HIPAA Compliance News

HIPAA Penalties Waived for Good Faith Operation of COVID-19 Community-Based Testing Sites

Posted by HIPAA Journal

The HHS has a further Notice of Enforcement Discretion covering healthcare providers and business associates that participate in the operation of COVID-19 community-based testing sites.

Under the terms of the Notice of Enforcement discretion, the HHS will not impose sanctions and penalties in connection with good faith participation in the operation of COVID-19 community-based testing sites. The Notice of Enforcement discretion is retroactive to March 13, 2020 and will continue for the duration of the COVID-19 public health emergency or until the Secretary of the HHS declares the public health emergency is over.

The purpose of the notification is to help pharmacies, other healthcare providers, and their business associates to provide COVID-19 testing services and specimen collection at dedicated walk-up or drive through facilities, without risking a financial penalty for noncompliance with HIPAA Rules.

While the Notice of Enforcement Discretion has been issued, the HHS’ Office for Civil Rights is encouraging covered entities and their business associates to ensure reasonable safeguards are implemented to protect the privacy of users of the service and prevent the accidental exposure or disclosure of PHI to unauthorized individuals.

Privacy controls such as canopies and barriers should be used to separate the testing area to protect the privacy of users of the service and there should be a buffer zone to prevent members of the public from observing individuals being tested.

Social distancing measures need to be implemented to reduce the risk of transmission of SARS-CoV-2. A distance of at least 6 feet should be maintained between patients. These social distancing will help to ensure conversations between a patient and CBTS staff cannot be overheard. OCR also recommends posting signs prohibiting filming at testing facilities.

A Notice of Privacy Practices should also be posted in a place where it can be easily read by visitors. The NPP should also be published online, with information included in the printed notice explaining how the NPP can be viewed online.

Uses and disclosures of PHI should be limited to the minimum necessary amount to achieve the purpose for which the information is disclosed, other than when disclosing PHI for treatment purposes.

You can view the Notice of Enforcement Discretion on this link.

The post HIPAA Penalties Waived for Good Faith Operation of COVID-19 Community-Based Testing Sites appeared first on HIPAA Journal.

OCR Issues Notice of Enforcement Discretion to Allow Business Associates to Disclose PHI for COVID-19 Public Health and Health Oversight Activities

Posted by HIPAA Journal

On April 2, 2020, the Department of Health and Human Services announced that with immediate effect, it will be exercising enforcement discretion and will not impose sanctions or financial penalties against healthcare providers or their business associates for good faith uses and disclosures of protected health information (PHI) by business associates for public health and health oversight activities for the duration of the COVID-19 public health emergency, or until the Secretary of the HHS declares the public health emergency no longer exists.

The Notice of Enforcement Discretion was issued to support Federal public health authorities and health oversight agencies such as the Centers for Medicare and Medicaid Services (CMS), the Centers for Disease Control and Prevention (CMS), state and local health departments, and other emergency operation centers that require timely access to COVID-19 related data.

While disclosures of PHI by HIPAA-covered entities for public health and health oversight purposes are permitted under the HIPAA Privacy Rule, currently business associates of HIPAA covered entities are only permitted to disclose PHI for public health and health oversight purposes if it is specifically stated that they can do so in their business associate agreement with a HIPAA covered entity. Without the Notice of Enforcement discretion, business associates could face financial penalties for disclosures of PHI for public health and health oversight purposes.

The Notice of Enforcement Discretion applies to the HIPAA Privacy Rule Provisions 45 CFR 164.502(a)(3), 45 CFR 164.502(e)(2), 45 CFR 164.504(e)(1) and (5) but only for a good faith use or disclosure of PHI for public health activities by a business associate for public health activities consistent with 45 CFR 164.512(b), or health oversight activities consistent with 45 CFR 164.512(d). The business associate must inform the covered entity about the use of disclosure no later than 10 calendar days after the use or disclosure occurred.

The Notice of Enforcement Discretion does not apply to any other provisions of HIPAA Rules and the HIPAA Security Rule remains in effect. Should PHI be disclosed to a public health authority or health oversight agency, the business associate must ensure the requirements of the HIPAA Security Rule are met and reasonable safeguards are implemented to ensure the confidentiality, integrity, and availability of ePHI and that the information is transmitted in a secure manner.

