COMING TO THE HIPAA PARTY: TIPS FOR IT SUPERHEROES & Schenck Price Smith & King, LLP COMING TO THE HIPAA PARTY: TIPS FOR IT SUPERHEROES & COMPLIANCE TO COEXIST Presented by: Deborah A. Cmielewski, Esq. March 2, 2016 © Schenck Price Smith & King, LLP

AGENDA 1. Background: How did we get here? 2. The Security Rule 3. 45 C.F.R. § 164.308 4. Where do we go from here?

SETTING THE STAGE “…all the major healthcare data breaches of 2015 … were the result of the actions of hackers.”

HUMAN ERROR RESULTED IN BREACHES Loss of devices Equipment theft Unauthorized disclosures Improper disposal

RECENT ENFORCEMENT CONTINUES Lahey Triple-S UWM Lincare

“REQUIRED” vs. “ADDRESSABLE” SPECIFICATIONS Required means you must do it Addressable Reasonable and appropriate Must document decisions

45 C.F.R. § 164.308 Administrative Safeguards The Security Rule is flexible and scalable

SECURITY MANAGEMENT PROCESS (45 C.F.R. § 164.308(a)(1)(ii)) - Sanction Policy (R): Apply appropriate sanctions for failure to comply - IS Activity Review (R): Regularly review records of IS activity

ID SECURITY OFFICIAL

WORKFORCE SECURITY (45 C.F.R. § 164.308(a)(3)(ii) Authorization Supervision Workforce Clearance Termination Procedures

INFORMATION ACCESS MANAGEMENT (45 C.F.R. § 164.308(a)(4)(ii) - Consistent with “minimum necessary” - Role-based access

SECURITY AWARENESS AND TRAINING 45 C.F.R. § 164.308(a)(5) - Training must be effective - Often cited in regulatory actions

“Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.”

OCR CYBER-AWARENESS INITIATIVE

QUESTIONS?

Serving Our Clients And Community For Over 100 Years www. spsk Serving Our Clients And Community For Over 100 Years www.spsk.com Deborah A. Cmielewski, Esq. (973) 540-7327 dac@spsk.com