HIPAA Vendor Assessments

HIPAA Analytics offers healthcare providers, vendor (Business Associates) due diligence consulting to ensure vendors meet required levels of HIPAA privacy and security. The assessment process is generally customized to meet provider requirements that focus on the nature of the vendor services, business process, types of data, and technology that support the provider. Depending on the scope of the assessment, project tasks may include;

  • Developing a due diligence vendor questionnaire and supporting the vendor completion.
  • Providing validation of questionnaire responses.
  • Providing ongoing activities related to the development, implementation, maintenance, and adherence to the vendors policies and procedures covering the privacy and security of patient protected health information (PHI) in compliance with federal and state laws.
  • Collaborate with vendor business and technology departments to define and develop compliance policies and procedures in connection with provider/vendor service agreements.
  • Coordinating and communicating due diligence requests with contacts within the vendor business units and other third-party service providers
  • Evaluate and score due diligence materials related to a vendors HIPAA privacy and security compliance program.
  • Work closely with vendors to remediate any gaps or weaknesses related to a vendor’s compliance program.
  • Provide training to vendor business units related to the requirements for complying with the provider contract and business associate agreement.
  • Review, revise and, at times, draft policies, procedures, and guidelines to ensure business processes are in compliance with provider and vendor program.
  • Develop and maintain reports to communicate to provider compliance issues found or non-compliance with the vendor compliance program.
  • Develop and/or enhance tools to assist vendor in complying with provider contract and vendor business associate agreement.

Contact us for more information on HIPAA vendor assessments and services.

Based in Minneapolis/St. Paul, MN we are centrally located to serve clients anywhere in the nation.

 

 

Data Breach Prevention and Notification Plan

In today’s expanding HIPAA compliance environment, staying on top of privacy and security regulations amended by the recent HITECH Act can be daunting. For example, one new regulatory requirement includes establishing data breach notification requirements for HIPAA covered entities and their business associates. The challenge for healthcare organizations in this provision alone becomes the process of measuring exposure to a data breach, developing policies and procedures to reduce exposure and developing a data breach incident plan to help minimize risk.

Need for Compliance Support
While the process of implementing new data breach requirements appear simple enough, most healthcare organizations admit they are not equipped to meet new data breach requirements. In fact, a recent study[1] on Patient Privacy and Data Security by the Ponemon Institute reports a key takeaway…”Most healthcare organizations experience undetected breaches of patient data due to lack of preparation and staffing. Healthcare organizations in our study told us they have inadequate resources (71 percent), few (if any) appropriately trained personnel (52 percent) and insufficient policies and procedures in place (69 percent) to prevent and quickly detect patient data loss.”

Full Impact of Data Breach
According to another Ponemon Institute study[2] , the data breach incident cost to U.S. companies is $202 per compromised customer record in 2008. Cost factors include, expensive outlays of investigative and administrative expenses, customer defections, opportunity loss, reputation management, and costs associated with customer support such as information hotlines and credit monitoring subscriptions.

Reducing Data Loss: People, Process and Technology
In response to the potential negative effects of a data breach, healthcare organizations continue to upgrade their technology, yet according to Rick Kam, president of ID Experts, a data breach solutions company, explains in a recent data breach press statement[3] that, “Hardly a day goes by without news of some type of data breach being reported. Data breach incidents are growing in frequency and severity, while regulatory requirements for data privacy protection and incident notification are becoming more stringent. Although organizations entrusted with PII and PHI are making investments in technologies such as encryption and data loss prevention (DLP), none of these are “silver bullets” that will eliminate data breach risks. Despite the focus on failure or lack of adequate security controls within organizations, a far more significant and common portion of these events are simply the result of staff’s lack of awareness and/or compliance to internal security policies and lax practices to safeguard sensitive information.”

To be sure, any healthcare organization is complex, with countless internal and external data points touched by people, processes and technology. To achieve privacy and security assurance of data integrity a thorough analysis of “all” data points is key to a successful compliance program.