“The CDC, CMS, and state and local health departments need quick access to COVID-19 related health data to fight this pandemic,” explained OCR Director, Roger Severino. “Granting HIPAA business associates greater freedom to cooperate and exchange information with public health and oversight agencies can help flatten the curve and potentially save lives.”

You can view the OCR Notice of Enforcement Discretion on this link.

The post OCR Issues Notice of Enforcement Discretion to Allow Business Associates to Disclose PHI for COVID-19 Public Health and Health Oversight Activities appeared first on HIPAA Journal.

CMS Announces Sweeping Regulatory Changes in Response to Surge in COVID-19 Patients

Posted by HIPAA Journal

The Department of Health and Human Services’ Centers for Medicare and Medicaid Services (CMS) has announced a set of sweeping regulatory changes and waivers to give healthcare providers maximum flexibility to treat patients during the 2019 Novel Coronavirus pandemic. The new changes will allow healthcare providers to act as healthcare delivery coordinators in their areas.

The temporarily changes will ease restrictions are intended to create hospitals without walls, which will make it easier for hospitals and health systems to cope with an expected massive increase in COVID-19 patients over the coming weeks.

Under normal circumstances, federal restrictions require hospitals to provide medical services within their existing facilities, but this will cease to be possible as patient numbers increase. As the number of COVID-19 cases grow, hospitals will soon reach capacity. If they do not develop additional sites to provide treatment to patients, they will be overwhelmed.

To ensure all patients can receive treatment and no one is left behind, the CMS has relaxed restrictions and has issued temporary new rules that will allow treatment to be provided in other locations. Many ambulatory surgery centers have taken the decision to cancel elective procedures during the public health emergency. Hospitals and health systems would be permitted to use those locations along with inpatient rehabilitation hospitals, and even hotels and dormitories, and would still be eligible to receive reimbursement for services under Medicare. The new locations could be used to provide medical services to non-COVID-19 patients to free up inpatient beds for COVID-19 patients that require intensive care and respirators.

The CMS explained that ambulatory surgery centers have two options. They can either contract with local healthcare systems to provide services on behalf of the hospital or they can enroll and bill CMS as hospitals during the public health emergency declaration, provided that is not in conflict with their State’s Emergency Preparedness or Pandemic Plan. Healthcare providers will not be permitted to operate outside of organized plans at the local level.

To further increase capacity, the CMS has issued a waiver that will allow doctor-owned hospitals to increase the number of beds without facing sanctions. Hospitals are permitted to set up drive-through screening centers for COVID-19, use off-campus testing sites, and coverage will be given to laboratory technicians who need to travel to a Medicare beneficiary’s home to collect samples to perform COVID-19 testing. CMS will be providing additional reimbursement for ambulances, which are likely to be required to transfer patients between healthcare facilities and doctor’s surgeries to ensure they receive the treatment they need. Medicare coverage for respiratory-related devices and equipment has now been extended to cover any medical reason.

Changes have also been made to facilitate the rapid expansion of the healthcare workforce. These changes include making it easier for providers to enroll in Medicare and allowing teaching hospitals to have medical residents provide services under the supervision of a teaching physician. The CMS has also issued a blanket waiver to allow hospitals to provide more benefits to support their medical staff, including multiple daily meals, laundry service for personal clothing, or child care services while the physicians and other staff are at the hospital providing patient care.

Changes have also been made to ease the administration burden on healthcare providers with the CMS putting patients above paperwork by eliminating paperwork requirements to ensure that clinicians can spend more time treating patients.

The CMS has previously announced that there is additional flexibility for the provision of telehealth services, with reimbursement now being provided for all Medicare beneficiaries in all areas. Coverage is now included for more than 80 additional services provided through telehealth, as long as those services are provided by clinicians allowed to provide telehealth services.

These new changes and waivers are only temporary and will last for the duration of the national public health emergency for COVID-19, after which the CMS will evaluate how best to return to the current system.

The post CMS Announces Sweeping Regulatory Changes in Response to Surge in COVID-19 Patients appeared first on HIPAA Journal.

OCR Issues Guidance on Allowable Disclosures of PHI to First Responders During the COVID-19 Crisis

Posted by HIPAA Journal

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has issued further guidance on HIPAA and COVID-19, the disease caused by the 2019 Novel Coronavirus, SARS-CoV-2. The new guidance document provides examples of allowable disclosures of protected health information (PHI) by covered entities under the HIPAA Privacy Rule to help make sure first responders and others receive PHI about individuals exposed to SARS-CoV-2 or displaying symptoms of COVID-19.

