Laureen shows you her proprietary “Bubbling and Highlighting Technique”
Download your Free copy of my "Medical Coding From Home Ebook" at the top right corner of this page
One costly error, two big lessons learned. We all make mistakes. Thankfully, few of us ever make a mistake that costs us $ 2.175 million. That was the price Sentara Hospitals will have to pay for their mistake: a mail merge error that led to numerous hospital bills being sent out to the wrong patients — […]
The post Sentara HIPAA Breach Teaches Us About PHI appeared first on AAPC Knowledge Center.
Avoid HIPAA breaches from ransomware attacks
Although ransomware is not a new phenomenon, a recent increase in reported attacks along with several well-publicized cases have raised the public’s awareness of the threat it poses. Ransomware, a variety of malware, can be incredibly damaging because it is designed to infect a system, find and encrypt the system’s data, and lock out users until they pay a ransom–typically in an anonymous electronic currency like bitcoin–to regain access through a decryption key.
According to a U.S. government interagency report, there have been approximately 4,000 ransomware attacks each day since the beginning of the year, up from the 1,000 daily attacks reported last year. Further, a recent analysis by managed security services provider Solutionary found that 88% of ransomware attacks during the second quarter of this year targeted healthcare entities.
"Hospitals rely on data systems not only for the survival of their business, but the survival of their patients. Because of this, the perceived value of the data becomes much greater, meaning the criminals can charge premium ransoms against their victims," says Travis Smith, senior security research engineer at Tripwire, a Portland, Oregon-based cybersecurity firm.
The variants of ransomware that exist can complicate a hospital or other healthcare provider’s response, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. In addition to the typical form of ransomware that infiltrates systems and locks users out of their data unless they make some form of payment, some types can also exfiltrate a copy of the locked data to the hacker, or delete the data but make it seem as though it’s encrypted and still present-tricking the user into paying for data that is actually gone.
"In each scenario, you don’t know if there is intention to release the data if you pay or not. You may pay and still get nothing. Or you may get it back. There is no certainty to it. Some victims have gotten access back; others have not," says Goldstein, a former software developer and network administrator. "The general guidance from law enforcement, such as the FBI, is not to pay ransom. But if everything you have is locked out, you may not feel like you have a choice."
HHS guidance
In light of the increased prevalence of ransomware threats, the U.S. Department of Health and Human Services (HHS) recently released guidance to help covered entities understand the risks associated with these types of attacks and how complying with HIPAA can help identify, prevent, and recover from ransomware.
"The HHS is just reacting to what is happening in the marketplace. The sustained increase in the number of successful ransomware attacks is proof that the ransomware problem is going to get worse before it gets better. Issuing guidance is raising awareness of the issue at hand," Smith says.
The HHS guidance states that healthcare entities can better protect against ransomware by implementing security measures required by the HIPAA Security Rule. According to the guidance, these measures include limiting access to electronic protected health information (PHI) to personnel and software that require it; and conducting risk analyses to identify threats and vulnerabilities to PHI.
"You have to do the risk analysis. Ransomware is just another form of malware; it’s particularly insidious, but they all require doing the risk analysis," says Goldstein.
A big takeaway from the HHS guidance is the importance of taking appropriate actions beforehand to mitigate the potential of damage caused by ransomware, he adds. Unlike malware that simply transfers PHI without authorization, ransomware makes the PHI unavailable or destroys it altogether.
"For a healthcare provider in particular, having data exfiltrated means there’s damage to the patients, but likely not to their immediate health. Being locked out of your health data or your patients’ health data is a potential threat to the life and health of patients," he says.
HIPAA breaches
The guidance provides clarification on whether a ransomware infection constitutes a HIPAA breach. A breach under HIPAA is any acquisition, access, use, or disclosure of PHI in a manner that is not permitted under the HIPAA Privacy Rule and that compromises the PHI’s security or privacy.
Prior to the release of the HHS guidance, instances of data exposure that revealed individuals’ PHI would be considered a HIPAA breach, says Justin Jett, director of compliance and auditing at Plixer International, a Kennebunk, Maine-based security analytics company. However, at that point, one could have made the argument that ransomware wouldn’t technically be considered a breach since it encrypts data rather than exposing it.
Now, according to the new guidance, if a ransomware infection encrypts electronic PHI that was not encrypted prior to the incident, a breach has occurred. The guidance reasons that the PHI has been "acquired" because hackers have taken control or possession of it. In these cases, the hospital must then undertake a risk analysis and, when applicable, comply with the breach notification requirements and notify individuals affected, HHS, and the media.
However, if the hospital had previously (prior to the ransomware attack) encrypted the PHI in a manner that would render it unusable, unreadable, or undecipherable to an unauthorized individual, there is a possibility the ransomware attack wouldn’t be considered a breach.
