Healthcare Data Security Update

Healthcare Data Security Update
Latest Changes and What Technologies You
Need to Comply
Live Webinar
August 25, 2009

Sponsored by 3COM

informed Healthcare Data Security Update:
Latest Changes and What
Technologies You Need to Comply

Healthcare Informatics Webinar
August 25, 2009

www.morganlewis.com

Data Breach Notification – Federal Law?

• 45 states now have data breach notification laws.

• Generally apply to “owners” of data.

• Laws vary on:
– Triggering elements
– Notification requirements – timing, recipients, method
– Law enforcement involvement
– Exceptions for encryption, decreased risk

• Federal legislation warranted.

• Has been introduced for last five years, seems more likely now.

• Will generally provide universal regulation.
© Morgan, Lewis & Bockius LLP 3

Mandatory Encryption

• New laws in MA and NV expressly require encryption of “personal
information” when it moves.

• Extension of laws in many states requiring “reasonable precautions,”
but now more specifics.

• MA rules effective March 1, 2010.

• Requires a “Comprehensive Written Information Security Plan.”

• Retail – compliance with PCI/DSS will generally cover.

• Some likelihood of federal preemption.


Amended HIPAA Privacy and Security

• Amendments to HIPAA Privacy and Security Rules are in The
Health Information Technology for Economic and Clinical Health Act
(HITECH) provisions of The American Recovery & Reinvestment
Act of 2009 (ARRA).

• Effective Date: February 18, 2010, except as otherwise noted.


Major Changes in HITECH Act

• Today we will address:
– Expanded obligations of Business Associates (BAs).
– Affirmative notification of breach requirements.
– Increased enforcement and penalties.

• Additional changes include:
– Guidance on “Minimum Necessary” standard.
– Prohibition on sale of PHI, and restrictions on marketing.
– Increased individual rights with respect to certain PHI (applicable to
providers).
– Limited application to Personal Health Records (PHR) Vendors.


Business Associates

• HITECH Act responded to concerns that a wide variety of
organizations maintain and transmit PHI, but are not regulated by
HIPAA.

• HITECH Act is a game changer with respect to the legal obligations
of BAs and this is likely to have a significant impact upon
outsourcing arrangements.

• Prior to HITECH Act, BAs were not directly regulated under HIPAA.
– Subject to privacy and security restrictions pursuant to required BA
agreements.
– Only contractual remedies were available to covered entities for breach
of the BA agreement.
– Unless the BA also happened to be a covered entity, in which case a
breach of a BA agreement could result in sanctions.

Business Associates and the Security Rule

• Security Rule Obligations – Under HITECH Act, BAs must comply
with the HIPAA Security Rule’s administrative, technical, and
physical safeguard requirements.
– Essentially the same compliance obligations as a covered entity.
– Newly strengthened HIPAA civil and criminal sanctions apply.

• Effective Date: February 18, 2010.



• New BA obligations will include:
– Implementing written policies and procedures that address each
Security Rule standard.
– Implementing a security awareness and training program for workforce
members.
– Designating a security official.
– Conducting a security risk analysis, coupled with a security
management process.

• Covered entities have often attempted to effectively “pass through”
Security Rule standards to vendor BAs.
– HITECH Act provides further support for rigorous security due diligence
of vendors.


• Large BA organizations, such as outsourcing companies, are likely
to already have implemented a comprehensive security compliance
program.
– However, program still may not be fully aligned with Security Rule
requirements.

• Smaller BAs, particularly those that are not exclusively dedicated to
the healthcare industry, may have a lot of work to do.

• The good news – the Security Rule represents a flexible standard
that is consistent with prudent risk management practices.


Business Associates and the Privacy Rule

• Different than approach under Security Rule.

• Requires a BA to only use or disclose PHI consistent with
obligations under a BA agreement with a covered entity.
– Provisions of BA agreement dictated by Privacy Rule.

• Violation of a BA agreement will be a violation of HIPAA (and
subject to new, enhanced sanctions).


Business Associates and the Privacy Rule

• The additional privacy requirements of the HITECH Act that are applicable
to covered entities will also apply to BAs (Section 13404(a) of ARRA).

• Seems to refer to new privacy requirements relating to:
– Access to electronic health records (EHRs)
– Accounting of disclosures from EHRs
– New “minimum necessary rule” standards
– HITECH’s limitations on marketing
– Prohibition on sale of EHRs and PHI

• It appears that each of these new requirements must be reflected in the BA
agreement.

