Preparation is key to HIPAA compliance for health IT vendors

Health IT vendors are not breach proof but should be “breach ready,” according to a Health Care Compliance Association webinar entitled, HIPAA: Marketing and Contracting Solutions for Health IT Vendors. William J. Roberts, partner at Shipman & Goodman LLP, discussed strategies for vendors to incorporate compliance with the Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) into negotiations, agreements, and policies.

HIPAA landscape

HIPAA privacy continues to grow in importance for the health care sector, for both covered entities and their vendors. Roberts said that health IT vendors face two challenges: managing covered entity customers that have concerns about HIPAA compliance, a “major undertaking” when a vendor has thousands of covered entity customers, and a regulatory and enforcement landscape that is shifting its focus from covered entities to vendors (see 2017 OCR resolution agreements off to a strong start, June 30, 2017; Business associates no longer second to covered entities as OCR increases focus, November 22, 2016). He pointed out that 60 percent of business associates have suffered a data breach, and in 2016 HHS imposed a $650,000 penalty in the first HIPAA enforcement action against a business associate (see $650K payment, 6 year CAP resolve nursing home ePHI loss, July 1, 2016).

Pitches

A vendor should already have developed a formal HIPAA compliance program before reaching out to potential customers, and HIPAA compliance should be at the forefront of a vendor’s pitch or response to a request for proposals. The vendor should provide a summary of its HIPAA compliance policies, including its establishment, review, security, and training. A policy summary, said Roberts, is preferable to disclosing the policies themselves, which would be a “roadmap to being hacked.” Roberts also advised vendors to highlight certifications and set forth clear expectations for the privacy aspects of the proposed relationship.

Business associate agreements

The business associate agreement is a vendor’s first opportunity to make a good impression regarding its commitment to privacy. Vendors should have at least one template agreement, or more than one for different types of customers. Roberts advised knowing what a vendor can and cannot agree to before a negotiation and educating the sales team to avoid later back-pedaling on a promise. He also suggested empowering the customer by providing a “menu” of choices that are acceptable to the vendor—for example, barebones breach notice within five days or a more thorough notice at 15 days.

If customers are or might someday be substance abuse treatment providers, the vendor should consider this same approach for qualified service organization agreements. The vendor should review its customers and potential targets for the application of the “Part 2” confidentiality rules and include a provision in the agreement requiring the customer to notify the vendor of the customer’s status as a Part 2 program.

Data breach response

No human or service is perfect, and a vendor will probably have a data breach at some point, said Roberts, which makes a detailed data breach response plan “vital.” He identified the following elements of a breach response plan:

  • Develop an incident intake procedure.
  • Identify the leaders and members of the response team.
  • Rely on standard templates and standard works.
  • Consider a “playbook” and/or a breach reporting decision tool.
  • Develop a customer relations strategy before the breach occurs.
  • Have support vendors ready to act.

The vendor should not simply notify the customer that a breach has occurred; it should have a plan and proposal that it can offer the customer. The process should:

  • provide the covered entity the information it needs to fulfill its own legal obligations;
  • reassure the customer that the situation is under control and being handled properly;
  • inform the customer of steps the vendor has taken and is willing to take on behalf of the covered entity;
  • provide a “menu” of services available to the customer; and
  • create a plan for the future—a holistic look at what the company is doing, not just boilerplate language.

OCR shows no signs of slowing HIPAA enforcement

The HHS Office for Civil Rights (OCR) is on pace to have another record-breaking year for enforcement actions against covered entities (CEs) and business associates (BAs) accused of Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) violations. As of February 13, 2017, it had already entered into two resolution agreements with CEs and imposed civil monetary penalties (CMPs) on another for only the third time in its history. Prior to 2016, the OCR had not entered into more than six resolution agreements with CEs or BAs in single year. As of December 2016, the OCR had entered into twice that number. As of February 13, 2016, the OCR had just imposed its second CMP, but had not yet entered into any resolution agreements.

