To update your contact information€¦ · To update your contact information: Click on “View”...

To update your contact information:

Click on “View” within the Ribbon Bar and select “Slide Master”. Once open, select this slide from the Slide Master layout choices. Use this master slide layout to update the presenter’s contact information below. The information will automatically populate on the rest of the slides throughout the presentation.

Please note: This slide should never be added to a live presentation. It is only meant to be a master and should be deleted prior to your presentation.

Ozzie Fonseca| 949-567-3851 | [email protected] 1

Welcome to the Experian Master PowerPoint Template.

The following slides are meant to provide examples of the look and feel required when building your presentations. Feel free to delete the red boxes shown and to type over any existing content.

Alternatively, there are many pre-configured templates available by clicking “New Slide” and choosing one of the various ones from the “Layout” menu in the “Home” section of the PowerPoint Ribbon Bar.

®

Risk Assessment & HITECH: A 360°View from the Trenches

IAPP Global Privacy Summit 2011

March 10, 2011








Ozzie FonsecaExperian® Data Breach Resolution

� Certified Information Privacy Professional (CIPP).

� Serviced over 2,300 data loss incidents including the

deployment large scale breach notification programs,

incident response call centers, and state-of-the-art

credit monitoring and fraud resolution services.

� Spent several years in the call center industry

specializing in implementing breach response

programs from a customer service perspective.








AgendaWelcome!

� Introductions

� Overview of Key HITECH Provisions

� Business Associate Considerations & Lessons Learned

� Marketing Considerations & Lessons Learned

� Risk Assessment Best Practices

� Electronic Access Compliance Best Practices

� Q&A








M. Peter Adler, CIPP, CISSPSRA International

� Chief Privacy and Cybersecurity Legal Compliance

Officer at SRA International.

� Advises on compliance with legal requirements

related to privacy and cyber security, including

fulfilling customer privacy and security contractual

requirements.

� Leads the establishment and implementation of

corporate policies and standards for data privacy and

network security.

� Extensive experience in state, national and

international information security and privacy law and

is the former Chief Privacy Officer at United Health

Group.








Derek Woo, MCP, CNE

Sinaiko Healthcare Consulting

� Managing director, Revenue Cycle and Healthcare

Informatics Services at Sinaiko Healthcare

Consulting.

� Directs all aspects of the firm's Health Information

Technology and Information Security practice.

� Depth of experience in technology, healthcare

operational processes and government organizations.

� Served as information security advisor to U.S. Sen.

Edward Kennedy's office on a proposed rulemaking

panel for the Health Insurance Portability and

Accountability Act (HIPAA).








� Access to Certain Information In Electronic Format. An individual has a right to obtain from the covered entity a copy of his or her information in an electronic format.

� Restrictions on Disclosures for Paid-For Medical Costs. Individuals will have the right to prohibit the disclosure of protected health information (PHI) to a health plan for items or services that the individual paid for in full out-of-pocket.

� Increased Accounting of Certain PHI Disclosures. Required if covered entity (CE) uses an EHR. CEs must provide accounting for disclosure of PHI to carry a treatment, payment, and healthcare operations when the PHI is in an EHR.

� Amended Marketing Rules. Limits the healthcare operations exception for communications when the CE receives remuneration for the communication except in limited circumstances.

� Opportunity to Opt-Out of Fundraising.

HITECH: Overview of Key Provisions








� Enhanced Business Associate Provisions. Clarifies and expands definition of “business associate” (BA) and increases BA legal obligations and compliance requirements.

� Notification for breaches involving PHI.

� Restrictions on sales of EHRs or PHI. CEs and BAs may not sell PHI and EHRs, except in limited circumstances, unless the individual authorizes the sale.

� Special provisions for vendors of personal health records and other non-HIPAA covered entities.

� Enhancement enforcement, funding for enforcement and increased penalties.

� Limited Data Sets and Minimum Necessary.

HITECH: Overview of Key Provisions, continued








Enhanced BA Legal Obligations

� Each security and privacy requirement in the

HITECH Act that is applicable to a covered entity is

also applicable to a BA and should be included in a

business associate agreement (BAA).

� A BA must comply with administrative, technical, and

physical safeguards under the security rule.

� This includes the documentation requirements of the

security rule (policies, procedures and other

documents.

� BAs that violate the security and privacy provisions

are subject to the HIPAA civil and criminal penalties.








