HIPAA Lockdown: One-Hour Guide to PHI Best Practice

• Awesome Content

Supporting material

Supporting material

• Awesome Content

Copyright 2016 – Not to be reproduced without express permission of Benefit Express Services, LLC 1

Sample Topic

Sample image

HIPAA Lockdown: One Hour Guide to PHI

Best PracticeLarry Grudzien

Attorney at Law


About Larry

Larry GrudzienERISA Attorney

Lawrence (Larry) Grudzien, JD, LLM is an attorney practicing exclusively in the field of employee benefits. He has experience in dealing with qualified plans, health and welfare, fringe benefits and executive compensation areas. He has more than 35 years’ experience in employee benefit law.

Mr. Grudzien was also an adjunct faculty member of John Marshall Law School’s LL.M. program in Employee Benefits and at the Valparaiso University’s School of Law. Mr. Grudzien has a B.A. degree in history and political science from Indiana University, J.D. degree from Valparaiso University School of Law and LL.M. degree in tax from Boston University School of Law. He is a member of Indiana and Illinois Bars.

• “Health plans are required to protect and safeguard a participant’s or covered dependent’s personal health information (PHI) from impermissible use or disclosure and they must obtain a patient’s content for certain uses and disclosures.

• What is required to protect information?

• What information is protected?

• What steps must a health plan and the employer do to comply?


General Requirements

Health plans must:

• Establish written policies and procedures to protect PHI.

• Protect and safeguard a participant’s or covered dependent’s personal health information (PHI).

• Obtain participant’s or covered dependent’s written permission for certain uses of PHI.

• Notify a participant and/or covered participant of policies of disclosure and use of PHI.

• Report impermissible use or disclosure of PHI.

• Allow a participant and/or covered dependent to inspect or copy his or her PHI.

• Use and disclose only the “minimum necessary” health information.

• Enter into Business Associate Agreements.


What is Required?

• All medical records and other individually identifiable health information held or disclosed by a health plans in any form, whether communicated electronically, on paper or orally.

• Health plans may release PHI to employers without authorization in very limited circumstances.

• Three conditions must be met:

Provider must provide service at the request of employer or as an employee

Service provided must relate to medical surveillance of workplace or an evaluation to determine individual has workplace injuries or illness

Employer must have legal requirement under state or federal law to keep records


What is “Protected Health Information” (PHI)?

• Group health plans do not need to obtain a participant’s or a covered dependents consent to release information for the administration of the plan.

• Plan sponsor’s obligation depends on whether it receives protected health information, summary health information or no health information.

• Obligations, if it receives only summary health information

• Required plan amendments

• Obligations, if it receives protected health information


What are the Plan Sponsor’s obligations?

• HIPAA Privacy Policy

• HIPAA Privacy Use and Disclosures

• Notice of Privacy Practices

• Business Associate Contracts

• Authorization for Release of Information

• Amendment to Health Plan Document

• Amendment to Health Plan SPD

• Plan Sponsor Certification to Health Plan


What documents are needed to comply?

Documents for Implementing individual Rights:

• Request to inspect or copy PHI

• Request to amend or correct PHI

• Request for Accounting of Disclosures of PHI

• Request for restrictions on Use or Disclosure of PHI


What documents are needed to comply?

Health plans are allowed to use or disclose PHI in the following circumstances:

• as required in accordance with an individual’s right to access PHI

• for covered functions (i.e., treatment, payment, or health care operations)

• with respect to specific types of information after the opportunity to agree or object

• pursuant to an individual’s authorization

• as required or permitted under HIPAA’s public policy exceptions and a limited data set may be disclosed when certain requirements are met


Consent Issues

A health plan may use and disclose PHI without authorization:

• For its own treatment, payment, and health care operations

• For the treatment activities of another health care provider

• To another covered entity for the payment activities of the entity receiving the information

• To another covered entity for certain health care operations activities of the entity that receives the information if each entity has (or had) a relationship with the individual who is the subject of the PHI, the PHI pertains to such relationship, and the purpose of the disclosure is one of those listed in the regulations


