Google Meet is an advanced VoIP and videoconferencing service that can be used by healthcare providers to provide telehealth services, remote consultations, and virtual patient visits. But is Google Meet HIPAA compliant?

Google Meet is rapidly becoming the go-to videoconferencing service for organizations in all industries due to its integrations with other productivity tools in the Google Workspace Suite. However, if the service is used by healthcare providers to communicate Protected Health Information, certain measures must be put in place to make Google Meet HIPAA compliant.

First of all, before Google Meet is used to collect, share, or transmit Protected Health Information, a healthcare provider must subscribe to a Business Google Workspace or Cloud Identity account and sign Google´s Business Associate Addendum.  The Addendum provides information about which of Google´s services can be used in compliance with HIPAA and what the customers´ obligations are.

The BAA Alone Does Not Make Google Meet HIPAA Compliant

However, signing the Business Associate Addendum does not – by itself – make Google Meet HIPAA compliant. System administrators have to configure the service to support compliance – for example, by making Meet the default videoconferencing service in the organization to prevent workstations prompting calls via Hangouts, which is not HIPAA compliant when used in video mode.

It may also be necessary to make all Google Meet invites private in order to mask any PHI mentioned in the invites (i.e., patients´ names) and to control access to recordings of Meet videos, which are saved to Google Drive by default. It will certainly be necessary to develop policies on how to use Google Meet in compliance with HIPAA and train members of the workforce on the policies.

To help healthcare providers and their Business Associates use Google Meet in compliance with HIPAA, Google recently updated its Workspace and Cloud Identity Implementation Guide. The Guide not only provides advice on how to make Google Meet HIPAA compliant, but also all the services in the Workspace and Cloud identity services covered by the Business Associate Addendum.

Why HIPAA Compliance Matters in Telehealth

It has been claimed that healthcare professionals often mistakenly believe that communicating ePHI via any communication channel is in compliance with HIPAA when the communication is directly between a healthcare professional and a patient. This is not true, and there are many examples of unencrypted communications being intercepted or accessed impermissibly.

Consequently, it is important that Covered Entities and Business Associates implement a secure and HIPAA compliant solution such as Google Meet when providing telehealth services. However, it is equally important that the solution is configured to comply with the Technical Safeguards of the Security Rule, that only authorized users have access to the solution, and that system of monitoring Google Meet communications is implemented to prevent accidental or malicious breaches of ePHI.

The post Is Google Meet HIPAA Compliant? appeared first on HIPAA Journal.

The answer to the question are phone calls HIPAA compliant can be dependent on who is making the call, what the call concerns and who the call is to.

Before discussing are phone calls HIPAA compliant, it is important to establish who HIPAA applies to. This is because almost two-thirds of complaints about HIPAA violations are rejected because they allege a violation has been committed by a business that is not subject to the HIPAA Rules. In such cases, HHS´ Office for Civil Rights has no jurisdiction to investigate complaints and so rejects them.

HIPAA applies to most health plans, health care clearinghouses, and healthcare providers (“Covered Entities”), and to Business Associates and subcontractors providing a service for on behalf of a Covered Entity. Healthcare-related calls from these sources to individuals are permissible provided the recipient has given their implied consent to receive a call and the call follows FTC guidelines.

Additionally, to make phone calls HIPAA compliant, Covered Entities and Business Associates are required to comply with the General Rules for Uses and Disclosures of PHI (§164.502 to §164.512), and the Minimum Necessary Standard when making phone calls to someone other than the individual which relate to the individual´s condition, treatment, or payment for treatment.

Implied Consent and FTC Guidelines

Phone calls to individuals from Covered Entities and Business Associates are permissible if the recipient of the phone call has given their implied consent by providing a contact telephone number to the Covered Entity or Business Associate. However, under HIPAA, individuals also have the right to revoke consent or request that communications are either made by voice or by text.

Healthcare-related – but not payment-related – phone calls and text messages from Covered Entities to individuals are FTC compliant if they are made for an allowable reason. Allowable reasons are limited to:

• Appointments and reminders
• Hospital pre-registration instructions
• Health checkups
• The provision of medical treatment
• Lab test results
• Notifications about prescriptions
• Pre-operative instructions
• Post-discharge follow-up calls
• Home healthcare instructions

According to the FTC guidelines, calls to individuals should start with the Covered Entity stating their name and the reason for the call. Calls can last no longer than 60 seconds (text messages must be no longer than 160 characters), and Covered Entities cannot contact individuals more than three times per week. Any additional contact – by voice or by text – requires the individual´s authorization.

