RECognition & Health IT 2.0 Expo

HIPAA Audit Program and Omnibus Rule

Tuesday, June 25, 2013 Sheraton Dover Hotel Dover, DE Barbara J. Holland, Esq. DHHS, Office of Civil Rights Regional Manager, Region III

HIPAA Audit Program

• Mandated by HITECH Act, Section 13411 ‐ Audits • HHS must conduct periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification Standards.

• Program Opportunity • Examine mechanisms for compliance • Identify best practices • Discover risks and vulnerabilities that may not have come to light through complaint investigations and compliance reviews • Encourage renewed attention to compliance activities 2

Multi‐year Audit Plan

Description Audit program development study Vendor

Booz Allen Hamilton

Covered entity identification and cataloguing Evaluation of audit program

Booz Allen Hamilton

Develop audit protocol and conduct audits

KPMG, Inc.

PWC, LLP Status/Timeframe

Closed 2010 Closed 2011 Closed 2011 ‐ 2012

Open

Conclude in 2013 3

2011/2012 Implementation

• Audit Protocol Design • Created a comprehensive, flexible process for analyzing entity efforts to provide regulatory protections and individual rights • Resulting Audit Program • Conducted 115 performance audits through December 2012 to identify findings in regard to adherence with standards. • Two phases: • Initial 20 audits to test original audit protocol • Final 95 audits using modified audit protocol 4

What is a Performance Audit?

• An audit service conducted in accordance with GAGAS, Generally Accepted Government Auditing Standards (The Yellow Book) • Provides findings, observations, or conclusions based on an evaluation of sufficient, appropriate evidence against established audit criteria • Can include a limitless range of objectives driven by the needs of users • Can entail objective assessments of a variety of attributes: – Program effectiveness, economy, and efficiency – Internal control – Compliance – Other questions of interest to management (e.g. value of assets, determination of pension benefits) 5

Who Can Be Audited?

• Any Covered Entity o For 2011 ‐ 2012, OCR sought wide range of types and sizes • Health plans of all types • Health care clearinghouses • Individual and organizational providers • Any Business Associate TBD after September 23, 2013 (HITECH Final Rule compliance date) 6

Breakdown of 2012 Auditees

Level 1 Entities

• Large Provider / Health Plan • Extensive use of HIT ‐ complicated HIT enabled clinical /business work streams • Revenues and or assets greater than $1 billion

Level 2 Entities

• Large regional hospital system (3 ‐ 10 hospitals/region) / Regional Insurance Company • Paper and HIT enabled work flows • Revenues and or assets $300 million to $1 billion

Level 3 Entities

• Community hospitals, outpatient surgery, regional pharmacy / All Self ‐ that don’t adjudicate their claims • Some but not extensive use of HIT – mostly paper based workflows • Revenues $50 Million to $300 million Insured entities

Level 4 Entities

• Small Providers (10 to 50 Provider Practices, Community or rural pharmacy) • Little to no use of HIT – almost exclusively paper based workflows • Revenues less than $50 million 7

Auditees by Type & Size

LEVEL Health Plans Health Care Providers Health Care Clearinghouses 11 2 16 3 10 1 24 1 61 7 _________________________________________________ Total 1 13 26 2 12 31 3 11 22 4 11 36 Total 47 115

8

Overall Cause Analysis

For every finding and observation cited in the audit reports, audit identified a “Cause.” • Most common cause across all entities:

entity unaware of the requirement .

• 39% (115 of 293) of Privacy Requirements • 27% (163 of 593) of Security Requirements • 12% (11) of Breach Notification Requirements • Most of these related to elements of the Rules that explicitly state what a covered entity must do to comply.

• Other causes noted included but not limited to: • Lack of application of sufficient resources • Incomplete implementation • Complete disregard 9

What have the audits discovered so far?

• • • • • • • • 65 % of the violations are in the security area 42.70% of the security violations involve administrative safeguards 16.70% involve physical safeguards Policies and procedures exist but are outdated or not implemented HIPAA compliance programs were not a priority Larger institutions continue to have security problems Entities are not conducting regular risk assessments Entities are not managing third party risks 10

What does this mean for you as a covered entity?

• • • • • • Your odds of being audited have now increased OCR is under Congressional pressure to enforce HIPAA/HITECH You need to have current policies and procedures that are implemented You need to have updated risk assessments You need to be aware of the findings and actions taken by OCR in its recent enforcement actions You must have an up-to-date risk assessment of your compliance with the Privacy and Security Rules. If you had a breach or security incident, an additional risk assessment has to be performed specifically addressing those factors that resulted in breach or violation 11

Omnibus HIPAA Final Rule

• Issued January 17, 2013, Effective March 26, 2013 • Compliance Date September 23, 2013 • Major Changes: o Expands Liability  Business Associates/Subcontractors and Agents of Covered Entities o Presumption of Breach unless low probability of data compromise o CE must make assessment of risk following breach o Use PHI for marketing and fundraising (opt-out) o individual’s right of access to electronic PHI o Enforcement Penalties 12

Expanded Liability

• HITECH made BAs subject to Security Rule and certain Privacy Rule provisions • New regs implement HITECH requirements • BA definition amended to add  patient safety organizations,    HIOs/data transmission entities (cloud vendors), vendors who provide PHRs on behalf of covered entities and Subcontractors (law firms) 13

Expanded Liability

• BAs now directly Liable • Subcontractors to BAs also subject to HIPAA • BAA must spell out delegated authority • Agreement is also required between BA and subcontractor that contains all required BAA provisions • Law of Agency applies even when no BAA -- “No matter how far ‘down the chain’ the information flows” 14

Revised definition of Breach

• Prior definition: o Acquisition, access, use or disclosure of PHI in a manner not permitted by Privacy Rule which compromises the security or privacy of the PHI • Interim final rule defined “compromise” o Poses a significant risk of financial, reputational or other harm 15

New Definition

• An acquisition, access, use or disclosure of PHI in a manner not permitted is presumed to be a breach • Unless the CE or BA can demonstrate (via documentation) that there is a low probability that

the PHI has been compromised

16

CE must conduct a risk assessment to determine probability of compromise

• Factors that must be weighed in assessing probability of compromise o The nature and extent of the PHI involved o The unauthorized person who used the PHI or to whom the disclosure was made o Was the PHI actually acquired or viewed, and o Has the risk to the PHI been mitigated 17

Enforcement provisions adopted and clarified

• Regulations adopt HITECH increased penalty structure:   Did not know: $100-$50,000 per violation Reasonable cause: $1,000-$50,000 per violation   Willful neglect

*

violation if corrected: $10,000-$50,000 per Willful neglect if uncorrected: $50,000 per violation • $1,500,000 maximum for all violations of an identical provision per year

*

Conscious, intentional failure or reckless indifference to a compliance obligation 18

Enforcement Provisions: new clarifications

• Factors government must now consider when determining penalties o Nature and extent of violation, now includes number of affected individuals o Nature and extent of harm resulting, now includes reputational harm o o History of compliance, now includes indications of non compliance (vs. formal findings of violations) Financial condition of the organization • If willful neglect, HHS o Required to investigate o Must conduct a compliance review o May (but probably won’t) resolve informally 19

Areas for CEs and BAs to focus on in the future

• • • Risk assessments – ongoing Training of personnel Policies and procedures – especially w/respect to mobile devices and encryption 20

OCR’s future focus

      Not giving entities a 2 nd , 3 rd , 4 th chance to comply May start to look at repeat violators Complaints may trigger broad review Now required to do compliance review where willful neglect Breach reports may trigger compliance investigations even where not required. Additional audits may be undertaken following evaluation of initial program 21