Healthcare Data Privacy

State AGs Fine DNA Testing Lab $400,000 for Data Breach

Posted February 20, 2023 by HIPAA Journal

DNA Diagnostics Center (DDC), one of the largest private DNA testing laboratories in the United States, has been fined a total of $400,000 by state attorneys general in Pennsylvania and Ohio for violations of state laws that contributed to a breach of the personal information of almost 46,000 Pennsylvania and Ohio residents, and approximately 2.1 million individuals across the United States.

The data breach that prompted the investigation was discovered by DDC on August 6, 2021, when suspicious activity was detected in some of its archived databases. The investigation determined the databases had been accessed by unauthorized individuals between May 24 and July 28, 2021, and certain files and folders had been removed. The databases contained the sensitive information of individuals who had received DNA testing services between 2004 and 2012, including 33,300 individuals in Pennsylvania and 12,600 individuals in Ohio. The information included sensitive customer information including names, Social Security numbers, and payment information.

The databases had been obtained from a company called Orchid Cellmark, which DDC acquired in 2012. The databases had been archived and were not used for any business purposes and, according to DDC, were inadvertently transferred as part of the acquisition, without the knowledge of DDC. Nine years after the acquisition, DDC was still unaware that the databases existed in its systems. DDC said it had conducted penetration tests and an inventory assessment prior to the data breach occurring, but those assessments and tests only identified active customer data and did not reveal the presence of the archived databases on its systems.

Prior to the data breach, DDC contracted with a third-party service provider to conduct data breach monitoring. That company detected the data breach and attempted to contact DDC on multiple occasions via automated email alerts, but employees failed to respond for two months. During those two months, malware – Cobalt Strike – was installed on the network and data was exfiltrated. The breach investigation confirmed that an unauthorized third party had logged on via a VPN on May 24, 2021, using a DDC user account. Active Directory credentials were harvested from a Domain Controller that provided password information for each account in the network. The VPN used by the threat actor was not in use at DDC, which had migrated to a new VPN. The unauthorized third party used a test account with admin privileges to achieve persistent access and execute Cobalt Strike within its network. Five servers were compromised that contained backups of 28 databases, and a decommissioned server was used to exfiltrate the data. The threat actor then contacted DDC and demanded payment for the return and deletion of the stolen data, and payment was made.

The investigation by the state attorneys general found DDC had “engaged in deceptive or unfair business practices by making material misrepresentations in its customer-facing privacy policy concerning the safeguarding of its customers’ personal information.” It was also alleged that DDC failed to employ reasonable measures to detect and prevent unauthorized access to its computer networks, and as such, engaged in unfair and deceptive cybersecurity practices which exposed customer data to unauthorized access and theft. The state AGs ruled that those failures constituted unfair trading practices and violations of state Consumer Protection Law.

DDC chose to settle the investigations with no admission of wrongdoing. Under the terms of the settlement, DDC agreed to pay $200,000 to Pennsylvania and $200,000 to Ohio, implement and maintain a comprehensive information security program, conduct comprehensive risk assessments at least annually, allocate risk-appropriate resources to protect the personal information of consumers, and conduct an information security program assessment at least annually to review the effectiveness of the information security program.

“The more personal information these criminals gain access to, the more vulnerable the person whose information was stolen becomes,” said Acting Attorney General Henry. “That’s why my Office took action with the assistance of Attorney General Yost in Ohio. I am proud of the work our agents and attorneys do every day to protect Pennsylvanians’ most sensitive information.”

The post State AGs Fine DNA Testing Lab $400,000 for Data Breach appeared first on HIPAA Journal.

Democratic Senators Propose Update to HIPAA to Ban Abortion-Related PHI Disclosures Without Patient Consent

Posted February 14, 2023 by HIPAA Journal

Two Democratic U.S. Senators – Michael Bennett (D-CO) and Mazie Hirono (D-HI) – have introduced a bill that seeks to strengthen the privacy protections of the Health Insurance Portability and Accountability Act (HIPAA) for individuals seeking access to abortion care. The bill – The Secure Access for Essential Reproductive (SAFER) Health Act – was prompted by the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization, which removed the federal right to abortions and gave individual states the full power to regulate any aspect of abortion care not protected under federal law.

The senators are concerned that while patient privacy is protected under HIPAA, HIPAA permits healthcare providers to disclose patient information for legal investigations without patient consent, which means the sensitive health information of individuals seeking access to abortion care could be disclosed to law enforcement to allow those individuals to be prosecuted for attempting to terminate pregnancies.

In June 2022, in response to the Supreme Court decision, the Department of Health and Human Services issued guidance to HIPAA-covered entities and their business associates confirming that while the HIPAA Privacy Rule permits disclosures of protected health information, as required by law, without individual authorizations, the HIPAA Privacy Rule does not require such disclosures. The HHS also confirmed that disclosures of reproductive health information are also only permitted in very limited circumstances, and encouraged anyone who believes their privacy has been violated to file a complaint with OCR.

The SAFER Health Act seeks to improve protections further and prohibit healthcare professionals from sharing personal health information related to the termination or loss of pregnancy with the courts without a valid authorization from the patient and, if passed, would apply to federal, state, local, and tribal proceedings, including civil, criminal, administrative, and legislative proceedings. The Act calls for the HHS to revise HIPAA and health information technology regulations accordingly to allow the enforcement of this new requirement, and to conduct a national campaign to educate HIPAA-covered entities and their business associates about the revisions.

“No one should have to worry about being investigated or prosecuted for receiving or providing reproductive health care,” said Bennet. “This legislation will protect the privacy of patients who have had abortions, regardless of where they live or receive care.” Bennett, along with other Democratic senators, introduced the Freedom to Travel for Health Care Act in July 2022, to clarify that it is illegal for states that have implemented bans or restrictions on abortions to prohibit state residents from traveling across state lines to receive abortion care. Bennet was also one of several Democratic Senators to introduce the Let Doctors Provide Reproductive Health Care Act, which sought to protect doctors that provided legal abortions to out-of-state patients; however, both Acts failed to make it past the Senate.

“MAGA Republicans in states with abortion bans have made it very clear they want to prosecute women for seeking reproductive health care. One way they plan to do that is by weaponizing patients’ reproductive health information,” said Senator Hirono. “That is why I am proud to introduce the SAFER Health Act—legislation that would strengthen and expand HIPAA to protect women and ensure doctors cannot share personal reproductive health information to a court proceeding without patient consent.

The post Democratic Senators Propose Update to HIPAA to Ban Abortion-Related PHI Disclosures Without Patient Consent appeared first on HIPAA Journal.

Senators Demand Answers from Telehealth Firms on Pixel-Related Data Sharing Practices

Posted February 13, 2023 by HIPAA Journal

A bipartisan group of senators has written to three telehealth companies demanding answers about the use of third-party tracking technologies on their websites and details of the sensitive health data that they share with third parties such as Meta, Google, and social media networks.

In the summer of 2022, The Markup/STAT conducted an investigation into the use of tracking technologies on the websites of U.S. hospitals and found that around one-third of the hospitals investigated had these technologies on their websites. Website tracking code could capture and transmit identifiable health information to third parties, which could be further disclosed and used for targeted advertising. In December 2022, a similar investigation was conducted on the use of the code by telehealth companies. The investigation revealed 49 out of the 50 telehealth websites they investigated were sharing consumer data with third parties through pixels and other website tracking technologies, despite the companies maintaining that any information disclosed to them by consumers would be kept private and confidential.

Maria Cantwell (D-WA), Chair of the Senate Commerce Committee, Amy Klobuchar of (D-MN), Susan Collins (R-ME), and Cynthia Lummis (R-WY) wrote Cerebral in California, Monument in New York, and Workit Health in Michigan about these disclosures. The senators say the telehealth industry has been valued at over $30 billion and has allowed Americans to get easy access to the care they need, especially individuals in rural communities with limited physical access to healthcare facilities. However, the convenience of telehealth should not be at the expense of privacy and sensitive health information should not be exposed to the world’s largest advertising ecosystem.

Cerebral operates a website that was used by more than 200,000 patients in 2020 and 2021. Users of its website are asked to complete medical questionnaires, which include questions about medical conditions such as depression, anxiety, and bipolar disorder. That information, along with details of the medications they purchase through the website, is sent to third parties who can monetize that information. Website users are told that their health data will remain private and confidential and were not informed about these disclosures.

Workit Health’s website was used by more than 20,000 individuals in 2021. Its users were similarly asked to complete medical questionnaires, including questions about substance use and mental health, and that information was discovered to have been shared with platforms such as Google and Facebook along with identifiable information. Workit Health stated on its website that any information shared by users would be kept private and would be protected by its HIPAA-compliant software

Monument’s website was used by more than 30,000 patients in 2021. Users of the website were asked questions about mental health and alcohol use. Monument claims on its website that consumers’ health information is kept 100% confidential and that Monument is HIPAA compliant but The Markup/STAT investigation revealed information was being shared with platforms such as Google and Facebook without the knowledge of website users.

The senators asked the telehealth companies to provide a list of all questions consumers may be asked, the types of information that are shared with third parties, and whether information has ever been shared with a third party that would allow an individual to be identified as seeking treatment for a specific mental health or substance abuse condition. They also asked the companies to commit to protecting patient privacy and informing patients, in clear, easy-to-understand, plain language, the exact types of information that will be shared with third parties and for what specific purposes.

Last year, the Department of Health and Human Services’ Office for Civil Rights (OCR) issued guidance to HIPAA-regulated entities on the use of website tracking technologies. OCR confirmed that HIPAA-covered entities are not permitted to share protected health information via these tracking technologies unless consent to do so is obtained from individuals in advance, or if the provider of the technology is a HIPAA business associate, a valid business associate agreement is in place, and the disclosure is expressly permitted by the HIPAA Privacy Rule.

The Federal Trade Commission is also taking an interest in the use of these tracking technologies on health apps and websites and recently announced its intention to fine GoodRx, a provider of discounts for medications and telehealth services, $1.5 million for violations of the FTC Health Breach Notification Rule. GoodRx is alleged to have failed to notify consumers that their health information had been disclosed to third parties such as Facebook and Google after claiming users’ health data would be kept private.

