HIPAA Privacy and Security Compliance Ben Conley Seyfarth

HIPAA Privacy and Security Compliance Ben Conley Seyfarth Shaw LLP bconley@seyfarth. com

Why am I here? Question: We aren’t in the health care business – why do we need to know about HIPAA Privacy Compliance? Answer: Because your company sponsors a health plan that provides health benefits to employees and their families. © 2015 Seyfarth Shaw LLP 3

But my Health Plan is Fully Insured…. • Do you sponsor a health FSA or health reimbursement arrangement? • Do you assist with medical plan eligibility inquiries? • If no, even employers sponsoring fully-insured health plans are subject to HIPAA privacy requirements (but requirements may be less onerous). © 2015 Seyfarth Shaw LLP 4

When Do Employees Use or Disclose PHI? • Inquiries from participants regarding eligibility or coverage • Help with participants’ claims for benefits • Paid claims reports from third party administrators • Requests for eligibility information from health care providers or government agencies © 2015 Seyfarth Shaw LLP 5

The HIPAA Firewall Comp/ Benefits/HR Risk Management Health Plan Payroll Legal HIPAA Firewall ©

Let’s Say I’ve Mastered HIPAA…. Now What? • Be cautious – other laws may also restrict use of employee health (or other) information: - State privacy laws FMLA Americans With Disability Act (ADA) Genetic Information Non-discrimination Act (GINA) Mental Health Privacy Acts State electronic disclosure acts (Social Security Numbers) © 2015 Seyfarth Shaw LLP 7

Presentation Overview • • Overview of HIPAA Privacy HIPAA Security Breach Notification HIPAA Enforcement

Part I Overview of HIPAA Privacy © 2015 Seyfarth Shaw LLP 9

HIPAA Privacy Roadmap • What’s a “covered entity”? • What is PHI? • What

What is a “Covered Entity”? Not a Covered Entity Employers Individual Employees Vendors Group Health Plans Health care providers Health Care Clearinghouses Medicare Part D Vendors © 2015 Seyfarth Shaw LLP 11

Group Health Plans Insured and Self-Funded Subject to HIPAA Privacy Not Subject to HIPAA Privacy Medical Short-term Disability Prescription Long-term Disability Dental Life Insurance Vision Workers’ Compensation Health Flexible Spending Account FMLA EAP Employment Drug Test Wellness Programs Stop Loss Insurance Health Risk Assessment Retirement Plans © 2015 Seyfarth Shaw LLP 12

Business Associates • A Business Associate is any entity who: - Performs various services for a covered entity - Involving the use or disclosure of PHI - Examples: o o Claims adjudication, data analysis, utilization review, consulting or data aggregation services • Must enter into a business associate agreement addressing: - Permitted uses and disclosures of PHI by the BA - Security of the PHI while in possession of the BA • Business Associates are directly subject to much of HIPAA © 2015 Seyfarth Shaw LLP 13

Expansion of Business Associate Rules • Business Associate Agreements must require business associate to: - Comply with security rules in handling e-PHI - Ensure that subcontractors will comply with the same restrictions that apply to business associates - Report security incidents and breaches of unsecured PHI to the covered entity (here, group health plan) - If carrying out the group health plan’s obligations under the privacy rule, the business associate must comply with the privacy rule requirements that would otherwise apply to the group health plan © 2015 Seyfarth Shaw LLP 14

What is Protected Health Information? • Protected Health Information (PHI) is information: - Created/received by a health plan/other covered entity: - Relates to: o the past, present or future physical or mental health or condition of the individual, o the provision of health care to an individual, or o the past, present or future payment for the provision of health care to an individual; and - Must either identify the individual directly or contains elements that can be linked to a particular individual © 2015 Seyfarth Shaw LLP 15

PHI Examples Health Plan PHI Not Health Plan PHI Claims Letters Doctor’s Excuse Note Enrollment Information Doctor’s Note for Return to Work EOBs FMLA Requests Doctor’s Bills Drug-Test Results Coverage Certificates Disability Claims EAP Treatment Records Workers’ Comp. Claims Detailed Health Plan Reports Genetic Information (includes family history) © 2015 Seyfarth Shaw LLP 16

Examples of Identifying Information Dates (birth, admission, discharge) Email Address Medical records #s © 2015 Seyfarth Shaw LLP Name SSN Address Identifying Information Biometric Identifiers Phone # 17