Making Other Phone Calls HIPAA Compliant

Other phone calls made by a Covered Entity or Business Associate (i.e., not to an individual for an allowable reason) are only subject to the General Rules for Uses and Disclosures and the Minimum Necessary Standard if the communication involves the disclosure of an individual´s PHI. Any phone calls that do not involve the disclosure of PHI are not subject to the Privacy Rule standards.

Nonetheless, there are many types of HIPAA-related phone calls that are subject to Privacy Rule standards. For example, a phone call made from one Covered Entity to another for treatment, payment, or healthcare operations purposes, a phone call made to local authorities to report a public health issue, or a phone call made to the police to report patient abuse or neglect.

Covered Entities can communicate PHI to a Business Associate in a phone call, but before doing so, a Business Associate Agreement must be in place to stipulate the allowable uses and disclosures of PHI. In states where more stringent privacy protections exist, it may also be necessary for a Covered Entity to enter into a contract with another Covered Entity before disclosing PHI for any reason.

Is PHI Disclosed in a Phone Call Subject to the Security Rule?

One final point about making phone calls HIPAA compliant concerns whether PHI disclosed during a phone call is subject to the Security Rule. According to the definition of electronic media in  §160.103 of the HIPAA General Provisions, PHI disclosed during a phone call is not considered to be subject to the Security Rule “if the information being exchanged did not exist in electronic form immediately before the transmission”.

However, if the PHI is subsequently recorded on electronic media, the stored PHI (now ePHI) becomes subject to Security Rule standards. Therefore, if PHI is disclosed during a permissible provider-to-provider phone call, and the information is entered into an EHR or other electronic database, the information has to be protected in the same way as any other PHI relating to the individual that is stored electronically.

Are Phone Calls HIPAA Compliant? FAQs

Can nurses give patient information over the phone?

As members of a Covered Entity´s workforce, nurses can give patient information over the phone for permissible uses and disclosures. However, before nurses give patient information over the phone, it is important they verify the identity of the person they are speaking with in order to prevent unauthorized disclosures or disclosing more than the minimum necessary patient information.

Is sharing patient information with family over the phone HIPAA compliant?

With regards to sharing patient information with family over the phone, patients should be given the opportunity to object to their information being shared with family members. Provided the patient has not objected, sharing patient information with family over the phone is HIPAA compliant. However, it is still necessary to comply with the Minimum Necessary Standard.

If a patient is incapacitated and unable to object to their information being shared, healthcare providers can share patient information over the phone with family members provided that the disclosure of PHI is considered to be in the patient´s best interests. Once the patient is no longer incapacitated, he or she must be given the opportunity to object as soon as possible.

Are cell phone calls HIPAA compliant?

As discussed above in “Implied Consent and FTC Guidelines”, calls to cell phones are HIPAA compliant if a patient has given their cell phone number to the Covered Entity as a point of contact. If a patient has given both a cell phone number and a landline number, Covered Entities can use either number to contact the patient up to the FTC- mandated limit of three calls/texts per week.

What information can hospitals give over the phone?

If they are responding to an enquiry about the well-being of a patient, hospitals can provide “directory information” such as the general condition of the patient and their location within the hospital provided the patient is asked for by name, the identity of the caller is verified, and the patient has not objected to the information being disclosed.

Is a landline HIPAA compliant?

Calling a patient´s landline for an allowable reason is HIPAA compliant provided the landline number has been provided to the Covered Entity by the patient or patient’s representative. However, Covered Entities must take care to verify that the person they are speaking with is the patient, as landlines can be shared among multiple occupiers or – in a business – multiple employees.

Is giving out a phone number a HIPAA violation?

Giving out a phone number can be a HIPAA violation, but only in certain circumstances. Generally, a phone number is an “identifier” that, when included in a patient´s “designated record set”, becomes Protected Health Information. Any protected identifier in a designated record set can be disclosed if the disclosure is permitted by the General Rules for Uses and Disclosures of PHI.

