Patient privacy group welcomes HHS withdrawal of HITECH Act breach notification rule

The Patient Privacy Rights Foundation welcomed last week’s announcement by the Department of Health and Human Services (HHS) that it was withdrawing the health data breach notification rule.

The Foundation called the withdrawal a "huge step in the right direction" and reiterated its disappointment with the 'harm threshold' provision, which allows health care providers to conduct a risk assessment of any data breach, before deciding whether it is necessary to report the breach to HHS. "The broad discretion granted to industry goes far beyond Congressional intent", read the Foundation's submission sent to HHS during the 2009 public comment period. "There was no mention of any consideration of a harm standard in HHS previous Request for Information, thus thwarting any opportunity for public debate." Several Congressmen also submitted comments to the HHS, expressing concerns over the breadth of discretion that would be given to companies, "particularly with regard to determining something as subjective as harm from the release of sensitive and personal information."

HHS is expected to publish a final rule in the Federal Register in the coming months.

July 13 Data Security Workshop - FREE

On July 13, Mintz Levin will be joined by Sophos, Six Weight Consulting, and MFA Cornerstone Consulting to hold a free compliance workshop focused on both the gaps and overlap of Massachusetts’ data protection regulation 201 CMR 17.oo and the recent updates to federal health and medical data privacy found in the HITECH Act. We'll have an interactive hands-on workshop that will help you to address some critical questions within your organization:

• What are my organization and business partner’s obligations?
• What kind of information do I need to protect and how do identify it?
• Is data encryption necessary?
• What is a WISP?
• What is a data breach and what is my responsibility and liability if I have one?
  
  For information or to register to attend the event, which will be hosted by Mintz Levin in our downtown Boston office, please click this link: http://tinyurl.com/35pk3yr
  
  

Proposed HITECH Regulations Out in May?

Buried in a part of today's Federal Register was the publication of the Department of Health and Human Services' regulatory agenda. The agenda presents a forecast of expected HHS rulemaking activities and suggests that in May of this year HHS will issue the long-awaited proposed rules to modify the HIPAA Privacy, Security, and Enforcement Rules as necessary to implement the privacy, security, and certain enforcement provisions of the HITECH Act (see our earlier blog posts).

The Department is also scheduled to issue a final rule in May of this year, addressing the certification standards and implementation criteria for electronic health record technology.

HHS Announces Delay in Enforcement of HITECH Rules as Applied to Business Associates

As we have discussed before, HHS’s Office of Civil Rights has let it be known that a proposed rule implementing the HITECH Act’s privacy and security provisions as they apply to business associate liability is in the works. The proposed rule will also deal with new limitations on the sale of protected health information, marketing, and fundraising communications, and stronger individual rights to access electronic medical records, among other things. According to the Office of Civil Rights, the proposed rule “will provide specific information regarding the expected date of compliance and enforcement of these new requirements.”

We take this to mean that enforcement of these particular HITECH Act provisions will be delayed.

For more information, see the Mintz Levin Health Law and Employee Benefits Alert just published.

Quick Compliance Survey

No, we're not "taking names" here. This is just a 10-question survey to gauge some basic compliance metrics. Please participate!

Click here to take survey

Today is the day......

After implementation delays and rule changes, new data protection regulations that are widely considered the most stringent in the nation take effect today. The Massachusetts data security regulations require institutions that hold personal data on Massachusetts citizens to encrypt that information and implement written data protection policies, reports the Boston Globe.

Discussion continues and questions abound. Will this set the bar nationwide as the articulation of what constitutes "reasonable security" for personal information? How should companies handle the varying risk of harm standards when dealing with state laws and federal law, such as the HITECH Act?

Today's compliance deadline - Enforcement of the HITECH/HIPAA data breach notification rule

February and March are just full of significant deadlines for privacy/security reporting and compliance.

