Kaiser Permanente has been fined $450,000 by the California Department of Managed Care (CDMC) for impermissibly disclosing the confidential and protected health information (PHI) of up to 167,095 health plan members. Between October 2019 and December 2019, Kaiser Permanente sent 337,755 mailings to enrollees of its health plan; however, an error updating its electronic medical record system resulted in some mailings being sent to outdated addresses.

Kaiser Permanente was contacted by 8 individuals who said they had opened the packets but realized that they were not the intended recipients and 1,788 of the packets were returned unopened as the recipients realized they had been sent to the wrong addresses. The mailings were sent to 167,095 enrollees and Kaiser Permanente could not be sure that those mailings had been received by the intended recipients, which meant thousands of enrollees’ PHI may have been impermissibly disclosed.

CDMC investigated the reported breach and determined there had been an unauthorized disclosure of medical information and negligent maintenance or disposal of medical information, both of which violated the California Confidentiality of Medical Information Act (CMIA). On November 11, 2019, Kaiser Permanente became aware that an error in its electronic medical record system that had resulted in a data breach but failed to stop the mailings until December 20, 2019, 39 days after the error was discovered. As a result of that failure to act, a further 175,000 mailings were potentially sent to incorrect addresses.

In addition to the financial penalty, Kaiser Permanente has agreed to take corrective actions to prevent further data breaches of this nature, including updating its software systems, conducting periodic checks to confirm addresses are in synch, and system checks to ensure it is using the most current physical and/or mailing addresses. Kaiser Permanente will also work with its call center employees to confirm address information, will notify all affected individuals, and will provide refresher training to its staff on the legal standards of the Health Insurance Portability and Accountability Act (HIPAA) concerning the protection of PHI.

“Health plans must protect the confidentiality of enrollee records and maintain and dispose of medical information correctly,” said DMHC Director Mary Watanabe. “Kaiser Permanente agreed to take corrective actions to protect consumers’ confidential information and ensure this doesn’t happen again.”

The post Kaiser Permanente Fined $450,000 for CMIA Violations Due to Mailing Error appeared first on HIPAA Journal.

In August last year, the Federal Trade Commission (FTC) took legal action against the mobile data broker Kochava alleging the Idaho company had violated consumer privacy and put consumers at risk by selling geolocation data from their mobile phones, which was tied to each individual through the unique ID of their mobile device.

The FTC claimed Kochava sold the data from hundreds of millions of devices which could reveal that consumers had visited sensitive locations such as abortion clinics, mental health clinics, places of worship, and other sensitive locations. Since the information was tied to a user’s mobile device, companies that used Kochava’s data feeds would be able to identify and track specific mobile devices. As an example, the FTC claimed that individuals visiting reproductive health clinics for abortions could be identified, along with the medical professionals that provided those services, and those individuals could be exposed to stigma, discrimination, physical violence, emotional distress, prosecution, or other harms.

On May 4, 2023, a federal District Court Judge dismissed the complaint as the FTC failed to allege that consumers had been put at significant risk of harm, but left the door open for the FTC to continue with its legal action by allowing an amended complaint to be filed within 30 days. The FTC has now filed an amended complaint against Kochava that includes additional facts to support its allegations that Kochava engaged in unfair practices that violated the FTC Act and put consumers at significant risk of harm. The amended complaint includes new factual allegations that the FTC says are based, in part, on materials provided by Kochava in response to its Civil Investigative Demand.

The FTC has filed a motion to temporarily file the amended complaint under seal, as while the FTC does not believe any of the information detailed in the amended complaint reveals any trade secrets or other material that it believes should be subject to confidential treatment, the FTC anticipates Kochava may object to the public disclosure of that material. When the material was provided to the FTC, Kochava marked it as ‘proprietary’ and ‘highly confidential’. The FTC said it is acting “out of an abundance of caution,” and in accordance with internal rules covering the disclosure of proprietary and trade secret information by requesting the complaint be sealed until such point that the court decides that the material is not subject to confidential treatment.

Kochava sought to have the initial complaint dismissed and is expected to file a motion to also have the FTC’s amended complaint dismissed. Kochava continues to maintain the company has proactively complied with all appropriate laws and has not violated consumer privacy.

The post FTC Files Amended Complaint Against Kochava for Selling Geolocation Data appeared first on HIPAA Journal.

In May 2023, the Florida Legislature passed an update to the Florida Electronic Health Records Exchange Act that prohibits healthcare providers that use certified health record technologies from storing electronic health records outside the United States, its territories, or Canada. The ban also covers patient information stored through a third-party or subcontracted computing facility or cloud computing service, which must similarly maintain the data in the continental United States, its territories, or Canada. When the ban takes effect it will no longer be possible to use overseas vendors that require access to patient information as the update also bans the access, retrieval, and transmission of patient data from locations outside the United States, its territories, or Canada. All healthcare providers covered by the Florida Electronic Health Records Exchange Act must comply with the updated law by July 1, 2023.

