“OCR Enforcement Update” was the topic of the presentation by Iliana Peters, HHS Office for Civil Rights (OCR) Senior Adviser for HIPAA Compliance and Enforcement at the Health Care Compliance Association (HCCA) Compliance Institute. She provided an update on enforcement, current trends, and breach reporting statistics. Peters stated that the OCR continues to receive and resolve complaints of Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) violations of an increasing number. She cited that OCR has received 150,507 complaints to date, with 24,879 being resolved with corrective action measures or technical assistance. At the rate of reports being received, the OCR is estimating receiving 17,000 complaints in 2017. She said that this year OCR has placed a major priority on privacy issues and will be issuing guidance on this, ranging from social media privacy, certification of electronic health record technology, and the rationale for penalty assessment. She spoke about OCR’s Phase 2 audits that are underway, involving 166 covered entities (CEs) and 43 business associates (BAs). These audits are to ensure CEs’ and BAs’ compliance with the HIPAA Privacy, Security, and Breach Notification Rules that include mobile device compliance. They address privacy, security, and breach notification audits. It is expected that among the results of this effort will be increases in monetary penalties this year. Phase 3 will follow the same general approach currently being used, which includes review of control rules for privacy protection, breach notification, and security management.
In her comments about what the OCR has learned from its audits and investigations, Peters made the point that most HIPAA breaches still commonly occur as a result of poor controls over systems containing protected health information (PHI). A particular vulnerability has been mobile devices, such as laptops computers, that failed to be properly protected with encryption and password.
Peters provided in her slide presentation considerable advice as what CEs and BAs should do to prevent breaches and other HIPAA-related problems. CEs and BAs should:
- ensure that changes in systems are updated or patched for HIPAA security;
- determine what safeguards are in place;
- review OCR guidance on ransomware and cloud computing;
- conduct accurate and through assessments of potential PHI vulnerabilities;
- review for proliferation of electronic PHI (ePHI) within an organization;
- implement policies and procedures regarding appropriate access to ePHI;
- establish controls to guard against unauthorized access;
- implement policies concerning secure disposal of PHI and ePHI;
- ensure disposal procedures for electronic devices or clearing, purging, or destruction;
- screen appropriately everyone in the work area against the OIG’s List of Excluded Individuals and Entities (LEIE);
- ensure departing employees’ access to PHI is revoked;
- identify all ePHI created, maintained, received or transmitted by the organization;
- review controls for PHI involving electronic health records (EHRs), billing systems, documents/spreadsheets, database systems, and all servers (web, fax, backup, Cloud, email, texting, etc.);
- ensure security measures are sufficient to reduce risks and vulnerabilities;
- investigate/resolve breaches or potential breaches identified in audits, evaluations, or reviews;
- verify that corrective action measures were taken and controls are being followed;
- ensure when transmitting ePHI that the information is encrypted;
- ensure explicit policies and procedures for all controls implemented; and
- review system patches, router and software, and anti-virus and malware software.
Expert tips to meet HIPAA compliance requirements
Carrie Kusserow, MA, CHC, CHPC, CCEP, is a HIPAA expert with over 20 years of compliance officer and consultant experience. She pointed out that the OCR finds that most HIPAA breaches still commonly occur as a result of poor or lapsed controls over systems with PHI. She noted that Iliana Peters stated that the OCR often encounters situations where established internal controls were not followed; in many cases, discoveries of breaches within organizations were not promptly investigated. Also, most of the breaches currently being reported involve mobile devices, specifically laptop computers, and a failure to properly encrypt and password protect PHI. Kusserow offered additional tips and suggestions to those offered in the OCR presentation, particularly as it relates to mobile devices.
- Conduct a complete security risk analysis that addresses ePHI vulnerabilities.
- Ensure the Code of Conduct covers reporting of HIPAA violations.
- Validate effectiveness of internal controls, policies, and procedures.
- Maintain an up-to-date list of BAs that includes contact information.
- Ensure identified risks have been properly addressed with corrective action measures.
- Develop corrective action plans to promptly address any weaknesses or breaches identified.
- Follow the basics in prevention of information security risks and PHI breaches.
- Ensure policies/procedures govern receipt and removal of laptops containing ePHI.
- Verify workforce member and user controls for gaining access to ePHI.
- Verify laptops and other mobile devices are properly encrypted and password protected.
- Implement safeguards to restrict access to unauthorized users.
- Review adequacy of security processes to address potential ePHI risks and vulnerabilities.
- Ensure the hotline is set up to receive HIPAA-related calls.
- Verify that all BAs have signed business associate agreements.
- Train the workforce on HIPAA policies/procedures, including reporting violations.
- Investigate complaints, allegations, and reports of non-compliance promptly and thoroughly.
- Engage outside experts to independently verify controls are adequate and being followed.
Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.
Copyright © 2017 Strategic Management Services, LLC. Published with permission.