Issue link: https://viewer.e-digitaledition.com/i/266572
IN 2013, THE DEPARTMENT of Health and Human Services Office for Civil Rights issued a mendments to HIPA A's Privacy, Security, Breach Notification and Enforcement Rules. These Amendments, which required compliance by September 23, 2013, expanded the definitions of busi- ness associates and Breach notification. They also expanded physician liability for Breaches by their business associates and increased potential civil money penalties for violations. Not on ly h ave t he r u le s b e en strengthened, so too has enforcement. In November, 2013, the U.S. Office of Inspector General issued a scathing report of the Office for Civil Rights for failing to meet federal requirements critical to the oversight and enforcement of the Security Rule, assess risks, establish priorities, implement controls, consistently follow investigation policies and procedures, provide periodic compliance audits of covered entities, and comply with its own cybersecurity requirements. In light of this report, it is anticipated that the Office for Civil Rights will step up its investigation and enforcement efforts. In 2013, the Office for Civil Rights settled with two relatively small entities, with significant implications looking for ward. Adult & Pediatric Dermatology, a dermatology practice in New England, settled a HIPAA claim for $150,000.00 following an ePHI Breach involving 2,220 individuals. The Office for Civil Rights reach a $50,000.00 settlement with Hospice of Northern Idaho for a Breach involving fewer than 500 individuals. Both Breaches involved the losses/theft of unencrypted ePHI on a laptop or portable device. The investiga- tions found that both "covered entities" fa iled to comply w ith the Privacy, Security, and Breach Notification Rules by failing to conduct an analysis of the potential risks and vulnerabilities to the ePHI and not fully complying with the Breach Notification Rule. Moreover, they did not have a written policy and procedure or security and protection training in place for members and staff. To avoid costly mistakes of others, practices can ill afford complacency in maintaining the privacy and security of ePHI. Practices need to confirm that systems, networks, plans, procedures, staff, and business associates all comply with the new regulations. Specifically, every practice, regardless of size, should have as primary objec- tives for ePHI protection, a system that: (1) regularly assesses the privacy and security policy to ensure adequate and compliant protections are in place according to state and federal mandates; (2) performs annual training of staff on privacy and protection requirements; (3) performs regular assessments and analysis of the systems to identify weak- ness in compliance; (4) encrypts ePHI; (5) documents its policies, procedures, training, incident reports, disclosure accounting reports, logs, back-ups, (6) performs regular risk assessments of sys- tems, action plans in the event of breach; (7) has written contracts with business associates to confirm their HIPAA com- pliance and protection measures. An often overlooked resource to assist physicians in this process and in the event of a Breach may include the malpractice insurance carrier. Checking with the carrier on availability of risk assessment or of defense costs or liability coverage in the event of a Breach or investigation may also be included in coverage. These steps can greatly reduce the risk of a Breach. It is better be proactive rather than reacting to a prolonged, expensive, and watchful eye of the Office for Civil Rights under a mandated corrective plan. For 2014, with the continued prolifera- tion of ePHI, a culture of compliance is what your office should strive to achieve. John B odie i s an at tor ne y and a partner with Buckingham, Doolittle & Burroughs, LLP, in Cleveland, Ohio. For more information about the law firm, go to www.bdblaw.com or email Mr. Bodie at jbodie@BDBLAW.com ■ By John Bodie, JD HIPAA Compliance: Is Your Office Up-to-Date? 3 0 | Cleveland/Akron/Canton MD NEWS ■ M D N E W S . CO M ■ M A R C H /A P R I L 2 0 1 4