Final HIPAA-HITECH Rules, Cybersecurity, and Privacy Dino TsibourisMehmet Munur (614) (614)

Outline 1.Final HIPAA-HITECH Regulations 2.Breach Notification 3.Business Associate Agreements 4.Cybersecurity Developments 5.Other Privacy Developments 6.Questions

Why Comply? CVS $2.25 million fine Cignet Health $4.3 million fine BCBS of Tennessee $1.5 million fine Alaska DHHS $1.7 million fine Hospice of Northern Idaho $50,000 fine HHS investigated and resolved 19,306 cases

Final HIPAA-HITECH Rules Changes to Breach analysis and notification Changes to definition of Business Associates Security and Privacy Rule applicable directly to BAs Changes to Business Associate Agreements Changes to Privacy Notices Changes to restrictions on sale of PHI Changes to marketing rules

Business Associate Agreements BAs must enter into BAAs with sub-BAs Requires compliance with Privacy Rule Requires compliance with Security Rule Requires reporting of Security Incidents CE BAA BA sBA BAA

Breach Analysis Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

Breach Analysis Old Analysis: – Notify only if significant risk of financial, reputation, or other harm New Analysis: – Presume that there is a breach unless you can establish that there is a low probability of compromise of PHI

Key Dates Rules effective March 26, 2013 Compliance Required by September 23, 2013 Updated Business Associate Agreements by September 22, 2014

Recommendations Revise Notices and Agreements Revise Breach Analyses, Policies, Procedures Conduct Risk Assessment Have policy and team in place, practice Disclose Security Incidents and Breaches Consider Insurance

Cybersecurity Developments Cybersecurity Executive Order Cyber Intelligence Sharing and Protection Act enactment Electronic Communications Privacy Act amendments National Security Letters lawsuits

Other Privacy Developments EU Data Protection Regulation – Global Application – Large Fines – Individual Protections – Affects Cloud Service Providers Social Media Password Laws – Arkansas, California, Delaware, Illinois, Maryland, Michigan, New Mexico, New Jersey, and Utah

Conclusion 1.Final HIPAA-HITECH Regulations 2.Breach Notification 3.Business Associate Agreements 4.Cybersecurity Developments 5.Other Privacy Developments 6.Questions

Questions Dino TsibourisMehmet Munur (614) (614)