The post Senators Demand Answers from Telehealth Firms on Pixel-Related Data Sharing Practices appeared first on HIPAA Journal.

Cedars-Sinai Medical Center Sued for Website Tracking Technology Privacy Violations

Posted February 8, 2023 by HIPAA Journal

A lawsuit has been filed against Cedars-Sinai Medical Center alleging impermissible disclosures of patient data to Google, Meta, and other third parties due to the use of website tracking technologies without either a business associate agreement with the code providers or authorizations from patients. In the summer of 2022, an investigation into the use of these technologies revealed almost one-third of the top 100 hospitals in the United States had used pixels and other tracking code on their websites that were capable of collecting and transmitting sensitive data to the providers of that code. The Cedars-Sinai lawsuit is one of dozens filed against healthcare providers and other health-related companies in the past year over the use of tracking technologies on websites and mobile apps without user consent.

The widespread use of tracking technologies prompted the HHS’ Office for Civil Rights to issue guidance in December 2022 on the use of these technologies. The guidance confirmed that any tracking technologies that are capable of touching information protected by HIPAA can only be used if a valid, HIPAA-compliant business associate agreement is obtained from the provider of the code or if patient consent is obtained to share HIPAA-protected data.

The Cedars-Sinai Medical Center lawsuit was initially filed in California state court on December 30, 2022, but was moved to the U.S. District Court for Central California in Los Angeles on February 3, 2023. The lawsuit – John Doe v. Cedars-Sinai Health System and Cedars-Sinai Medical Center – alleges invasion of privacy, intrusion upon seclusion, negligence, breach of implied contract, breach of contract, and violations of the California Invasion of Privacy Act, California Confidentiality of Medical Information Act, and California Unfair Competition Law.

The lawsuit alleges the sensitive personal and health information of the plaintiff and other Cedars-Sinai patients was impermissibly disclosed to Google, Meta, and Microsoft Bing due to the use of tracking code on its website. The lawsuit states that Cedars-Sinai encourages patients to visit its website to research medical symptoms and health issues, identify doctors that can treat their specific health problems, and make appointments online. Doing so requires patients to disclose their symptoms and communicate highly sensitive medical information, which the plaintiff did in the belief that privacy was assured.

The tracking technologies added to the website recorded individually identifiable information based on user interactions and transmitted that information to unrelated companies, including Meta/Facebook, Google, Microsoft Bing, and social media platforms or businesses. According to the lawsuit, “this code served as real time wiretaps on patients’ communications,” and allowed marketing companies to use patients’ private information to target them with advertising related to their medical conditions, yet consent to collect and use private information for that purpose was not obtained, and patients were not informed about those uses and disclosures. The plaintiff is a Facebook user that has the ‘Keep Me Logged In’ feature of his Facebook account activated. He noticed an increase in health-related adverts since visiting the Cedars-Sinai website for further information on his medical condition. Some of the adverts he was served were specific to the medical condition he researched on the Cedars-Sinai website.

The lawsuit takes aim at Cedars-Sinai, not the providers of pixels and code, which explain in their terms and conditions that uses of the code in connection with health data is not permitted. For example, Google prohibits the use of Google Analytics code on the websites of HIPAA-covered entities and their business associates for any manner or purpose involving protected health information. The lawsuit claims that the inclusion of the tracking code has violated the privacy of patients and also constitutes a violation of the HIPAA Rules. The lawsuit seeks class action certification, a jury trial, compensatory and punitive damages, and injunctive relief.

The post Cedars-Sinai Medical Center Sued for Website Tracking Technology Privacy Violations appeared first on HIPAA Journal.

FTC Issues First Financial Penalty for a Health Breach Notification Rule Violation

Posted February 2, 2023 by HIPAA Journal

The Federal Trade Commission’s Health Breach Notification Rule requires vendors of personal health records and related entities to issue notifications to consumers in the event of a breach of unsecured personal records. The rule took effect in 2009, yet compliance has not been enforced. That has now changed. Yesterday, the FTC issued its first penalty for noncompliance with the Health Breach Notification Rule to the prescription drug provider, GoodRx Holdings Inc, which has been ordered to pay a financial penalty of $1.5 million.

In September 2021, the FTC issued a policy statement announcing its intention to start actively enforcing the Health Breach Notification Rule with a focus on health apps, which are generally not covered by HIPAA and data breaches are therefore not subject to the notification requirements of the HIPAA Breach Notification Rule. Two guidance documents – Health Breach Notification Rule: The Basics for Business – and Complying with FTC’s Health Breach Notification Rule – were published in January 2022 that clearly explained which entities are covered by the Health Breach Notification Rule, the types of events that require notifications to consumers, and how notifications should be issued. The first financial penalty was imposed almost a year to the day after the guidance was issued for the failure to notify consumers about unauthorized disclosures of their personal health information to Facebook, Google, Criteo, and others for advertising purposes.

GoodRx is a Santa Monica, CA-based provider of a telemedicine platform that includes a free-to-use website and mobile app that consumers can use to track prescription drug prices and obtain coupons that provide discounts on medications. The platform can also be used to arrange telehealth visits and access other health services. Users of the service provide personal and health information GoodRx, which also collects data from pharmacy benefit managers when users make purchases using GoodRx coupons. Since January 2017 more than 55 million consumers have used the GoodRx website and mobile app.

Multiple Privacy Violations and Deceptive Businesses Practices

According to the FTC complaint, GoodRx violated the FTC Act and its own privacy policy by sharing the sensitive personal and health information of its users with tech firms and social media websites without notifying users about those disclosures or obtaining consent to do so.

GoodRx told users of its website and mobile app that their personal health information would never be shared with advertisers or other third parties; however, the FTC determined that since at least 2017 GoodRx repeatedly violated that promise and shared personal health information with third parties such as Facebook, Google, Criteo, Branch, Twilio, and others for advertising purposes, including information about users’ health conditions and their prescription medications.

The personal health information of users was monetized and the data shared with Facebook was used to target its own users with adverts on Meta platforms such as Facebook and Instagram. The FTC cited one such example from 2019 where GoodRx compiled lists of users who had purchased certain medications for heart disease and blood pressure, then uploaded their email addresses, phone numbers, and advertising IDs to Facebook to allow those users to be identified in order to serve them with targeted health-related advertisements.

GoodRx also permitted third parties such as Facebook to use the shared data for their own internal purposes, while falsely claiming compliance with Digital Advertising Alliance principles, which require consent to be obtained before using health information for advertising purposes. GoodRx also misrepresented HIPAA compliance by displaying a seal on its telehealth services homepage falsely claiming it was in compliance with the HIPAA Rules. The company also failed to implement appropriate policies and procedures to protect the personal and health information of its users, and only implemented formal, written, privacy, and data-sharing policies when its data practices were publicly revealed by a consumer watchdog in February 2020.

The FTC said GoodRx was in violation of the Health Breach Notification Rule for failing to notify consumers of the impermissible disclosures of their personal health information, and the severity of those violations warranted a financial penalty. In addition to the financial penalty, GoodRx is prohibited from sharing the health data of its users for advertising purposes, must obtain consent from users for any other data sharing, must direct the third parties to whom health data were disclosed to delete that information, and must implement a comprehensive privacy program. The proposed penalty is now awaiting approval from the federal court.

“Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”

The post FTC Issues First Financial Penalty for a Health Breach Notification Rule Violation appeared first on HIPAA Journal.

2022 Healthcare Data Breach Report

Posted January 24, 2023 by HIPAA Journal

For the first time since 2015, there was a year-over-year decline in the number of data breaches reported to the Department of Health and Human Services’ Office for Civil Rights (OCR), albeit only by 1.13% with 707 data breaches of 500 or more records reported. Even with that reduction, 2022 still ranked as the second-worst-ever year in terms of the number of reported breaches.

As the year drew to an end, data breach numbers started to decline from a high of 75 data breaches in October. Time will tell whether this trend will continue in 2023, although the lull in data breaches appears to have continued so far this year with an atypically low number of breaches currently showing on the OCR data breach portal this month.

In addition to the slight reduction in reported data breaches, there was also a drop in the number of breached records, which fell by 13.15% from 54.09 million records in 2021 to 51.9 million records in 2022.

The theft of protected health information places patients and health plan members at risk of identity theft and fraud, but by far the biggest concern is the threat to patient safety. Cyberattacks on healthcare providers often cause IT system outages, which in many cases have lasted several weeks causing considerable disruption to patient care. While there have not been any known cases of cyberattacks directly causing fatalities, the lack of access to patient data causes diagnosis and treatment delays that affect patient outcomes. Multiple studies have identified an increase in mortality rates at hospitals following ransomware attacks and other major cyber incidents.

These cyberattacks and data breaches result in huge financial losses for healthcare organizations. The 2022 IBM cost of a data breach report indicates the average cost of a healthcare data breach increased to an all-time high of $10.1 million in 2023, although data breaches can be significantly more expensive. In addition to the considerable breach remediation costs, security must be improved, cyber insurance premiums increase, and it is now common for multiple class action lawsuits to be filed following data breaches. There is also a risk of financial penalties from regulators.

The largest ever healthcare data breach, suffered by Anthem Inc in 2015, affected 78.8 million members and cost the health insurer around $230 million in clean-up costs, $115 million to settle the lawsuits, $39.5 million to settle the state attorneys general investigation, and $16 million to resolve the OCR investigation. Even much smaller data breaches can prove incredibly costly. Scripps Health suffered a data breach of 1.2 million records in 2021 due to a ransomware attack. The attack caused losses in excess of $113 million due to lost business ($92 million) and the clean-up costs ($21 million). There are also several lawsuits outstanding and there could be regulatory fines.

Largest Healthcare Data Breaches in 2022

There were 11 reported healthcare data breaches of more than 1 million records in 2022 and a further 14 data breaches of over 500,000 records. The majority of those breaches were hacking incidents, many of which involved ransomware or attempted extortion. Notable exceptions were several impermissible disclosure incidents that resulted from the use of pixels on websites. These third-party tracking technologies were added to websites to improve services and website functionality, but the data collected was inadvertently transmitted to third parties such as Meta and Google when users visited the websites while logged into their Google or Facebook accounts. The extent to which these tracking technologies have been used by healthcare organizations prompted OCR to issue guidance on these technologies, highlighting the considerable potential for HIPAA violations.