For treatment, payment, and health care operations

The health plan may use and disclose PHI if individual has had opportunity to, prohibit the disclosure of such information in advance regarding to:

• Disclosures of limited types of information to family members or close personal friends of the individual for care, payment for care, notification, and disaster relief purposes

• Uses and disclosures of limited types of information for facility directory purposes (generally not applicable to health plans)

• Exceptions

Individual authorizations are required whenever the use or disclosure is not permitted under privacy rules. May request authorization for another entity for:

• Any purpose

• Especially before sending any marketing material


Authorizations

Health plans may disclose PHI without authorization:

• If required by law

• To certain designated public agencies, individuals and the employer

• Regarding an individual if a victim of designated abuse and certain other conditions are met

• To a health oversight agency

• In response to certain court proceedings

• To a law enforcement officials if certain conditions are met

• To a coroner or medical examiner of ID purposes

• To organ procurement organizations for transplant purposes

• To prevent health threat

• For certain specified government purposes

• To comply with Worker‘s Compensation purposes


Without Individual Authorization

For health plan underwriting

• Underwriting and placement of health coverage is a permissive health coverage operations

• Sharing PHI with other covered entities for other purposes limited

• Authorizations may be necessary in some situations

Personal representatives, minors, and spouses

• Covered entities must recognize a personal representative’s authority and provide information within that authority

• But certain exceptions do apply

• Parent’s authority

• Spouse’s authority


Permitted Uses

What is Required?

Health plans must establish policies and procedures with respect to PHI that complies with:

• HIPAA standards

• Implementation specifications

• Other requirements


Privacy Policy and Procedures

• Who is required to provide notices?

Covered entities (Health Plan)

• What must the notices describe?

Uses and disclosures of PHI that may be made by the covered entity

Individual’s rights

Health plan’s legal duties with respect to PHI

• What are a health plan’s duties?

Must provide own privacy notices if it has access to PHI

A health plan may arrange to have another entity to provide notice, but will be responsible if no notice is provided


Privacy Notices

• A health plan must designate a privacy official.

• The privacy official is responsible for the development and implementation of policies and procedures.

• A privacy officer must be designated for each subsidiary that is a covered entity.

A single corporate officer could be designated for multiple subsidiaries.

• Covered entities must designate a contact person or office for receiving complaints.

Such designation must be documented.

Contact person must be able to provide additional information about matters that are covered in privacy notice.


Privacy Official and Contact Person

• Apply to the electronic storage and transmission of PHI

• General effective date - April 21, 2006

• Covered entities must implement appropriate administrative, technical and physical safeguards for PHI

• Privacy rules require “appropriate safeguards” for protecting PHI

• No guidelines for PHI in oral, written or non-electronic form

• What information must be protected?

Any information transmitted by electronic media, maintained in electronic media or maintained in other form or medium

What is electronic media?

• Certain transmissions are not covered


Health care security requirements

• What are the four general security requirements?

• Ensure the confidentiality, integrity and availability of all electronic PHI that the covered entity creates, receives, maintains or transmits

• Protect against any reasonably anticipated threats or hazards to the security or integrity of such information

• Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required

• Ensure compliance by the workforce


Health care security requirements

What are the security standards?

• Administrative safeguards

• Physical safeguards

• Technical safeguards

Covered entities must:

• Use reasonable and appropriate measures to accomplish the requirements

• Engage in risk analysis to determine how to comply


Health Care Security Requirements

• All covered entities must standardize the format and content of all electronic transactions when engaging in “covered transactions.”

• These are called the EDI Standards.

• What are the EDI Standards requirements?

• Covered entities in conducting covered transactions must use standardized formats and content, as well as uniform codes in communicating with other entities.

• Only those entities who conduct ”standard transactions” electronically or engage others to do so are subject to EDI standards.

• Health plans are considered to be covered entities and must comply with the EDI Standards, along with the additional requirements.


Electronic Transaction Requirements

What are “covered transactions”?

• Health claims and equivalent encounter information

• Health care payment and remittance advice

• Coordination of benefits

• Health claim status

• Enrollment and disenrollment in a health plan

• Eligibility for a health plan

• Health plan premium payments

• Referral certification and authorization

• First report of injury

• Health claims attachments



• What transactions and transmissions are covered?