Today is the day that the Health & Human Services Office of Civil Rights begins to enforce the HITECH/HIPAA data breach notification rule. To "celebrate" the occasion, the agency publicly posted the first list of reported breaches affecting 500 or more individuals. The list is available on the HHS’ website, but I thought I would post them here. Reasonably instructive…..see any trends??

Breaches Affecting 500 or More Individuals
As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. The following breaches have been reported to the Secretary.

The Methodist Hospital
State:
Texas
Approx. # of Individuals Affected:
689
Date of Breach:
1/18/10
Type of Breach:
Theft
Location of Breached Information:
Computer

Carle Clinic Association
State:
Illinois
Approx. # of Individuals Affected:
1,300
Date of Breach:
1/13/10
Type of Breach:
Theft
Location of Breached Information:
Paper Records and Films

Ashley and Gray DDS
State:
Missouri
Approx. # of Individuals Affected:
9,309
Date of Breach:
1/10/10
Type of Breach:
Theft
Location of Breached Information:
Desktop Computer

Educators Mutual Insurance Association of Utah
State:
Utah
Business Associate Involved:
Health Behavior Innovations
Approx. # of Individuals Affected:
5,700
Date of Breach:
12/27/09
Type of Breach:
Theft
Location of Breached Information:
CDs


Goodwill Industries of Greater Grand Rapids, Inc.
State:
Michigan
Approx. # of Individuals Affected:
10,000
Date of Breach:
12/15/09
Type of Breach:
Theft
Location of Breached Information:
Backup Tapes

Private Practice
City and State:
Stoughton, MA
Approx. # of Individuals Affected:
1,860
Date of Breach:
12/11/09
Type of Breach:
Theft
Location of Breached Information:
Portable Electronic Device/Electronic Medical Record

AvMed, Inc.
State:
Florida
Approx. # of Individuals Affected:
359,000
Date of Breach:
12/10/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Blue Island Radiology Consultants
State:
Illinois
Business Associate Involved:
United Micro Data
Approx. # of Individuals Affected:
2,562
Date of Breach:
12/09/09
Type of Breach:
Loss
Location of Breached Information:
Backup Tapes

Private Practice
City and State:
Wilmington, NC
Business Associate Involved:
Rick Lawson, Professional Computer Services
Approx. # of Individuals Affected:
2,000
Date of Breach:
12/08/09
Type of Breach:
Hacking/IT Incident
Location of Breached Information:
Computer/Network Server/Electronic Medical Record

Kaiser Permanente Medical Care Program
State:
California
Approx. # of Individuals Affected:
15,500
Date of Breach:
12/01/09
Type of Breach:
Theft
Location of Breached Information:
Portable Electronic Device

University of California, San Francisco
State:
California
Approx. # of Individuals Affected:
7,300
Date of Breach:
11/30/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Detroit Department of Health and Wellness Promotion
State:
Michigan
Approx. # of Individuals Affected:
646
Date of Breach:
11/26/09
Type of Breach:
Theft
Location of Breached Information:
Laptop, Desktop Computer

Advocate Health Care
State:
Illinois
Approx. # of Individuals Affected:
812
Date of Breach:
11/24/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Concentra
State:
Texas
Approx. # of Individuals Affected:
900
Date of Breach:
11/19/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Children's Medical Center of Dallas
State:
Texas
Approx. # of Individuals Affected:
3,800
Date of Breach:
11/19/09
Type of Breach:
Loss
Location of Breached Information:
Portable Electronic Device

Universal American, Inc.
State:
New York
Business Associate Involved:
Democracy Data & Communications, LLC
Approx. # of Individuals Affected:
83,000
Date of Breach:
11/12/09
Type of Breach:
Incorrect Mailing
Location of Breached Information:
Postcards

Massachusetts Eye and Ear Infirmary
State:
Massachusetts
Approx. # of Individuals Affected:
1,076
Date of Breach:
11/10/09
Type of Breach:
Theft
Location of Breached Information:
Other