• Will a general incorporation by reference work or should each requirement
be specifically addressed in the BA agreement?


Business Associates and Security Breaches

• BAs must notify covered entities of any breach of which they
become aware.

• BA is not required to notify individuals.

• BA agreements will be required to include a confusing array of
breach notification provisions:
– Notice of unauthorized uses and disclosures of PHI (Privacy Rule)
– Notice of “Security Incidents” (Security Rule)
– Notice of “Breaches” (HITECH Act)


Amendment of Business Associate Agreements

• Additional privacy and security requirements imposed upon BAs
must be incorporated into the BA agreement.

• Potentially very burdensome given the number of BA agreements
entered into by most HIPAA-covered entities.

• New BA obligations are imposed by force of law, not contract; so,
are BA agreement amendments really necessary?

• Susan McAndrew of HHS Office for Civil Rights (OCR) has stated
that OCR is working on a proposed rule over the summer that will be
issued later this year.
– A model of a BA agreement on the OCR website is expected to be
updated at some point.


Amendment of Business Associate Agreements

• What should you do if you are entering into an outsourcing
agreement that will have a term that runs through February 2010?
– Incorporate provisions now that are likely to meet HITECH Act
requirements?
– Execute an amendment prior to February adding HITECH Act
provisions?

• One consideration favoring early amendment:
– New security breach obligations imposed on BAs will become effective
by September 24, 2009.


Affirmative Notification Obligation

• Pre-HITECH Act Rule:
– No affirmative obligation to notify individuals or HHS of a breach of
HIPAA Privacy or Security Rules.
– But, covered entities’ obligation to mitigate any harm caused by a
breach may have included notification of breach.


Affirmative Notification Obligation

• Under HITECH Act, if security of “Unsecured PHI” is “breached,”
covered entity must provide notice without unreasonable delay and
within 60 days after “discovery” of breach:
– To the impacted individuals.
– To the media: If breach involves more than 500 individuals in a state
or jurisdiction.
– To HHS: If breach involves more than 500 individuals, immediate
notice to HHS; if less than 500 impacted individuals, covered entity logs
breach and provides annual log to HHS.

• If BA discovers breach, it must notify the covered entity, but it may
be possible to delegate notification obligations to BA.
– HHS issued interim final regulations governing breach notification on
August 19, 2009.


Notice of Breach – Content

• Notice of Breach must include:
– Brief description of breach, including dates.
– Description of types of Unsecured PHI involved.
– Steps impacted individual should take to protect against potential harm.
– Brief description of steps covered entity has taken to investigate
incident, mitigate harm, and protect against further breaches.
– Contact information.


Definition of “Unsecured PHI”

• “Unsecured PHI” is PHI not secured through use of a technology or
methodology identified by HHS as rendering the information
unusable, unreadable, or indecipherable to unauthorized persons.

• Notification obligations are only triggered by breach of
“Unsecured PHI.”


Security Guidance

• By April 17 (and annually thereafter) HHS will issue guidance on what constitutes
“unsecured PHI”
• HHS issued guidance on April 17 and met its deadline, with further clarification
provided in the August 19 security breach notification regulations.
• If HHS had not issued guidance in time, then “unsecured PHI” would have been
defined as PHI that is not secured by a technology standard (such as encryption)
accredited by the American National Standards Institute (ANSI)
– This fall-back provision is now moot

• Should the government get into the business of recommending encryption standards
and other technologies?


Security Guidance -- Encryption

• HHS Security Guidance says that PHI is rendered “unusable,
unreadable or indecipherable” if:
– For data at rest: encryption consistent with NIST Special Publication
800-111, Guide to Storage Encryption Technologies for End User
Devices
– For data in motion: encryption that complies with the requirements of
Federal Information Processing Standards (FIPS) 140-2


Security Guidance -- Destruction

• Media on which PHI is stored or recorded must be destroyed:
– Paper, film or other hard copy media: must be shredded or destroyed
such that PHI cannot be read or otherwise reconstructed
– Electronic media: must be cleared, purged or destroyed consistent with
NIST Special Publication 800-88, Guidelines for Media Sanitization

• Guidance creates the “functional equivalent of a safe harbor”


Increased Enforcement Mechanisms

• Periodic Audits.
Effective Feb. 2010.