Name of Covered Entity	State	Covered Entity Type	Individuals Affected	Type of Breach
OneTouchPoint, Inc.	WI	Business Associate	4,112,892	Ransomware attack
Advocate Aurora Health	WI	Healthcare Provider	3,000,000	Pixel-related impermissible disclosure via websites
Connexin Software, Inc.	PA	Business Associate	2,216,365	Hacking incident and data theft
Shields Health Care Group, Inc.	MA	Business Associate	2,000,000	Hacking incident and data theft
Professional Finance Company, Inc.	CO	Business Associate	1,918,941	Ransomware attack
Baptist Medical Center	TX	Healthcare Provider	1,608,549	Malware infection
Community Health Network, Inc. as an Affiliated Covered Entity	IN	Healthcare Provider	1,500,000	Pixel-related impermissible disclosure via websites
Novant Health Inc. on behalf of Novant Health ACE & as contractor for NMG Services Inc.	NC	Business Associate	1,362,296	Pixel-related impermissible disclosure via websites
North Broward Hospital District d/b/a Broward Health (“Broward Health”)	FL	Healthcare Provider	1,351,431	Hacking incident and data theft
Texas Tech University Health Sciences Center	TX	Healthcare Provider	1,290,104	Hacking incident and data theft
Doctors’ Center Hospital	PR	Healthcare Provider	1,195,220	Ransomware attack
Practice Resources, LLC	NY	Business Associate	942,138	Hacking incident and data theft
Wright & Filippis LLC	MI	Healthcare Provider	877,584	Ransomware attack
Partnership HealthPlan of California	CA	Health Plan	854,913	Hacking incident and data theft
MCG Health, LLC	WA	Business Associate	793,283	Hacking incident and data theft
Yuma Regional Medical Center	AZ	Healthcare Provider	737,448	Ransomware attack
SightCare, Inc.	AZ	Health Plan	637,999	Hacking incident and data theft
CommonSpirit Health	IL	Business Associate	623,774	Ransomware attack
Metropolitan Area EMS Authority dba MedStar Mobile Healthcare	TX	Healthcare Provider	612,000	Ransomware attack
Wolfe Clinic, P.C.	IA	Healthcare Provider	542,776	Ransomware attack
Morley Companies, Inc.	MI	Business Associate	521,046	Ransomware attack
Adaptive Health Integrations	ND	Healthcare Provider	510,574	Adaptive Health Integrations
Christie Business Holdings Company, P.C.	IL	Healthcare Provider	502,869	Hacking incident and data theft
Health Care Management Solutions, LLC	WV	Business Associate	500,000	Hacking incident and data theft
OakBend Medical Center / OakBend Medical Group	TX	Healthcare Provider	500,000	Ransomware attack

While 2022 saw some very large data breaches reported, the majority of reported data breaches were relatively small. 81% of the year’s data breaches involved fewer than 50,000 records, and 58% involved between 500 and 999 records.

Hacking incidents dominated the breach reports with 555 of the 707 reported breaches (71.4%) classified as hacking/IT incidents, which accounted for 84.6% of all breached records in 2022. The average breach size was 79,075 records and the median breach size was 8,871 records. There were 113 reported unauthorized access/disclosure breaches reported in 2022, accounting for 14.5% of the breached records. The average breach size was 66,610 records due to some large pixel-related data breaches, and the median breach size was 1,652 records.

Theft (23 breaches) and loss (12 breaches) incidents were reported in relatively low numbers, continuing a downward trend from these once incredibly common data breaches. The downward trend is due to better control of devices and the use of encryption. The average breach size was 13,805 records and the median breach size was 1,704 records. There were four incidents involving the improper disposal of devices containing PHI and physical records. The average breach size was 1,772 records and the median was 1,021 records.

The high number of hacking incidents is reflected in the chart below, which shows the location of breached protected health information. Compromised email accounts remain a major source of data breaches, highlighting the importance of multi-factor authentication and training employees on how to recognize the signs of phishing.

Which Entities Suffered the Most Data Breaches?

The raw data on the OCR breach portal does not accurately reflect the extent to which business associate data breaches are occurring. When you factor in business associate involvement it is possible to gain a more accurate gauge of the extent to which data breaches are occurring at business associates. In 2022, 127 data breaches were self-reported by business associates, but there were 394 reported data breaches where business associates were involved – That’s a 337% increase since 2018. Last year, data breaches at business associates outnumbered data breaches at healthcare providers for the first time.

Several major business associate data breaches were reported to OCR in 2022, with some of the data breaches affecting several hundred healthcare organizations. A data breach at the debt collections company, Professional Finance Company, affected 657 of its healthcare clients and involved more than 1.91 million healthcare records. Eye Care Leaders, a provider of electronic health records to eye care providers, suffered a cyberattack that affected at least 41 eye care providers and exposed the data of almost 3.65 million patients.

The graph below shows the sharp increase in data breaches at business associates in recent years. There are several reasons for the increase. Hackers have realized the value of conducting attacks on business associates. One successful attack can provide access to the data, and sometimes networks, of all of the vendor’s clients. Healthcare organizations are now using more vendors to manage administrative functions and risk increases in line with the number of vendors. As more vendors are used, it becomes harder to monitor cybersecurity at the vendors. Managing third-party risk is one of the biggest challenges for healthcare organizations in 2023.

Where Did the Data Breaches Occur?

Healthcare data breaches were reported by HIPAA-regulated entities in 49 states, Washington D.C., and Puerto Rico in 2022. Alaska was the only state to survive the year with no reported data breaches. In general, the most populated states suffer the most data breaches. In 2022, the 10 most populated U.S. states all ranked in the top 15 worst affected states, although it was New York rather than California that topped the list with 68 reported breaches.

State	Breaches
New York	68
California & Texas	52
Florida & Pennsylvania	38
New Jersey	27
Georgia	26
Michigan, Virginia & Washington	24
Ohio	23
Illinois & North Carolina	22
Tennessee	17
Arizona & Maryland	16
Massachusetts & Wisconsin	15
Colorado	14
Connecticut, Indiana & Missouri	13
Alabama	11
Kansas, Oklahoma & South Carolina	9
Arkansas, New Hampshire & West Virginia	8
Nebraska & Oregon	7
Minnesota	6
Utah	5
Delaware, Nevada & Rhode Island	4
Hawaii, Kentucky, Louisiana, Mississippi, Montana, South Dakota, % Vermont	3
Iowa, Idaho, Maine, New Mexico, and Washington D.C.	2
North Dakota & Wyoming	1
Alaska	0

HIPAA Enforcement in 2022

HIPAA is primarily enforced by OCR, with state attorneys general also assisting with HIPAA enforcement. OCR imposed more financial penalties for HIPAA violations in 2022 than in any other year to date, with 22 investigations resulting in settlements or civil monetary penalties.

OCR has limited resources for investigations but does investigate all breaches of 500 or more records. That task has become increasingly difficult due to the increase in data breaches, which have tripled since 2010. Despite the increase in data breaches, OCR’s budget for HIPAA enforcement has hardly increased at all, aside from adjustments for inflation. As of January 17, 2022, OCR had 882 data breaches listed as still under investigation. 97% of all complaints and data breach investigations have been successfully resolved.

Some investigations warrant financial penalties, and while the number of penalties has increased, the penalty amounts for HIPAA violations have been decreasing. Most of the financial penalties in 2022 were under $100,000.

Since 2019, the majority of financial penalties imposed by OCR have been for HIPAA right of access violations, all of which stemmed from complaints from individual patients who had not been provided with their medical records within the allowed time frame. OCR continues to pursue financial penalties for other HIPAA violations, but these penalties are rare.

2022 HIPAA Settlements and Civil Monetary Penalties

Regulated Entity	Penalty Amount	Type of Penalty	Reason
Health Specialists of Central Florida Inc	$20,000	Settlement	HIPAA Right of Access failure
New Vision Dental	$23,000	Settlement	Impermissible PHI disclosure, Notice of Privacy Practices, releasing PHI on social media.
Great Expressions Dental Center of Georgia, P.C.	$80,000	Settlement	HIPAA Right of Access failure (time/fee)
Family Dental Care, P.C.	$30,000	Settlement	HIPAA Right of Access failure
B. Steven L. Hardy, D.D.S., LTD, dba Paradise Family Dental	$25,000	Settlement	HIPAA Right of Access failure
New England Dermatology and Laser Center	$300,640	Settlement	Improper disposal of PHI, failure to maintain appropriate safeguards
ACPM Podiatry	$100,000	Civil Monetary Penalty	HIPAA Right of Access failure
Memorial Hermann Health System	$240,000	Settlement	HIPAA Right of Access failure
Southwest Surgical Associates	$65,000	Settlement	HIPAA Right of Access failure
Hillcrest Nursing and Rehabilitation	$55,000	Settlement	HIPAA Right of Access failure
MelroseWakefield Healthcare	$55,000	Settlement	HIPAA Right of Access failure
Erie County Medical Center Corporation	$50,000	Settlement	HIPAA Right of Access failure
Fallbrook Family Health Center	$30,000	Settlement	HIPAA Right of Access failure
Associated Retina Specialists	$22,500	Settlement	HIPAA Right of Access failure
Coastal Ear, Nose, and Throat	$20,000	Settlement	HIPAA Right of Access failure
Lawrence Bell, Jr. D.D.S	$5,000	Settlement	HIPAA Right of Access failure
Danbury Psychiatric Consultants	$3,500	Settlement	HIPAA Right of Access failure
Oklahoma State University – Center for Health Sciences (OSU-CHS)	$875,000	Settlement	Risk analysis, security incident response and reporting, evaluation, audit controls, breach notifications, & the impermissible disclosure of the PHI of 279,865 individuals
Dr. Brockley	$30,000	Settlement	HIPAA Right of Access
Jacob & Associates	$28,000	Settlement	HIPAA Right of Access, notice of privacy practices, HIPAA Privacy Officer
Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A.,	$50,000	Civil Monetary Penalty	Impermissible disclosure on social media
Northcutt Dental-Fairhope	$62,500	Settlement	Impermissible disclosure for marketing, notice of privacy practices, HIPAA Privacy Officer

HIPAA enforcement by state attorneys general is relatively rare. Only three financial penalties were imposed in 2022 by state attorneys general. In these cases, penalties were imposed for violations of the HIPAA Rules and state laws.

