“Reaching across Arizona to provide comprehensive quality health care for those in need” Our first care is your health care Arizona Health Care Cost Containment System HIPAA Privacy and Security 2013: The New Regulations By Melanie A. Herring, Esq.

“Reaching across Arizona to provide comprehensive quality health care for those in need” Our first care is your health care arizona health care cost containment system 2 Major Provisions  Breach Notification Regulations  Business Associate (BA) Changes  Enhanced Enforcement and Penalties  New Privacy Requirements  Amended Notice of Privacy Practices (NPP)

“Reaching across Arizona to provide comprehensive quality health care for those in need” Our first care is your health care arizona health care cost containment system 3 Important Deadlines  January 25, 2013: Final Regs were issued  March 22, 2013: Effective Date  September 23, 2013: Compliance Date (180 days from Effective Date)*  September 22, 2014: Deferred Compliance Date for Certain BA Contracts *For all future HIPAA amendments, default 180 day compliance deadline

“Reaching across Arizona to provide comprehensive quality health care for those in need” Breach Notification Standards... When a CE is required to report a privacy or security breach to HHS-OCR, the affected individuals, and/or the media.... Our first care is your health care arizona health care cost containment system 4

“Reaching across Arizona to provide comprehensive quality health care for those in need” Our first care is your health care arizona health care cost containment system 5... Breach Notification Standards  Under the old rule, breaches were not reported unless they posed “a significant risk of reputational, financial or other harm”  Under the new rule, “harm threshold” is eliminated and replaced with a more objective standard  Under the new rule, the “safe harbor” provisions for encrypted and PHI secure disposal remain intact

“Reaching across Arizona to provide comprehensive quality health care for those in need”... Breach Notification Standards New Rule: All incidents are assumed to be a reportable breach to HHS-OCR unless a Risk Analysis (RA) reveals a “low probability” that PHI has been compromised Our first care is your health care arizona health care cost containment system 6

“Reaching across Arizona to provide comprehensive quality health care for those in need”... Breach Notification Standards 4 factors to a Risk Analysis: The nature and extent of PHI involved, including the types of identifiers and the likelihood of re- identification The unauthorized person who used or received the PHI Whether the PHI was actually acquired and viewed, and Our first care is your health care arizona health care cost containment system 7

“Reaching across Arizona to provide comprehensive quality health care for those in need”... Breach Notification Standards  The extent to which any risk to the PHI has been mitigated Notification to HHS-OCR will be required if the RA reveals any risk except “Low Probability that the PHI will be or has been compromised” Our first care is your health care arizona health care cost containment system 8

“Reaching across Arizona to provide comprehensive quality health care for those in need”... Breach Notification Standards  The CE’s Risk Analysis must be in writing and retained by the CE.  Willful Negligence: If a breach reported to HHS-OCR suggests “willful negligence” by the CE or its BA, then HHS-OCR must investigate Our first care is your health care arizona health care cost containment system 9

“Reaching across Arizona to provide comprehensive quality health care for those in need” Business Associate Requirements This section of the regulation has the most changes. Highlights:  Amended BA definition: Clarify that a BA is also an entity that “maintains” PHI on behalf of the CE (i.e.: record storage services, record locator services) E-prescribing Gateways, HIO’s, PSO’s are a BA Our first care is your health care arizona health care cost containment system 10

“Reaching across Arizona to provide comprehensive quality health care for those in need”...Business Associate Requirements  Security Rule, Minimum Necessary Rule, Accounting of Disclosures Rule now apply directly to BA’s  Our BA contracts will require amendments  Our BA’s must now have BA contracts in place with their subcontractors Our first care is your health care arizona health care cost containment system 11

“Reaching across Arizona to provide comprehensive quality health care for those in need”... Business Associate Requirements  BA’s are now directly liable for their own breaches, and the CE of a BA remains liable as well for its BA’s breaches  Subcontractors to BA’s are directly liable for their own breaches Our first care is your health care arizona health care cost containment system 12

“Reaching across Arizona to provide comprehensive quality health care for those in need” Enhanced Penalties and Enforcement  HHS-OCR may fine all parties responsible (i.e.: can fine the CE and the BA for the same violation)  The General Rule: Monetary penalties will be tallied on a per person and per day basis  Maximum Annual Cap for Violations of a Provision: 1.5 million dollars  A few defenses are allowed but if you do not cure the violation within 30 days of the breach you may lose that defense Our first care is your health care arizona health care cost containment system 13

“Reaching across Arizona to provide comprehensive quality health care for those in need” New Privacy Requirements  50 year deceased exception  BA’s are now directly required to comply with significant provisions of the privacy rule  Genetic information (GINA) is now expressly included within the definition of “health information”  Amendments to the Marketing Requirements (mostly dealing with financial remuneration marketing) Our first care is your health care arizona health care cost containment system 14

“Reaching across Arizona to provide comprehensive quality health care for those in need”... New Privacy Requirements  Prohibits the sale of PHI without individual authorization (data use agreements)  Enhances an individual’s right to request and receive a copy of their PHI records  An individual can restrict disclosures of his/her PHI to health plans if the PHI pertains solely to a service that the individual has paid for in full Our first care is your health care arizona health care cost containment system 15

“Reaching across Arizona to provide comprehensive quality health care for those in need”... New Privacy Requirements  Relaxes the regulations surrounding disclosures of PHI to family members or others involved in the person’s care  Allows disclosure of immunization records to schools Our first care is your health care arizona health care cost containment system 16

“Reaching across Arizona to provide comprehensive quality health care for those in need” Notice of Privacy Practices Must Amend the CE’s Notice of Privacy Practices and mail to all individuals by September 23, 2013 Our first care is your health care arizona health care cost containment system 17

“Reaching across Arizona to provide comprehensive quality health care for those in need” Genetic Information Nondiscrimination Act (GINA) GINA prohibits the use of genetic information for underwriting purposes. HHS has made this prohibition applicable to all health plans subject to HIPAA, not just the limited set of plans covered by GINA Our first care is your health care arizona health care cost containment system 18