"I interpret this guidance as removing the loophole of ransomware not actually looking at the data. Since malware changes over time, it’s within the realm of possibility that ransomware will target [PHI] and exfiltrate the data once found. The new guidance states that if the ransomware is unable to actually see the protected healthcare information in cleartext (not encrypted), then it is not a reportable breach," Smith says.
Even in these cases, the guidance says additional analysis would be required to determine if the PHI was sufficiently encrypted prior to the attack. Goldstein says this emphasizes the need for a risk analysis whenever there is a security incident. He further noted that HHS may have included this guidance so covered entities could not view the ransomware’s own encryption of the data as protection against that data being compromised.
"In those cases, the data is technically encrypted by virtue of the ransomware, but it’s not encrypted by the covered entity; it’s encrypted by someone else who controls that encryption. It shouldn’t be viewed as encryption for the purposes of your risk analysis," Goldstein says."
Prevention and recovery
To better prevent ransomware, Jett says all staff should be appropriately trained on email and web security as most malware and ransomware comes from those sources. Additionally, companies should invest in heightened email security solutions, like anti-spam firewalls, which will help prevent the most obvious attacks from getting to employees’ inboxes.
The HHS guidance suggests that since HIPAA requires the workforces of covered entities to receive security training on detecting and reporting malware, employees can assist with early detection of ransomware by spotting indicators of an attack. These warning signs could include unusually high activity in a computer’s CPU as the ransomware encrypts and removes files, or an inability to access files that have been encrypted, deleted, or relocated.
Even if hospitals are vigilant, ransomware attacks may still occur. Again, the guidance suggests that HIPAA compliance may help hospitals recover from ransomware attacks due to HIPAA’s mandate for frequent backups of data.
Goldstein warns, however, that some variants of ransomware can lie dormant for a period of time in order to migrate across systems, including into data backups. Many hospitals and companies keep hot backups as part of their disaster recovery plan. These backups can be automatically or manually switched on if a system goes down. If ransomware has infiltrated a backup, the backup’s data could also become compromised and encrypted by the ransomware as soon as it’s activated.
"The important thing about dealing with the impact of ransomware is that it may require additional or different protections compared to what other malware requires to avoid or mitigate its ill effects," he says.
Recent ransomware attacks
All types of malicious software attacks are on the rise,but ransomware has recently received more high-profile media coverage, says Doron S. Goldstein, partner and co-head of privacy, data, and cybersecurity practice at Katten Muchin Rosenman, LLP, in New York City. "Ransomware has certainly gotten more coverage lately because of the potential damage, and the sophistication of some of these attacks has increased," he says.
The following are a few of the recent ransomware attacks that made headlines:
Hollywood Presbyterian Medical Center: In February, this Los Angeles hospital paid hackers the equivalent of $ 17,000 in bitcoins to regain access to its computer system, according to the Los Angeles Times. The malware prevented hospital staff from accessing their system for 10 days by encrypting its files; once the hospital paid the ransom, it was given a decryption key to unlock the files. In a statement, CEO Allen Stefanek said paying the ransom was the quickest way to restore the hospital’s systems.
Chino Valley Medical Center and Desert Valley Hospital: In March, hackers targeted these southern California hospitals by infiltrating their computer systems with ransomware. A spokesman for the two hospitals, which are part of Prime Healthcare Services, Inc., said technology specialists were able to limit the attacks so both hospitals remained operational, no data was compromised, and no ransom was paid.
MedStar Health: Also in March, this Columbia, Maryland-based system was targeted with ransomware that encrypted the system’s data. According to the Baltimore Sun, the hackers demanded that MedStar pay three bitcoins, worth approximately $ 1,250, to unlock a single computer, or 45 bitcoins, the equivalent of about $ 18,500, to unlock all of its computers. MedStar refused to pay the ransom, and staff at its 10 hospitals and more than 250 outpatient centers resorted to using paper records while system access was restored.
Kansas Heart Hospital: In May, hackers infected the network system of this Wichita hospital with ransomware. According to local CBS affiliate KWCH12, the hospital paid an undisclosed portion of the ransom demanded but the hackers refused to return full access and demanded a second payment. The hospital announced that it had refused to make the second payment and would work with its IT team and external security experts to restore access to the rest of the system.
HIPAA enforcement
Small breaches could become a big problem
In a year of high-profile, multimillion dollar settlements for large HIPAA breaches, OCR raised the stakes in a big way?by taking a harder line on small breaches. OCR announced plans to crack down on smaller breaches?those affecting fewer than 500 individuals?in August. Although all breaches must be reported to OCR, generally only breaches affecting 500 or more individuals are regularly investigated, while small breaches are investigated only as resources permit. OCR instructed its regional offices to increase investigations of small breaches to discover the root causes. Identifying common root causes will help the agency better measure HIPAA compliance throughout the industry and address industrywide compliance gaps, OCR said. Regional offices may obtain corrective action if an investigation of a smaller breach reveals noncompliance.