Is the entity conducting the transaction a covered entity (or its business associate)?

Does the transaction fall within the definition of one of the covered transactions?

• Covered entities must comply with the EDI Standards in certain stated transactions.

• Transactions within a covered entity are subject to the EDI Standards.



EDI Requirements

• Applies to transactions transmitted using electronic media

• Does not apply to any transactions conducted in paper or over the telephone

• Does not apply to noncovered entities

• Does not apply to group health plans with under 50 participants

• Does not apply to health plan sponsors because they are not covered entities



A group health plan may not share PHI with plan sponsor except for disclosure of:

• De-identified information

• Group health plan enrollment and disenrollment information

• Limited summary health information for insurance placement and settlor function

• PHI to plan sponsor personnel involved in plan administration when certain requirements are met

• Pursuant to authorization


Final Thoughts: Sharing PHI with Plan Sponsor

• Health plans can not provide access to PHI to plan sponsors without certain plan provisions and safeguards.

• Disclosure must be for “plan administrative functions.”

• Health care providers and health plans may use and disclose PHI with an individual’s “authorization” for any purpose provided in the authorization.

• These functions include:

Plan must not condition treatment or payment on receipt of an authorization

In some circumstances, an employer may condition employment on receipt of authorization

Authorization may be required to obtain PHI for purposes of FMLA or ADA

An authorization may be required for an employer to assist employee with a claim

An authorization may be required for an employer to receive reports from EAP


Certain Employer Functions Require Authorization

HIPAA includes numerous exceptions to broad use and disclosure rules.

Common employer practices that fall under these exceptions:

• State/Federal disclosure requirements

• Workers’ compensation

• Health information contained in employment record


Exceptions for some common employer practices

• Change office behavior

• Shred pertinent documents- do not simply discard them.

• Prohibit staff from accessing a participant’s medical records to learn a neighbor’s birthday or to satisfy a similar form of curiosity.

• Do not leave messages about a participant’s health on an answering machine or with someone other than the patient or doctor.

• Avoid discussions about a participant’s claims in elevators, cafeteria or other public places.

• Avoid paging participant’s using identifiable information.

• Do not fax information without knowing that the persons to whom the fax is addressed is ready to receive it.

• Do not allow faxes to sit on an office machine where unauthorized people may see them.


Special Concerns

HIPAA Security Breaches

American Recovery and Reinvestment Act of 2009 (ARRA) modified HIPAA

• Security and privacy rules apply to Business Associates (BAs)

• Created new notification rules for a Privacy breach

Notice to affected individuals.

Notice to Media

Notice to the Department of Health and Human Services (HHS)

• Penalties for non-compliance increased


Overview

• Most security rules now apply to BAs

• Some privacy rules now apply to BAs

• Generally effective February 1, 2010:

Some provisions, such as the breach rules and penalties, can apply earlier

BAs must comply with electronic protected health information (PHI) and breach rules as of September 1, 2009, but do not need security policies and procedures until February, 2010


Security and Privacy Rules Applied to Business Associates

• A breach is:

“The acquisition, access, use or disclosure” of PHI

In a manner not otherwise permitted under the HIPAA privacy rule

“Which compromises the security or privacy” of the PHI

• Regulations do not incorporate the statute’s use of “accesses, maintains, retains, modifies, records, stores, destroys or otherwise holds, uses or discloses” unsecured PHI.

• Compromises PHI is defined as a breach that poses “a significant risk of financial, reputational, or other harm.”

BAs can make a judgment call about how significant a threat is.

• If not significant, there is no breach and reporting is not required.

Risk assessment should be done and documented so it can be demonstrated why a breach notice was not needed.


Breach Defined

During an evaluation consider:

• Who impermissibly used PHI or to whom information was impermissibly disclosed

• The nature of the PHI that was disclosed

For example:

• If the name of an individual and plan participation are disclosed there could be a privacy breach, but there may be no harm.

• If the types of treatment or other sensitive information (social security number, account number, etc.) are revealed then there is a higher likelihood of harm.