If a patient has objected to their phone number being given out, if the phone number is given out without authorization for a disclosure requiring an authorization, or if the phone number is given out in the course of an impermissible disclosure, these are examples of HIPAA violations – if the phone number is included in the patient´s designated record set. If it is not part of the patient´s designated record set, the phone number is not protected, and therefore no HIPAA violation has occurred.

The post Are Phone Calls HIPAA Compliant? appeared first on HIPAA Journal.

The maximum penalty for violating HIPAA is currently $1,919,173 (September 2022). However, this figure represents the maximum penalty per violation type, and Covered Entities and Business Associates found guilty of multiple violations can expect to pay much more.

When Congress passed HIPAA in 1996, it set the maximum penalty for violating HIPAA at $100 per violation with an annual cap of $25,000. These limits were applied when the Department of Health & Human Services (HHS) published the Enforcement Rule in 2006 and they stayed in force until the publication of the Final Omnibus Rule in 2013.

Among other changes to HIPAA, the Final Omnibus Rule introduced amendments to the Enforcement Rule attributable to passage of the HITECH Act in 2009. The HITECH Act mandated a four tier penalty structure for HIPAA violations and new minimum and maximum penalties for violating HIPAA. The four tiers were based on the level of culpability associated with the violation:

Tier 1 – Lack of Knowledge:  The person did not know (and, by exercising reasonable diligence, would not have known) that the event was a violation of HIPAA.

Tier 2 – Lack of Oversight: The violation was due to reasonable cause and not willful neglect to comply with the HIPAA regulations.

Tier 3 – Willful Neglect: The violation was due to the willful neglect of the Covered Entity or Business Associate but corrected within 30 days of discovery.

Tier 4 – Willful Neglect, Not Corrected: The violation was due to the willful neglect of the Covered Entity or Business Associate but not corrected within 30 days of discovery.

The Penalties for Violating HIPAA Change after Review

Originally, due to “inconsistent language” of the HITECH Act, HHS interpreted the new Enforcement Rule penalty structure as follows:

However, following a review of the penalty tiers by HHS´ Office of General Counsel, the annual caps were amended in 2019 to align with those mandated by HITECH.

This resulted in the annual limit for a Tier 1 violation being less than the maximum penalty for violating HIPAA in Tier 1 – a situation that has continued as the penalties for violating HIPAA have been adjusted to account for inflation. Additionally, the maximum penalty for violating HIPAA in Tier 4 has also been increased. The current (September 2022) penalties for violating HIPAA are:

The Maximum Penalty for Violating HIPAA is per Violation Type

It is important for Covered Entities and Business Associates to be aware that the maximum penalty for violating HIPAA is per violation type. This mean that (for example), if a Covered Entity fails to conduct a risk assessment, fails to implement measures to prevent a foreseeable breach, and fails to notify patients when a breach occurs, the Covered Entity could be issued the maximum penalty for violating HIPAA three times over.

It is also important to be aware that State Attorneys General have the authority to impose civil money penalties on Covered Entities and Business Associates found to have violated HIPPA. Consequently, what a Covered Entity or Business Associate pays in penalties to HHS´ Office for Civil Rights may be substantially increased – as Anthem Inc. found out following a breach of 78.8 million records in 2015.

In addition to reaching a $16 million settlement with HHS´ Office for Civil Rights, Anthem Inc. was also fined $48.2 million by State Attorneys General in two separate cases. Additionally, a class action was brought against Anthem Inc. by individuals whose data was breached – resulting in a further $115 million settlement. Consequently, if found guilty of a HIPAA violation, the maximum penalty for violating HIPAA could be much more then the figures published annually in the Federal Register.

The post What is the Maximum Penalty for Violating HIPAA? appeared first on HIPAA Journal.

In answer to the question can medical records be subpoenaed; the answer is yes because every type of record can be subpoenaed. Possibly a more relevant question would be “how should healthcare providers respond to a subpoena for medical records”?

In most states, there are three types of subpoenas – a “witness subpoena” that requires an entity to appear in court to give evidence, a “deposition subpoena” that requires an entity to provide copies of records and/or attend a deposition hearing, and a “subpoena duces tecum” that requires an entity to provide copies of records and/or attend a court hearing.