Regional offices were instructed to take several factors into consideration when investigating smaller breaches and determining potential corrective action. These are:
A closer look
OCR has come under fire for its handling of small breaches. In late 2015, a joint Pro Publica/NPR investigation analyzed federal data on HIPAA complaints and requested documents from OCR, including letters sent to entities that were the subject of HIPAA complaints (www.propublica.org/article/few-consequences-for-health-privacy-law-repeat-offenders). The investigation identified the top serial HIPAA violators, including the Department of Veterans Affairs and CVS. OCR generally responded to these complaints by sending letters reminding the entity of its obligation to protect patient privacy and follow HIPAA, and warned that if OCR received another complaint it may take more serious action. However, OCR rarely took any further or more serious action.
One reason could be that many of these breaches affect fewer than 500 individuals. Both large and small breaches must be reported through OCR’s web portal (www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html) but there are different deadlines for reporting each and, previously, they were not equally prioritized by OCR.
But that asymmetric enforcement policy left many frustrated and means that OCR may be missing data vital to creating an overall picture of HIPAA compliance and effectiveness. An NPR report released in conjunction with Pro Publica’s investigation revealed the lasting and personal harm done by small breaches (www.npr.org/sections/health-shots/2015/12/10/459091273/small-violations-of-medical-privacy-can-hurt-patients-and-corrode-trust).
Massive breaches caused by hackers will put patients at risk for medical and financial identity theft, but, considering the amount of personal data stored by entities across all industries and the sheer number of data breaches, it’s difficult to tie a specific breach to identity theft (see the July and August issues of BOH for more information on breaches and medical identity theft). Small breaches, however, often expose PHI to people in the community the patient lives and works in, leaving the patient at risk for far more personal harm.
But OCR hasn’t ignored all small breaches. In July, the agency reached a $ 650,000 HIPAA settlement with Catholic Health Care Services of the Archdiocese of Philadelphia (CHCS), a business associate (BA), for a 2014 breach affecting 412 individuals after an unencrypted mobile device was stolen (www.medicarecompliancewatch.com/news-analysis/business-associate-agrees-650000-hipaa-fine).
The agency’s strong action may have been spurred by CHCS’ long-standing organizationwide HIPAA noncompliance. CHCS hadn’t conducted a risk analysis since September 23, 2013, the compliance date of the Security Rule for BAs, and therefore had no risk management plan. CHCS also lacked any policies regarding the removal of mobile devices from its facility. OCR suggested that, due to CHCS’ widespread neglect of basic security measures, the fine could have been even higher and only a consideration of the role CHCS plays in delivering care to at-risk populations, including the elderly, disabled individuals, and individuals living with HIV/AIDS, tempered its decision.
Getting perspective
Implementing OCR’s directive may be a tall order for resource-strapped regional offices and it’s difficult to predict what the outcome will be, Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts, says.
"I’m not sure it’s actually going to make a huge difference, but I think, from the beginning, those of us who were watching HIPAA enforcement were concerned that, while HHS had good intentions, they just didn’t have the resources," she says.
That’s not surprising: HHS is a huge department with many major priorities, including CMS. But, given that HHS and OCR work with limited resources, the new focus on small breaches could be a significant sign of things to come, Borten says. The agency likely recognizes that small breaches are a huge unknown: There’s no "Wall of Shame" for small breaches and little in the way of accountable reporting.
"I just have the sense that there’s an enormous volume of under 500 breaches that get reported that we don’t hear much about," she says. "So I think it’s very important that they take this step."
Some organizations may have been inclined to brush off small breaches: 499 patients is still shy of the 500 mark, she points out, and an organization could easily add it to the end of the year small breach report and forget about it. Those organizations are the ones that will be in for the biggest wake-up call. "Hopefully they’ll hear this and they’ll think again," she says.
Large breaches often grab the headlines, and with good reason. But massive incidents like the Anthem breach may not provide the most useful data for either OCR or other covered entities (CE) and BAs. Massive breaches are statistically unlikely, according to a June 2015 report by researchers at the University of New Mexico and the Lawrence Berkeley National Laboratory (www.econinfosec.org/archive/weis2015/papers/WEIS_2015_edwards.pdf).
"Certainly, you could get hit by one of those big ones," Borten says. "But it’s much more likely, far more likely, you’re going to suffer smaller breaches."
Big breaches come with the risk of big settlements. OCR makes a point of publicizing HIPAA breach settlements and putting the dollar signs front and center. This year alone the agency has levied millions of dollars in HIPAA settlements fines for large breaches. But even as HIPAA breach settlement fines are getting bigger, the numbers don’t stack up against the amount of breaches that are reported each year. Many more organizations get away with little more than a strongly worded letter from OCR. A multimillion dollar fine may be significant for most organizations, but the odds are currently in their favor, Rick Kam, CIPP/US, president and co-founder of ID Experts, says.
"The likelihood that an organization will get fined is so low," he says. "They only catch the big ones, but there are millions of others that are losing data everywhere because nobody’s looking at them."