GINA Expands PHI • No increasing premiums or contributions based upon genetic information • No requesting/requiring genetic testing • No collecting genetic information prior to or in connection with enrollment (watch your health risk assessments and disease management programs) © 2015 Seyfarth Shaw LLP 18

What is “Genetic Information”? • Genetic tests (including those of a family member) - revealing information regarding traits for disease • Family history – manifestation of a disease or disorder in family members of an individual (not the manifestation of a disease of the individual) Note: GINA considers your spouse to be genetically related to you. © 2015 Seyfarth Shaw LLP 19

Covered Entity QUIZ Do we need to be concerned about HIPAA Privacy? • You inform your workers’ compensation carrier of an employee injury by preparing and sending a medical report to the carrier? • An update regarding an employee’s recent battle with cancer is posted on the company’s intranet? • Health risk assessment question regarding family history of breast cancer? • First aid for work-site injuries? © 2015 Seyfarth Shaw LLP 20

Privacy Notice • Current participants have been given a privacy notice • Automatically provide a copy to new participants at enrollment • Provide a copy to anyone upon request • Provide notice of notice every 3 years • Provide an updated notice if material changes © 2015 Seyfarth Shaw LLP 21

Know Your Privacy Officer • • Ask questions Report a violation Participant complaints Most

Complaints and Policy Violations • Complaints - To Benefits Department/Privacy Officer or Health and Human Services - Privacy Officer investigates • Report Policy Violations - Promptly notify Privacy Officer - Mitigate harmful impact (may include notifying individual) - Cooperate with investigation - Prevent recurrence • No retaliation or intimidation for complaints or reporting violations © 2015 Seyfarth Shaw LLP 23

Scope of Disclosure • All permitted disclosures must be limited to: - Minimum necessary amount of PHI o only the amount of information needed o only the people who need to see it OR • Limited Data Set © 2015 Seyfarth Shaw LLP 24

Scope of Disclosure – Limited Data Set Must Remove Can Include Name Dates of Birth Street Address Dates of Death Telephone #s Dates of Service Email Geographic Information (city, state, zip) Social Security #s Medical Record #s Fingerprints, Voiceprints, Photos © 2015 Seyfarth Shaw LLP 25

Authorization • A proper authorization must: - Authorize you to disclose specific information Be signed and dated Include an expiration date or event Still be valid (not revoked)! • Keep a copy of the authorization in the participant’s benefit file for 6 years © 2015 Seyfarth Shaw LLP 26

What are Permitted Uses and Disclosures? No Authorization from the Employee Needed • • • For treatment (only relevant for providers/on-site clinic) For payment activities For health care operations activities To the individual For workers’ compensation purposes For certain public policy reasons © 2015 Seyfarth Shaw LLP 27

Disclosures for “Payment and Health Care Operations” • • • Health Care Operations General administration and design Quality assessment Obtaining legal and other services Plan audits Risk underwriting © 2015 Seyfarth Shaw LLP • • Payment Enrollment Assist employee with claim Determining eligibility and coverage Billing and claims management Pre-authorization (TPA) Utilization management Medical necessity (TPA) 28

Disclosures to the Individual • To Individual regarding her own claim or enrollment - OK • To employee about her covered family member’s enrollment status - OK • To employee about her covered family member’s claim – could be a trap for the unwary - If family member is not a unemancipated minor, do not disclose without authorization © 2015 Seyfarth Shaw LLP 29

Personal Representative = Participant • Parent of minor child, unless - parent has agreed to confidentiality - minor able to consent to health care under state law and has done so, or - disclosure to parent may subject minor child to abuse • Court-appointed guardians, etc. – require documentation • Executor of estate • Translator © 2015 Seyfarth Shaw LLP 30

Disclosures for Workers Compensation • May disclose as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs - Mainly reporting purposes - This does not mean any and all information from health plan can be given to those working on a workers compensation claim © 2015 Seyfarth Shaw LLP 31

Other Permitted Uses and Disclosures Always Ask Privacy Officer* • Workers’ compensation • Court orders • Subpoenas and discovery requests • Law enforcement • • • HHS investigation Government Public health & safety Domestic violence Other law *Privacy Officer is required to keep a log of these types of disclosures © 2015 Seyfarth Shaw LLP 32