“Certified electronic health record technology” is defined as “a qualified electronic health record that is certified pursuant to s. 3001(c)(5) of the Public Health Service Act as meeting standards adopted under s. 3004 of such act, which are applicable to the type of record involved, such as an ambulatory electronic health record for office-based physicians or an inpatient hospital electronic health record for hospitals.”

“Qualified electronic health record” is defined as “an electronic record of health-related information concerning an individual which includes patient demographic and clinical health information, such as medical history and problem lists, and which has the capacity to provide clinical decision support, to support physician order entry, to capture and query information relevant to health care quality, and to exchange electronic health information with, and integrate such information from, other sources.”

Covered healthcare providers include hospitals, ambulatory surgery centers, pharmacies, home health agencies, hospices, laboratories, mental health treatment facilities, substance abuse services, and licensed healthcare providers such as physicians, nurses, dentists, therapists, podiatrists, and massage therapists.

Healthcare providers should conduct an audit to confirm the locations where health records are stored to ensure that they are compliant. If a cloud vendor is used to store patient information, data centers must be located in the specified regions. If contracted third parties are used to provide support services such as managed service providers, IT support companies, scheduling support providers, and other vendors, they, along with any subcontractors they use, should be prohibited from storing or accessing patient information outside of the United States, its territories, or Canada.

If the audit confirms patient data is stored in or is accessed from prohibited locations, steps should be taken immediately to move patient data to a compliant storage location and restrict access from unauthorized locations ahead of the compliance deadline.

The post Florida Bans Offshore Storage of Electronic Health Records appeared first on HIPAA Journal.

The Federal Trade Commission (FTC) has proposed changes to the Health Breach Notification Rule to strengthen the applicability of the Rule to health apps and other emerging direct-to-consumer technologies that collect, store, and transmit identifiable health data.

There has been an explosion of health apps and connected devices that collect health data, and those apps and devices are collecting vast amounts of health data. There are also incentives for companies that collect health data to disclose that information to third parties for advertising and other purposes. The Health Insurance Portability and Accountability Act (HIPAA) requires health data to be safeguarded, places restrictions on uses and disclosures of health data, and if a data breach occurs, the HIPAA Breach Notification Rule requires notifications to be issued. While health apps and connected devices may collect health data that would be classed as Protected Health Information under HIPAA if collected by a HIPAA-regulated entity, most health apps and connected devices are not covered under HIPAA.

The FTC Health Breach Notification Rule applies to vendors of personal health records (PHR) and related entities that are not covered by HIPAA and requires those companies to issue notifications to consumers, the FTC, and the media in the event of a breach of identifiable health data. When a data breach occurs at a third-party service provider to vendors of PHRs and PHR-related entities, the Health Breach Notification Rule requires those entities to issue notifications to vendors and PHR-related entities. The Health Breach Notification Rule has been in effect for a decade, but the FTC has only just started enforcing compliance. Since December 2022, the has taken two enforcement actions against entities alleged to have violated the Health Breach Notification Rule – GoodRx and Easy Healthcare (Premom) –  both of which were found to have failed to issue timely notifications about breaches of identifiable health data.

In September 2021, the FTC issued a policy statement confirming the Health Breach Notification Rule applies to health apps and connected devices that collect, use, or transmit consumer health information. The FTC has reviewed the comments received about the policy statement and has determined that the Health Breach Notification Rule needs to be modernized to clarify its applicability to health apps, connected devices, and other direct-to-consumer technologies.

The proposed updates include a change to the definition of “PHR identifiable health information,” and new definitions have been added for “health care provider” and “health care services or supplies.” The definition of “PHR related entity” has been revised to make it clear that only entities that access or send unsecured PHR identifiable health information to a personal health record — rather than entities that access or send any information to a personal health record — qualify as PHR related entities. The FTC has also clarified what it means for a personal health record to draw PHR identifiable health information from multiple sources. The proposed update makes it clear that a “breach of security” includes the unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or unauthorized disclosure.

The FTC has also authorized the expanded use of email and other electronic means as a way of providing clear and effective notice of a breach to consumers, and the required content of notifications has also been expanded. Notifications will need to include information about the potential harm that can be caused by the breach, and notifications must include the names of any third parties who might have acquired unsecured personally identifiable health information.

The comment period on the proposed changes is 60 days from the date of publication of the Notice of Proposed Rulemaking in the Federal Register.

The post FTC Proposes Changes to Modernize the Health Breach Notification Rule appeared first on HIPAA Journal.