Clarification and Expansion of “Business Associate” Definition

� Definition of “business associate” includes:

� entities that provide data transmission services to a covered entity (or its business

associate) if the service involves access to PHI on a routine basis, including:

� a health information exchange organization;

� a regional health information organization;

� an E-prescribing Gateway; or

� any vendor that contracts with the covered entity to allow the covered entity to

offer a personal health record (PHR) to patients.








View from the Trenches: Top 5 HITECH Business Associate Risks to Assess

1. Has a BA compliance plan been prepared and

approved?

2. Are BAAs effectively managed within the

organization?

3. Are all of the HITECH terms being included in

your BAAs?

4. Are you or others correctly designated as BA?

5. Should you monitor BA compliance?








Marketing Rule: Prior to HITECH Amendments

� Use or disclosure of PHI for marketing requires individual authorization, except:

� Face-to-face communications; and

� Promotional gifts of nominal value

� Exceptions made for certain types of health care operations communications and

treatment communications and typically do not require authorization.








HITECHKey Definition: Financial Remuneration

� The direct or indirect payment from or on

behalf of a third party whose product or service

is being described.

� Elements:

� Direct or indirect payment

� From a third party or on behalf of a third

party

� The third party's product is being

described








Unchanged in HITECH AmendmentsKey Definition: Treatment

Treatment Includes:

� the provision, coordination, or management of health care and related services by

health care providers;

� including the coordination or management of health care by a health care provider

with a third party;

� consultation between health care providers relating to a patient; or

� the referral of a patient for health care from one health care provider to another.








HITECH Key Definition: Marketing

� Subject to exceptions, “marketing” is defined to mean:

� To make a communication about a product or service that encourages recipients

of the communication to purchase or use the product or service.








Not Marketing: Marketing Exceptions

� For treatment of an individual by a health care provider

� Health care providers may receive remuneration in exchange for making a

treatment communication about a health related product or service, but certain

requirements must be met (discussed later).

� Refill reminders or communications about a currently prescribed drug/biologic and

the (financial remuneration is reasonable).

� For unremunerated health care operations communications described on the

following page…








Health Care Operations Communications

� A marketing exception applies exists if there is no financial remuneration to the CE

for the communication and the communication:

(1) Describes health-related products or services (or payments for those products

or services) that are provided by or included in a plan of benefits. This includes

communications:

� Describing a provider network or plan network

� For case management or care coordination

� Describing plan enhancements or replacements

� Describing health-related products or services available only to members

that are value-added, not part of the plan of benefits.

(2) Is related to case management or care coordination falling outside of treatment

definition, including the direct or recommend alternative treatments and related

functions (e.g., therapies, health care providers).








Marketing

� Marketing includes communication about a product or service, etc.-

� that are not included in the exceptions

� that are otherwise found in the exceptions, but financial remuneration is involved

as follows:

� Amount paid is not reasonably related to the CE’s costs in making the

communications and communication is about refill reminders or currently

prescribed meds; and

� CE receives financial remuneration in exchange for making health care

operation communications

� That are face-to-face and from CE to individual; or are promotional gift of nominal

value provided by the CE








Compliance Requirements

� For marketing

– Obtain an authorization for any use or disclosure of PHI for marketing, except if

communication is:

� A face-to-face communication made by a CE to an individual; or

� A promotional gift of nominal value provided by the CE

– Authorization must state when financial remuneration is Involved

• For health care providers receiving remuneration in exchange for making a treatment

communication about a health related product or service

– Must include the use and disclosure in Notice of Privacy Practices and provide

opportunity to opt-out

– Disclose the financial remuneration in communication

� i.e., A statement that covered health care provider is receiving financial

remuneration in exchange for making the communication.








View from the Trenches: Top 5 HITECH Marketing Risks to Assess

1. Is your organization a CE or a BA providing

communications to persons involving he use or

disclosure of PHI?

2. Has your organization categorized these

communications as either marketing or not

marketing?

3. Has the organization identified when direct or

indirect remuneration is exchanged for the

communications?

4. Have authorization forms and the notice of

privacy practices been updated to include

instances where financial remuneration is

involved?

5. If remuneration is involved, have you checked

that activities do not involve the sale of PHI?








Risk Assessment - Breach

Breach—a few key considerations…

� Health and Human Services has withdrawn the Final Rule for Breach

Notification for Unsecured Protected Health Information for further study (08/10).