All three types of subpoenas can be used to subpoena medical records or require a healthcare provider to answer questions/testify about a medical record. Although are not exclusive to any particular type of case, a witness subpoena will most likely be used in a legal action where both a patient and a healthcare provider are the parties in a case (i.e., a medical negligence claim).

The other two types of subpoenas will most commonly involve cases in which the healthcare provider is not a party in a civil or criminal action (i.e., an injury compensation claim), but the patient´s medical records are required to support discovery and/or resolve the action. In such cases, it is important to be aware can medical records be subpoenaed in compliance with HIPAA.

What HIPAA Says about Medical Records being Subpoenaed

The relevant parts of HIPAA relating to medical records being subpoenaed can be found in §164.512 of the Privacy Rule – “[Permissible] uses and disclosures for which an authorization [from the patient] or opportunity to agree or object is not required” – specifically the section relating to disclosures for judicial and administrative proceedings (Section C). This section states that healthcare providers can disclose PHI in response to a subpoena provided that:

• Only PHI expressly requested by the subpoena is disclosed and de-identified information could not reasonably have been used.
• The information requested is relevant to a legitimate proceeding and the request is specific and limited in scope.
• The subject of the PHI has been informed about the subpoena or reasonable efforts have been made to notify the individual.
• An objection has not been filed by the subject of the PHI and the time to file an objection has elapsed.
• Any PHI disclosed in response to a subpoena is not used for any purpose other than the purpose for which it was requested.
• The party seeking the disclosure has put in place or requested a protective order to prevent further disclosures.
• Any PHI disclosed in response to the subpoena for medical records will be returned or disposed of at the end of the proceedings for which they were requested.

It is important to be aware that the provisions of Section C do not supersede other provisions of the Privacy Rule. Consequently, it is still necessary to obtain an authorization before disclosing psychotherapy notes or substance abuse disorder medical records, the Minimum Necessary Standard still applies, and Covered Entities have to comply with the provisions of any state laws that pre-empt HIPAA when more stringent privacy protections exist.

Responding to a Subpoena for Medical Records

There are different ways to respond to a subpoena for medical records depending on the type of subpoena (witness, deposition, or duces tecum) and the subpoena issuer. It is important to respond correctly when medical records are subpoenaed because incorrect responses can result in HIPAA violations. For this reason, healthcare providers and administrators should obtain legal advice to find out can medical records be subpoenaed in the specific circumstances of each subpoena.

The significance of the subpoena issuer is that it is not possible to object to a court order, a subpoena signed by a judge, magistrate, or administrative tribunal, or a grand jury subpoena. In such cases, it is necessary to comply with the subpoena for medical records and respond by disclosing the PHI expressly requested by the subpoena – notwithstanding that the content of the subpoena should cover the Privacy Rule provisions listed above (i.e., return or disposal of PHI, etc.).

If a subpoena is signed by a court clerk or attorney, additional assurances may be required by HIPAA. For example, a subpoena requesting medical records relating to substance abuse disorder medical records is invalid unless it is accompanied by a signed court order authorizing the disclosure. Similarly, if patient authorization is required to respond to a subpoena, healthcare providers should use their own authorization form rather than a waiver sent with the subpoena by an attorney.

Objecting to a Subpoena for Medical Records

Healthcare providers can object to a subpoena for medical records when it has been signed by a court clerk or attorney for a variety of reasons. These include (but are not limited to):

• The subpoena does not allow the healthcare provider sufficient time to collate the information requested.
• The subpoena requires the disclosure of PHI requiring an authorization and it has not been possible to obtain an authorization from the patient.
• The subpoena imposes an undue burden on the healthcare provider – typically when the PHI of multiple patients is requested for a class action.
• The subpoena is unreasonable or oppressive, or it is procedurally defective (i.e., no protective order has been requested to prevent further disclosures).

Usually there is a time period for filing an objection to a subpoena, and this can vary according to where the subpoena is issued. Similarly, there may be other reasons for objecting to a subpoena for medical records depending on state law. Consequently, expert and specialist legal advice is needed for the specific circumstances of each subpoena, and healthcare providers and administrators should always obtain legal advice before responding to a subpoena for medical records.