Individual Rights Under HIPAA • Right to inspect/copy PHI • Right to request amendment to PHI • Right to request restrictions on disclosure - Health plan is not required to comply with request • Right to request confidential communications • Accounting of disclosures • Direct these requests to the Privacy Officer © 2015 Seyfarth Shaw LLP 33

Test Time! An employee applies for disability benefits. You remember that you previously helped the employee with a medical plan claim for a related condition. True or False? You can access the employee’s medical plan information to see if the employee’s disability claim relates to a pre-existing condition. © 2015 Seyfarth Shaw LLP 34

Privacy Physical Safeguards • Printed Materials - Lock the files - Clear desktop - Incoming mail o deliver unopened, mark “confidential” - Outgoing mail o seal, verify purpose, identity, address, other possible recipients, mark “confidential” - Destroy unneeded material © 2015 Seyfarth Shaw LLP 35

Privacy Physical Safeguards • Telephone Use - Know with whom you’re speaking No speakerphone unless in a private, secure room Otherwise avoid being overheard Leaving voice mail – verify purpose, identity, number, other possible recipients; leave limited message not including PHI • Fax Machines and Printers - Use dedicated fax machines and printers when possible - Pick up printing promptly - Incoming faxes o Instruct sender – mark private, verify number - Outgoing faxes o Verify purpose, identity, number, other possible recipients © 2015 Seyfarth Shaw LLP 36

Test Time! You work in benefits and are inside the HIPAA Firewall. The Division Vice President calls you for information about whether Mr. Executive has a pre-existing condition that could make it difficult to obtain life insurance coverage. If he does, the company wants to provide him with special life insurance coverage. True or False? You can provide the information. © 2015 Seyfarth Shaw LLP 37

Part II HIPAA Security © 2015 Seyfarth Shaw LLP 38

HIPAA Security Roadmap • Electronic PHI • Unsecured PHI © 2015 Seyfarth Shaw LLP

What’s EPHI? • Individually identifiable health information - same as Privacy • Created or received by a covered entity (here, a health plan) - same as Privacy • Transmitted by, or maintained in, electronic media EPHI - more narrow than Privacy © 2015 Seyfarth Shaw LLP 40

What Additional Policies and Procedures Apply? • Covered entities must create HIPAA Security Policies and Procedures that cover: - administrative safeguards - physical safeguards - technical safeguards © 2015 Seyfarth Shaw LLP 41

Physical/Administrative Safeguards • Limit visitor access to facilities containing PHI/EHPI • Do not let visitors travel unescorted through facilities • Store physical PHI in secure location © 2015 Seyfarth Shaw LLP 42

Your Computer • Lock workstation when not in use (all computers or devices containing e. PHI should have automatic time-out enabled) • WATCH “REPLY ALL” • Mobile devices used to access e. PHI should be password protected. © 2015 Seyfarth Shaw LLP 43

Security Incident Response and Reporting • Security Incidents - Attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in the Plan’s information system • Examples - Someone uses your workstation with your password and without authorization - Viruses - Theft of workstation REPORT ALL SECURITY INCIDENTS TO YOUR HIPAA SECURITY OR PRIVACY OFFICER © 2015 Seyfarth Shaw LLP 44

What is the Difference between Secure and Unsecured PHI? • Unsecured PHI is PHI that is unencrypted - Must encrypt/destroy unsecured PHI to render it secured • Secured PHI is: - Unusable - Unreadable or - Indecipherable to unauthorized individuals. • Paper PHI: - Avoid printing EPHI when possible Will be unsecured unless shredded or destroyed in a similar fashion Shred documents in shredders Encryption will render it secured When possible – encrypt! © 2015 Seyfarth Shaw LLP 45

Part III Breach Notification © 2015 Seyfarth Shaw LLP 46

Overview of Breach Notification Requirements In the case of a “breach”: • Must notify individuals within 60 calendar days • If more than 500 individuals involved, must alert the media as well • HHS must also be notified © 2015 Seyfarth Shaw LLP 47

What Constitutes a “Breach”? • Information disclosed/acquired is unsecured PHI; • Disclosure is unauthorized;

What Constitutes a “Breach”? • Old Rule - No need to notify if no significant risk of financial or reputational harm • New Rule - Presumed breach unless demonstrate there is low probability that the PHI has been compromised © 2015 Seyfarth Shaw LLP 49