The new guidance document is in Q&A form and explains when covered entities are permitted to disclose PHI such as names and other identifying information to first responders, law enforcement officers, paramedics, and public health authorities without first obtaining a HIPAA authorization.

The document confirms that under the HIPAA Privacy Rule, disclosures of PHI are permitted when the information is required to provide treatment, when a disclosure is required by law, when first responders such as paramedics are at risk of contracting COVID-19 and need information to prevent infection, and when a disclosure could prevent or lessen a serious and imminent threat.

OCR also confirms that a disclosure of PHI is permitted when responding to a request for PHI from a correctional institution or law enforcement official in lawful custody of an inmate or other individual, and PHI is required in order to provide healthcare services to the individual, to ensure the health and safety of the individual or others in the institution, those required to transport the individual, and when PHI is required to maintain safety, security, and good order in a correctional institution.

OCR explains that a hospital is permitted to provide a list of names and addresses of all individuals known to have tested positive for COVID-19 to an EMS dispatch for use on a per-call basis. That information can then be used to ensure that any personnel responding to an emergency at the patient’s location knows they must take extra precautions to ensure their own safety, such as wearing personal protective equipment (PPE).

911 call center staff may ask for information about a patient’s symptoms in order to determine whether there is a risk they have been infected with SARS-CoV-2. Information may then be passed to law enforcement officers and others responding to an incident at the person’s location to ensure they take steps to protect themselves.

In all cases, a covered entity must make reasonable efforts to limit the disclosed information to the minimum amount necessary to accomplish the purpose for the disclosure.

“Our nation needs our first responders like never before and we must do all we can to assure their safety while they assure the safety of others,” said Roger Severino, OCR Director. “This guidance helps ensure first responders will have greater access to real time infection information to help keep them and the public safe.”

The guidance document – COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities – can be found on the HHS website on this link (PDF).

The post OCR Issues Guidance on Allowable Disclosures of PHI to First Responders During the COVID-19 Crisis appeared first on HIPAA Journal.

February 2020 Healthcare Data Breach Report

Posted by HIPAA Journal

There were 39 reported healthcare data breaches of 500 or more records in February and 1,531,855 records were breached, which represents a 21.9% month-over-month increase in data breaches and a 231% increase in breached records. More records were breached in February than in the past three months combined. In February, the average breach size was 39,278 records and the mean breach size was 3,335 records.

Largest Healthcare Data Breaches in February 2020

The largest healthcare data breach was reported by the health plan, Health Share of Oregon. An unencrypted laptop computer containing the records of 654,362 plan members was stolen from its transportation vendor in an office break in.

The second largest breach was a ransomware attack on the accounting firm BST & Co. CPAs which saw client records encrypted, including those of the New York medical group, Community Care Physicians. Aside from the network server breach at SOLO Laboratories, the cause of which has not been determined, the remaining 7 breaches in the top 10 were all email security incidents.

Name of Covered Entity Covered Entity Type Individuals Affected Type of Breach Location of Breached PHI
Health Share of Oregon Health Plan 654,362 Theft Laptop
BST & Co. CPAs, LLP Business Associate 170,000 Hacking/IT Incident Network Server
Aveanna Healthcare Healthcare Provider 166,077 Hacking/IT Incident Email
Overlake Medical Center & Clinics Healthcare Provider 109,000 Hacking/IT Incident Email
Tennessee Orthopaedic Alliance Healthcare Provider 81,146 Hacking/IT Incident Email
Munson Healthcare Healthcare Provider 75,202 Hacking/IT Incident Email
NCH Healthcare System, Inc. Healthcare Provider 63,581 Hacking/IT Incident Email
SOLO Laboratories, Inc. Business Associate 60,000 Hacking/IT Incident Network Server
JDC Healthcare Management Healthcare Provider 45,748 Hacking/IT Incident Email
Ozark Orthopaedics, PA Healthcare Provider 15,240 Hacking/IT Incident Email

Causes of February Healthcare Data Breaches

Hacking/IT incidents dominated the breach reports, accounting for two thirds (66.67%) of all breaches reported in February and 54.78% of breached records (839,226 records). The average breach size was 32,277 records and the median breach size was 4,126 records. 80.76% of those incidents involved hacked email accounts.