Can Medical Records be Subpoenaed? FAQs

Can courts subpoena medical records?

Yes, but as mentioned above, it is important to establish whether a court-issued subpoena is signed by a judge or a court clerk on behalf of an attorney as this affects the right to object to a subpoena for medical records.

Can an attorney subpoena medical records?

In most states, an attorney can subpoena medical records. However, in some states medical records obtained by an attorney via a deposition subpoena can only be used during the discovery process and are not admissible as evidence in court (also see the next FAQ).

Can a judge subpoena medical records?

Judges can subpoena medical records at any stage of proceedings. They can also subpoena medical records previously subpoenaed by an attorney if the medical records have been obtained via a deposition subpoena and are not admissible in court.

How far back can medical records be subpoenaed?

This depends on the purpose of the subpoena and the state in which the subpoena was issued. This is because statutes of limitations exist on certain legal proceedings (i.e., you cannot file a personal injury claim after x years), and because state-mandated retention periods differ from state-to-state.

What is a subpoena duces tecum for healthcare records?

A subpoena duces tecum for healthcare records is a court order requiring a healthcare provider to produce the requested medical records at a deposition or court hearing. Usually, the court order allows the healthcare provider to produce the medical records remotely without an in-person appearance being necessary.

The post Can Medical Records be Subpoenaed? appeared first on HIPAA Journal.

One of the capabilities of many business password managers is the ability to send encrypted messages to any recipient. Often this capability is used to securely share login credentials or other confidential data. But is it okay to share ePHI via a business password manager?

Over the past few years, the capabilities of business password managers – particularly vault-based password managers – have grown significantly. For example, whereas SSO integration was once big news, these days we are talking more about password-less logins and it has been estimated that biometric facial recognition hardware will be present in 90% of smartphones by 2024.

With regards to the ability to send encrypted messages, this first started as a means of sending passwords to users in the same business subscription. It evolved into sending notes, files, and other data to users in the same business subscription, and then further evolved to sending encrypted messages of any kind to any recipient regardless of whether they are using a password manager.

Why Share ePHI via a Business Password Manager?

There are many circumstances when healthcare providers or other members of a Covered Entity´s workforce need to send or request ePHI to or from a colleague or Business Associate. In many cases, the colleague or Business Associate may not be in the same communications network – raising the issue of how to transmit ePHI securely in compliance with the HIPAA Security Rule.

The most common forms of communication – such as SMS, IM, email, etc. – are not suitable because they lack the necessary features to fulfil the requirements of the Technical Safeguards – for example, access controls, automatic logoff, encryption, audit controls, etc. However, most business password managers do have the necessary features to send and receive ePHI compliantly.

These features enable users to share ePHI via a business password manager securely without risking an impermissible disclosure of ePHI and facilitate “the flow of health information needed to provide and promote high-quality healthcare” – a major goal of the HIPAA Privacy Rule. However, in order to share ePHI via a business password manager in full compliance with HIPAA, the vendor of the password manager must sign a Business Associate Agreement. Not all are willing to do so.

Is a Business Associate Agreement Necessary?

In 2016, the Department of Health & Human Services (HHS) published an FAQ regarding whether or not a Cloud Service Provider is excluded from the definition of a Business Associate if the Cloud Service Provider cannot access ePHI stored in the cloud because it is encrypted and the Cloud Service Provider does not have the decryption key.

The answer was that a Cloud Service Provider is not excluded under the “conduit exception rule” because conduits such as the U.S. Postal Service, Fed-Ex, and DHL are transmission services and the temporary storage of PHI while it is in the conduit´s possession is incident to the transmission, while the temporary storage of ePHI with a Cloud Service Provider is persistent.

HHS stated in the FAQ that “a Cloud Service Provider that maintains ePHI for the purpose of storing it will qualify as a Business Associate […] even if the Cloud Service Provider does not actually view the information”. Substitute password manager vendors for Cloud Service Providers, and it is clear a Business Associate Agreement is necessary to share ePHI via a business password manager.

Which Vendors will Sign a Business Associate Agreement?