� HITECH Act breach notification requirement applies only to the breach of

unsecured PHI.

� If PHI is rendered “unusable, unreadable, or indecipherable” to unauthorized

individuals, it is secure.

� The breach of secure PHI is not subject to the breach notification requirement.

� May not need to act on breach notification requirement if PHI is secure.









Breach

Acquisition, access, use or disclosure of PHI in a manner not

permitted under the Privacy Rule which compromises the security or

privacy of the PHI

Was the PHI secured,

encrypted or destroyed?

Was the use or disclosure impermissible under the

Privacy Rule, i.e. was the Privacy Rule violated?

NO (It is unsecured PHI)

Was there a significant risk of harm to

the individual (financial, reputational or

other)? (Conduct Risk Assessment to

confirm)

YES

Does one of the

exceptions* apply?YES

BREACHNO

NO

BREACH

YES

NO

NO

YES

Here’s where a solid risk assessment process can help…

� Determine if breach falls into one of the seven exception criteria� Disclosure to the Individual� Disclosure for Treatment, Payment and Health

Care Operations (TPO)� Opportunity to Agree or Object� “Incident to”� Limited Data Set / De-identified Data /

Encrypted� Has Authorization� Public Policy (Legal Requirement, Law

Enforcement, etc.)









Hot Tips!

� When entering, save a copy of

(or print screen) your entry.

There is no way to get back to

your entry after you submit it!

� You will not be given a

reference number. If you later

have to enter an addendum to a

previous report, there is no way

to link it to the previous report.








Electronic Access – HITECH and EHR

� Stimulus expenditures for development and

adoption of Health Information Technology

(“HIT”)� Medicare and Medicaid reimbursement

systems

� Utilization of an electronic health record

(“EHR”) for each person in the United States

by 2014

� Adoption of EHR is critical to improvements

in quality of care and ultimate cost savings









� “Meaningful Use” of EHR for reporting periods

� Recognition that new types of technology manage and communicate/transmit health information – EMR, PHR, Health Information Exchanges

� Widespread adoption of EHR will not occur unless the public is assured that the privacy of their health information is secured

Data from HIMSS AnalyticsTM Database 2010 HIMSS Analytics








Electronic Access – HITECH and EHRM

eanin

gfu

l Use—

Ris

k A

ssessm

ent P

rocess Discovery

Assessment

Recommendation

Review

• Longest phase of the Risk Assessment

• Identify Drivers and Objectives

• Evaluate People, Process and Technology

• Understand the ‘Lifecycle’ of Information

• Identify PHI Touch Points

• Analyze and Quantify all Discovery data

• http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrul

e/nist800-30.pdf [NIST 800-30]

• http://www.iso.org/iso/home.htm [ISO 27001]

• Align Gaps and Weaknesses with Drivers and Objectives

• Draft Recommendations to close Gaps and address Weaknesses

• Recommendations should be ranked (severity)

• Recommendations should be phased (short, mid, long-term)

• Draft Recommendations should be reviewed with all

stakeholders—business units, steering committee(s), leadership

• Recommendations are finalized, approved and carried out









� “Administrative, Technical and Physical”…not just IT Security

� “Anticipated Threats and Hazards”…duty to be informed

� C, I and A (Confidentiality, Integrity and Availability)

� Risk Assessment

� Access Management

� Network Security (transmission…encryption)

� Intrusion Detection (both network and host)

� Malicious code detection

� Incident Management and Response

----------------------New! (for HITECH)

� Business Associates are now required to comply with Privacy and Security Standards

� Enhanced Breach Notification and Response

� Individual’s Rights & Restriction on Disclosures by Providers

� Enhanced Accounting of Disclosure Requirements—6 yrs. (No TPO) vs. 3 yrs. (TPO)









Commonality Matrix








Thank You…Questions & Answers

Ozzie FonsecaDirectorExperian® Data Breach Resolution

[email protected]/DataBreach

For complimentary educational resources, please visit: www.Experian.com/DataBreach

Derek WooManaging DirectorSinaiko Healthcare Consulting

M. Peter AdlerChief Privacy and Cybersecurity Legal Compliance OfficerSRM International

[email protected]

[email protected]

To update your contact information€¦ · To update your contact information: Click on “View”...

Documents

Transcript of To update your contact information€¦ · To update your contact information: Click on “View”...