1. From HIPAA to IFHIMA Nationwide & Worldwide Privacy & Security Initiatives
Northern Indiana Health Information Management Association
March 29, 2019
Dorinda Sattler, MJ, RHIA, CHPS, CPHRM
Clinical Assistant Professor/HIT Program Director
Owner/Consultant – Sattler Healthcare Consulting, Inc.

2. The good ole days… There was a patchwork of privacy laws.
From HIPAA to IFHIMA
March 29, 2019
The good ole days…
There was a patchwork of privacy laws.
Health Insurance Portability and Accountability Act enacted 1996
compliance with Privacy Rule required by
compliance with Security Rule by
Initially, little enforcement “teeth”.

3. HIPAA Gets Tough Omnibus final rule 1.25.2013
From HIPAA to IFHIMA
March 29, 2019
HIPAA Gets Tough
Omnibus final rule
implemented HITECH Act changes and GINA changes to HIPAA.
Strengthened HIPAA’s Privacy and Security protections
Extended applicability of certain provisions to BAs
Established breach notification requirements
Required periodic audits by HHS.
Compliance by
OCR charged with oversight and enforcement of HIPAA Privacy and Security Rules

4. From HIPAA to IFHIMA
March 29, 2019
Breach notification
With HITECH’s breach notification requirement implemented into HIPAA, CEs and BAs are now having to notify the OCR about breaches of PHI or ePHI.
The notifications become triggers for future audits.

5. OCR Enforcement Process
From HIPAA to IFHIMA
March 29, 2019
OCR Enforcement Process
Investigates complaints received
Conducts compliance reviews of circumstances brought to its attention
Conducts audits
Provides education and outreach to assist with compliance
May issue subpoenas to compel cooperation with investigations
Enters into resolution agreements, assesses CMPs
Required to submit a report to Congress annually

6. From complaints to audits
From HIPAA to IFHIMA
March 29, 2019
From complaints to audits
Initially OCR was reactionary in determining compliance:
Responded due to complaints received, or
Responded if made aware of situations where compliance was suspect.

7. Phase 1 Audits Proactive audits began in 2011
From HIPAA to IFHIMA
March 29, 2019
Phase 1 Audits
Proactive audits began in 2011
Pilot audits performed
Audit findings analyzed and the pilot audit program was evaluated throughout 2013
Planning activities for next phase

8. Phase 2 Audits Full implementation 2016
From HIPAA to IFHIMA
March 29, 2019
Phase 2 Audits
Full implementation 2016
CEs and BAs chosen for audit based on history of complaints and self-reported breaches
Desk audits begin for randomly chosen CEs and BAs.
Focus is on key non-compliance areas identified in Phase I. Also includes areas related to security

9. Phase 2 Audit Results (so far)
From HIPAA to IFHIMA
March 29, 2019
Phase 2 Audit Results (so far)
Desk audits completed 2017
166 covered entities
41 business associates
Failure to implement effective risk analysis and RM strategies per the Security Rule
Failure to adequately safeguard PHI and ensure individual access to PHI
Incomplete NPPs
Aggregate findings to be published 2019!

10. Totality of all enforcement actions =
From HIPAA to IFHIMA
March 29, 2019
Totality of all enforcement actions =

11. OCR Stats as of 12.31.18* Complaints received: 197,049+
From HIPAA to IFHIMA
March 29, 2019
OCR Stats as of *
Complaints received: 197,049+
Compliance reviews initiated: 924
Cases resolved: 192,350
26,558 cases resolved by requiring changes in privacy practices
62 cases resulted in CMPs or settlements totaling $96,581,582.00
11,653 cases: No violation found *

12. OCR Stats as of 12.31.18* (continued)
From HIPAA to IFHIMA
March 29, 2019
OCR Stats as of * (continued)
Of the 197,049+ complaints:
122,019 were not eligible for enforcement
OCR lacked jurisdiction (entity not a CE or BA)
Untimely complaint or complaint withdrawn
Activity described did not violate HIPAA (permitted privacy disclosures) *

13. OCR Stats as of 12.31.18* (continued)
From HIPAA to IFHIMA
March 29, 2019
OCR Stats as of * (continued)
Issues investigated most:
Impermissible uses and disclosures
Lack of safeguards of PHI
Lack of patient access to their PHI
Lack of administrative safeguards for ePHI
Use or disclosure of more than the minimum necessary PHI *

14. OCR Stats as of 12.31.18* (continued)
From HIPAA to IFHIMA
March 29, 2019
OCR Stats as of * (continued)
Most common types of CEs required
to take corrective action:
General Hospitals
Private Practices and Physicians
Outpatient Facilities
Pharmacies
Health Plans (group health plans and health insurance issuers) *

15. In the in 2018 Jan. - Filefax, Inc. $100,000
From HIPAA to IFHIMA
March 29, 2019
In the in 2018
Jan. - Filefax, Inc $100,000
Jan. - Fresenius Medical Care $3,500,000
Jun. - MD Anderson Ca. Center* $4,300,000
Sep. - Boston Medical Center, with
Brigham and Women’s Hospital, and
Massachusetts General Hospital $999,000
*Judgment, whereas others were settlements

16. In the in 2018 (still!) Oct. – Allergy Assoc. of Hartford $125,000
From HIPAA to IFHIMA
March 29, 2019
In the in 2018 (still!)
Oct. – Allergy Assoc. of Hartford $125,000
Oct. – Anthem, Inc $16,000,000
Nov. – Pagosa Springs $111,400
Dec. – Cottage Health $3,000,000
Total (Settlements and Judgments) $28,683,400

17. Onward and upward OCR Outreach Efforts Print materials Website
From HIPAA to IFHIMA
March 29, 2019
Onward and upward
OCR Outreach Efforts
Print materials
Website
On-line provider education training
Raise awareness of individuals’ rights

18. From HIPAA to IFHIMA
March 29, 2019
So we can relax, right?

19. From HIPAA to IFHIMA
March 29, 2019

20. HIPAA is not the only king!
From HIPAA to IFHIMA
March 29, 2019
LOL, nope.
OCR finalizing a permanent audit plan and protocols
Enforcement activities show no sign of slowing down
HIPAA is not the only king!
California and other state data privacy laws
GDPR
Possible US-like GDPR?
Which brings me to...

21. From HIPAA to IFHIMA
March 29, 2019
IFHIMA
International Federation of Health Information Management Associations
Member nations: 23 as of representing 7 global regions
Congress held every three years
Work relative to HIM includes:
ICD, EHR, HIM Education, IG and of course, Privacy!

22. IFHIMA Privacy Workgroup
From HIPAA to IFHIMA
March 29, 2019
IFHIMA Privacy Workgroup
Currently writing privacy whitepaper
Global perspective, HIM highlight
Case studies from some member nations
US, India, Australia, Qatar, and S. Korea
White paper to be published and presented to IFHIMA Congress in Dubai November 2019
Privacy panel anticipated

23. From HIPAA to IFHIMA
March 29, 2019

24. From HIPAA to IFHIMA
March 29, 2019
References
IFHIMA