Too often, organizations assume that if the volume of patients affected by a breach is low, the impact is also low, Borten says, and that’s simply not true. Even a breach involving a single individual’s record can have serious consequences.
As physician practices and local hospitals are absorbed into large corporate health systems, executive perspective on small breaches can become even more skewed, Borten cautions. Executive officers overseeing multiple hospitals, clinics, and physician practices may be more interested in overall numbers and the big picture. A clinical summary handed to the wrong patient at a physician office across the state may simply not register and the impact on the patient will be invisible.
But it’s the duty of privacy and security officers to avoid making that same mistake, she says. "They should be wiser than to fall into that thinking. It falls to them to take a case to the senior leadership or the board of directors and make them recognize that it isn’t just the big breaches," she says. "We worry about the little ones, too."
Privacy and security officers should help provide C-suite the perspective to recognize small breaches and give them the proper weight. A small breach can be just as serious as a large one, Borten says. If an employee posts a patient’s PHI on a social media site, for example, the organization could find itself fighting a lawsuit; even if the case is dismissed, direct legal expenses and time and resources spent preparing documents add up fast. And, as the NPR report showed, it’s not only the patient’s reputation in the community that may suffer; an organization can easily earn a reputation as careless and unconcerned with its patients’ well-being after a small breach.
Small breaches, little data
Because small breaches aren’t investigated to the same standards as large breaches, it’s difficult to measure just how HIPAA-compliant most organizations are and what the real HIPAA pain points are. Another problem is the underreporting of small breaches, Borten says. In 2013 when the HIPAA omnibus rule was released, HHS strengthened the language describing what constitutes a reportable breach. However, HHS also commented at the time that it was concerned there was a significant amount of underreporting. Borten says her experience working with CEs and BAs proves HHS was right to be concerned.
"I think there’s a tendency for underreporting to be more common when there are just one or two patients involved," she says.
In the early days of HIPAA breach notification, some may have been under the impression that CEs and BAs were not required to report breaches affecting fewer than 500 individuals at all, she adds. But that’s never been the case. Although large and small breaches are reported to OCR according to different systems and time frames, organizations are required to treat any breach the same regarding notification to patients.
Adding up
Small breaches are likely more typical than large ones, Kam says. Since 2009, roughly 230,000 breaches have been reported to OCR. But only approximately 1,000 have been breaches affecting over 500 individuals and subject to the more stringent investigation procedure. Investigating all HIPAA breaches would be a daunting task for any agency, but by almost exclusively looking at large breaches, OCR left the door open for repeat HIPAA offenders. Small breaches are reported to the agency at the end of the year, but each breach is counted separately, meaning an organization could experience multiple small breaches that add up to well over 500 individuals affected?yet still not be investigated because no single breach hit the 500 mark.
"It turns out that for breaches in healthcare, most of the time, the record count is under 500 records," Kam says. "So you have these organizations that are breaching multiple times and not really correcting the situation because it doesn’t get highlighted or investigated."
OCR’s instructions to its regional offices appear aimed to close that loophole. Along with phase two of the HIPAA audit program, this could be a sign that OCR is getting serious about collecting facts on HIPAA compliance in the real world and improving education and enforcement. The agency might be realizing that it’s time to change if it expects organizations to take HIPAA compliance seriously.
"If you’re seeing the same problem over and over, you’ve got to do something to change," Kam says. "So far, nobody’s listening."
Data breaches
The cost of a data breach
Complicated Medicare, Medicaid, and private insurer reimbursement rules can easily throw a hospital for a loop and leave it running dangerously low on revenue. An organization’s leaders know they must work better and smarter and make strategic investments that will pay off in savings, while privacy and security officers may sometimes struggle to make the connection between their concerns and those of leadership.
But sound information security programs act as a kind of insurance: money spent up front to protect against an even greater financial loss down the road. Getting that message across can be challenging, but may transform the way an organization approaches information security.
Getting the numbers
Prevention is better than a cure, but privacy and security officers will be expected to back up conventional wisdom with hard numbers. So just how much does a data breach cost on average? The answer depends on the industry, according to the Ponemon Institute’s 2016 Cost of Data Breach Study: Global Analysis (www-03.ibm.com/security/data-breach). The study, sponsored by IBM Security, tracks and analyzes data breach costs and mitigation factors in industries around the world. The average per record cost of a data breach is $ 158 in the U.S., but in the healthcare industry that cost is more than double that at $ 355 per record. That can add up quickly if an organization experiences multiple breaches a year.
Several factors play into the higher costs seen in the healthcare industry, Diana Kelley, executive security advisor at IBM Security, says. Highly regulated industries such as healthcare typically see higher costs for breaches in a combination of fines and administrative costs.
"Whenever there’s a fine coming into play, that could lift up the total cost of recovery post-breach because in addition to all of the work you have to do to eradicate the threat, help your customers, and deal with the cleanup and recovery, you have to pay these fines," she says.
