By: Eamon Callahan and Wilston Johnston HIPAA By: Eamon Callahan and Wilston Johnston

Overview HIPAA Background Componenets of the Law Examples of Major Violations Lessons Learned HIPAA Safeguards

HIPAA Health Insurance Portability and Accountability Act of 1996 Dictates the use, transfer, and storage of patient medical records

History Development of electronic medical records systems in early 1990s Signed into law in 1996 by Pres. Bill Clinton Original law provided no details, but mandated Congress to pass future regulation Privacy Rule passed in 1999 Transaction and Code Sets Rule in 2000 Security Standards Rule in 2003 Enforcement Rule in 2006

Sections of the Law Privacy Rule: Security Rule: Defines Protected Health Information (PHI) Identifies entities covered by law Healthcare providers, insurance plans/companies, “healthcare clearinghouses” Security Rule: Sets standards for security practices to protect PHI Sets guidelines than enacts specific practices Mandates requirement for “administrative, technical, and physical safeguards”

Legal Consequences Entities give 30 days to correct breaches and notify patients Corrections often include suspension/termination of employees Tiered fine structure Between $100 - $100,000 fine due to nature of defense

HIPAA Violations Unfortunately HIPAA violations happen frequently According the Elizabeth Snell, “HIPAA settlements have been taking place, and have been going aggressively, topping close to $15 million so far in 2017” https://healthitsecurity.com/news/what-should-entities-expect-with-ocr-hipaa- enforcement https://www.youtube.com/watch?v=iFxSGNrbEzs

HIPAA Security in the Field A Case Study from the Hellhole of Private EMS

Learning From Lawsuits According to Elizabeth Snell, 5 things that companies should take away from lawsuit are: Business Associate Agreements (BAAs) Audit Controls Breach Notifications Risk Management Basic HIPAA Safeguards

Business Associate Agreements (BAAs) According to U.S. Department of Health & Human Services a Business Associate agrees to: Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement; Report to covered entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information

Audit Controls and Breach Notifications Taken HIPAA’s website: “Monitoring and review of audit trails must be as close to real time as possible to be useful.” If/when a breach occurs the breach needs to be disclosed to the public and the authorities The affected people must be notified in a timely fashion. https://www.hipaa.com/audit-control-what-this-hipaa-security-rule-technical-safeguard-standard-means/

Risk Management According to HealthIT Security: Children’s agreed to a $3.2 million civil penalty, stemming from an incident when an unencrypted, non-password protected Blackberry was reported lost. Lacking risk management was also cited in the October 2016 settlement with St. Joseph Health (SJH). In that case, SJH agreed to a $2,140,500 million settlement after it was found to have failed to examine or modify a new file server when it was implemented.

Basic HIPAA Safeguards According to HealthIT Security: HIPAA technical safeguards, physical safeguards, and administrative safeguards are the backbone to any organization’s approach to compliance and data security. As technology continues to evolve and organizations have more ePHI, it becomes more important for entities to update their security measures and account for new tools. Advocate Health Care (Advocate) agreed to a $5.5 million OCR HIPAA settlement in August 2016, following multiple alleged HIPAA violations and noncompliance issues

Work Cited “Business Associate Contracts.” HHS.gov, US Department of Health and Human Services, 25 Jan. 2013 Callahan, Eamon. “Electronic Medical Records & .” 12 Dec. 2016. Jones, Ed. “Audit Control: What This HIPAA Security Rule Technical Safeguard Standard Means.” HIPAA.com, HIPAA, 9 June 2009, www.hipaa.com/audit-control-what-this-hipaa-security-rule-technical-safeguard-standard-means/. Perlmutter, Chad. “Storing Your Medical Records Securely.” Record Nations, Record Nation, 13 Jan. 2016, www.recordnations.com/2015/02/storing-medical-records-2/. Snell, Elizabeth. “5 Lessons Learned in OCR HIPAA Settlements.” HealthITSecurity, HealthITSecurity, 31 July 2017, healthitsecurity.com/news/5-lessons-learned-in-ocr-hipaa-settlements Snell, Elizabeth. “What Should Entities Expect with OCR HIPAA Enforcement?” HealthITSecurity, HealthITSecurity, 2 Nov. 2017, healthitsecurity.com/news/what-should-entities-expect-with-ocr-hipaa-enforcement. “This COP ASSAULT Story Gets WEIRD! - ETC Daily.” YouTube, YouTube, 5 Sept. 2017, www.youtube.com/watch?v=iFxSGNrbEzs.

By Callahan and Johnston HIPPA By Callahan and Johnston