State	Regulated Entity	Penalty	Penalty Type	Reason
Oregon/Utah	Avalon Healthcare	$200,000	Settlement	Lack of safeguards and late breach notifications
Massachusetts	Aveanna Healthcare	$425,000	Settlement	Lack of safeguards against phishing
New York	EyeMed Vision Care	$600,000	Settlement	Multiple security failures

The post 2022 Healthcare Data Breach Report appeared first on HIPAA Journal.

December 2022 Healthcare Data Breach Report

Posted January 16, 2023 by HIPAA Journal

The number of reported healthcare data breaches declined for the second successive month, with 40 data breaches of 500 or more healthcare records reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) in December 2022 – The lowest monthly total of the year and 29.7% fewer data breaches than the average monthly for 2022. The year ended with 683 data breaches, which is a year-over-year reduction of 4.3%. Only one other year has seen a fall in recorded data breaches (2014).

The worst month of 2022 for breached records was followed by the best, with 2,174,592 healthcare records exposed or compromised in December, well below the 2022 average of 3,986,025 records per month and 68.5% fewer breached records than in November. While this is certainly great news, even with this reduction, 2022 was the second worst-ever year for healthcare data breaches with more than 47 million records exposed or compromised from January 1 to December 31, 2022.

Largest Healthcare Data Breaches in December 2022

December saw 13 data breaches of 10,000 or more healthcare records reported to OCR. HIPAA Journal has been unable to obtain information on two of those breaches. Ransomware attacks continue to plague the healthcare industry, with 5 of the 13 largest breaches in December confirmed as involving ransomware, two of which involved the protected health information of more than 600,000 patients. Ransomware attacks on the healthcare industry more than doubled between 2016 and 2021 according to one recent analysis, although it is becoming increasingly difficult to obtain reliable data on the extent to which ransomware is used in cyberattacks due to the lack of standardized reporting. While healthcare organizations of all sizes are being attacked, ransomware gangs tend to focus their efforts on larger healthcare organizations, according to a recent report by Delinea.

Name of Covered Entity	State	Covered Entity Type	Individuals Affected	Cause of Breach
CommonSpirit Health	IL	Business Associate	623,774	Ransomware attack with business associate involvement
Metropolitan Area EMS Authority dba MedStar Mobile Healthcare	TX	Healthcare Provider	612,000	Ransomware attack
Avem Health Partners	OK	Business Associate	271,303	Hacking Incident at a business associate
Southwest Louisiana Health Care System, Inc. d/b/a Lake Charles Memorial Health System	LA	Healthcare Provider	269,752	Ransomware attack
Fitzgibbon Hospital	MO	Healthcare Provider	112,072	Ransomware attack
Monarch	NC	Healthcare Provider	56,155	Hacking Incident – No information released
Ola Equipment LLC	HI	Business Associate	39,000	Hacking Incident – No information released
The Elizabeth Hospice	CA	Healthcare Provider	35,496	An employee sent PHI to a personal email account
Legacy Operating Company d/b/a Legacy Hospice	AL	Healthcare Provider	21,202	Compromised email accounts
Employee Group Insurance Benefits Plan of Acuity Brands, Inc.	GA	Health Plan	20,849	Hacking incident (data theft confirmed)
San Gorgonio Memorial Hospital	CA	Healthcare Provider	16,846	Hacking incident (data theft confirmed)
Hawaiian Eye Center	HI	Healthcare Provider	14,524	Ransomware attack
Foundcare, Inc.	FL	Healthcare Provider	14,194	Compromised email account

Causes of December 2022 Healthcare Data Breaches

Hacking and other IT incidents continue to dominate the breach reports and typically involve many more records than other types of data breaches. In December, 28 incidents were classified as hacking/IT incidents – 70% of the month’s total breaches. 1,965,032 healthcare records were exposed or impermissibly disclosed in those incidents– 90.4% of the month’s breached records. The average breach size was 70,180 records and the median breach size was 4,152 records. 20 of the month’s breaches involved compromised network servers, with 12 incidents involving hacked email accounts.

The risk of email-related data breaches can be greatly reduced by providing regular security awareness training to the workforce, as is required by the HIPAA Security Rule, and by implementing multi-factor authentication, with FIDO-based MFA providing the greatest level of protection. HIPAA-regulated entities should also ensure that their password management practices are kept up to date. A recent audit of the Department of the Interior identified many password management failures, which are all too common in the healthcare industry.

There were 10 unauthorized access/disclosure-related data breaches in December involving 168,386 records. The average breach size was 16,839 records and the median breach size was 1,739 records. There has been a decline in these types of data breaches in recent years as HIPAA training and monitoring of medical record access have improved. There were two loss/theft incidents reported involving 41,174 records. Both of these incidents involved computers/other electronic devices and could have been prevented by encrypting the devices.

December Data Breaches by HIPAA Regulated Entity

Healthcare providers were the worst affected type of HIPAA-regulated entity, with 24 breaches reported of 500 or more records. Business associates reported 11 data breaches and 5 data breaches were reported by 5 health plans. Two of the data breaches reported by healthcare providers had business associate involvement but were reported by the healthcare provider. The chart below shows the breakdown based on where the breach occurred.

States Affected by December 2022 Data Breaches

Healthcare data breaches were reported by HIPAA-regulated entities in 22 states. California was the worst affected with 4 reported breaches.

State	Reported Data Breaches
California	4
Florida, New York, Texas & Washington	3
Georgia, Hawaii, Illinois, Massachusetts, Missouri, South Dakota & Virginia	2
Alabama, Connecticut, Louisiana, Maryland, North Carolina, Nebraska, Oklahoma, Rhode Island, Wisconsin & West Virginia	1

HIPAA Enforcement Activity in 2022

OCR closed the year with two financial penalties to resolve alleged HIPAA violations. Health Specialists of Central Florida’s case stemmed from an investigation into a HIPAA Right of Access violation over the failure to provide a woman with a copy of her deceased father’s medical records. The records were provided, but there was a 5-month delay. Health Specialists of Central Florida settled the case and paid a $20,000 financial penalty. This was the 42^nd financial penalty to be imposed under OCR’s HIPAA Right of Access enforcement, which was launched in 2019.

New Vision Dental in California was one of just two healthcare providers to settle a HIPAA violation case with OCR in 2022 that did not involve a HIPAA Right of Access violation. OCR investigated New Vision Dental in response to complaints that patient information was being impermissibly disclosed online in response to negative reviews on Yelp. OCR also identified a Notice of Privacy Practices failure. The case was settled for $23,000. Including these two penalties, OCR resolved 22 HIPAA violation cases with settlements and civil monetary penalties in 2022, more than any other year since OCR was given the authority to impose financial penalties for HIPAA violations.

State Attorneys General also have the authority to impose financial penalties for HIPAA violations. In December, a joint investigation by Oregon and Utah resulted in a financial penalty for Avalon Healthcare over a phishing attack. Avalon Healthcare was determined to be in violation of the HIPAA Security and Breach Notification Rules and state laws due to a lack of appropriate safeguards to protect against phishing attacks and an unreasonable delay in sending breach notification letters, which were issued 10 months after the breach was detected. The case was settled for $200,000. This was one of three enforcement actions by state attorneys general in 2022 to resolve HIPAA violations.

The post December 2022 Healthcare Data Breach Report appeared first on HIPAA Journal.

AI in Healthcare

Posted January 16, 2023 by HIPAA Journal

The topic of AI in healthcare often gets mixed reactions. While some people are firm believers in the benefits of AI in healthcare and the considerable benefits to patients, others have concerns about the ethics of AI in healthcare and there is considerable apprehension about the use of AI in healthcare attributable to a lack of knowledge about AI. In this article, we will explain what artificial intelligence is, the benefits of AI in healthcare, and how concerns about the ethics of AI in healthcare need to be overcome.

What is Artificial Intelligence (AI)?

One of the reasons why some people approach the topic of AI in healthcare with a degree of apprehension is that different sources offer different definitions of AI. It is also the case that some sources confuse AI with Machine Learning (ML), which strictly speaking is a subset of AI. To quote Microsoft’s definitions of the two terms:

Artificial intelligence is the capability of a computer system to mimic human cognitive functions such as learning and problem-solving. Through AI, a computer system uses math and logic to simulate the reasoning that people use to learn from new information and make decisions.

Machine learning is an application of AI. It is the process of using mathematical models of data to help a computer learn without direct instruction. This enables a computer system to continue learning and improving on its own, based on experience.

Therefore, while AI and ML are closely connected, they are not the same. Generally, a computer system uses AI to think like a human and perform tasks on its own, whereas ML is how a computer system develops its intelligence. Importantly, many of the concerns related to AI in healthcare revolve around how computer systems develop Artificial Intelligence and their capabilities to learn and make decisions without human instruction.

How Computer Systems Develop Artificial Intelligence

There are many different standard and hybrid techniques that determine how computer systems develop Artificial Intelligence. Generally, most follow the same two-stage process:

Supervised Learning

Most new AI systems start with a supervised learning process in which labeled datasets with known outcomes are fed into a system to train an algorithm on how to classify data. The outcomes produced by the system are then weighted to match the previously known outcomes. Often, this stage is followed by “semi-supervised learning” in which labeled datasets guide the algorithm as it classifies unlabeled datasets and predicts outcomes for the unlabeled data.

Unsupervised Learning

In unsupervised learning, the trained algorithm has to detect underlying patterns and relationships in never-before-seen unlabeled data in order to produce accurate outcomes. With unsupervised learning, it is important to remember that the aim is to make sense of data in the context of a specific question. How the answer is determined will depend on how the algorithm has been trained and weighted during the supervised and semi-supervised stages.