A surprising factor driving breach costs is the cost of breach notification. At more than half a million dollars, the U.S. has higher breach notification costs than any of the other countries in the 2016 Ponemon survey. The U.S. has strong data breach notification laws, Kelley says, and there are both federal and state breach notification laws that organizations must comply with.
What drives that cost? Simply the price of first class postage can quickly add up when breach notification letters must be mailed to hundreds or even thousands of affected patients, Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts, says. In fact, the rising cost of postage is one way state and federal governments hope to encourage organizations to spend money on prevention rather than remediation.
"The threat of such costs is intended to be a deterrent to lax security and to spur healthcare organizations to do their best to avoid breaches," Borten says. "Some breaches are not avoidable, but many or most are with better, yet still reasonable, security."
Some organizations may only look at fines when calculating how much a breach could cost, but by overlooking the seemingly smaller costs of a breach they may be missing the bigger picture. Breach notification is only one of the smaller individual and indirect costs of a breach that can add up to significant losses. Legal fees, security forensics, and any necessary security replacements or upgrades are only some of the indirect costs. Indirect costs may not be immediately apparent but they hit an organization’s bottom line all the same, Borten says.
"The indirect costs of a breach are probably not well understood by many healthcare organizations, especially smaller organizations that don’t have a good grasp of the Breach Notification Rule and a comprehensive incident response program," she says.
The value of a medical record
Information security may not be a traditionally strong point for some healthcare organizations. Previously, financial and retail organizations were hot targets for hackers after identity and financial information, but healthcare is quickly overtaking those industries. In comparison to the financial industry, healthcare isn’t known for strong security, Borten says.
"One reason is that organizations have been slow to recognize the value of their data. After all, it’s not like money in a bank account or credit card details that can be used for financial identity theft," she says. "Ironically, healthcare data now has a much higher street value than credit card information."
Healthcare organizations are in a unique position because of the amount of data they hold. A retail organization like Target, which experienced a massive data breach in 2013, likely only stores payment card information and mailing addresses, but most healthcare organizations also store insurance information along with sensitive details of an individual’s health. A 2015 survey by the Ponemon Institute and the Medical Identity Fraud Alliance (MIFA), the Fifth Annual Study on Medical Identity Theft, found that more than two million adults were the victim of medical identity theft and fraud in 2014 and according to Ann Patterson, senior vice president and program director of MIFA, that number will only go up.
That prediction may be supported by some of the biggest breaches this year. In July, a hacker offered millions of patient records for sale and posted samples of the records, showing names, contact information, and Social Security numbers, so interested buyers could verify the records. Other incidents this year have seen hackers offering similar teasers. Some of that data is bound to fall into the wrong hands and be used for financial and medical identity theft. Medical identity theft can cost an individual more than $ 13,000 on average, according to the 2015 MIFA/Ponemon survey, but healthcare organizations inevitably wind up absorbing some of the cost in bad debt. (For more on medical identity theft, see the July and August issues of BOH.)
Timing and teamwork saves money
The 2016 Ponemon study drew a link between the cost of a data breach and the time and manner in which an organization responds to the breach. The longer it takes an organization to detect a breach, the more it costs?approximately $ 1 million more per incident, the survey shows. The average overall cost of a breach that took a mean time to identify of less than 100 days was $ 3.2 million, while those that took more than 100 days to be identified cost an average of $ 4.38 million. The time it takes an organization to contain a breach also impacts the overall cost, according to the study.
Having a security incident response team in place lowered the costs. An organized, planned team can act quickly to identify, contain, and remediate breaches, key factors in keeping breach costs down, Kelley says. And that can give a clear picture of the actual return on investment for security in terms that the C-suite will easily understand. "If you’re trying to argue for incident response and building out the incident response plan or growing that team, here’s some real dollar value that you could tie to what the return on investment could be," she says.
Participation in threat sharing also showed a clear win for organizations. Threat sharing can give organizations a heads up on the latest and most common threats and help them make smart security investments and strategic threat reduction measures.
"This is becoming very important in healthcare as it is in all industries," Kelley says. "The attackers are very organized and collaborative: they’re sharing data, they’re sharing their tips and tricks with each other so they can get data more effectively."
If information sharing is winning for the bad guys, it can do the same for the good guys, she adds. Cyber threats shift quickly, making real-time or near-real-time information crucial. Organizations can share information on threats, like suspicious websites and server addresses that launch phishing attacks, and tips on shutting them down. But some may hesitate to engage in information sharing out of concern that it may expose sensitive business and security information.
An IBM study released in February looked at the C-suite’s attitudes and actions on cybersecurity (www-03.ibm.com/press/us/en/pressrelease/49100.wss). More than half (53%) of respondents agreed that information sharing between organizations is important for cybersecurity, yet 68% said they were unwilling to do so. It’s not surprising that chief executive officers would be uncomfortable sharing information with rival organizations but it can be done without disclosing sensitive data, Kelley says.