There were 6 unauthorized access/disclosure incidents, four of which involved paper/films, one was an email incident and one involved a portable electronic device. 15,826 records were impermissibly disclosed in those incidents. The average breach size was 3,126 records and the median breach size was 2,548 records.

While there were only three theft incidents reported, they accounted for 42.78% of breached records. The average breach size was 327,696 records and the median breach size was 530 records.

There were two incidents involving lost paperwork containing the PHI of 5,904 patients and two improper disposal incidents involving paper files containing the PHI of 15,507 patients.

Location of Breached Protected Health Information

As the bar chart below shows, the biggest problem area for healthcare organizations is protecting email accounts. All but one of the email incidents were hacking incidents that occurred as a result of employees responding to phishing emails. The high total demonstrates how important it is to implement a powerful email security solution and to provide regular training to employees to teach them how to recognize phishing emails.

Breaches by Covered Entity Type

26 data breaches were reported by HIPAA-covered entities in February. The average breach size was 23,589 records and the median breach size was 3,229 records. Data breaches were reported by 8 health plans, with an average breach size of 83,490 records and a median breach size of 2,468 records.

There were 5 data breaches reported by business associates and a further 5 breaches that were reported by the covered entity but had some business associate involvement. The average breach size was 50,124 records and the median breach size was 15,010 records.

Healthcare Data Breaches by State

The data breaches reported in February were spread across 24 states. Texas was the worst affected with 4 breaches. Three data breaches were reported in Arkansas, California, and Florida. There were two reported breaches in each of Georgia, Indiana, Michigan, North Carolina, Virginia, and Washington. One breach was reported in each of Arizona, Hawaii, Illinois, Iowa, Maine, Massachusetts, Minnesota, Missouri, New Mexico, New York, Oregon, Pennsylvania, Tennessee, and Wisconsin.

HIPAA Enforcement Activity in February 2020

There was one HIPAA enforcement action reported in February. The HHS’ Office for Civil Rights announced that Steven A. Porter, M.D had agreed to pay a financial penalty of $100,000 to resolve a HIPAA violation case. The violations came to light during an investigation of a reported breach involving the practice’s medical records company, which Dr. Porter claimed was impermissibly using patient medical records by preventing access until payment of $50,000 was received.

OCR found that Dr. Porter had never conducted a risk analysis to identify risks to the confidentiality, integrity, and availability of ePHI. The practice had also not reduced risks to a reasonable and appropriate level, and policies and procedures to prevent, detect, contain, and correct security violations had not been implemented.

The post February 2020 Healthcare Data Breach Report appeared first on HIPAA Journal.

OCR Issues Guidance on Telehealth and HIPAA During Coronavirus Pandemic

Posted by HIPAA Journal

Following on from the announcement from the HHS’ Office for Civil Rights that enforcement of HIPAA compliance in relation to the good faith provision of telehealth services during the COVID-19 nationwide public health emergency has been relaxed, OCR has issued guidance on telehealth and remote communications.

Telehealth is defined by the HHS’ Health Resources and Services Administration (HRSA) as “the use of electronic information and telecommunications technologies to support and promote long-distance clinical health care, patient and professional health-related education, and public health and health administration.” These services can be provided through the use of text, audio, or video via secure text messaging platforms, over the internet, using video conferencing solutions, or via landlines and wireless communications networks.

The Notification of Enforcement Discretion covers “All services that a covered health care provider, in their professional judgement, believes can be provided through telehealth in the given circumstances of the current emergency,” which includes the remote diagnosis and treatment of patients. The Notification of Enforcement Discretion only applies to “Penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency.”

OCR has confirmed that its Notification of Enforcement Discretion only applies to HIPAA-covered healthcare providers, not other HIPAA-covered entities that are not engaged in the provision of health care.

OCR explains that during the public health emergency, telehealth services can be provided to all patients, not only those that receive benefits under Medicare and Medicaid. Telehealth services can be provided to patients regardless of their health compliant, not only those with symptoms of COVID-19.

There is currently no expiration date for the Notification of Enforcement Discretion. This is a fluid situation and likely to be a long-term public health emergency. OCR will issue a public notice when the enforcement discretion no longer applies, and that decision will be based on circumstances and facts.

