Post on 21-May-2020
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 1
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
®
Risk Assessment & HITECH: A 360°View from the Trenches
IAPP Global Privacy Summit 2011
March 10, 2011
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 2
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Ozzie FonsecaExperian® Data Breach Resolution
� Certified Information Privacy Professional (CIPP).
� Serviced over 2,300 data loss incidents including the
deployment large scale breach notification programs,
incident response call centers, and state-of-the-art
credit monitoring and fraud resolution services.
� Spent several years in the call center industry
specializing in implementing breach response
programs from a customer service perspective.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 3
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
AgendaWelcome!
� Introductions
� Overview of Key HITECH Provisions
� Business Associate Considerations & Lessons Learned
� Marketing Considerations & Lessons Learned
� Risk Assessment Best Practices
� Electronic Access Compliance Best Practices
� Q&A
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 4
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
M. Peter Adler, CIPP, CISSPSRA International
� Chief Privacy and Cybersecurity Legal Compliance
Officer at SRA International.
� Advises on compliance with legal requirements
related to privacy and cyber security, including
fulfilling customer privacy and security contractual
requirements.
� Leads the establishment and implementation of
corporate policies and standards for data privacy and
network security.
� Extensive experience in state, national and
international information security and privacy law and
is the former Chief Privacy Officer at United Health
Group.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 5
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Derek Woo, MCP, CNE
Sinaiko Healthcare Consulting
� Managing director, Revenue Cycle and Healthcare
Informatics Services at Sinaiko Healthcare
Consulting.
� Directs all aspects of the firm's Health Information
Technology and Information Security practice.
� Depth of experience in technology, healthcare
operational processes and government organizations.
� Served as information security advisor to U.S. Sen.
Edward Kennedy's office on a proposed rulemaking
panel for the Health Insurance Portability and
Accountability Act (HIPAA).
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 6
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
� Access to Certain Information In Electronic Format. An individual has a right to obtain from the covered entity a copy of his or her information in an electronic format.
� Restrictions on Disclosures for Paid-For Medical Costs. Individuals will have the right to prohibit the disclosure of protected health information (PHI) to a health plan for items or services that the individual paid for in full out-of-pocket.
� Increased Accounting of Certain PHI Disclosures. Required if covered entity (CE) uses an EHR. CEs must provide accounting for disclosure of PHI to carry a treatment, payment, and healthcare operations when the PHI is in an EHR.
� Amended Marketing Rules. Limits the healthcare operations exception for communications when the CE receives remuneration for the communication except in limited circumstances.
� Opportunity to Opt-Out of Fundraising.
HITECH: Overview of Key Provisions
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 7
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
� Enhanced Business Associate Provisions. Clarifies and expands definition of “business associate” (BA) and increases BA legal obligations and compliance requirements.
� Notification for breaches involving PHI.
� Restrictions on sales of EHRs or PHI. CEs and BAs may not sell PHI and EHRs, except in limited circumstances, unless the individual authorizes the sale.
� Special provisions for vendors of personal health records and other non-HIPAA covered entities.
� Enhancement enforcement, funding for enforcement and increased penalties.
� Limited Data Sets and Minimum Necessary.
HITECH: Overview of Key Provisions, continued
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 8
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Enhanced BA Legal Obligations
� Each security and privacy requirement in the
HITECH Act that is applicable to a covered entity is
also applicable to a BA and should be included in a
business associate agreement (BAA).
� A BA must comply with administrative, technical, and
physical safeguards under the security rule.
� This includes the documentation requirements of the
security rule (policies, procedures and other
documents.
� BAs that violate the security and privacy provisions
are subject to the HIPAA civil and criminal penalties.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 9
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Clarification and Expansion of “Business Associate” Definition
� Definition of “business associate” includes:
� entities that provide data transmission services to a covered entity (or its business
associate) if the service involves access to PHI on a routine basis, including:
� a health information exchange organization;
� a regional health information organization;
� an E-prescribing Gateway; or
� any vendor that contracts with the covered entity to allow the covered entity to
offer a personal health record (PHR) to patients.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 10
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
View from the Trenches: Top 5 HITECH Business Associate Risks to Assess
1. Has a BA compliance plan been prepared and
approved?
2. Are BAAs effectively managed within the
organization?
3. Are all of the HITECH terms being included in
your BAAs?