Kern Medical Center
State:
California
Approx. # of Individuals Affected:
596
Date of Breach:
10/31/09
Type of Breach:
Theft
Location of Breached Information:
Paper Records

Blue Cross Blue Shield Association
State:
District of Columbia
Business Associate Involved:
Service Benefits Plan Administrative Services Corp.
Approx. # of Individuals Affected:
3,400
Date of Breach:
10/26/09
Type of Breach:
Unauthorized Access
Location of Breached Information:
Mailings

Detroit Department of Health and Wellness Promotion
State:
Michigan
Approx. # of Individuals Affected:
10,000
Date of Breach:
10/22/09
Type of Breach:
Theft
Location of Breached Information:
Portable Electronic Device

The Children's Hospital of Philadelphia
State:
Pennsylvania
Approx. # of Individuals Affected:
943
Date of Breach:
10/20/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Public Employee Health Insurance Plan (Kentucky Employees' Health Plan)
State:
Kentucky
Approx. # of Individuals Affected:
676
Date of Breach:
10/20/09
Type of Breach:
Misdirected E-mail
Location of Breached Information:
E-mail

Brooke Army Medical Center
State:
Texas
Approx. # of Individuals Affected:
1,000
Date of Breach:
10/16/09
Type of Breach:
Theft
Location of Breached Information:
Paper Records

Alaska Department of Health and Social Services
State:
Alaska
Approx. # of Individuals Affected:
501
Date of Breach:
10/12/09
Type of Breach:
Theft
Location of Breached Information:
Portable USB Device

Cogent Healthcare of Wisconsin, S.C.
State:
Tennessee
Business Associate Involved:
Cogent Healthcare, Inc.
Approx. # of Individuals Affected:
6,400
Date of Breach:
10/11/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Health Services for Children with Special Needs, Inc.
State:
District of Columbia
Approx. # of Individuals Affected:
3,800
Date of Breach:
10/09/09
Type of Breach:
Loss
Location of Breached Information:
Laptop

Blue Cross Blue Shield Association
State:
District of Columbia
Business Associate Involved:
Merkle Direct Marketing
Approx. # of Individuals Affected:
15,000
Date of Breach:
10/07/09
Type of Breach:
Unauthorized Access
Location of Breached Information:
Mailings

Blue Cross Blue Shield of Tennessee
State:
Tennessee
Approx. # of Individuals Affected:
500,000
Date of Breach:
10/02/09
Type of Breach:
Theft
Location of Breached Information:
Hard Drives

City of Hope National Medical Center
State:
California
Approx. # of Individuals Affected:
5,900
Date of Breach:
9/27/09
Type of Breach:
Theft
Location of Breached Information:
Laptop

Private Practice
City and State:
Torrance, CA
Approx. # of Individuals Affected:
6,145
Date of Breach:
9/27/09
Type of Breach:
Theft, Unauthorized Access
Location of Breached Information:
Desktop Computer

Private Practice
City and State:
Torrance, CA
Approx. # of Individuals Affected:
5,166
Date of Breach:
9/27/09
Type of Breach:
Theft, Unauthorized Access
Location of Breached Information:
Desktop Computer

Private Practice
City and State:
Torrance, CA
Approx. # of Individuals Affected:
5,257
Date of Breach:
9/27/09
Type of Breach:
Theft, Unauthorized Access
Location of Breached Information:
Desktop Computer

Private Practice
City and State:
Torrance, CA
Approx. # of Individuals Affected:
857
Date of Breach:
9/27/09
Type of Breach:
Theft, Unauthorized Access
Location of Breached Information:
Desktop Computer

Private Practice
City and State:
Torrance, CA
Approx. # of Individuals Affected:
952
Date of Breach:
9/27/09
Type of Breach:
Theft, Unauthorized Access
Location of Breached Information:
Desktop Computer

University of California, San Francisco
State:
California
Approx. # of Individuals Affected:
610
Date of Breach:
9/22/09
Type of Breach:
Phishing Scam
Location of Breached Information:
Email