How We Can Help
Our data breach prevention audit examines PHI handled by people, processes and technology. Our audit will inventory PHI, evaluate policies and procedures, examine staffing roles, review business processes, conduct a security evaluation and upgrade training and awareness programs as needed.

[1] Benchmark study on patient privacy and data security, November 2010, Ponemon Institute, sponsored by ID Experts.
[2] Fourth Annual US Cost of Data Breach Study, January 2009, Ponemon Institute.
[3] Data breach risks and privacy compliance: The expanding role of the IT Security professional, Data Breach Press 2010, ID Experts.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us

Business Associate Strategy and the HITECH Act

Expanded Scope and Enforcement of HIPAA

Whether you are a hospital, insurance company or a vendor to healthcare, recent federal legislation has dramatically changed the rules regarding privacy and security compliance.

On February 17, 2009, President Obama signed into law the American Recovery and Reinvestment Act of 2009 [PDF], which contained provisions comprising the Health Information Technology for Economic and Clinical Health Act, or HITECH Act (“Act”). The Act makes sweeping changes to the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

The Act imposes additional privacy and security rules on business associates. For example, The Act provides for the business associate’s compliance with the terms of the business associate agreement a direct requirement of HIPAA. The Act also applies the administrative, physical and technical safeguard requirements of the security rule to business associates, including obligations related to policies, procedures and documentation.

Additionally, new data security breach notification requirements within the Act now apply to both covered entities and business associates, requiring patient notification of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information. Moreover, increased civil and criminal penalties now apply to violations of HIPAA privacy and security requirements and authorize state attorneys general to bring civil actions on behalf of state residents adversely affected or threatened by such violations.

Healthcare organizations are faced with a growing trend of sharing confidential health information with vendors (business associates) in order to meet critical business needs, yet from a risk management perspective, little if any measurement of business associate compliance knowledge is evaluated, leaving little assurance of sound compliance practices by the business associate handling patient confidential health information.

Privacy violations and security data loss by business associates and their sub-contractors have also become a strategic liability issue for healthcare organizations. For example, new security breach notification rules of the require patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information. New security breach notification requirements apply to covered entities and require business associates to notify covered entities of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information they hold on behalf of the covered entity, including the identity of each individual who is the subject of the unsecured protected health information.

According to the Ponemon Institute [PDF], a privacy and information management research firm, the data breach incident cost to U.S. companies is $202 per compromised customer record in 2008. Cost factors include, expensive outlays for detection, escalation, notification and response, along with legal, investigative and administrative expenses, customer defections, opportunity loss, reputation management, and costs associated with customer support such as information hotlines and credit monitoring subscriptions.

Bottom line. Make sure you have updated business associate agreements* in place by February 17, 2010.

*To view a sample HITECH Act Business Associate Agreement, view the RECENT ARTICLES section above entitled Healthdatamanagement.com—February 9, 2010 — New Model BA Agreement, or simply click here to go directly to the site.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us

HIPAA Security Evaluation: Checking Your Compliance Vital Signs

Checking Your Compliance Vital Signs
In health care, we think of “Vital Signs” as the measurements of body temperature, pulse, respiration rate, and blood pressure. Vital signs provide information about your general health. They offer clues to medical conditions. When you are sick, they are used to help check your return to good health.

In a similar way, HIPAA has “Vital Signs”, although not measurements of body temperature, pulse, respiration rate, and blood pressure. HIPAA created the Evaluation Standard 164.308(a)(8), which requires a periodic technical and non-technical evaluation of the healthcare organizations security safeguards to demonstrate and document compliance with security policy and the security rule requirements. In the case of your HIPAA program, the required periodic evaluation provides information about your organizations compliance health. The evaluation offers clues to the condition of security safeguards. If safeguards are found lacking, the evaluation is used to help check the return to good compliance health. Let’s examine the specific rule:

Evaluation 164.308(a)(8)
HIPAA Standard: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which an entity’s security policies and procedures meet the requirements of this subpart.