While this explanation might fail to reassure those who are concerned or apprehensive about AI – because “answers” are dependent on how the algorithm has been trained, the quality of data used to train the algorithm, how the output is weighted, and what the question is that the algorithm is trying to answer – artificial intelligence has in fact been present in many areas of everyday life for several years. For example:

Most people have played a video game against an AI-driven computer
AI is used by the finance industry to detect potential credit card fraud
The security industry uses AI to monitor multiple clusters of CCTV systems
Netflix “because you watched” recommendations are produced by AI
AI produces the routes recommended by Google Maps and other travel apps
Many email spam filters and antivirus software solutions are fine-tuned by AI

But, what about AI in healthcare? How is that being used, who is using it, and what are the benefits? Additionally, are concerns about the ethics of AI in healthcare justified; and, if so, what can be done to overcome the concerns? These questions are easier to answer with an understanding of what AI is and how computer systems develop artificial intelligence.

Examples of AI in Healthcare

AI in healthcare is an umbrella term for all the many different ML algorithms and other cognitive technologies that are used in the healthcare industry. Some algorithms are more advanced than others, most have been designed to answer specific questions, and – even when the specific question is the same – some have been trained or weighted differently from others.

Consequently, there are many examples of AI in healthcare from patient-orientated AI such as chatbots that can listen to a patient’s symptoms and health concerns, to pharma-orientated AI that can help bring life-saving treatments to market faster. Between either end of the healthcare spectrum, there are many more examples of AI in healthcare:

Medical Imaging

Using computer vision to identify health conditions in medical images is quickly becoming a primary use for AI-driven technology. More advanced algorithms can distinguish tumors from lesions and other diseases – resulting in more accurate diagnoses, faster administration of treatments, and better patient outcomes.

Precision Medicine

Similarly, computer systems that have been trained on precision medicine can develop medicinal or behavioral regimes specifically tailored to each patient depending on their condition, metabolic profile, microbiome composition, diet, lifestyle, sleep patterns, and many more data points collected and analyzed over years.

Physician Guidance

While robots performing major surgeries may still be a science fiction fantasy, some AI technologies have been developed that can guide physicians during minimally invasive surgical procedures via automated workflows and decision support. Most often, these technologies are used in treating strokes and heart conditions and for endovascular procedures.

Detecting Patient Deterioration

In post-acute environments, healthcare providers dedicate a lot of resources to checking vital signs to identify postoperative adverse events. AI-enabled tools can help care teams by calculating early warning scores that detect patient deterioration due to events such as respiratory failure or cardiac arrest – thus enabling more rapid responses.

Predictive Equipment Maintenance

As well as detecting patient deterioration, AI can be deployed to predict when medical equipment is in need of maintenance. Through remote sensing, AI can monitor the performance of medical hardware to proactively identify when it may need maintenance or replacement – reducing downtime, preventing avoidable interruptions to clinical practice, and mitigating patient delays.

Automated Resource Allocation

A major administrative challenge for large healthcare providers is patient flow and resource allocation. The failure to have the right resources in the right place at the right time puts patients at risk and increases unnecessary bed occupancy. However, using AI to identify patterns from real-time and historical data enables providers to optimize flow management efficiency.

Healthcare AI Companies

Compiling a list of healthcare AI companies is difficult because companies face multiple challenges in developing AI solutions that demonstrate real-world performance, meet medical needs, and address regulatory requirements. Consequently, many start-ups fail to make an impact in the healthcare industry and redirect their talents elsewhere. Some of those currently making an impact include:

PathAI

PathAI was founded with the aim of developing AI technology that could reduce error rates in pathology. The company’s AISight pathology platform was developed, trained, and validated using more than fifteen million annotations, and PathAI is now in the process of developing diagnostic solutions for gastroenterologists, dermatologists, oncologists, urologists, and gynecologists.

Regard

Unlike patient-orientated AI which can help users identify the causes of symptoms, Regard is an end-to-end AI solution for physicians that analyzes and synthesizes patient data, recommends diagnoses, and automates note-taking. By mitigating the risk of misdiagnoses and tackling repetitive tasks, physicians have more time available to see more patients and maximize revenues.

Freenome

Freenome is one of a number of healthcare AI companies that combine computational biology and machine learning to support better cancer management through early detection and precision intervention. Freenome’s AI platform can be deployed at general screenings or used to detect signs of cancer in diagnostic and blood tests.

Beth Israel Lahey Health

The Beth Israel Deaconess Medical Center – also known as Harvard University’s teaching hospital – used 25,000 images of blood samples to develop an AI-enhanced microscope that can detect harmful bacteria such as staphylococcus and E. coli much faster than is possible using manual scanning. To date, the microscopes have achieved a 95% accuracy rate.

VirtuSense

VirtuSense uses AI sensors to track inpatients’ movements so that providers and caregivers can be notified of potential falls. The company’s product range includes VSTAlert, which can predict when a patient intends to stand up to alert care reams, and VST Balance, which employs AI and machine vision to analyze a person’s risk of falling within the next year.

Benefits of AI in Healthcare

The above examples of AI in healthcare and technologies developed by healthcare AI companies focus on the “in-house” benefits of AI in healthcare inasmuch as they help deliver accurate diagnoses and treatment plans, prevent adverse events and accidents, and improve patient flow management. Outside of hospital environments, there are many further benefits of AI in healthcare.

From a patient’s perspective, AI technologies not only improve outcomes and help prevent adverse events in hospitals but can also enhance the remote patient experience. Advocates of AI in healthcare see AI as a way of providing convenient access to medical advice in the home, increasing patient engagement, and empowering patients to take more responsibility for their health and well-being.

Further benefits of AI in healthcare relate to how quickly pharmaceutical companies can bring new drugs to markets. Drug development processes can be significantly accelerated with AI technologies that quickly extract meaningful information from large datasets to predict harmful interactions with existing drugs, improve the quality of clinical trials, and reduce time to approval.

One recent example of the benefits of AI in healthcare is how AI was used during the COVID-19 pandemic to detect outbreaks, facilitate diagnoses, and accelerate gene sequencing. It is hoped that, as a tool for public health, AI can be used in the future to predict and track the spread of other infectious diseases by analyzing data from government, healthcare, and other sources.

Ethics of AI in Healthcare

According to a survey conducted by Dataiku in 2020, concern about the ethics of AI in healthcare is the primary organizational challenge stalling the adoption of AI in healthcare environments. Although specific concerns differ by organization, the concerns can generally be categorized as informed consent to use data, safety and transparency, algorithmic fairness, and data privacy.

These concerns are not unique to the United States nor to the healthcare industry. Governments and regulatory agencies across the world have struggled to resolve this challenge – with many implementing rules and regulations to govern how AI is used. In the United States, a patchwork of state and federal laws partially addresses the challenge, but many concerns remain.

To help support governments and regulatory agencies pass fair and consistent legislation, in 2021 the World Health Organization published guidance on the “Ethics and Governance of Artificial Intelligence for Health”. This comprehensive publication endorses six key ethical principles for consideration by governments, developers, companies, and society as a whole:

Protect human autonomy
Promote human well-being, safety, and the public interest
Ensure transparency, explainability, and intelligibility
Foster responsibility and accountability
Ensure inclusiveness and equity
Promote AI that is responsive and sustainable

Although political influences have resulted in the United States AI strategy shifting towards a market-orientated approach, the National Defense Authorization Act 2021 instructed the National Institute of Standards and Technology (NIST) to develop a framework for trustworthy AI systems that establishes common definitions and characterizations for aspects of trustworthiness.

With the exception of protecting human autonomy, the five remaining key ethical principles endorsed by the World Health Organization likely will be incorporated into the framework according to NIST’s latest report to Congress. If approved by Congress, the NIST AI standards could resolve many of the concerns about the ethics of AI in healthcare.

How NIST Standards Could Accelerate AI Adoption in Healthcare

In January 2021, a HITECH Act update came into effect – an amendment that gave the HHS’ Office for Civil Rights enforcement discretion when investigating data breaches if the breached organization could demonstrate twelve month’s continuous compliance with “standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the NIST Act” or a similar Act.

There is no evidence that HIPAA Covered Entities and Business Associates took their compliance obligations any more seriously after the enactment of the HITECH Act update, but it is noticeable that – despite a significant increase in the number of financial penalties issued by HHS’ Office for Civil Rights in the past two years – only four have been for violations of the Security Rule.

If there are amendments to the NIST Act to incorporate AI standards, and if a law is passed giving HHS’ Office for Civil Rights enforcement discretion when the standards are applied in healthcare organizations, this could accelerate AI adoption in healthcare as not only would it resolve many of the concerns about the ethics of AI in healthcare, it would also resolve the second highest challenge to the adoption of AI in healthcare (according to Dataiku) – the lack of regulatory guidance.

The Future of AI in Healthcare

The future of AI in healthcare is unclear if concerns about the ethics of AI in healthcare and the lack of regulatory guidance are allowed to continue. If the situation remains as it is, AI will continue to be incorporated into healthcare processes in piecemeal stages – which will continue to add value to healthcare operations and improve the patient experience but may result in inequalities that could make the wider adoption of AI in healthcare much more difficult in the future.

Alternatively, and notwithstanding that AI technologies are improving and becoming more sophisticated all the time, federal agencies – including the HHS – could introduce temporary guidance on the use of AI until such time as effective standards are developed. This would give healthcare organizations more confidence to adopt AI technologies with benefits for patients, organizations, and public health in general.

The post AI in Healthcare appeared first on HIPAA Journal.

HIPAA Updates and HIPAA Changes in 2023-2024

Posted January 9, 2023 by HIPAA Journal

HIPAA updates and HIPAA changes happen more frequently than many people are aware of because of the nature of the update or because of their minor impact on HIPAA compliance. A major update to HIPAA is long overdue, and steps were taken in December 2020 to address the need for HIPAA changes and HIPAA updates when HHS’ Office for Civil Rights (OCR) issued a Notice of Proposed Rulemaking that proposed multiple changes to the HIPAA Privacy Rule.

In addition, there has also been a proposed update to align 42 CFR Part 2 – the Confidentiality of Substance Use Disorder Patient Records regulations – more closely with HIPAA, and proposals to change the conditions under which PHI relating to reproductive healthcare can be used or disclosed. The Part 2 and reproductive health changes are expected to be finalized in 2024, while new proposed Security Rule standards for cybersecurity should be announced in 2024 and implemented in 2025.