In the guidance OCR explains that telehealth services can be provided from healthcare facilities, including other clinics, offices, and from the home. To protect patient privacy, the services should be provided in a private setting where conversations cannot be overheard. Public locations and semi-public settings should be avoided, unless consent is given by patients or in exigent circumstances. In all cases, safeguards must be implemented to protect against incidental uses and disclosures of patients’ protected health information.

OCR has also provided clarification on the good faith and bad faith provision of telehealth services. The Notification of Enforcement Discretion only applies to good faith provision of telehealth services.

Bad faith provision of telehealth services includes:

  • Use of PHI for criminal purposes or furtherance of a criminal act
  • Uses of PHI transmitted during a telehealth communication for purposes not permitted by the HIPAA Privacy Rule e.g. sale of PHI; use of PHI for marketing purposes without first obtaining authorization
  • Violations of state licensing laws
  • Violations of professional ethical standards that would result in disciplinary action
  • The use of public-facing communications products

Public and Non-public Facing Communications Platforms

The Notification of Enforcement Discretion only applies to the use of non-public facing communications tools. These include HIPAA-compliant communications solutions, Facebook Messenger video, WhatsApp, Apple FaceTime, Skype, Google Hangouts video, and texting facilities within those applications. These non-public facing applications typically use end-to-end encryption, which helps to ensure PHI is not intercepted in transit. These solutions have access controls and give users control over certain aspects of communications, such as recording and muting conversations.

Public-facing communications platforms are not covered by the Notification of Enforcement Discretion and MUST NOT be used. These communications platforms have been developed to allow wide or indiscriminate access and are open to the public. Public-facing platforms include Facebook Live, Twitch, and TikTok, as well as chatroom platforms such as Slack.

You can view the OCR guidance on telehealth and HIPAA during the COVID-19 nationwide public health emergency on this link (PDF).

The post OCR Issues Guidance on Telehealth and HIPAA During Coronavirus Pandemic appeared first on HIPAA Journal.

Telehealth Services Expanded and HIPAA Enforcement Relaxed During Coronavirus Public Health Emergency

Posted by HIPAA Journal

In an effort to prevent the spread of the 2019 novel coronavirus, patients suspected of being exposed to the virus and individuals with symptoms of COVID-19 have been told to self-isolate at home. It is essential for contact to be maintained with people at risk, especially seniors and people with disabilities.

Telehealth services, including video calls, can help healthcare professionals assess and treat patients remotely to reduce the risk of transmission of the coronavirus. Telehealth services can also be used to maintain contact with patients who choose not to visit medical facilities due to the risk of exposure to the virus.

On Monday, March 16, 2020, the Trump Administration announced that telehealth services for Medicare beneficiaries have been expanded. Prior to the announcement, doctors were only able to claim payment for telehealth services provided to people living in rural areas and no access to local medical facilities and for patients with established relationships with billing providers.

“We are doing a dramatic expansion of what’s known as telehealth for our 62 million Medicare beneficiaries, who are amongst the most vulnerable to the coronavirus,” explained Seema Verma, administrator of the Centers for Medicare and Medicaid Services (CMS). “Medicare beneficiaries across the nation—no matter where they live—will now be able to receive a wide-range of services via telehealth without ever having to leave home. These services can also be provided in a variety of settings, including nursing homes, hospital outpatient departments, and more.”

Effective March 6, 2020, Medicare will reimburse a wide range of healthcare providers for office and telehealth visits, including nurse practitioners, social workers, and clinical psychologists. Reimbursement will be at the same rate as face-to-face visits.

Relaxation of Enforcement of Noncompliance with HIPAA

Telehealth services are subject to HIPAA regulations. The technology used, such as smartphone and communications platforms, must comply with HIPAA rules and have safeguards in place to ensure the confidentiality, integrity, and availability of ePHI. During a public health emergency such as a disease outbreak the HIPAA Security Rule still applies. Healthcare professionals that provide telehealth services would, under normal circumstances, not be permitted to use certain video conferencing technology such as Facetime or Skype, as the services are not fully compliant with HIPAA.

The HHS’ Office for Civil Rights announced on March 17, 2020 that it is taking a more relaxed position on HIPAA enforcement of noncompliance with certain HIPAA provisions related to telehealth services. “OCR will exercise its enforcement discretion and will not impose penalties for noncompliance with the regulatory requirements under the HIPAA Rules against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency.  This notification is effective immediately,” explained OCR in its Notification of Enforcement Discretion for telehealth.