4. Are you or others correctly designated as BA?
5. Should you monitor BA compliance?
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 11
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Marketing Rule: Prior to HITECH Amendments
� Use or disclosure of PHI for marketing requires individual authorization, except:
� Face-to-face communications; and
� Promotional gifts of nominal value
� Exceptions made for certain types of health care operations communications and
treatment communications and typically do not require authorization.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 12
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
HITECHKey Definition: Financial Remuneration
� The direct or indirect payment from or on
behalf of a third party whose product or service
is being described.
� Elements:
� Direct or indirect payment
� From a third party or on behalf of a third
party
� The third party's product is being
described
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 13
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Unchanged in HITECH AmendmentsKey Definition: Treatment
Treatment Includes:
� the provision, coordination, or management of health care and related services by
health care providers;
� including the coordination or management of health care by a health care provider
with a third party;
� consultation between health care providers relating to a patient; or
� the referral of a patient for health care from one health care provider to another.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 14
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
HITECH Key Definition: Marketing
� Subject to exceptions, “marketing” is defined to mean:
� To make a communication about a product or service that encourages recipients
of the communication to purchase or use the product or service.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 15
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Not Marketing: Marketing Exceptions
� For treatment of an individual by a health care provider
� Health care providers may receive remuneration in exchange for making a
treatment communication about a health related product or service, but certain
requirements must be met (discussed later).
� Refill reminders or communications about a currently prescribed drug/biologic and
the (financial remuneration is reasonable).
� For unremunerated health care operations communications described on the
following page…
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 16
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Health Care Operations Communications
� A marketing exception applies exists if there is no financial remuneration to the CE
for the communication and the communication:
(1) Describes health-related products or services (or payments for those products
or services) that are provided by or included in a plan of benefits. This includes
communications:
� Describing a provider network or plan network
� For case management or care coordination
� Describing plan enhancements or replacements
� Describing health-related products or services available only to members
that are value-added, not part of the plan of benefits.
(2) Is related to case management or care coordination falling outside of treatment
definition, including the direct or recommend alternative treatments and related
functions (e.g., therapies, health care providers).
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 17
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Marketing
� Marketing includes communication about a product or service, etc.-
� that are not included in the exceptions
� that are otherwise found in the exceptions, but financial remuneration is involved
as follows:
� Amount paid is not reasonably related to the CE’s costs in making the
communications and communication is about refill reminders or currently
prescribed meds; and
� CE receives financial remuneration in exchange for making health care
operation communications
� That are face-to-face and from CE to individual; or are promotional gift of nominal
value provided by the CE
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 18
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Compliance Requirements
� For marketing
– Obtain an authorization for any use or disclosure of PHI for marketing, except if
communication is:
� A face-to-face communication made by a CE to an individual; or
� A promotional gift of nominal value provided by the CE
– Authorization must state when financial remuneration is Involved
• For health care providers receiving remuneration in exchange for making a treatment
communication about a health related product or service
– Must include the use and disclosure in Notice of Privacy Practices and provide
opportunity to opt-out
– Disclose the financial remuneration in communication
� i.e., A statement that covered health care provider is receiving financial
remuneration in exchange for making the communication.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 19
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
View from the Trenches: Top 5 HITECH Marketing Risks to Assess
1. Is your organization a CE or a BA providing
communications to persons involving he use or
disclosure of PHI?
2. Has your organization categorized these
communications as either marketing or not
marketing?
3. Has the organization identified when direct or
indirect remuneration is exchanged for the
communications?
4. Have authorization forms and the notice of
privacy practices been updated to include
instances where financial remuneration is
involved?
5. If remuneration is involved, have you checked
that activities do not involve the sale of PHI?
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 20
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Risk Assessment - Breach
Breach—a few key considerations…
� Health and Human Services has withdrawn the Final Rule for Breach
Notification for Unsecured Protected Health Information for further study (08/10).
� HITECH Act breach notification requirement applies only to the breach of
unsecured PHI.
� If PHI is rendered “unusable, unreadable, or indecipherable” to unauthorized
individuals, it is secure.
� The breach of secure PHI is not subject to the breach notification requirement.
� May not need to act on breach notification requirement if PHI is secure.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 21
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Risk Assessment - Breach
Breach
Acquisition, access, use or disclosure of PHI in a manner not
permitted under the Privacy Rule which compromises the security or
privacy of the PHI
Was the PHI secured,
encrypted or destroyed?