Many types of health details are sensitive these days given the risk of employment discrimination.


Breach Defined

• Effective for breaches occurring 30 days on or after publication in the Federal Register.

• HHS will use its enforcement discretion and not impose penalties until February 22, 2010.

No guidance on whether penalties could relate to actions taken between September 23, 2009 and February 21, 2010.

• HHS does not have the authority to penalize BAs until February 18, 2010.

This will not negate any potential exposure from breach of contract or negligence.


Breach Defined

• Secured PHI

• Unintentional acquisition, access or use by individual acting under authority of BA

• Inadvertent disclosure from one covered entity to another covered entity

• Unauthorized disclosure where the unauthorized individual would not reasonably have been able to retain the information


Exceptions to Breach

Secured PHI

• PHI that is held in a manner deemed to be “secure.”

Electronic data protected by specified encryption technology

Paper or film records shredded or destroyed

Electronic media purged in accordance with specific standards.

Unsecured PHI

• PHI that is not rendered unusable, unreadable or indecipherable to unauthorized individuals through technology or methodology approved by HHS.

PHI in any form is covered (oral and written-both paper and electronic.)

Access controls, firewalls, etc. do not make data secured.

Redaction of paper documents does not make them secured.


Exceptions to Breach - #1. Secured PHI

Safe harbor

• For data:

In motion (moving through a network)

At rest (in a database or flash drive)

In use (in process of being created, retrieved, updated or deleted)

Disposed (both discarded paper records and recycled electronic media)


Exceptions to Breach - #1. Secured PHI

The unintentional acquisition, access or use of PHI by a workforce member or person acting under the authority of the plan or BA if acquisition, access or use is in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA privacy rule

• Workforce member – includes employees, volunteers and others under the control of the plan

• BA can be acting under the authority of the plan

• Example:

An employee who is responsible for billing receives an email which contains PHI about a plan participant from another employee. The email was accidentally sent. The billing employee opens the email, notices she is not the intended recipient, alerts the employee who sent the email and then deletes the email.


Exceptions to Breach - #2. Unintentional Acquisition

Inadvertent disclosure by a person who is authorized to access PHI at a plan or BA to another person authorized to access PHI at the same plan or BA, if the PHI received is not further used or disclosed in a manner violating 45 CFR §164 Part E.

Example:

• A member of an appeals committee shares a participant’s PHI with another committee member. Member 1 thought the participant had appealed a claim, however it was actually a different participant’s appeal. Member 2 does not disclose or use the PHI.


Exceptions to Breach - #3. Disclosure to Another Covered Entity

• Disclosure of PHI where a plan or BA has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain the PHI.

• Appears to apply to both physical (e.g., actual paper record) retention and mental retention.

• Example:

A plan mails a number of EOBs to the wrong individual. The EOBs are returned by the post office as undeliverable. They are unopened.


Exceptions to Breach - #4. Unauthorized Disclosure, Not Retained

Plan and BA must determine:

• whether there was an impermissible use or disclosure of PHI under the Subpart E

• whether the impermissible use or disclosure compromises the security or privacy of the PHI and document such findings

• if an exception applies


Identification of Breach

When a breach is discovered:

• BA should report the data to the plan within the timeframe allowed by their agreement

Do not need to report the breach to the affected individuals, unless the contract specifies

• Plan must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed as a result of the breach

• Plan may need to notify the media

• Plan must notify HHS


Notification Rules

Discovery of a breach

• First day on which the breach is known or should reasonably have been known by a covered entity or BA if they had exercised reasonable diligence

• Plan and BA deemed to have knowledge of workforce members and any agents

Agent status determined using federal common law agency rules

• BA is often an agent of the plan

• Broad reach

• If breaching employee never tells anyone of a breach, the breach occurred but cannot be discovered and therefore there is no reporting obligation


Notification Rules

Business Associate notification to plan

• Must notify plan after it discovers a breach of unsecured PHI

Same rules as for covered entities in determining when a breach is discovered

• BA must provide notice to plan without unreasonable delay, but in no event later than 60 days after breach discovered

• BA must provide a list of each individual whose PHI was breached and any other information the plan would need to send out notice to individuals


Notification Rules

Notice to individuals

• The Plan must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired or disclosed as a result of the breach.

