012 - Phase 1 - pilot audit established an audit protocol (115 CE) 2013 - evaluated Pilot program 2014 - revised program and readied for Phase 2 2016 (July) – Phase 2 Desk Audits launched (166 CE and 43 BA) enhanced protocols test the efficacy of desk audits in evaluating the compliance efforts compliance improvement activity

4. Audits and Reviews Phishing Email Disguised as Official OCR Audit Communication -  November 28, 2016 Pre-audit Questionnaire – must identify BAs! May initiate a compliance review No results until at least September 2017 Then on-site audits of CE and BA

4. Audits and Reviews Samples Requested and Inquiries of Management Privacy Rule Security Rule Breach Notification Will be On-site Audits of both CE and BA after completion of desk audits

4. Audits and Reviews Privacy Audits Documentation Requested 48 areas of inquiry P&P and Examples/samples Personal representatives, use and disclosure for public health, decedents, minimum necessary, notice of privacy practices, amendment requests, sanctions, right to access, etc.

4. Audits and Reviews Privacy Audits Inquiry of Management 18 inquiries INQUIRE OF MANAGEMENT how the entity recognizes personal representatives for an individual for compliance with HIPAA Rule requirements

4. Audits and Reviews Business Associate Contracts Obtain and review a sample of BAA and evaluate whether the agreements are consistent with established performance criteria the entity has established and the P&P. Inquire of Management as to whether any business associate arrangements involved onward transfers of PHI to additional business associates and subcontractors Provide a sample

4. Audits and Reviews Breach Notification Samples Requested and Inquiries of Management 12 areas of inquiry complaints to CE, sanctions of workforce members, risk assessments resulting in low probability of compromise, PHI was not secured, breach notification sent to individuals, breach over 500, etc.

4. Audits and Reviews Breach Notification Obtain a list of risk assessments in which the CE determined that was a low probability of compromise – so not reported on the Wall of Shame. Sampling methodology Inquiry of Management – Administrative requirements, timeliness of notifications, content of notification, method of notification etc.

4. Audits and Reviews HIPAA Security Obtain Security documentation to demonstrate 100 areas of inquiry Latest written Risk Analysis - 2 most recent, sanctions, access requests, termination of access, security awareness and training – malicious software, passwords, disaster recovery, contingency plans, etc.

Address the Rational Woes Ensure your organization has a good patient complaint and resolution process Summary report of open and closed cases, and timeframes Understand the process Scenario-based Education Internalized dialogue

Mitigate the Rational Woes Get a Breach Report At least annually Understand your Breach Reporting Process All Portable devises MUST be encrypted. Period BYOD or organization-owned

Mitigate the Rational Woes Support Business Associate Agreement (BAA) function Contract Management! If no one is responsible, no one is responsible. Be sure you have the BAAs you should Be sure you know what they say Hold BA accountable – audit them?

Mitigate the Rational Woes Support resources for HIPAA Security Document, document, document IT – deep, unnatural aversion to documentation Trust but verify

Mitigate the Rational Woes Risk assessment, Risk Assessment, Risk Assessment, Risk Assessment Continual process, never done Need to catch vulnerabilities and threats Regular working meetings Document discussions and decisions in meeting minutes

Mitigate the Rational Woes Cyber Insurance Manage the investigation and forensics Organizational Culture Blame? Lip service Collaboration between PO and SO Premiere Organization - Premiere Compliance Proper oversight

Use shouldn’t be sleeping Physician office with MDs using their personal portable devices for work

Kirsten Wild, RN, BSN, MBA, CHC Wild Consulting, Inc Kirsten Wild, RN, BSN, MBA, CHC Wild Consulting, Inc. Cedarburg, WI 262-993-4747 kirsten.wild@att.net