• “Willful Neglect.”
– Audit required if preliminary investigation of complaint indicates “willful neglect,”
and HHS is required to impose a penalty for violations due to willful neglect.
– Effective Feb. 2011 (regs. expected in Aug. 2010).

• State Attorneys General.
Authorized to bring a civil action for HIPAA violations to enjoin violations
and seek limited damages on behalf of residents. Effective immediately.

• Mechanism for Individual Recovery.
Regs. to issue by Feb. 2012, and effective on or after date of regulations.

• Annual Reports to Congress.


Increased Tiered Penalties

• Increased Tiered Penalties:
– Tier 1: If person is not aware of the violation (and would not have known with
reasonable diligence), penalty is at least $100/violation, not to exceed $25,000
for all violations of the same requirement in the same year.
– Tier 2: If violation is due to “reasonable cause” (but not willful neglect), penalty is
at least $1,000/violation, not to exceed $100,000 for all violations of the same
requirement in the same year.
– Tier 3: If violation is due to willful neglect and is corrected in 30 days, penalty is
at least $10,000/violation, not to exceed $250,000 for all violations of the same
requirement in the same year.
– Tier 4: If violation is due to willful neglect and is not corrected in 30 days, penalty
is at least $50,000/violation, not to exceed $1.5 million for all violations of the
same requirement in the same year.

• Effective Date: Increased penalty amounts apply immediately. “Willful
neglect” provisions not applicable until February 2011.


For further information contact:
Reece Hirsch, CIPP
Morgan Lewis & Bockius LLP
415.442.1422
rhirsch@morganlewis.com


Defense in Depth Security Solutions
Integrated End-to-End Security

Sean Newman, Global Product Manager, Security

3Com Confidential, NDA Required

26

3Com Delivers “No Compromise” Enterprise Networking

Data Center Campus Branch

Ultra Modern Lower TCO Defense
Architecture By Design In Depth

Ease of integration, future Lower operational and End to end defense-in-
proof investment protection, capital costs depth, fewer incidents
“green,” faster time to service per dollar spent
delivery/enablement

3Com Confidential

3Com
27
Security

Defense in Depth – The Secure Network Fabric
3Com Enterprise Security

› Accommodates large customers › End to end solution for branch office,
(e.g. CNPC - 10K VPN locations) LAN and Data Center
› Standalone and embedded › Integrated best of breed technologies
› Multi-core processing › Internal and External Comprehensive
architecture for high scaling Perimeter protection
Defense
in
Depth
Architecture

Easier to install
and Manage
› NOC/SOC experience
with IMC Integration
› Comware enterprise
class OS
› Proactive security
with IPS/iMC/NAC
3Com Confidential

3Com
28
Security

Delivering a Secure, Compliant, Healthcare Environment

3Com Confidential

3Com
Security

Intelligent Management Center – The “Secret Sauce”

3Com Confidential

3Com
Security

Network Access Control with IMC

3Com Confidential

3Com
Security

Integrated Flexible IPS Deployment

TippingPoint Centralized Policy and
Digital Vaccine Configuration Management
Service Integrates with IMC

• INTERNAL ATTACKS AGAINST
– WIRED / WIRELESS LAN
INFRASTRUCTURE
– DATA CENTER

• INTERNAL & EXTERNAL ATTACKS
– MAJOR NETWORK SEGMENTS

• EXTERNAL ATTACKS THROUGH
– CORPORATE WAN PERIMETER
– WEB APPLICATION INFRASTUCTURE
– ROBO
– SERVICE PROVIDER / PARTNER PERRING POINTS

3Com Confidential

3Com
32
Security

Questions?

Confidential

34

Learn More
Webinars from Healthcare Informatics

http://www.vendomewebinars.com

Contact Information
Richard Jarvis
Webinar Director
Phone: 212.812.1413
E-mail: rjarvis@vendomegrp.com

Abbegayle Hunicke
Webinar Project Manager
Phone: 212.812.8429
E-mail: ahunicke@vendomegrp.com

Healthcare Data Security Update

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (18)

Andere mochten auch

Andere mochten auch (8)

Ähnlich wie Healthcare Data Security Update

Ähnlich wie Healthcare Data Security Update (20)

Mehr von GuardEra Access Solutions, Inc.

Mehr von GuardEra Access Solutions, Inc. (20)

Healthcare Data Security Update