We discuss all the HIPAA updates since the inception of HIPAA and this information can be used in conjunction with our HIPAA checklist to understand what is required to ensure compliance.

Please use the form on this page to arrange your free copy of the checklist.

Major HIPAA Updates in the Past 25 Years

Since HIPAA was signed into law there have been a few major HIPAA updates. The HIPAA Privacy and Security Rules were introduced which limited uses and disclosures of protected health information, gave patients new rights over their healthcare data, and introduced a set of minimum security standards.

Those HIPAA updates were followed by the incorporation of the Health Information Technology for Economic and Clinical Health (HITECH) Act, which saw the introduction of the Breach Notification Rule in 2009 and the Omnibus Final Rule in 2013. Such major HIPAA updates placed a significant burden on HIPAA-covered entities and considerable time and effort were required to introduce new policies and procedures to ensure continued HIPAA compliance.

There have been two minor HIPAA Privacy Rule changes since 2013 – the first, in 2014, allowed patients to have access to test reports to align the Privacy Rule with the Clinical Laboratory Improvement Amendments. The second HIPAA Privacy Rule change, in 2016, allowed covered entities to disclose PHI to the National Instant Criminal Background Check System.

The most commonly updated section of HIPAA is Part 162 of the Administrative Simplification Regulations. Part 162 HIPAA updates are most often made by CMS to existing standards – for example, the 2020 change relating to Schedule II drug refills. However, a proposed Part 162 HIPAA change expected to be finalized in 2024 could have wider implications.

HIPAA Changes in 2024

HIPAA Updates and HIPAA Changes Over the past few years, there have been increasing calls for HIPAA changes to decrease the administrative burden on HIPAA-covered entities, but the HIPAA 2024 rules and regulations are currently much the same as they were in 2013. OCR responded to feedback from healthcare industry stakeholders by issuing a request for information (RFI) in December 2018 on potential changes to the HIPAA Rules. OCR sought comments from HIPAA-covered entities about possible changes to HIPAA Rules in 2019 and beyond, which are mostly concerned with the easing of certain administrative requirements and the removal of certain provisions of the HIPAA Privacy Rule that have been limiting or discouraging the coordination of care. The comment period closed on February 12, 2019.

OCR asked 54 different questions in its RFI. Some of the main aspects that were under consideration were:

Patients’ right to access and obtain copies of their protected health information and the time frame for responding to those requests (Currently 30 days)
Removing the requirement to obtain written confirmation of receipt of an organization’s notice of privacy practices
Promotion of parent and caregiver roles in care
Easing of restrictions on disclosures of PHI without authorization
Possible exceptions to the minimum necessary standard for disclosures of PHI
Changes to HITECH Act requirements for the accounting of disclosures of PHI for treatment, payment, and healthcare operations
Encouragement of information sharing for treatment and care coordination
Changing the Privacy Rule to make sharing PHI with other providers mandatory rather than permissible.
Expansion of healthcare clearinghouses’ access to PHI
Addressing the opioid crisis and serious mental illness

In 2019, then OCR Director, Roger Severino, said, “We are committed to pursuing the changes needed to improve quality of care and eliminate undue burdens on covered entities while maintaining robust privacy and security protections for individuals’ health information.”

The aim of the HHS is to implement changes that will make compliance less of a burden without negatively affecting patient privacy or decreasing the security of individuals’ protected health information (PHI). There are no planned changes to the HIPAA Security Rule in this RFI, but several HIPAA Privacy Rule changes have been proposed.

It has been suggested that in many of the areas covered by the RFI, the best solution may not be HIPAA rule changes. Guidance was issued in 2022 and 2023, and it is likely further HIPAA guidance will be issued in 2024 to tackle some of the issues currently experienced with HIPAA compliance by clearing up misconceptions and correcting false interpretations of the HIPAA requirements. However, changes to HIPAA in 2024 are now likely to be implemented, although it may take until 2025 for all the changes to become effective.

Proposed HIPAA Privacy Rule Changes in 2024

OCR issued a Notice of Proposed Rulemaking on December 10, 2020, that detailed the HIPAA changes to the Privacy Rule due to be implemented, based on the responses to its December 2018 RFI. The proposed changes are limited, and several HIPAA Privacy Rule changes that healthcare industry stakeholders have been campaigning for have not been included. Most of the proposed HIPAA changes are relatively minor tweaks to strengthen patient access to PHI, facilitate data sharing, and ease the administrative burden on HIPAA-covered entities.

In 2021, OCR sought feedback on the proposed HIPAA changes for 60 days from the date of publication in the Federal Register, with the comment period extended for a further 45 days to give healthcare industry stakeholders more time to review the proposed changes and provide their feedback. OCR has read the comments and the publication of the Final Rule is now imminent.

The proposed updates to the HIPAA Privacy Rule are as follows:

Allowing patients to inspect PHI in person and take notes or photographs of their PHI.
Changing the maximum time to provide access to PHI from 30 days to 15 days.
Restricting the right of individuals to transfer ePHI to a third party to only ePHI that is maintained in an EHR.
Confirming that an individual is permitted to direct a covered entity to send their ePHI to a personal health application if requested by the individual.
Stating when individuals should be provided with ePHI without charge.
Requiring covered entities to inform individuals that they have the right to obtain or direct copies of their PHI to a third party when a summary of PHI is offered instead of a copy.
The Armed Forces’ permission to use or disclose PHI to all uniformed services has been expanded.
A definition has been added for electronic health records.
Wording change to expand the ability of a covered entity to disclose PHI to avert a threat to health or safety when harm is “seriously and reasonably foreseeable.” (currently it is when harm is “serious and imminent.”)
A pathway has been created for individuals to direct the sharing of PHI maintained in an EHR among covered entities.
Covered entities will not be required to obtain a written acknowledgment from an individual that they have received a Notice of Privacy Practices.
HIPAA-covered entities will be required to post estimated fee schedules on their websites for PHI access and disclosures.
HIPAA-covered entities will be required to provide individualized estimates of the fees for providing an individual with a copy of their own PHI.
The definition of healthcare operations has been broadened to cover care coordination and case management.
Covered healthcare providers and health plans will be required to respond to certain records requests from other covered healthcare providers and health plans when individuals direct those entities to do so when they exercise the HIPAA right of access.
Covered entities will be permitted to make certain uses and disclosures of PHI based on their good faith belief that it is in the best interest of the individual.
The addition of a minimum necessary standard exception for individual-level care coordination and case management uses and disclosures, regardless of whether the activities constitute treatment or health care operations.

The Proposed HIPAA Changes Will Create Challenges for Healthcare Providers

The pending HIPAA updates are intended to ease the administration burden on HIPAA-covered entities, although in the short term, the burden will be increased. Updates will need to be made to policies and procedures and changes will be required for notices of privacy practices, although there will not, at least, be the requirement to obtain written acknowledgment that updated NPPs have been received.

What is certain is HIPAA officers and other compliance staff will have a busy few months when the Final Rule is published. OCR will provide sufficient notice before the 2024 HIPAA changes take effect and become enforceable, but there will likely be a lot of work to be done. It will be important to create a plan for making all of the required changes to ensure they are fully implemented ahead of the compliance deadline.

When the Final Rule is published, there will be a requirement to change policies and procedures where necessary, and that will require retraining of employees. HIPAA requires training to be provided to the workforce during or soon after onboarding, and after any material change in policies and procedures. HIPAA training may not need to be provided to the entire workforce, but a significant number of employees will need to be trained, and that is likely to place a considerable burden on covered entities and has the potential to cause workflow disruptions.

Improved access to medical records could pose problems for healthcare providers, who will need to ensure they have sufficient staffing and efficient procedures for verifying identities and providing copies of records – especially as the time frame for providing those records will be shortened from 30 days to 15 days. The extension will also be shortened to 15 days, giving healthcare organizations a maximum of 30 days to provide the requested records.

The definition of EHRs has also been updated to include billing records, and these will need to be provided to patients who request a copy of their PHI. That has the potential to make it more time-consuming to provide copies, as billing records are often kept in different systems than healthcare records. It may be necessary to access two different systems in order to provide patients with a copy of their records.

It will be easy for bottlenecks to occur and important not to get into a situation where 15 day extensions are regularly required. There could well be a need to prioritize requests to make sure patients who urgently need a copy of their records get them in a timely manner. Bear in mind that OCR is laser-focused on healthcare providers that fail to provide patients with timely access to their medical records.

Another of the changes related to patient access is the requirement to allow patients to take notes and photographs of their PHI. There will need to be designated places where patients can inspect PHI privately and, if required, take photographs. Healthcare providers will need to implement safeguards to ensure patients are not taking photographs of PHI they are not authorized to see.

The proposed HIPAA changes prohibit covered entities from imposing unreasonable measures on individuals exercising their right of access, including unreasonable identity verification requirements. That has the potential to cause problems for healthcare providers.

A definition has also been proposed for a personal health application. If finalized, patients must be allowed to have their records sent to a personal health application of their choosing. However, there may be privacy risks associated with doing so, and patients will need to be made aware of those risks. That will add an additional burden on healthcare providers, who may not necessarily have the required information to determine whether there is a privacy and security risk.

Proposed Part 2 and HIPAA Changes in 2024

In November 2022, OCR and the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a Notice of Proposed Rulemaking (NPRM) which sees both Part 2 and HIPAA changes to better align these regulations.

Part 2 protects patient privacy and records related to treatment for substance use disorder (SUD) with HIPAA applying to protected health information. SUD records are treated differently as they are highly sensitive and require greater protection and restrictions than other health information covered by the HIPAA Privacy Rule. While these additional protections are important, they can hamper care coordination due to the barriers that they put in the way of information sharing.

The proposed changes are intended to ease the complexity of compliance with HIPAA and Part 2, break down barriers to information sharing, and improve care coordination, without removing protections for patients. The update expands patient rights regarding the uses and disclosures of their SUD records.