Not many, despite claiming to have HIPAA-compliant password managers. 1Password and Keeper – the two most popular password managers in the U.S. – both state they do not qualify as Business Associates because of their zero knowledge architectures (which is incorrect). LastPass and NordPass have such incorrect information about HIPAA on their websites that we strongly suspect they don´t understand a Business Associate Agreement is necessary. Most others keep quiet about the issue.

Among those that do publicly state they are willing to sign a Business Associate Agreement, Bitwarden and Zoho Vault are the most well-known. Of the two, Zoho Vault is the most feature-rich; but at nearly 50% more expensive per user than Bitwarden, Zoho Vault could work out to be unnecessarily expensive if you are not going to use all the features you are paying for. Additionally, Bitwarden passed a HIPAA Security Rule Assessment Report conducted by AuditOne in 2020.

In conclusion, it is okay to share ePHI via a business password manager, provided that the password manager has been configured to comply with the Technical Safeguards of the Security Rule and the vendor of the password manager has signed a Business Associate Agreement. If the vendor is unwilling to sign a Business Associate Agreement, it is not possible to share ePHI via a business password manager without violating HIPAA.

The post Is it Okay to Share ePHI via a Business Password Manager? appeared first on HIPAA Journal.

What happens after a HIPAA complaint is filed can vary according to who it is filed with, whether or not the complaint is justified, and the nature of the complaint.

When you register with a healthcare provider or become a member of a group health plan, you are given a Notice of Privacy Practices. The Notice of Privacy Practices explains how the healthcare provider or health plan can use or disclose your health information and also what rights you have to restrict specific uses and disclosures and request a copy of any health information held about you.

The Notice of Privacy Practices should also provide details of who you can complain to if you think a healthcare provider or health plan has used or disclosed your health information impermissibly, or if your rights have been violated. Usually, the contact details are those of the organization´s Privacy Office and the Department of Health & Human Services´ Office for Civil Rights.

It is also possible to file a complaint with your State Attorney General. However, the majority of states require that you complain to the organization before filing a complaint with the State Attorney General. For this reason, it is important to keep copies of any correspondence between you and the organization, and records of who you spoke with and when if complaining by phone.

What Happens after a HIPAA Complaint is Filed with an Organization?

There is no HIPAA-mandated process for what happens after a HIPAA complaint is filed with a healthcare provider or health plan, so the process is likely to vary from organization to organization. However, the Privacy Rule states that all complaints have to be documented, so the first thing that will happen is that you will receive an acknowledgement of your complaint.

Healthcare providers and health plans are aware that if they do not respond to your complaint satisfactorily and in a timely manner, you have the right to escalate the complaint to HHS´ Office for Civil Rights or your State Attorney General. Therefore, as regulatory investigations can be disruptive and attract indirect costs, your complaint will be reviewed as a matter of priority.

If the review identifies a potential HIPAA violation, it will be investigated further. An investigation can result in several outcomes.

• If no violation is identified, you should receive a communication explaining why.
• If a minor violation is identified, the organization will likely take steps to rectify it.
• If a more serious violation is identified, the organization may escalate your complaint to HHS´ Office for Civil Rights for technical assistance or to report a data breach.

If you are dissatisfied with the response from your healthcare provider or health plan – or you fail to hear from them in a timely manner – you can escalate the complaint to HHS´ Office for Civil Rights or your State Attorney General. Unlike complaining to a State Attorney General, HHS´ Office for Civil Rights does not require you to have complained to the organization before complaining to them.

What Happens after a HIPAA Complaint is Filed with HHS´ Office for Civil Rights?

When a complaint is filed with HHS´ Office for Civil Rights, the complaint is reviewed to establish the agency has the authority to investigate, the complaint is made within 180 days of the alleged violation, and that the complaint relates to a violation of the Privacy, Security, or Breach Notification Rules. Around two-thirds of complaints are rejected at the review stage because the complaint is made against an organization not subject to HIPAA, is too late, or no violation has occurred.

If a complaint passes the review stage, HHS´ Office for Civil Rights will contact the healthcare provider or health plan to attempt an informal resolution to the complaint – for example, by providing technical assistance. If a more serious violation is identified, HHS´ Office for Civil Rights will conduct a full-scale investigation into the organization´s compliance, with the possible outcomes being technical assistance, a more formal corrective action plan, or a civil money penalty.