OCR confirmed that during the coronavirus public health emergency, healthcare providers are permitted to use “any non-public facing remote communication product that is available to communicate with patients,” in connection with good faith provision of telehealth. That enforcement discretion also applies to telehealth services related to the diagnosis and treatment of health conditions unrelated to COVID-19. While enforcement has been relaxed, Verma said “it is still important for covered entities must continue to implement reasonable safeguards to protect patient information against intentional or unintentional impermissible uses and disclosures.”

While OCR does not endorse the use of certain products, it has been suggested that healthcare providers could use Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype. Public facing chat and communications platforms such as Facebook Live, Twitch, and TikTok would not be permitted for telehealth purposes.

OCR reminded covered entities that they can obtain greater privacy protections by using HIPAA-compliant video communications solutions and should obtain a signed business associate agreement. Provides of platforms that do sign BAAs and provide a HIPAA compliant service include TigerConnect, Skype for Business, Zoom for Healthcare, Updox and VSee.

“OCR will not impose penalties against covered health care providers for the lack of a BAA with video communication vendors or any other noncompliance with the HIPAA Rules that relates to the good faith provision of telehealth services during the COVID-19 nationwide public health emergency,” explained OCR in its notice. When the public health emergency ends, penalties would apply if a BAA is not in place and communications platforms are used that are not HIPAA compliant.

The post Telehealth Services Expanded and HIPAA Enforcement Relaxed During Coronavirus Public Health Emergency appeared first on HIPAA Journal.

HIPAA Compliance and COVID-19 Coronavirus

Posted by HIPAA Journal

HIPAA covered entities – healthcare providers, health plans, healthcare clearinghouses – and business associates of covered entities no doubt have many questions about HIPAA compliance and COVID-19 coronavirus cases. There may be confusion about the information that can be shared about individuals who have contracted COVID-19 and those suspected of exposure to the 2019 Novel Coronavirus, and with whom information can be shared.

HIPAA Compliance and the COVID-19 Coronavirus Pandemic

There is understandably concern about HIPAA compliance and the COVID-19 Coronavirus pandemic and how the HIPAA Privacy Rule and Security Rule apply. In the age of HIPAA, no disease outbreak on this scale has ever been experienced.

It is important to remember that during a public health emergency such as a disease outbreak, and this applies to HIPAA compliance and COVID-19, that the HIPAA Privacy and Security Rules still apply. The HIPAA Security Rule ensures the security of patients’ protected health information (PHI) and requires reasonable safeguards to be implemented to protect PHI against impermissible uses and disclosures. The HIPAA Privacy Rule restricts the uses and disclosures of PHI to those related to treatment, payment, and healthcare operations.

When public health emergencies are declared, it is common for the Secretary of the HHS to issue partial HIPAA waivers in affected areas. In such cases, certain provisions of the HIPAA Privacy Rule are waived for a period of 72 hours from the moment a HIPAA-covered entity institutes its disaster protocol. As of March 16, 2020, no HIPAA waivers have been declared by the Secretary of the HHS. Even without a HIPAA waiver, the HIPAA Privacy Rule permits responsible uses and disclosures of patients’ PHI.

OCR released a bulletin about the 2019 Novel Coronavirus in February 2020 confirming how patient information may be shared under the HIPAA Privacy Rule during emergency situations, such as the outbreak of an infectious disease, a summary of which is detailed below.

Permitted Uses and Disclosures of PHI in Emergencies

PHI can be disclosed without first receiving authorization from a patient for treatment purposes, including treating the patient or treating other patients. Disclosures are also permitted for coordinating and managing care, for patient referrals, and consultations with other healthcare professionals.

With a disease such as COVID-19, it is essential for public health authorities to be notified as they will need information in order to ensure public health and safety. It is permissible to share PHI with public health authorities such as the Centers for Disease Control and Prevention (CDC) and others responsible for ensuring the safety of the public, such as state and local health departments. These disclosures are necessary to help prevent and control disease, injury, and disability. In such cases, PHI may be shared without obtaining authorization from a patient.

Disclosures of PHI are also permitted to prevent and lessen a serious and imminent threat to a specific person or the public in general, provided that such disclosures are permitted by other laws. Such disclosures do not require permission from a patient. In such cases, these disclosures are left to the discretion and professional judgement of healthcare professionals about the nature and the severity of the threat.