The key changes that were proposed are:

Single patient consent for all future uses and disclosures of SUD records for treatment, payment, and healthcare operations.
Permitted to redisclose SUD records in accordance with the HIPAA Privacy Rule
Patients will be able to obtain an accounting of disclosures of their SUD records and request restrictions on certain disclosures
Expansion of prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings
Part 2 programs must establish a complaints process about Part 2 violations and must not require patients to waive the right to file a complaint as a condition of providing treatment, enrollment, payment, or eligibility for services.
The breach notification requirements will apply to Part 2 records, which will be covered by the HIPAA Breach Notification Rule.
The HIPAA Privacy Rule Notice of Privacy Practices requirements have been updated to address uses and disclosures of Part 2 records and individual rights with respect to those records.
The HHS will be able to impose civil money penalties for violations of Part 2, in line with HIPAA and the HITECH Act

The NPRM was issued in November 2022 and there is a 60-day comment period, so it is highly likely that the final rule will be issued in 2024. Covered entities will then be given time to implement the changes before they become enforceable.

HITECH Act Updated in 2021 Regarding Recognized Security Practices

Many healthcare industry stakeholders had been campaigning for the addition of a safe harbor for HIPAA-covered entities and business associates that have adopted a common security framework and have implemented industry-standard security best practices, yet still experienced a data breach. It is not possible to prevent all cyberattacks and data breaches, and it is unfair to punish HIPAA-regulated entities for impermissible disclosures of ePHI when they have made all reasonable efforts to secure their systems.

A bill was proposed in 2020 that called for the HHS to consider the recognized security practices that have been adopted by HIPAA-regulated entities, that have been in place for the 12 months prior to a data breach occurring when deciding on financial penalties and other sanctions. The bill, HR 7898, was signed into law by President Trump on January 5, 2021.

The purpose of the bill is to encourage healthcare organizations to invest in security and adopt a recognized security framework by providing an incentive. The HITECH Act update has not created a safe harbor for HIPAA-regulated entities that have adopted a security framework and have implemented industry-standard security best practices, but OCR will consider the efforts made with respect to security when making determinations in its investigations of complaints and data breaches.

HIPAA-regulated entities that are able to demonstrate they have adopted recognized security practices will benefit from a decrease in the length and extent of audits and investigations of data breaches, and OCR will consider recognized security practices as a mitigating factor to reduce any financial penalties that would otherwise have been applied.

In 2022, in response to another request for information, OCR published a video that explains what recognized security practices are and the evidence that can be submitted to prove they have been in place. OCR said that when investigations are launched, OCR will write to the HIPAA-regulated entity and provide an opportunity for evidence of recognized security practices to be submitted.

HIPAA Fines and Settlements Due to be Shared with Victims of HIPAA Violations

In addition to requesting information on recognized security practices, OCR sought comments on how to implement a requirement of the HITECH Act regarding financial penalties and settlements for HIPAA violations. Section 13410(c)(1) of the HITECH Act requires OCR to share a portion of the funds it receives from its HIPAA enforcement activities with the victims of HIPAA violations. This is important, as there is no private cause of action in HIPAA, which means individuals cannot sue HIPAA-regulated entities for HIPAA violations that have resulted in harm being caused.

The problem for OCR – which is why this requirement has not been implemented to date – is the difficulty in implementing a fair method of determining what victims should receive. In its April 6, 2022, RFI, OCR requested comments to help OCR with establishing a methodology under which an individual who is harmed by an offense punishable under HIPAA may receive a percentage of any civil money penalty or monetary settlement collected with respect to the offense.

The Government Accountability Office (GAO) has shared a methodology for sharing funds, but OCR is seeking comment on any alternative methodologies. The main problem, however, is identifying the types of harms that should be considered in the distribution of CMPs and monetary settlements to harmed individuals, as “harm” is not defined by statute.

No timescale has been provided on when a Notice of Proposed Rulemaking will be issued in this regard, or when funds will start to be shared with victims of HIPAA violations. These HIPAA changes could occur in 2024, but it may be some years before this HITECH Act requirement is implemented.

HIPAA Changes Due to the 2019 Novel Coronavirus (SARS-CoV-2) and COVID-19

HIPAA Updates HIPAA Changes In response to the 2019 Novel Coronavirus pandemic, the HHS announced major changes to the enforcement of HIPAA compliance in 2020, which will remain in place for the duration of the nationwide COVID-19 public health emergency or until the Secretary of the HHS declares the public health emergency is over. These “unprecedented HIPAA flexibilities” were announced in March and April by means of Notices of Enforcement Discretion and are intended to ease the burden on healthcare organizations and business associates that are having to overcome major challenges testing and treating COVID-19 patients. The changes to HIPAA enforcement have been introduced to ensure that HIPAA compliance does not get in the way of the provision of high-quality patient care.

On April 11, 2023, OCR announced that the Secretary of the Department of Health and Human Services will not be renewing the COVID-19 Public Health Emergency, which is due to expire on May 11, 2023. That means the flexibilities introduced through the following Notifications of Enforcement Discretion will come to an end at 11:59 pm on May 11, 2023. From that date and time there will be no further flexibilities and non-compliance will be penalized in the same manner as before the COVID-19 pandemic. There is one exception concerning telehealth. OCR will implement a 90-day transition period, where the flexibilities will continue until 11:59 pm on August 11, 2023, and fines will not be issued with regard to the good faith provision of telehealth services up to that date.

Notification of Enforcement Discretion for Telehealth Remote Communications

The first Notice of Enforcement Discretion was announced by OCR on March 17, 2020. The coronavirus pandemic has seen social distancing measures introduced, and with hospitals dealing with huge numbers of cases, Americans are being encouraged to remain indoors. In order to continue to provide quality care to patients while reducing the risk of patients transmitting or contracting COVID-19, telehealth services have been expanded. The CMS has also expanded telehealth to include all Medicare and Medicaid beneficiaries.

To help ensure that patients receive the care they need, OCR has announced that it will not impose sanctions and penalties on healthcare providers in association with the good faith provision of telehealth services for the purpose of diagnosis and treatment, regardless of whether the telehealth services are directly related to COVID-19. OCR will not impose penalties on healthcare providers in relation to the use of everyday communication technologies for providing those services, even if the platforms used are not completely compliant with HIPAA. For instance, it is permissible to use Skype (rather than Skype for Business), FaceTime, Google Hangouts Video, and Zoom. It is not permitted to use public-facing platforms to provide these services, such as Facebook Live and TikTok.

“We are empowering medical providers to serve patients wherever they are during this national public health emergency,” said Roger Severino, OCR Director. “We are especially concerned about reaching those most at risk, including older persons and persons with disabilities.”

This Notification of Enforcement Discretion will end at 11:59 pm on May 11, 2023. The ‘grace period’ will last for 90 days, so the hard date for compliance is 11:59 pm on August 11, 2023.

Notification of Enforcement Discretion to Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities

The second Notice of Enforcement Discretion was announced by OCR on April 2, 2020, and concerns uses and disclosures of PHI by business associates of HIPAA-covered entities for reasons related to public health and health oversight activities. HIPAA does not permit business associates to disclose PHI for public health and health oversight activities unless it is stated that they can do so in their business associate agreement (BAA) with a HIPAA-covered entity.

Under the Notice of Enforcement Discretion, OCR will not impose sanctions and penalties on business associates or their covered entities for these uses and disclosures to the likes of Federal public health authorities and health oversight agencies, such as the Centers for Disease Control and Prevention (CDC) and Centers for Medicare and Medicaid Services (CMS), state and local health departments, and state emergency operations centers. Should such a use or disclosure occur, the business associate must notify the covered entity within 10 days of the use or disclosure.

“The CDC, CMS, and state and local health departments need quick access to COVID-19 related health data to fight this pandemic,” said Roger Severino. “Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives.”

This Notification of Enforcement Discretion will end at 11:59 pm on May 11, 2023.

Notification of Enforcement Discretion for Community-Based Testing Sites

The third Notice of Enforcement Discretion was announced by OCR on April 9, 2020 – backdated to March 13, 2020 – and concerns the good faith participation in the operation of COVID-19 testing centers. OCR will be exercising enforcement discretion and will not impose sanctions and penalties on healthcare providers, including pharmacies, and business associates that participate in the operation of COVID-19 testing sites such as mobile testing centers, walk-up facilities, and drive-through testing centers that only provide COVID-19 specimen collection or testing services to the public.

“We are taking extraordinary action to help the growth of mobile testing sites so more people can get tested quickly and safely,” said Roger Severino. “President Trump has ordered the federal government to use every tool available to help save lives during this crisis, and this announcement is another concrete example of putting the President’s directive into action.”

This Notification of Enforcement Discretion will end at 11:59 pm on May 11, 2023.

Notice of Enforcement Discretion Regarding Online or Web-Based Scheduling Applications for Scheduling of COVID-19 Vaccination Appointments

OCR announced a further Notice of Enforcement Discretion on January 19, 2021, that concerns the scheduling of appointments for COVID-19 vaccinations. OCR said financial penalties and sanctions would not be imposed on HIPAA-covered entities or their business associates for violations of the HIPAA Rules in relation to the good faith use of online or web-based scheduling applications (WBSAs) for scheduling appointments for COVID-19 vaccinations.

WBSAs that would not be fully compliant with the HIPAA Rules under normal circumstances can be used for scheduling COVID-19 vaccination appointments without penalty, although it is not permitted to use a WBSA that does not incorporate reasonable security safeguards to ensure the privacy and security of ePHI and the Notice of Enforcement Discretion does not apply if the solution provider has prohibited the use of the WBSA for scheduling healthcare appointments.

OCR explained that the Notice of Enforcement Discretion does not apply to the use of a WBSA for anything other than scheduling COVID-19 vaccination appointments, such as arranging appointments for other medical services or for screening individuals for COVID-19 prior to arranging an in-person healthcare visit.

OCR encourages HIPAA-covered entities and their business associates to implement reasonable safeguards to ensure the privacy and security of healthcare data, such as adhering to the minimum necessary standard when inputting data, using encryption if available, and ensuring all privacy settings in the WBSA are activated.

OCR will be exercising enforcement discretion retroactive to December 11, 2020. This Notification of Enforcement Discretion will end at 11:59 pm on May 11, 2023.

HIPAA Penalties Could Officially Change in 2024

A HIPAA change occurred in 2019 concerning the penalties for HIPAA violations. OCR issued a Notice of Enforcement Discretion in 2019 which stated that OCR has adopted a new penalty structure for non-compliance with HIPAA Rules after a reevaluation of the requirements of the HITECH Act.