Breach – Exceptions (Involve Privacy Officer) • If PHI is secured, no breach • “Secured” – rendered unusable, unreadable or indecipherable to unauthorized individuals • Examples: - Encryption - Destruction © 2015 Seyfarth Shaw LLP 50

Breach – Exceptions (Involve Privacy Officer) • Any unintended acquisition of PHI by an individual acting under the authority of the plan, if: - The person was acting in good faith and within the scope of employment, and - The person did not in appropriately use the information once acquired • For example, a misdirected e-mail received by an employee that is deleted by the recipient © 2015 Seyfarth Shaw LLP 51

Breach – Notification to Individual • Must be given by first-class mail at individual’s last known address • If no address, must use a substitute method: - For less than 10 individuals, must use another reasonable method, such as telephone; - For more than 10 individuals, must notify via publication © 2015 Seyfarth Shaw LLP 52

Breach – Notification to Media • If the Breach involves more than 500 individuals, notice must be provided: - to prominent media outlets in the area where the individuals reside, - without unreasonable delay, and - in no case later than 60 calendar days after the date the breach was discovered © 2015 Seyfarth Shaw LLP 53

Breach – Notification to HHS • Breaches of < 500 people: - Keep a log of breaches - Notify HHS of the breaches within 60 days of the end of the calendar year in which the breach was discovered. • Breaches of > 500 people: - HHS must be notified at the same time notice is made to individuals © 2015 Seyfarth Shaw LLP 54

Part IV HIPAA Enforcement © 2015 Seyfarth Shaw LLP 55

Minimum Civil Penalties No knowledge = $100/ violation, up to $25 k cap © 2015 Seyfarth Shaw LLP Reasonable Cause = $1, 000/ violation, up to $100 k cap Willful Neglect = $10 k / violation if corrected in 30 days; $50 k if not), up to $100 k cap 56

Maximum Civil Penalties $50 k / violation up to a cap of $1. 5

HIPAA Enforcement • First civil monetary penalty against a Seattle hospital • $100, 000 for 30 + complaints of lost PHI (e. g. lost laptops) • 386, 000 individuals’ data exposed • $. 38 per individual 2008 2009 Settlement with CVS Pharmacy for $2, 250, 000 penalty for failure to implement HIPAA policies during disposal process © 2015 Seyfarth Shaw LLP Settlement with Rite Aide on similar facts for $1, 000 2010 Settlement with Alaska Department of Health and Social Services for $1, 700, 000 related to stolen flash drive 2011 2012 $4, 300, 000 penalty against Cignet Health for failure to respond to patient’s request for medical records and failure to cooperate with HHS 58

Civil Enforcement • HHS received over 87, 000 complaints of HIPAA violations • OCR has resolved 95% through - 21, 000 via enforcement - 9, 800 found no violation - 51, 000 were not eligible for enforcement • Most common issues (in order): - Impermissible uses and disclosures of PHI Lack of safeguards for PHI Uses and disclosures of more than minimum necessary PHI Lack of administrative safeguards of electronic PHI © 2015 Seyfarth Shaw LLP 59

Criminal Penalties Knowing violation – $50, 000 and one year in prison False pretenses– $100, 000 and five years in prison Intent to sell/use for commercial use – $250, 000 and ten years in prison © 2015 Seyfarth Shaw LLP 60

How will HHS ever know whether we are HIPAA compliant? • HHS recently wrapped up a round of mandatory audits - HHS hired KPMG to perform the pilot program Launched in November 2011 Audited approximately 150 covered entities Published audit protocols • Audits viewed primarily as a “compliance improvement” activity - Results will not identify specific entities audited © 2015 Seyfarth Shaw LLP 61

State Attorney Generals Can Also Sue Under HIPAA • CT AG sued Health Net due to missing hard drive containing 446, 000 individual’s PHI • MN AG brought first action against a business associate, Accretive Health, in connection with theft of an unencrypted laptop computer containing approximately 23, 500 patients’ records • HITECH creates 50 new “HIPAA Police” © 2015 Seyfarth Shaw LLP 62

PHInal Exam An employee asks his supervisor for help with a denied medical claim. The supervisor e-mails you to ask you to look into it. You contact the third party administrator and find out why the claim was denied. True or False? You can e-mail the supervisor to let him know why the claim was denied so he can explain it to the employee. © 2015 Seyfarth Shaw LLP 63