The process is much the same when a complaint is filed with a State Attorney General, and both the HHS´ Office for Civil Rights and State Attorneys General will inform a complainant of the outcome of their complaint once it is resolved. The only exception to this process is when a possible criminal violation of HIPAA is identified by either HHS´ Office for Civil Rights – in which case the complaint is escalated to the Department of Justice for investigation.

The post What Happens after a HIPAA Complaint is Filed? appeared first on HIPAA Journal.

Some of the biggest fines for HIPAA violations have been for failing to comply with the medical records destruction rules. Consequently, it is vital Covered Entities and Business Associates are aware how to destruct medical records compliantly.

Each state has its own requirements for retaining medical records; and, in some cases, certain types of medical records have to be retained for longer periods than others. Federal laws can also dictate how long specific records have to be retained (i.e., OSHA 1910.1200(g)), and if these records are maintained in a designated record set, they are considered to PHI and Covered Entities are required to keep them until the retention period expires.

Although HIPAA has document retention requirements, there are no minimum retention periods for medical records. However, the Privacy Rule does require that Covered Entities implement appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for whatever period the records are maintained by the Covered Entity. This requirement also applies to the destruction of medical records.

The HIPAA Medical Records Destruction Rules

Although there are no specific HIPAA medical records destruction rules, the Privacy Rule requires Covered Entities to determine what steps are reasonable to safeguard medical records through the destruction process and develop and implement policies and procedures to carry out those steps. In determining what is reasonable, Covered Entities should assess potential risks to patient privacy in the context of what form the information is in and how it is being destructed

Additionally, the Security Rule requires Covered Entities and Business Associates to develop and implement policies and procedures to facilitate the compliant destruction of electronic PHI and/or media on which it is stored. Any members of the workforce involved in the destruction process, or who supervise other members of the workforce responsible for destructing medical records in compliance with HIPAA must receive training on the PHI destruction policies and procedures.

Failing to implement reasonable safeguards to protect PHI in connection with its destruction could result in impermissible disclosures of PHI, and several Covered Entities have received substantial fines for failing to comply with the HIPAA medical records destruction rules:

• In 2009, CVS Pharmacy Inc. was one of the first Covered Entities to reach a financial settlement for a HIPAA violation – the company agreeing to a $2.25 million settlement for the improper disposal of PHI.
• The following year, the pharmacy chain Rite Aid agreed to pay $1 million to settle a similar HIPAA violation; and, a few years, the independent Cornell Prescription Pharmacy had to pay $125,000 for also disposing of PHI improperly.
• It is not just pharmacies who fail to comply with the HIPAA medical records destruction rules. In 2013, the former owners of a medical billing practice were fined $140,000 for disposing of 67,000 medical records in a public dump.
• More recently, the New England Dermatology and Laser Center agreed to settle an investigation into the improper destruction of medical records for $300,640 and implement a Corrective Action Plan for two years – which will incur further indirect costs.

How to Destruct Medical Records in Compliance with HIPAA

HHS´ Office for Civil Rights has previously released guidance on how to destruct medical records in compliance with HIPAA. With regards to paper records, the agency suggests “shredding or otherwise destroying PHI […]so the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster or other trash receptacle”.

With regards to the bulk destruction of PHI, the agency suggests depositing PHI in locked dumpsters that are only accessible by authorized persons or maintaining PHI in a secure area until such time as a disposal company removes it to destroy it professionally. In such circumstances, it will be necessary to enter into a Business Associate Agreement with the entity responsible for destructing the records.

With regards to ePHI stored electronically HHS´ Office for Civil Rights advocates clearing and purging electronic media, or destroying the media by disintegration, pulverization, melting, incinerating, or shredding. It is important to note that some clearing and purging techniques are not 100% effective on modern hard drives, and it may be possible to recover deleted data in some cases.

It is also important to note that some states have more stringent medical records destruction rules than HIPAA; and, in some states, any organization that creates, maintains, or transmits personal health information may be subject to medical records destruction rules – not just HIPAA Covered Entities and Business Associates. If you are unsure which medical records destruction rules apply to your organization, it is recommended you seek professional compliance advice.

The post Understanding the HIPAA Medical Records Destruction Rules appeared first on HIPAA Journal.