If BA discovers breach, must notify plan and should identify each individual who is affected.

• Notification must be made without unreasonable delay and be no later than 60 calendar days after discovery of the breach.

60 days, from date breach first known, is the outside limit and may be unreasonable in some circumstances.

• 60 days begins even if initially unclear whether there was a breach

Burden of proof on covered entity/BA to show timeliness.


Notification Rules


• When direct notice is not possible due to the plan having insufficient or out of date contact information, may notify by substitute form

For less than 10 individuals, it may be written notice, telephone notice or other means

For more than 10 individuals, should be a conspicuous posting on the covered entity’s web site for 90 days or more or a conspicuous notice in a major print or broadcast media

• Toll-free phone number must be included so individuals can learn if unsecured PHI was breached

• Must be on the home page of the website or be a prominent hyperlink

• What constitutes a major print or broadcast media is a facts and circumstances test, which considers the geography of the individuals


Notification Rules


• Notice must include:

Plain language, brief description of what happened including the date of breach and date of breach discovery

Type of unsecured PHI involved (e.g., social security number, full name, address, etc.)

Steps an individual should take to protect himself/herself from potential harm

Brief description of what is being done to remedy and mitigation the effects of the breach

Contact procedures for individuals to ask questions or get additional information

• Must include a toll-free phone number, email address, web site or mailing address


Notification Rules

Media Notice

• Notice must be provided to prominent media outlets in the state or jurisdiction if unsecured PHI of more than 500 residents of the state or jurisdiction is or is reasonably believed to have been accessed, acquired or disclosed during a breach

Assumption that major media is similar to prominent media

Jurisdiction is smaller than a state (e.g., county or city)

Must affect 500 residents of the state or jurisdiction – if the total breach is more, but there are not 500 in a state or jurisdictions, this notice is not required

• This notice is in addition to the individual notice


Notification Rules

HHS Notice

• Notice must be provided to HHS if there is a breach of 500 or more individuals

Notice must be submitted within same timeframe for sending notice to affected individuals

Calculation of individuals is for a total discovered during investigation

• If there was an individual discovery of 400 individual, but upon investigation another 150 are discovered, must notify HHS

• Log must be maintain and submitted annually to HHS for breaches of less than 500 individual

Must be submitted within 60 days of the end of the calendar year

HHS website will provide details on how to submit


Notification Rules

• State notification laws not preempted unless they stand “as an obstacle.”

• Law enforcement delay of notification, verbal notice must be documented and is for a maximum of 30 days, written notice is for the time period specified

• Must train workforce on requirements

• Complaint processes must provide for the ability to include complaints regarding these processes

• Retaliation/waiver/intimidating acts are prohibited

• There are sanctions for failure to comply


Penalties/Enforcement

HHS audits now required

Penalty amounts:

• Minimum $100 if did not know of violation and would not have known even with reasonable diligence – maximum $50K per violation, $1.5M total

• Minimum $1,000 if reasonable cause and not willful neglect –maximum $50K per violation, $1.5M total

• Minimum $10,000 if willful neglect but corrected – maximum $50K per violation, $1.5M total

• Minimum $50,000 if willful neglect and not corrected – maximum $1.5M


Penalties/Enforcement

Compliance Audits

• OCR announced the launch of phase 2 of the audit program in March 2016.

• Here are some things to expect:

• Who may be audited?

OCR intends to audit a wide range of covered entities, and business associates will be added to the list of audit targets, now that OCR has direct enforcement authority over business associates.

OCR’s stated goal is to have a broad sample of audited entities, including each type of covered entity (plans, providers, and clearinghouses), different types of business associates, entities of different sizes, and entities located in various regions throughout the country.

Compliance Audits

What is the structure of the audit program?

Phase 2 will be conducted in three rounds:

• Round 1: The first round will be remote desk audits of covered entities, based on documents and other information received in response to an information request.

