From HIPAA to IFHIMA Nationwide & Worldwide Privacy & Security Initiatives Northern Indiana Health Information Management Association March 29, 2019 Dorinda Sattler, MJ, RHIA, CHPS, CPHRM Clinical Assistant Professor/HIT Program Director Owner/Consultant – Sattler Healthcare Consulting, Inc.

The good ole days… There was a patchwork of privacy laws. From HIPAA to IFHIMA March 29, 2019 The good ole days… There was a patchwork of privacy laws. Health Insurance Portability and Accountability Act enacted 1996 compliance with Privacy Rule required by 4.14.2003 compliance with Security Rule by 4.20.2005 Initially, little enforcement “teeth”.

HIPAA Gets Tough Omnibus final rule 1.25.2013 From HIPAA to IFHIMA March 29, 2019 HIPAA Gets Tough Omnibus final rule 1.25.2013 implemented HITECH Act changes and GINA changes to HIPAA. Strengthened HIPAA’s Privacy and Security protections Extended applicability of certain provisions to BAs Established breach notification requirements Required periodic audits by HHS. Compliance by 9.23.13 OCR charged with oversight and enforcement of HIPAA Privacy and Security Rules

From HIPAA to IFHIMA March 29, 2019 Breach notification With HITECH’s breach notification requirement implemented into HIPAA, CEs and BAs are now having to notify the OCR about breaches of PHI or ePHI. The notifications become triggers for future audits.

OCR Enforcement Process From HIPAA to IFHIMA March 29, 2019 OCR Enforcement Process Investigates complaints received Conducts compliance reviews of circumstances brought to its attention Conducts audits Provides education and outreach to assist with compliance May issue subpoenas to compel cooperation with investigations Enters into resolution agreements, assesses CMPs Required to submit a report to Congress annually

From complaints to audits From HIPAA to IFHIMA March 29, 2019 From complaints to audits Initially OCR was reactionary in determining compliance: Responded due to complaints received, or Responded if made aware of situations where compliance was suspect.

Phase 1 Audits Proactive audits began in 2011 From HIPAA to IFHIMA March 29, 2019 Phase 1 Audits Proactive audits began in 2011 Pilot audits performed 2011-12 Audit findings analyzed and the pilot audit program was evaluated throughout 2013 Planning activities for next phase 2014-15

Phase 2 Audits Full implementation 2016 From HIPAA to IFHIMA March 29, 2019 Phase 2 Audits Full implementation 2016 CEs and BAs chosen for audit based on history of complaints and self-reported breaches Desk audits begin for randomly chosen CEs and BAs. Focus is on key non-compliance areas identified in Phase I. Also includes areas related to security

Phase 2 Audit Results (so far) From HIPAA to IFHIMA March 29, 2019 Phase 2 Audit Results (so far) Desk audits completed 2017 166 covered entities 41 business associates Failure to implement effective risk analysis and RM strategies per the Security Rule Failure to adequately safeguard PHI and ensure individual access to PHI Incomplete NPPs Aggregate findings to be published 2019!

Totality of all enforcement actions = From HIPAA to IFHIMA March 29, 2019 Totality of all enforcement actions =

OCR Stats as of 12.31.18* Complaints received: 197,049+ From HIPAA to IFHIMA March 29, 2019 OCR Stats as of 12.31.18* Complaints received: 197,049+ Compliance reviews initiated: 924 Cases resolved: 192,350 26,558 cases resolved by requiring changes in privacy practices 62 cases resulted in CMPs or settlements totaling $96,581,582.00 11,653 cases: No violation found *https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/2018-december/index.html

OCR Stats as of 12.31.18* (continued) From HIPAA to IFHIMA March 29, 2019 OCR Stats as of 12.31.18* (continued) Of the 197,049+ complaints: 122,019 were not eligible for enforcement OCR lacked jurisdiction (entity not a CE or BA) Untimely complaint or complaint withdrawn Activity described did not violate HIPAA (permitted privacy disclosures) *https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/2018-december/index.html

OCR Stats as of 12.31.18* (continued) From HIPAA to IFHIMA March 29, 2019 OCR Stats as of 12.31.18* (continued) Issues investigated most: Impermissible uses and disclosures Lack of safeguards of PHI Lack of patient access to their PHI Lack of administrative safeguards for ePHI Use or disclosure of more than the minimum necessary PHI *https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/2018-december/index.html

OCR Stats as of 12.31.18* (continued) From HIPAA to IFHIMA March 29, 2019 OCR Stats as of 12.31.18* (continued) Most common types of CEs required to take corrective action: General Hospitals Private Practices and Physicians Outpatient Facilities Pharmacies Health Plans (group health plans and health insurance issuers) *https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/2018-december/index.html

In the in 2018 Jan. - Filefax, Inc. $100,000 From HIPAA to IFHIMA March 29, 2019 In the in 2018 Jan. - Filefax, Inc. $100,000 Jan. - Fresenius Medical Care $3,500,000 Jun. - MD Anderson Ca. Center* $4,300,000 Sep. - Boston Medical Center, with Brigham and Women’s Hospital, and Massachusetts General Hospital $999,000 *Judgment, whereas others were settlements

In the in 2018 (still!) Oct. – Allergy Assoc. of Hartford $125,000 From HIPAA to IFHIMA March 29, 2019 In the in 2018 (still!) Oct. – Allergy Assoc. of Hartford $125,000 Oct. – Anthem, Inc. $16,000,000 Nov. – Pagosa Springs $111,400 Dec. – Cottage Health $3,000,000 Total (Settlements and Judgments) $28,683,400

Onward and upward OCR Outreach Efforts Print materials Website From HIPAA to IFHIMA March 29, 2019 Onward and upward OCR Outreach Efforts Print materials Website On-line provider education training Raise awareness of individuals’ rights

From HIPAA to IFHIMA March 29, 2019 So we can relax, right?

From HIPAA to IFHIMA March 29, 2019

HIPAA is not the only king! From HIPAA to IFHIMA March 29, 2019 LOL, nope. OCR finalizing a permanent audit plan and protocols Enforcement activities show no sign of slowing down HIPAA is not the only king! California and other state data privacy laws GDPR Possible US-like GDPR? Which brings me to...

From HIPAA to IFHIMA March 29, 2019 IFHIMA International Federation of Health Information Management Associations Member nations: 23 as of 3.11.19 representing 7 global regions Congress held every three years Work relative to HIM includes: ICD, EHR, HIM Education, IG and of course, Privacy!

IFHIMA Privacy Workgroup From HIPAA to IFHIMA March 29, 2019 IFHIMA Privacy Workgroup Currently writing privacy whitepaper Global perspective, HIM highlight Case studies from some member nations US, India, Australia, Qatar, and S. Korea White paper to be published and presented to IFHIMA Congress in Dubai November 2019 Privacy panel anticipated

From HIPAA to IFHIMA March 29, 2019

From HIPAA to IFHIMA March 29, 2019 References https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2015-2016-2017.pdf IFHIMA