Required Standard
HIPAA created the Evaluation Standard 164.308(a)(8), which requires a periodic technical and non-technical evaluation (emphasis added) of the healthcare organizations security safeguards to demonstrate and document compliance with their security policy and the security rule requirements. Required standard, means, “a covered entity must implement the implementation specifications”.

Some Thoughts on Conducting an Evaluation

  1. Decide whether the evaluation will be conducted with internal staff resources or external consultants.
  2. Engage external expertise to assist the internal evaluation team where additional skills and expertise is determined to be reasonable and appropriate.
  3. Use internal resources to supplement an external source of help, because these internal resources can provide the best institutional knowledge and history of internal policies and practices.

Develop Standards and Measurements for Reviewing All Standards and Implementation Specifications of the Security Rule

  1. Use an evaluation strategy and tool that considers all elements of the HIPAA Security Rule and can be tracked, such as a questionnaire or checklist.
  2. Implement tools that help document and report on the level of compliance, integration, or maturity of a particular security safeguard deployed to protect EPHI.
  3. If available, consider engaging specific staff or management having responsibilities that include security (for example, billing manager).
  4. Leverage any existing reports or documentation that may already be prepared by the organization addressing compliance, integration, or maturity of a particular security safeguard deployed to protect EPHI.

Conduct Evaluation

  1. Determine, in advance, what departments and/or staff will participate in the evaluation.
  2. Secure management support for the evaluation process ensures participation.
  3. Collect and document all needed information.
  4. Collection methods may include the following: Interviews, surveys, third party examinations
  5. Outputs of automated tools, such as access control auditing tools, system logs, and results of penetration testing.
  6. Conduct penetration testing (where trusted insiders attempt to compromise system security for the sole purpose of testing the effectiveness of security controls), if reasonable and appropriate.

Document Results

  1. Reasonable and appropriate documentation practices will often include:
  2. Analyze the evaluation results.
  3. Identify security weaknesses.
  4. Document in writing every finding and decision.
  5. Develop security program priorities and establish targets for continuous improvement.

Repeat Evaluations Periodically

  1. Establish the frequency of evaluations, taking into account the sensitivity of the EPHI controlled by the organization, its size, complexity, and environmental and/or operational changes (e.g., other relevant laws or accreditation requirements).
  2. In addition to periodic re-evaluations, consider repeating evaluations when environmental and operational changes are made to the organization that affect the security of EPHI (e.g., if new technology is adopted or if there are newly recognized risks to the security of the information).

Conducting your annual security evaluation is an excellent way to insure you have complied with Evaluation Standard 164.308(a)(8) of HIPAA and have documented your organizations HIPAA vital signs.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us

HIPAA Security Training: A Flexible Approach

Whether your organization is an insurance company, hospital, clinic, dental group, elder-care facility or anything in between, security awareness and training is required of all members of its workforce (including management).

So how must healthcare organizations plan to meet the Security and Awareness Training Standard? As a first step, I often caution clients to review specific standards and the references made as a part of the standard – for example, §164.308, the Security Awareness and Training Standard must be read in conjunction with § 164.306 Security Standards: General rules, since the General Rules help the organization understand the general intent of the standards and guidance for implementing them. Take a look at the General Rules and see for example the guidance on a “Flexible Approach” -

§ 164.306 Security Standards: General Rules

(a) General requirements. Covered entities must do the following:
(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits.
(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under sub-part E of this part.
(4) Ensure compliance with this subpart by its workforce.
(b) Flexibility of approach. (Emphasis added)
(1) Covered entities may use any security measures that allow the covered entity to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.
(2) In deciding which security measures to use, a covered entity must take into account the following factors:
(i) The size, complexity, and capabilities of the covered entity.
(ii)The covered entity’s technical infrastructure, hardware, and software security capabilities.
(iii) The costs of security measures.
(iv)The probability and criticality of potential risks to electronic protected health information.

As you can see, the General Rules help answer the question…”We are a clinic and cannot afford a large scale training program like a hospital, what can we do?” By reading § 164.306 Security Standards: General Rules, healthcare organizations of any size will realize the “flexibility” built into the regulations are designed to accommodate healthcare operations of any size.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us