The HITECH Act called for penalties for HIPAA violations to be increased and, in 2013, the HHS implemented a new HIPAA penalty structure with minimum and maximum penalties set for the four penalty tiers, based on the level of culpability. In each category, a maximum penalty of $1.5 million, per violation category, per year was set. The HHS reviewed the language of the HITECH Act in 2019 and interpreted the requirements of the HITECH Act differently. “Upon further review of the statute by the HHS Office of the General Counsel, HHS has determined that the better reading of the HITECH Act is to apply annual limits.”

Rather than a maximum penalty of $1.5 million per year in all four categories, the maximum fine was reduced in the first three tiers. The current minimum and maximum penalties, adjusted for inflation, can be found here.

Currently, OCR is using the new penalty structure, as detailed in the Notice of Enforcement Discretion published in the Federal Register. While that remains in effect indefinitely, the new penalty structure is not legally binding and can be changed at any time. It is possible that this change to HIPAA will be made official in 2024, although first, a Notice of Proposed Rulemaking will need to be issued. OCR is more likely to continue to use its new interpretation under its Notice of Enforcement Discretion without making it official.

OCR has been pushing Congress to increase the maximum penalties for HIPAA violations as the total funds from OCR’s enforcement actions decreased significantly when the new penalty structure was introduced. OCR’s budget is extremely stretched as funding for the department has remained flat for years despite increasing numbers of hacking incidents and data breaches which has significantly increased OCR’s workload.

As well as the expected HIPAA updates in 2024, OCR will continue to issue HIPAA guidance in 2024 to explain how HIPAA applies in certain situations and to clear up confusion about the requirements of HIPAA. However, what originally starts as guidance could evolve into new HIPAA rulemaking. An example of this is OCR’s response to the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization and the overturning of Roe v Wade, which removed the federal right to an abortion. OCR originally confirmed, through guidance, how the HIPAA Privacy Rule applies to disclosures of reproductive health information, but has since published an NPRM to tackle evolving issues related to this case.

Proposed Changes to Privacy Rule for Reproductive Health Care

According to the NPRM, issues relating to currently permissible uses and disclosures of PHI have evolved due to an increasing number of women in anti-abortion states travelling to other states to have “legal” terminations. Under §164.512(e) of the Privacy Rule, covered entities are permitted to disclose PHI for civil, criminal, or administrative proceedings.

Some states have enacted anti-abortion legislation that criminalizes the facilitation of a termination regardless of where it takes place. Courts in these states could subpoena PHI from covered entities in neighboring “legal” states in pursuit of a criminal conviction against any person who has assisted an individual in obtaining an abortion – including the covered entity.

OCR is concerned that the fear of PHI being disclosed for a procedure considered legal in the location where the procedure was administered could discourage patients from sharing important information with their healthcare providers and dissuade some healthcare providers from performing terminations for out-of-state citizens.

To address these concerns, OCR is proposing changes to the HIPAA Privacy Rule that include the creation of a new category of PHI – “reproductive health care” – and placing limitations on how it can be used and disclosed. These limitations are similar to those for genetic information inasmuch as it will not be possible to disclose reproductive health care records without an attestation it will not be used impermissibly.

The proposals will not only cover terminations, but other reproductive healthcare information, such as the provision of contraceptives (or the provision of contraception advice), fertility treatments, and pregnancy screening. Miscarriage management will also be included in the new category of PHI, as will diagnoses and treatments of conditions related to the reproductive system – even if the recipient of the diagnoses and treatments is not of reproductive age.

Other measures proposed in the NPRM include a new category of uses and disclosures – “Attested uses and disclosures” – which may well be used to align the HIPAA Privacy Rule with Part 2 privacy requirements. Under the new category, recipients of PHI will have to attest that it will not be further used or disclosed for prohibited purposes – i.e., in the case of reproductive health care, to support a civil, criminal, or administrative investigation or proceeding.

Covered entities are already being alerted to the fact that, if the proposals are finalized, any false attestations will be considered notifiable data breaches, while the person(s) that further disclose attested PHI will be in violation of §1177 of the Social Security Act for the wrongful disclosure of individually identifiable health information. Violations of this section are considered to be criminal violations carrying a maximum penalty of up to ten years in jail and a fine of up to $250,000.

HIPAA Security Rule Changes Proposed in Concept Paper

In December 2023, HHS published a Healthcare Sector Cybersecurity Strategy which proposes a framework to help the healthcare sector address cybersecurity threats. The framework is built on the development of cybersecurity goals for the healthcare sector, the incentivization of hospitals to adopt cybersecurity practices, and penalties for those that fail to meet cybersecurity goals.

The penalties will consist of disbarment from Medicare and Medicaid programs for any hospital CMS considers not to have complied with the yet-to-be-produced goals, and civil monetary penalties imposed by HHS’ Office for Civil Rights for any covered entity or business associate that fails to comply with yet-to-be-published Security Rule standards.

In a document outlining the Strategy, HHS states it will begin updating HIPAA Security Rule standards in the Spring of 2024, while working with Congress to increase the civil monetary penalties for HIPAA violations and increase the resource available to investigate potential violations and conduct “proactive audits”. This implies there could also be a 2024 HIPAA audit program on the horizon.

Other HIPAA Rule Changes May Lead to Future Updates

HIPAA rule changes are not exclusive to the Privacy, Security, and Breach Notification Rules. There have been a number of HIPAA rule changes relating to transaction code sets and identifiers (Part 162 of the HIPAA Administrative Simplification Regulations). Usually, these rule changes have a limited impact on covered entities and business associates; however, a proposed HIPAA rule change published in December 2022 could have implications for many day-to-day healthcare operations.

The proposed HIPAA rule change was published by CMS to resolve an issue concerning healthcare attachment transactions. These transactions occur when a health plan needs further information from a healthcare provider to authorize a treatment or pay a bill. Healthcare providers can also provide further information when submitting an authorization request or bill to accelerate treatment and/or payment.

The issue exists because further information cannot be “attached” to an existing transaction and has to be faxed or mailed separately. To resolve the issue, CMS is proposing three new transaction codes. However, in order to authenticate users, ensure the integrity of the attachment, and guarantee nonrepudiation, attachments transmitted using the new codes will have to be digitally signed. To address this issue, CMS has proposed a standard for acceptable e-signatures.

Compliance with the e-signature standard is only necessary when covered entities use the transaction codes to submit attachments electronically. There is no requirement to digitally sign attachments when they are faxed or sent through the mail. It is considered that, like most previous Part 162 HIPAA rule changes, the proposals will have a limited impact on covered entities and business associates.

However, the possibility exists that the proposed standard may be extended to other transactions in the future, and then to day-to-day healthcare operations. As this article discusses, there are a number of ways in which e-signatures are used in day-to-day healthcare operations; and, if the e-signature requirements are rolled out across the rest of the Administrative Simplification Regulations, covered entities and business associates may have to make some significant procedural changes.

FAQs

If HIPAA settlement sharing is introduced, will that result in more fines being issued?

If HIPAA settlement sharing is introduced, it is unlikely to result in more fines being issued by HHS’ Office for Civil Rights. Although the agency may come under pressure to pursue more settlements, there has been no indication that the current policy of voluntary compliance wherever possible will be reviewed.

How was HIPAA updated by the Omnibus Final Rule in 2013?

When HIPAA was updated by the Omnibus Final Rule in 2013, the major changes included further limiting permissible uses and disclosures of PHI, expanding patients’ rights, and making business associates directly liable for HIPAA violations attributable to their non-compliance. The Omnibus Final Rule also confirmed the new violation penalty structure imposed by the HITECH Act.

When was HIPAA last updated?

HIPAA was last updated in 2020 when the Centers for Medicare and Medicaid Services (CMS) published the Interoperability and Patient Access Final Rule. Although some provisions of this Final Rule have since been rescinded or delayed, or are subject to review, CMS is pushing forward with giving patients more choices about how they access PHI despite concerns about security risks.

What were the changes in 2017 that impacted HIPAA compliance?

The changes in 2017 that impacted HIPAA compliance relate to changes in 42 CFR Part 2 of the Public Welfare Code. These changes placed stricter conditions on the uses and disclosures of PHI when a patient is suffering a substance abuse disorder (SUD) and impact HIPAA compliance for providers in this field of healthcare who may have to have a three-tier structure for protecting SUD-related PHI, other PHI, and non-protected personal information.

Where is the best place to find changes to the HIPAA standards?

The best place to find changes to the HIPAA standards in the Administrative Simplification Regulations is the HHS’ Office for Civil Rights website. The website provides the opportunity for visitors to register for a “Weekly News Digest” that will deliver new about Proposed Rules, Interim Rules, and Final Rules straight to your email inbox.

How will HHS announce HIPAA changes in 2024?

HHS will announce HIPAA changes in 2024 via one or more Final Rules published in the Federal Register. Once a Final Rule is published in the Federal Register, HHS will publish a News Release on its website. HHS News Releases are usually widely reported in trade publications and on compliance websites, so it is unlikely that a major change to HIPAA in 2024 will go unnoticed.

Where can compliance officers find the latest version of HIPAA?

Compliance officers can find the latest version of the HIPAA Administrative Simplification Regulations on the eCFR website (https://www.ecfr.gov/). The Administrative Simplification Regulations are in three Parts – 45 CFR 160, 162, and 164. Part 164 includes the Security Rule (Subpart C), the Breach Notification Rule (Subpart D), and the Privacy Rule (Subpart E), but compliance officers should not omit to review other Parts of the Title to identify any other standards that apply.

Will There be an Omnibus HIPAA Final Rule 2024?

It is unlikely there will be an Omnibus Final Rule 2024 due to the volume and variety of new regulations being proposed. While it may be possible that proposed changes to the HIPAA Privacy Rule are amalgamated with proposed changes to 42 CFR Part 2, other proposals – such as electronic signatures, attestations, and interoperability – may be introduced separately and then expanded to other areas of HIPAA in subsequent rule making.

The post HIPAA Updates and HIPAA Changes in 2023-2024 appeared first on HIPAA Journal.