Was the use or disclosure impermissible under the
Privacy Rule, i.e. was the Privacy Rule violated?
NO (It is unsecured PHI)
Was there a significant risk of harm to
the individual (financial, reputational or
other)? (Conduct Risk Assessment to
confirm)
YES
Does one of the
exceptions* apply?YES
BREACHNO
NO
BREACH
YES
NO
NO
YES
Here’s where a solid risk assessment process can help…
� Determine if breach falls into one of the seven exception criteria� Disclosure to the Individual� Disclosure for Treatment, Payment and Health
Care Operations (TPO)� Opportunity to Agree or Object� “Incident to”� Limited Data Set / De-identified Data /
Encrypted� Has Authorization� Public Policy (Legal Requirement, Law
Enforcement, etc.)
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 22
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Risk Assessment - Breach
Hot Tips!
� When entering, save a copy of
(or print screen) your entry.
There is no way to get back to
your entry after you submit it!
� You will not be given a
reference number. If you later
have to enter an addendum to a
previous report, there is no way
to link it to the previous report.
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 23
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Electronic Access – HITECH and EHR
� Stimulus expenditures for development and
adoption of Health Information Technology
(“HIT”)� Medicare and Medicaid reimbursement
systems
� Utilization of an electronic health record
(“EHR”) for each person in the United States
by 2014
� Adoption of EHR is critical to improvements
in quality of care and ultimate cost savings
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 24
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Electronic Access – HITECH and EHR
� “Meaningful Use” of EHR for reporting periods
� Recognition that new types of technology manage and communicate/transmit health information – EMR, PHR, Health Information Exchanges
� Widespread adoption of EHR will not occur unless the public is assured that the privacy of their health information is secured
Data from HIMSS AnalyticsTM Database 2010 HIMSS Analytics
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 25
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Electronic Access – HITECH and EHRM
eanin
gfu
l Use—
Ris
k A
ssessm
ent P
rocess Discovery
Assessment
Recommendation
Review
• Longest phase of the Risk Assessment
• Identify Drivers and Objectives
• Evaluate People, Process and Technology
• Understand the ‘Lifecycle’ of Information
• Identify PHI Touch Points
• Analyze and Quantify all Discovery data
• http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrul
e/nist800-30.pdf [NIST 800-30]
• http://www.iso.org/iso/home.htm [ISO 27001]
• Align Gaps and Weaknesses with Drivers and Objectives
• Draft Recommendations to close Gaps and address Weaknesses
• Recommendations should be ranked (severity)
• Recommendations should be phased (short, mid, long-term)
• Draft Recommendations should be reviewed with all
stakeholders—business units, steering committee(s), leadership
• Recommendations are finalized, approved and carried out
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 26
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Electronic Access – HITECH and EHR
� “Administrative, Technical and Physical”…not just IT Security
� “Anticipated Threats and Hazards”…duty to be informed
� C, I and A (Confidentiality, Integrity and Availability)
� Risk Assessment
� Access Management
� Network Security (transmission…encryption)
� Intrusion Detection (both network and host)
� Malicious code detection
� Incident Management and Response
----------------------New! (for HITECH)
� Business Associates are now required to comply with Privacy and Security Standards
� Enhanced Breach Notification and Response
� Individual’s Rights & Restriction on Disclosures by Providers
� Enhanced Accounting of Disclosure Requirements—6 yrs. (No TPO) vs. 3 yrs. (TPO)
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 27
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Electronic Access – HITECH and EHR
Commonality Matrix
To update your contact information:
Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.
Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.
Ozzie Fonseca| 949-567-3851 | Ozzie.Fonseca@Experian.com 28
Welcome to the Experian Master PowerPoint Template.
The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.
Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.
Thank You…Questions & Answers
Ozzie FonsecaDirectorExperian® Data Breach Resolution
949.567.3851Ozzie.Fonseca@Experian.comwww.Experian.com/DataBreach
For complimentary educational resources, please visit: www.Experian.com/DataBreach
Derek WooManaging DirectorSinaiko Healthcare Consulting
M. Peter AdlerChief Privacy and Cybersecurity Legal Compliance OfficerSRM International
510.913.2534Derek.Woo@Sinaiko.comwww.sinaiko.com
703.502.1270Peter_Adler@sra.com