1. Final HIPAA-HITECH Rules, Cybersecurity, and Privacy Dino TsibourisMehmet Munur (614)360-3133(614) 360-3101 Dino@Tsibouris.comDino@Tsibouris.com Mehmet.Munur@Tsibouris.comMehmet.Munur@Tsibouris.com

2. Outline 1.Final HIPAA-HITECH Regulations 2.Breach Notification 3.Business Associate Agreements 4.Cybersecurity Developments 5.Other Privacy Developments 6.Questions

3. Why Comply? CVS $2.25 million fine Cignet Health $4.3 million fine BCBS of Tennessee $1.5 million fine Alaska DHHS $1.7 million fine Hospice of Northern Idaho $50,000 fine HHS investigated and resolved 19,306 cases

4. Final HIPAA-HITECH Rules Changes to Breach analysis and notification Changes to definition of Business Associates Security and Privacy Rule applicable directly to BAs Changes to Business Associate Agreements Changes to Privacy Notices Changes to restrictions on sale of PHI Changes to marketing rules

5. Business Associate Agreements BAs must enter into BAAs with sub-BAs Requires compliance with Privacy Rule Requires compliance with Security Rule Requires reporting of Security Incidents CE BAA BA sBA BAA

6. Breach Analysis Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

7. Breach Analysis Old Analysis: – Notify only if significant risk of financial, reputation, or other harm New Analysis: – Presume that there is a breach unless you can establish that there is a low probability of compromise of PHI

8. Key Dates Rules effective March 26, 2013 Compliance Required by September 23, 2013 Updated Business Associate Agreements by September 22, 2014

9. Recommendations Revise Notices and Agreements Revise Breach Analyses, Policies, Procedures Conduct Risk Assessment Have policy and team in place, practice Disclose Security Incidents and Breaches Consider Insurance

10. Cybersecurity Developments Cybersecurity Executive Order Cyber Intelligence Sharing and Protection Act enactment Electronic Communications Privacy Act amendments National Security Letters lawsuits

11. Other Privacy Developments EU Data Protection Regulation – Global Application – Large Fines – Individual Protections – Affects Cloud Service Providers Social Media Password Laws – Arkansas, California, Delaware, Illinois, Maryland, Michigan, New Mexico, New Jersey, and Utah

12. Conclusion 1.Final HIPAA-HITECH Regulations 2.Breach Notification 3.Business Associate Agreements 4.Cybersecurity Developments 5.Other Privacy Developments 6.Questions

13. Questions Dino TsibourisMehmet Munur (614)360-3133(614) 360-3101 Dino@Tsibouris.comDino@Tsibouris.com Mehmet.Munur@Tsibouris.comMehmet.Munur@Tsibouris.com