HIPAA Compliance Date Is Approaching

Final HIPAA Compliance Date For
Providers Is Fast Approaching
Robert W. Patterson
Lauren A. Fish
Jaeckle Fleischmann & Mugel, LLP
Avant Building – Suite 900
200 Delaware Avenue
Buffalo, NY 14202-2107
Tel: 716.856.0600September 7, 2013

HIPAA Privacy and Security in a Nutshell
Covered entities (CEs) (health care providers,
health plans & “clearinghouses”) must:
 protect privacy and security of protected
health information (PHI)
 provide access to PHI to individuals
 include protective provisions in contracts with
business associates (BAs)
2

A Quick History Lesson
1996 HIPAA enacted
2000-02 First HIPAA final rules
2003 Effective date of first HIPPA rules
2009 HITECH (part of ARRA)
2009-12 Proposed HITECH rules
Jan. 2013 “Omnibus final rule” eff. 3/2013
9/23/2013 Final compliance date
3

Enforcement and Penalties
 Increased monetary penalties
 “Tiers” with mandatory minimum/maximum
penalties based on culpability
 Mandatory OCR investigation if preliminary
investigation indicates possible violation
 Mandatory penalty if willful neglect
 Increased audit activity
4

Recent Settlements and Penalties
 Affinity Health Plan - $1.2 million settlement
 Prime Healthcare - $275,000
 Mass. Eye and Ear - $1.5 million
 Mass. Pathology Group - $140,000
 Hospice of Northern Idaho - $50,000
and
 Phoenix Cardiac Surgery - $100,000
5

Breach Notifications
 General rule: CE must notify affected
individuals and HHS of a breach of
unsecured PHI
 Original rule: Notice not required if no risk of
harm to the individual
 Omnibus rule: Breach is assumed if risk of
compromise of PHI
 Must perform risk analysis
6

Business Associates
 Provides services that involve use or
disclosure of PHI
 Billing, utilization review, claims processing, etc.
 Provider must have all BAs under contract
 HITECH changes
 Makes BAs directly subject to HIPAA
 Downstream contractors are BAs (of the 1st BA)
 Change to BA definition (HIEs, HIOs)
7

Business Associates (continued)
 BA changes increase provider’s duties
 BA must notify HHS of breach, etc.
 Provider must ensure that 1st BA is complying
 “Chain of trust” includes downstream vendors
 Provider due diligence
 BA Privacy & Security Questionnaires
 Examine all vendor relationships to see to BA
relationship exists
8

Marketing
 Pre-2013 — Promotions could be sent to
patients as long as considered “treatment”
 Omnibus rule — Need patient authorization
for paid promotional communications
 Exceptions
 Refill reminders (if remuneration is reasonable)
 Face to face communications
 NPP must state that patient authorization is
required for disclosures of PHI for marketing
9

Fundraising
 Patient right to opt out
 “800” number not required (but encouraged)
 Broader range of info can be used
 Outcome info, specific physician or dept.
 Can’t condition treatment on authorization
 NPP must inform patients that they may be
contacted for fundraising purposes and right
to opt out
10

Notice of Privacy Practices (NPP)
 Every provider and CE must have an NPP
and make it available to patients
 New requirements under HITECH and
omnibus rule
 Marketing communications and “sale” uses and
need for authorization
 Fundraising and opt-out rights
 Right to restrict re “self-pay” services
 Right to be notified of a breach
11

12
Other Changes in Omnibus Rule
 Patient right to restrict disclosure of “self-pay”
services
 May need “flags” or holds in billing system
 Patients can request other restrictions but
not mandatory as this
 Patient access to PHI in electronic form
 E.g. MS Word/Excel document or .pdf
 Note 30 day (+ one 30 day extension) deadline

Other Changes in Omnibus Rule (continued)
 Written authorization to disclose proof of
immunization to a school no longer required
 Oral authorization permitted, but must be documented
 Family member access to deceased patient’s
PHI
 If involved in care or treatment
 Unless patient restricted before death
 Confirms that copier, fax, etc. info can be PHI
that must be appropriately secured, including
when traded in, sold or disposed of.
13

What Providers Should Do
 Assessment of HIPAA compliance policies
and procedures
 Mobile devices, cloud computing
 Disposal of equipment
 Evaluation of BAs and Subcontractors
 Assess BA relationships
 Modify BA agreements
14

What Providers Should Do (continued)
 Update and post NPP
 Mobile devices, cloud computing
 Disposal of equipment
 Evaluation of potential “marketing” or “sale of
PHI” arrangements
 Be aware of New York rules
15

HIPAA Compliance Date Is Approaching

More Related Content

What's hot (19)

Similar to HIPAA Compliance Date Is Approaching (20)

Recently uploaded (20)

HIPAA Compliance Date Is Approaching

Editor's Notes