"Nobody wants to give away the keys to the kingdom, and if you’ve been breached you don’t want to show everybody where you went wrong and how you went wrong," she says. "That’s not the kind of information sharing that we need to do to succeed. What we really need to share is what the bad guys are doing."
An organization doesn’t need to discuss its intellectual property, specific security controls, or other corporate secrets. The information an organization should share could be the general content of a phishing email, the IP address it was sent from, and the type of malware attached. This allows cybersecurity researchers and experts to create protections and update anti-malware and anti-virus software.
And as stakeholders and the Office of the National Coordinator of Health IT continue to push for interoperability, doing your part to ensure other organizations steer clear of hackers and malware could become even more important. "I think the more we tie systems together and we share with our partners, there are a couple things we can do. One of those is sharing information about threats," Kelley says.
Customer cost
No one likes to hear that their personal data has been breached, but how that dissatisfaction plays into the cost of a breach isn’t clear. According to the 2016 Ponemon study, the healthcare industry is the second most vulnerable to what it calls "churn"?a sharp drop in customers following a data breach. This may surprise those who assume healthcare is relatively immune to consumer pressure, but it’s supported by other trends that see healthcare becoming consumer-driven. It might also offer a clue as to how strongly some patients feel about breaches of PHI. It’s relatively simple to change banks, but changing healthcare insurers or providers is a more complicated process that takes more motivation, Kelley says.
"What’s it cost you to go from one bank to another bank if you don’t like their practices or they suffered a major breach?" she says. "Healthcare, it’s a little bit more difficult, but there’s still a level of choice and healthcare is very personal for people."
But privacy and security officers might want to rely on something other than consumer pressure to make the case for better security, Borten says. Often, patients simply have no better alternative and can’t switch providers or insurers if they’re unhappy over a data breach. And those who do switch may find themselves back in the same system after a few years.
"The reality is more complicated," she says. "As seen in some of the big retail breaches, after some initial falloff, customers come back in full force. In healthcare, some patients may not have other options: they may be locked in to a given provider by their health plan, or they may stay with an organization after a breach because they have long-established relationships they do not want to give up."
Cost conscious
Another recent study on the cost of data breaches by RAND raises questions about how the cost of a breach measures up against other financial risks organizations face. The RAND study, published in the Journal of Cybersecurity (http://cybersecurity.oxfordjournals.org/content/early/2016/08/08/cybsec.tyw001), found that the average cost of a data breach is roughly equal to an organization’s average IT budget, which is itself only 0.04% of an organization’s estimated revenue. The study authors suggest that public concerns about data breaches don’t match up with the relatively modest financial impact on organizations. Organizations, like individuals, are often motivated by self-interest and will not spend on risks that don’t have a significant impact on them; expecting them to act otherwise is not realistic, the study argues.
While that may in fact be the attitude of some executives when faced with competing demands and costs, the study leaves some significant questions unanswered. Bad debt is identified by the RAND study as the top financial risk for healthcare organizations, but data breaches can add to that cost. Victims of medical identity theft may be hit with thousands of dollars in medical expenses someone else racked up under their name. These fraudulent bills often wind up adding to an organization’s bad debt. Bad debt may often be a problem an organization can’t control, but by reducing data breaches, an organization can cut its risk of bad debt caused by medical identity theft.
Privacy and security
Is HIPAA enough?
HIPAA breaches haven’t become less common. If the law was, in part, meant to reduce the amount of PHI released to unauthorized individuals, some may say its success is uncertain. HIPAA’s requirements aren’t prohibitively stringent: they provide a basic floor of privacy and security. If a covered entity (CE) or business associate (BA) does no more than comply with HIPAA, it will simply be doing the bare minimum to safeguard PHI. Although that may not sound difficult, some organizations continue to fall short and leave others wondering if HIPAA is enough to meet today’s information security and privacy challenges.
Covering basics
HIPAA does provide a floor for privacy and security, a minimum amount an organization can do, but is it effective? "No, it establishes a level of security that’s not actually effective," Rick Kam, CIPP/US, president and co-founder of ID Experts, says.
HIPAA is not as closely tied to reimbursement as other compliance measures. Many organizations may choose to simply meet HIPAA’s basic requirements and put the majority of their efforts into meeting other compliance goals. Although such a situation may not exactly set HIPAA up to fail, it doesn’t do any favors for the privacy and security of PHI either.
"For most organizations, who don’t think they’re going to have an issue, they’re lulled into a comfortable zone where they can say, ‘I’ve done what the federal government has asked me to do, that’s enough, I’m compliant.’ The bad news is they’re still being breached and their employees are being sloppy and losing data and so forth," Kam says.
The Office for Civil Rights’ (OCR) HIPAA audit program is intended to help CEs and BAs get better at HIPAA compliance?and help the agency understand what it can do better. Whether the audits will result in changes or improvements to HIPAA is debatable. Earlier this year, some lawmakers suggested expanding HIPAA and making it stronger, but it’s unlikely the topic will be revisited in earnest until next year at the earliest, Kam says.