Mid America Kidney Stone Association, LLC
State:
Missouri
Approx. # of Individuals Affected:
1,000
Date of Breach:
9/22/09
Type of Breach:
Theft
Location of Breached Information:
Network Server

HITECH Act Compliance Date Arrived -- Without the Promised Regulatory Guidance

We have been so focused on the upcoming Massachusetts data security deadline, that we let one last week go without fanfare. As we have gently reminded you on several occasions, the new HIPAA privacy and security rules contained in the Health Information Technology for Clinical and Economic Health Act (HITECH) became effective on February 17th.

The HITECH Act was passed as part of the “Stimulus Bill” on February 17, 2009. Although rumors continue to swirl that additional regulations will be forthcoming shortly (the latest rumor is that the East Coast blizzard slowed down the review and approval process), it is clear that they were not out as of the February 17th effective date. Therefore, covered entities and their business associates must act immediately on the terms of the HITECH statute itself.

HITECH imposes new HIPAA rules on covered entities and their business associates. New data breach notification rules require covered entities to review any possible wrongful disclosures to determine whether to warn individuals or notify the federal government or the press. Covered entities should have policies in place to meet these requirements in the event of a breach. Covered entities should review and revise their business associate agreements and their other policies and procedures as well.

HITECH also makes most HIPAA rules applicable directly to business associates. If your company serves healthcare providers or insurance plans (including group health plans), and you receive health information, you are probably a business associate and are covered by these changes. Most importantly, business associates must adopt HIPAA policies and procedures to protect the security of the information they collect, hold and use. In addition to the contractual obligations business associate agreements put on them, business associates are now directly liable under HIPAA.

Data Privacy Day Tip #2 - HITECH Act

Written by Dianne Bourque

Effective February 17, 2010, significant new compliance obligations will be imposed on business associates through the HITECH provisions of the American Recovery and Reinvestment Act of 2009 ("ARRA"). Business associates (or organizations that use or disclose protected health information on behalf of covered entities subject to HIPAA) will be directly liable for compliance with certain provisions of the HIPAA Privacy Rule and the HIPAA Security Standards, and may be audited by the Department of Health and Human Services ("HHS"). They will also be subject to increased civil and criminal penalties for non-compliance.

DATA PRIVACY DAY REMINDER: Time to update business associate agreements to reflect HITECH's new breach-notice provisions and other requirements. Business associates must also--at a minimum--(i) undertake and complete a security risk assessment, (ii) prepare and adopt written security policies and procedures, and (iii) conduct workforce training in their policies and procedures.

Link to blog post for more information:
Privacy and Security Information - Privacy MATTERS: Federal Breach Notification Rules -- NEXT WEEK. Are you ready?

Connecticut Attorney General Brings Charges Against Health Net for HIPAA Violations

Written by Dianne Bourque

On January 13, Connecticut Attorney General Richard Blumenthal filed charges against Health Net of Connecticut, Inc., for violating federal privacy law. Blumenthal is the first state attorney general to file such a suit using HIPAA enforcement authority granted to states under the HITECH provisions of the American Recovery and Reinvestment Act of 2009.

The law suit was prompted by Health Net’s loss of a portable disk drive from a Connecticut office. The unencrypted drive contained health and other personal information for approximately 1.5 million current and former Health Net members. Almost one-half million of the affected members were Connecticut residents.

In a statement, Health Net said that it would cooperate with the Attorney General and that there is no evidence that any of the lost data had been misused.

Massachusetts Data Security Standards vs. New HIPAA Guidelines

Here's a link to an article (by the author of this blog...) comparing the Massachusetts data security standards (effective January 1, 2010) to the Department of Health & Human Services Guidelines promulgated under the new HITECH Act (effective in mid-September).   Compliance challenges are coming on all fronts -- and it's best not to duplicate efforts. 

Employee Benefit News