1. CalOHI Staff Policy Branch Operations Branch Information Technology
Legal Services
You may be wondering who is behind all this HIPAA work: Let me take a minute and introduce the CalOHI staff:
There Hart – Policy
Alex Kam – Operations
Greg Thompson – IT
Stephen Stuart – Legal
Elaine Scordakis – Planning & Reporting
Terrie Williams – Technical Assistance & Training
Bobbie Holm – Program Development
Ruth Jacobs – Corrective Action
Alan Zamansky – Program Review
Daryl Spiker – Business & Contractual Services

2. CalOHI Interfaces ADVISORY GROUPS DEPARTMENTS LOCAL AGENCIES U.S. DHHS
CALIFORNIA
OFFICE OF
HIPAA IMPLEMENTATION
CALIFORNIA
LEGISLATURE
STATEWIDE WORKGROUP
The work of CalOHI is on a different dimension than that of operating departments. CalOHI is responsible for planning, policy articulation, education, monitoring, tracking, evaluation, and reporting HIPAA implementation as a whole. Successful implementation requires close coordination and communication between CalOHI and many key groups such as:
U.S. HHS
California Legislature
Local Agencies
Control Agencies
Departments
CONTROL AGENCIES
SUB-WORKGROUPS
The Advisory Group
The Statewide Workgroup
Sub workgroups

3. Statewide Workgroup
Proposed

4. Preemption under HIPAA
Why necessary
What CalOHI is doing
Next steps
Possible exception determinations (waivers)
Some state laws may have to be changed or modified
Generally, HIPAA preempts state law, except that in the Privacy area, more stringent state law preempts HIPAA. So, need to determine what to follow in each case. Different results – 50 states. Tough on multi-state business.
We are analyzing major statewide laws – IPA & Confidentiality of Medical Info Act, and are asking all covered entities to analyze their program specific statutes. We will review these when they come back & discuss these.
Based on these reviews, we will map out what Calif. Has to follow.
Then we need to decide where to ask for waivers. These will have to be requested by the Governor.
Also, we may need to change some state statutes – California Constitution, Sec. 3.5 of Article III.
Complicates the waiver process.

5. Accomplishments & On-Going Activities
SB 456 Activities:
Assessment
Legislative Report
DOF Quarterly Report
Advisory Committee
Web Site
Charter
Policy & Information Memorandums
Preemption Analysis
Enterprise Efforts
MSA
Departmental Liaisons
Phases to HIPAA Compliance
Since October, CalOHI has:
In accordance with SB 456: 1) developed the assessment and sent to 200+ departments, 2) began preparing the leg report, 3) created a quarterly report process for DOF and collected data from departments who have HIPAA funding, 4) organized an Advisory committee which will have its first meeting April 26th. The group is composed of 53 members representing…, 5) began the research and development to initiate a web site.
CalOHI has developed a charter which outlines … (handout)
Developed policy & information memorandums and shared them with impacted departments and members of the statewide workgroup.Our staff counsel has been working with other departments and corresponding with the federal government about preemption and HIPAA law.
CalOHI has been pursuing enterprise efforts among departments to most efficiently tackle HIPAA
A MSA has been established for impacted departments to use to contract with HIPAA vendors; near finalization…
CalOHI staff have been assigned to departments…
Also, CalOHI has developed its own taxonomy, per se, to measure steps to compliance with HIPAA (handout)

6. What the assessment is telling us…
24 impacted departments
53 programs
10 Covered Entities
6 Health Care Providers
8 Health Care Plans
1 Health Care Clearinghouse
12 Business Associates
13 Trading Partners
6 Hybrid Entities
20 Impacted by Data
Content
Sent out approximately 280 assessments to state entities and interested parties. Of those, 209 were to state entities that may be impacted by HIPAA.
To date, we have received 162 back, 78% return rate.
We have validated data for those departments that indicated HIPAA impact and met with Departments as necessary.
Shows 12 covered entities, for example
There are 6 Business Associates that are not Covered Entities. For example, SCO, Insurance, Inspector General for VA, California Medical Assistance Commission, Dept. of Social Services, HHSDC
Departments are at different stages of assessment. DHS started early. Very few know the cost of remediation.
What does all this mean…?

7. 18 programs impacted in 46 categories
For Example…
18 programs impacted in 46 categories
Health Services
18 impacted programs
(including Medi-Cal)
10 covered entities
1 provider
10 health plans
4 business associates
3 trading partners
18 data content
Approximately 151 impacted
IT systems
DHS represents about 33% of state impacted entities

8. What the assessment is telling us…
24 Departments impacted in over 100 ways
Unexpected impacted departments include Forestry
and YACA
Most departments recently identified as impacted
are at the awareness stage, and therefore, we do
not have much cost information from them
See Bobbie’s talking points

9. Next Steps Develop Statewide Project Plan with Departments
Identify Risks / Contingencies with Departments
Identify Best Practices & Strategies
Continue to Pursue Enterprise Efforts
Continued Presence at National Level