Other agencies, such as the Office of Inspector General and Government Accountability Office, have recently questioned OCR’s oversight of HIPAA and lack of robust guidelines. Even OCR agrees that a permanent audit program—required by HIPAA—is long overdue. But in this, the agency isn’t far removed from the entities it oversees, Frank Ruelas, MBA, principal of HIPAA College in Casa Grande, Arizona, says.
"HHS-OCR is much like many of the CEs and BAs, as they have next to or no auditing and monitoring function," he says. "When you don’t have an effective auditing and monitoring function, I don’t believe you can have an effective enforcement function. It’s as simple as that."
OCR offers a risk analysis tool and improved its guidelines and explanations for CEs and BAs this year, but the agency has limited ability to help smaller entities that may struggle to afford new software and upgraded security safeguards. Smaller entities may be more likely to combine the role of information security officer with other duties and may have a difficult time competing with larger organizations for qualified staff. Smaller entities may simply not have the expertise in-house, Kam says.
"There have to be other ways these organizations can improve," he says. "Maybe it’s as simple as other industries, like the insurance industry, coming to their rescue with cyber insurance and tools that are part of their programs in order to help those small organizations do a better job."
Focus on fines
OCR relies on fines to scare CEs and BAs into HIPAA compliance, yet for many the fines aren’t all that scary.
An organization that’s been through a HIPAA breach investigation may not want to repeat the experience. However, as a ProPublica investigation earlier this year discovered, OCR investigates relatively few breaches (www.propublica.org/article/few-consequences-for-health-privacy-law-repeat-offenders).
Even when an organization is investigated, the consequences often come years later and may not be significant enough to change its behavior. Those fines might cripple a small BA or CE, but larger companies or health systems might see even the biggest HIPAA fines as cheaper than compliance, Mac McMillan, FHIMSS, CISSM, co-founder and CEO of CynergisTek, Inc., in Austin, Texas, says.
In recent settlement announcements, OCR has put at least some of the blame squarely on the organization’s leaders. Those strong words may be in vain, Ruelas says. Because the agency doesn’t hold an organization’s leaders directly responsible for failing to act on risk analyses or support privacy and security needs, there’s little incentive for leaders to be accountable.
"I also think that it is not uncommon when settlements are made, there are people that are named scapegoats for the issues related to the settlement and often find themselves in some manner as the sacrificial lamb in losing their jobs," Ruelas says.
One way to solve the accountability crisis would be to take a cue from legislation such as the Sarbanes-Oxley Act (www.sec.gov/about/laws.shtml#sox2002), Kam says. The Sarbanes-Oxley Act was signed into law in 2002 in response to the corporate and accounting scandals that rocked the financial world in the early 2000s. If an organization’s chief executive officer was required to personally sign off on risk analysis reports and could be held personally accountable for his or her failure to properly follow up on security risks, HIPAA might start to carry some real weight.
Standard security
OCR recommends that CEs and BAs follow theNational Institute of Standards and Technology’s (NIST) cybersecurity framework. The agency released a HIPAA/NIST crosswalk tool in February to help CEs and BAs map HIPAA security requirements to specific standards in the framework (www.hhs.gov/sites/default/files/nist-csf-to-hipaa-security-rule-crosswalk-02-22-2016-final.pdf). CEs and BAs aren’t required to follow the NIST’s cybersecurity framework, but it provides the practical guidance many are looking for. It can also be used to help an organization improve its data security overall and better protect PHI and business and financial information.
"I think the healthcare industry needs to up the ante, to work toward a higher standard," Kam says. "NIST and others are publishing security protocols and frameworks that the industry can work toward. Those are the types of standards that should be looked at, not for compliance but for data security."
Other security standards such as the Payment Card Industry Data Security Standard (PCI-DSS) are optional but can be used to enhance an organization’s security.
But regardless of the standard, organizations must determine that security standards and policies are actually being applied. All too often policies on paper are fully implemented. Without regular organizationwide risk analyses, gaps in compliance and implementation will be missed. Failure to complete or follow up on organizationwide risk analyses has been cited repeatedly in OCR’s recent HIPAA breach settlements. A risk analysis is the cornerstone of a security program, Linda Sanches, MPH, senior advisor for health information privacy for OCR, said in September at the Health Care Compliance Association’s annual regional conference in Boston.
"You cannot have a sound security program without a risk analysis," she said.
Sanches advised CEs and BAs to check OCR’s website for guidance and tools designed to help with HIPAA compliance. But a Government Accountability Office (GAO) report released in September cast a critical eye on the agency’s resources for CEs and BAs (www.gao.gov/assets/680/679260.pdf). The GAO report slammed OCR’s oversight of HIPAA and called the guidance and tools it offers CEs and BAs inadequate.