The agency kicked off the year by entering into a $475,000 resolution agreement with Presence Health. Unlike past agreements that settled potential violations of the HIPAA Privacy and Security Rules, the Present Health resolution represented the OCR’s first agreement to resolve potential violations of the HIPAA Breach Notification Rule. Presence failed to notify the OCR, affected individuals, and the media that paper-based operating schedules containing the protected health information (PHI) of 836 individuals had gone missing in the statutorily-required 60-day timeline for breaches affecting more than 500 individuals; instead, it waited more than 100 days.

Eight days later, the OCR announced a $2.2 million resolution agreement with MAPFRE Life Insurance Company of Puerto Rico for Security Rule violations affecting the data of 2,209 individuals. The OCR determined that MAPFRE failed to perform a risk analysis, implement risk management plans, and encrypt data stored in removable storage media led to a breach caused when a thief stole a USB data storage device containing electronic PHI (ePHI).

In early February, the OCR announced that it had issued a final determination and imposed a $3.2 million CMP on Children’s Medical Center of Dallas due to a pattern of noncompliance with the Security rule. Children’s suffered a breach in 2010 due to the loss of an unencrypted, non-password-protected BlackBerry device containing the ePHI of 3,800 individuals.  It suffered a second breach in 2013; despite the first breach, Children’s had failed to encrypt a laptop containing the ePHI of 2,462 individuals that was later stolen. The agency determined that the CMP was merited based on Children’s failure to implement risk management plans, in contravention of prior recommendations to do so, and its failure to encrypt mobile devices, storage media, and workstations. The OCR also imposed CMPs against Lincare, Inc., a home health company, in 2016 and against Cignet Health in Prince George’s County, Maryland, in 2011.

The agency stepped up enforcement efforts in 2016, in part due to negative reports regarding its performance from the HHS OIG and the Government Accountability Office (GAO). It began the Phase 2 audit process, targeting both CEs and BAs, and announced its intention to allocate resources for the first time to investigate complaints of breaches affecting 500 individuals or fewer. It appears geared to continue, if not ramp up, its enforcement efforts, but the impact of newly appointed HHS Secretary Thomas E. Price, M.D.–who will appoint a new OCR director–remains to be seen. Price, a physician and former Congressional representative has historically opposed government regulatory activity of physicians. However, Adam H. Greene, Partner at Davis Wright Tremaine, suggests that, although Price the physician may dislike HIPAA, “his personal views will [not] necessarily lead to a significant change in enforcement.”

 

Hackers to focus on hospitals in 2017

Hackers will target the health care sector above all others in 2017, with their focus shifting from insurers to hospitals, predicts Experian® Data Breach Resolution. The company’s fourth annual Data Breach Industry Forecast also indicates that ransomware will be an increased threat to hospitals. It suggests that “nation-state” cyberattacks will increase, with at least one significant incident in 2017, and that passwords will be phased out in favor of two-factor authentication.

Hospital focus

In 2015, four of the six data breaches reported to the HHS Office for Civil Rights (OCR) affecting more than one million individuals targeted health care insurance companies.  As a result, Michael Bruemmer, vice president of Experian Data Breach Resolution, noted that many insurers “doubled down on defenses.” Protected health information (PHI) remains a lucrative source of data for hackers, but the report suggests that hackers will seek this information from hospitals, in lieu of insurers, in 2017. Bruemmer noted that hospitals “tend to be more decentralized, making their cybersecurity defenses easier to penetrate.” Electronic health records (EHRs), in particular, are targeted because they are accessible by various entities and individuals. The report predicts that ransomware–which encrypts data, effectively preventing providers from using data unless they pay a ransom–will increase, and may shift from simply locking systems in exchange for money to actually stealing data. At any rate, recent OCR guidance on ransomware makes it likely to be a more publicized topic in 2017 (see Data for ransom: OCR offers ransomware guidance).