• Round 2: The second round will be remote desk audits of business associates, based on documents and other information received in response to an information request. Rounds 1 and 2 are expected to be completed by December 2016

• Round 3: The third set of audits will be on-site and will examine a broader scope of HIPAA requirements than the desk audits. Both covered entities and business associates, including those that already underwent a desk audit, may be subject to an on-site audits


Compliance Audits

How will the audit program work?

• The audit process will employ common audit techniques.

• Entities selected for an audit will be sent an email notification of their selection and will be asked to provide documents and other data in response to a document request letter.

• Audited entities will submit documents online via a new secure audit portal on OCR’s website—within 10 business days after they receive OCR’s request.

• After reviewing relevant documentation and other information, auditors will develop and share draft findings with the audited entity.

• Audited entities will have the opportunity to respond to the draft findings, and their written responses will be included in the final audit report. Audit reports generally describe how the audit was conducted, discuss any findings, and contain entity responses to the draft findings.


Compliance Audits

What is the audit timeline?

• The timeline for desk audits is quite compressed.

• Once the auditor sends draft findings to the audited entity, the audited entity will have just 10 business days to review the findings and return written comments to the auditor.

• The auditor will complete a final report within 30 business days after receiving the audited entity’s comments.

• On-site audits will be conducted over a period of 3–5 days, depending on the size of the entity.

• As with desk audits, the audited entity will have just 10 business days to review and submit written comments on the auditor’s draft findings.

• The final audit report will be completed and furnished to the audited entity within 30 days after the audited entity’s response.


Compliance Audits

What is the likely scope of an audit?

• OCR has indicated that desk audits will be more limited than on-site audits, but it is unclear how much more limited they will be.

• OCR also has released an updated audit protocol. Previously, OCR had suggested that the updated protocol would identify the areas that OCR would focus on during phase 2 audits, but the actual protocol does not really carry through on this suggestion—it lists all of the security rule’s requirements for administrative, physical, and technical safeguards and all of the breach notification rule’s requirements.


Compliance Audits

What is the likely scope of an audit?

• The protocol is a little narrower with respect to the privacy rule, covering:

the Notice of Privacy Practices

the right to request privacy protection for PHI

access of individuals to PHI

administrative requirements (such as training, policies and procedures, sanctions, and document retention)

uses and disclosures of PHI

and individuals’ rights to request amendment of PHI and accountings of disclosures


Compliance Audits

• How do you prepare for a possible audit?

• Be alert to OCR communications

• Don’t ignore OCR

• Round up all the OCR inquires

• Have an audit response plan in place

• Conduct a pre-audit review

• Time is of the essence

• Know your business associates

• Develop or update compliance documents


Compliance Audits

About benefitexpress

Company Background - Services

EligibilityEnrollmentIntegration

Self ServiceCommunicationsEE Call Center

Decision SupportRetiree H&W Admin.

COBRADirect Billing

Total RewardsReimbursements (HSA / FSA)

Commuter BenefitsDependent Verifications

ACA & Other Compliance Svc.

We help participants understand and usetheir benefits wisely so that they can be accountable for their healthcare.

We enable you, as the plan sponsor, to enable and deliver your benefits strategy.

benefit wise. relationship driven.

62

Company Background – Book of Business

Copyright 2017 – Not to be reproduced without express permission of Benefit Express Services, LLC

Clients & Services Supported

226

Administration Participants 1,500,000+

3,952Technology Clients

Reimbursement / COBRA clients 187

Average client size - participants 4,100

Mid/Large Administration clients

ACA 1095 Forms Generated 250,000

250 employees serving our clients from two services center; Schaumburg, IL and Rancho Cordova, CA.


Some of Our Partners

Questions?

Larry GrudzienAttorney at Law

(708) [email protected]

Copyright 2017 – Not to be reproduced without express permission of Benefit Express Services, LLC

Contact Information

65

mailto:[email protected]

http://www.larrygrudzien.com/

HIPAA Lockdown: One-Hour Guide to PHI Best Practice

Recruiting & HR

Transcript of HIPAA Lockdown: One-Hour Guide to PHI Best Practice