Looking to states
Most states have privacy and security laws and organizations can look to them to answer some of the questions, and fill some of the gaps, left by HIPAA. Navigating a patchwork of state laws isn’t always ideal. Multi-state organizations must keep track of laws in each state they operate in. And if a resident of one state experiences a breach of his or her PHI held by an organization in another state, it might be difficult for an organization to determine which state’s law applies. However, HIPAA was designed to complement state laws, not overrule them.
"HIPAA is designed to work with state laws," Sanches said. "You really need to look at the interplay between state laws."
Authorities at doctor administrations merchant EmCare in Florida have advised 60,000 patients, representatives and contractual workers about a cybersecurity occurrence that may have uncovered their own data. An unapproved individual had the capacity to get to various worker email accounts that contained clinical information and statistic data, alongside driver’s permit and Social Security quantities of certain people, as indicated by an examination.
The post Florida Physician reports a HIPAA Breach that could affect over 60K patients appeared first on The Coding Network.
Product watch
Prevalent Vendor Assess evaluates third-party vendors’ HIPAA compliance
by Chris Apgar, CISSP
Much of today’s healthcare industry is reliant on third-party vendors. If you haven’t asked your vendors whether they are compliant with HIPAA and have implemented sound information privacy and security programs, you are likely facing unknown?and possibly significant?risks. Covered entities (CE) and business associates (BA) are required by HIPAA to exercise due diligence when it comes to their BAs and BA subcontractors. Assessing the risk of those vendors is necessary, especially if those vendors support critical functions in support of CE operations.
Prevalent offers Vendor Assess: a software as a service-based tool that can automate a large part of third-party vendor assessments. Its third-party risk management solution can help CEs and BAs manage the risks associated with BAs and BA subcontractors. And Vendor Assess provides the information and tools necessary to require vendors to address risks that could have an adverse impact on business and clinical operations.
Vendor Assess is a subscription-based service which uses industry best practices to efficiently support CEs and BAs to conduct third-party assessments without the need for additional staff or resources. Prevalent Vendor Assess leverages Prevalent’s Vendor Risk Manager platform to generate focused third-party risk assessments and store the results in an easily accessible web portal. Also, Prevalent’s Vendor Threat Monitor is available to support the collection of real-time vendor threat intelligence information. THe subscription includes a single assessment, threat intelligence monitoring, reporting, and assessment recommendations by Prevalent.
Vendor Assess uses predeveloped third-party security questionnaires to identify CE and BA vendor risks. The questionnaires sent to vendors are customized to address areas of risk that are associated with each vendor versus a static set of questions that are not necessarily suited for each vendor. Because risks vary depending on the vendors and the services provided, the customization is an added bonus?especially when evaluating critical vendor information security risk to CEs and BAs.
The tool can be used to electronically generate questionnaires that can be distributed to vendors and takes a lot less time than manually generating, addressing, and sending questionnaires that are geared to identify risks that vendors pose to their CE and BA clients. The tool creates a centralized repository that can be used to track vendor risk management activities and questionnaire returns and create a baseline of vendor risk that can be used for future Vendor Assess assessments.
In addition to providing a sound solution to assess vendor risk, Prevalent’s offerings include the Prevalent Vendor Risk Maturity Assessment. The Vendor Risk Maturity Assessment was created to help CEs and BAs understand the maturity of their vendor risk management program, review specific actions for maturity improvement, and benchmark overall maturity with other Prevalent clients.
The Vendor Risk Maturity Assessment identifies CEs’ and BAs’ vendor risk management program maturity. The assessment involves a question and answer session with the staff responsible for vendor risk management. A Prevalent analyst reviews the data, identifies areas for improvement, develops a specific action plan for improving maturity across all the CE’s BAs and BA subcontractors and creates an executive presentation to show how an entity’s vendor risk assessment program compares to other Prevalent clients.
Pricing for Prevalent services fits the budget of most small and large CEs and BAs. Pricing is, for the most part, tiered by the number of vendors CEs and BAs will be sending questionnaires out to. Prevalent offers a concierge package of services that has, per Prevalent, appealed to smaller CEs and BAs. More information is available from Prevalent at www.prevalent.net.
Editor’s note
Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. Opinions expressed are that of the author and do not represent HCPro or ACDIS. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Email your HIPAA questions to Associate Editor Nicole Votta at [email protected].
If you thought the Department of Health and Human Services’ loosening of several Obamacare rules indicated less HIPAA enforcement, think again. The agency’s Office of Civil Rights settled $ 28.7 million worth of HIPAA violations in 2018, up 22 percent over the previous record year. The OCR also announced it achieved the single largest HIPAA settlement […]
The post HIPAA Enforcement has Banner Year appeared first on AAPC Knowledge Center.
Our front office would not release it without patient’s signature/consent.
Is that correct? We are new in town and don’t want to give the impression that we are delaying the care but also don’t want to release info without consent and violating HIPAA.
Thoughts?