Nation-state attacks

The report also anticipates an escalation in cyberattacks between nation-states in 2017, noting that both U.S. presidential candidates discussed the issue in 2016. Although Bruemmer noted in December that the incoming Trump administration’s cyberweapons policy is unclear, he anticipates “a publicly observable action in the near future” and thus recommends that the administration “shor[e] up its defense mechanisms and identify[ ] vulnerabilities.”  Amidst heated discussions on both sides regarding Russia’s alleged interference with the recent U.S. presidential election, President-elect Trump appointed Thomas P. Bossert as Assistant to the President for Homeland Security and Counterterrorism. Bossert indicated, “We must work toward cyber doctrine that reflects the wisdom of free markets, private competition and the important but limited role of government,” and noted, “The internet is a U.S. invention,” that should reflect the nation’s values “as it continues to transform the future for all nations and all generations.”  The president-elect, recently reflecting on cybersecurity, noted “no computer is safe.”

Death of the password?

The report also predicts that individual passwords will be phased out, in all industries, in favor of two-factor authentication, which requires secondary authentication to allow access to systems and networks.  It lists tokens, geo location confirmation, and biometrics as examples of secondary authentication. Individuals’ use of the same passwords for various accounts can lead to “aftershock” breaches, which occur when a password compromised in one breach is used to break into another network in the future.  Experian Data Breach Resolution suggests that health care organizations will be forced to use two-factor authentication to protect against aftershocks.

HHS says sharing is preparing for cybersecurity threats

Cyber threat information sharing can help efforts to prevent, detect, and respond to cyber-attacks, according to the HHS Office of the National Coordinator for Health Information Technology (ONC) and the Assistant Secretary for Preparedness and Response (ASPR). Premised on the belief that health system preparedness requires knowledge of up-to-date threat information, the ONC and ASPR issued two funding opportunities to develop an Information Sharing and Analysis Organization (ISAO) for the health care sector.

Cyber Threats

As the health system becomes digital and health information takes on an increasingly electronic format, cyber threats have become a regular burden for health systems. Despite the growing threat, many components of the health care system lack the technological abilities to identify and protect themselves from cyber threats. Under the Cybersecurity Information Sharing Act (CISA) agencies, like HHS, were directed to develop tools that can help with the sharing of cybersecurity threat risks. Prior to the CISA, Executive Order 13691, signed on February 13, 2015, encouraged information sharing related to cyber threats between the government and private sector.

Recent Threats

Although some governmental efforts have focused on preparedness, data breaches continue to be a burden for the health care industry. This summer, Banner Health reported a cyberattack potentially affecting the protected health information (PHI) and payment card data of 3.7 million patients. The breach resulted from a hack of Banner’s point-of-sale systems, which may have been connected to its clinical systems. Such a lack of segmentation, may have contributed to the breach. Segmentation is the segregation of a network into areas that limits access to only those people, servers, and applications that need access, as a method of preventing hackers who enter part of a system from gaining complete control. However, the threat of cyber-attack reaches far beyond Banner Health. The scope of cyber threats is readily apparent from HHS’ “wall of shame,” which lists all of the breaches affecting 500 or more people that have been reported to the Office for Civil Rights (OCR).

ISAO

The idea behind the ISAO is to allow organizations with greater cyber threat knowledge share their understanding with less-equipped organizations. For example, with greater information sharing regarding the risks of segmentation, perhaps the scope of the Banner breach could have been mitigated. HHS hopes by sharing information between HHS and the health care and public health sector, the capacity to better prevent, detect and respond to cyber-attacks will improve. The funding directs an ISAO to:

  • provide cybersecurity information and education on cyber threats affecting the healthcare and public health sector,
  • expand outreach and education activities to assure that information about cybersecurity awareness is available to the entire healthcare and public health sector,
  • equip stakeholders to take action in response to cyber threat information, and
  • facilitate information sharing widely within the healthcare and public health sector regardless of the size of the organization.

HHS hopes its combined funding opportunities—$250,000 that can be renewed for up to five years—will help spread cyber threat information among industry stakeholders and federal partners.