Disclosures of Information to Individuals Involved in a Patient’s Care

The HIPAA Privacy Rule permits disclosures of PHI to individuals involved in the care of a patient such as friends, family members, caregivers, and other individuals that have been identified by the patient.

HIPAA covered entities are also permitted to share patient information in order to identify, locate, and notify family members, guardians, and other individuals responsible for the patient’s care, about the patient’s location, general condition, or death. That includes sharing information with law enforcement, the press, or even the public at large.

In such cases, verbal permission should be obtained from the patient prior to the disclosure. A healthcare professional must otherwise be able to reasonably infer, using professional judgement, that the patient does not object to a disclosure that is determined to be in the best interest of the patient.

Information may also be shared with disaster relief organizations that are authorized by law or charters to assist in disaster relief efforts, such as for coordinating the notification of family members or other persons involved in the patient’s care about the location of a patient, their status, or death.

The HIPAA Minimum Necessary Standard Applies

Aside from disclosures by healthcare providers for the purpose of providing treatment, the ‘minimum necessary’ standard applies. Healthcare professionals must make reasonable efforts to ensure that any PHI disclosed is restricted to the minimum necessary information to achieve the purpose for which the information is being disclosed.

When information is requested by a public health authority or official, covered entities can rely on representations from the public health authority or official that the requested information is the minimum necessary amount, when that reliance is reasonable under the circumstances.

Disclosures About COVID-19 Patients to the Media

HIPAA does not apply to disclosures by the media about infections, but HIPAA does apply to disclosures to the media by HIPAA-covered entities and their business associates. In such cases, the HIPAA-covered entity or business associate can provide limited information if a request is made about a patient by name. The information disclosed should be limited to the general condition of the named patient and their location in the facility, provided the disclosure is consistent with the patient’s wishes. The status of the patient should be described in terms such as undetermined, good, fair, serious, critical, treated and released, treated and transferred, or deceased.

All other information may not be disclosed to the media or any individual not involved in the care of a patient without first obtaining written consent from the patient in question.

Disclosures of Information About COVID-19 by Non-HIPAA Covered Entities

It is worth noting that HIPAA only applies to HIPAA-covered entities, business associates of HIPAA-covered entities, and subcontractors of business associates. There are no restrictions on disclosures of information about the 2019 Novel Coronavirus and COVID-19 by other entities; however, while HIPAA may not apply, other federal and state laws may do.

HIPAA would therefore not apply when an employee tells an employer they have contracted COVID-19 or are self-isolating because they are displaying symptoms of COVID-19. HIPAA would apply if an employer is informed about an employee testing positive, if the employer is notified about the positive test by the employer’s health plan.

Further Information on HIPAA Compliance and the COVID-19 Coronavirus Pandemic

In response to this emergency, HIPAA Journal has worked with Compliancy Group to set up a free hotline for any questions you have related to the response to HIPAA compliance during coronavirus crisis: (800) 231-4096

Background Information on the SARS-CoV-2 Pandemic and COVID-19

The 2019 Novel Coronavirus has been named Severe Acute Respiratory Syndrome Coronavirus 2 (SARS-CoV-2) and causes Coronavirus Disease 2019 (COVID-19). The virus was first identified in November and originated in Wuhan, in the Hubei province of China. The Chinese government took steps to control the spread of the virus, but it was not possible to contain, and it spread around globe.

The World Health Organization (WHO) declared the outbreak a public health emergency of international concern on January 30, 2020. Following the WHO declaration, HHS Secretary Alex Azar declared the SARS-CoV-2 outbreak a public health emergency for the United States. WHO declared the outbreak a pandemic on March 11, 2020 and on March 13, 2020, President Trump declared COVID-19 a national emergency.

SARS-CoV-2 is highly infectious, and COVID-19 has a high mortality rate. The mortality rate is difficult to determine many people infected with SARS-CoV-2 only have relatively mild symptoms and do not seek medical help. Testing has been erratic initially in many locations and tests have been in short supply. Based on the limited data available, the mortality rate ranges from less than 1% to 7%. In early March, WHO estimated a mortality rate of 3.4%; however, the data on which these figures are based may be inaccurate and this is an evolving situation.

One of the main factors that has contributed to the rapid spread of SARS-CoV-2 is the long incubation period before symptoms are experienced, during which time infected individuals can spread the virus. It can take up to 14 days before infected individuals start displaying symptoms. The median incubation time is 10 days.

This is a rapidly changing situation that is likely to get considerably worse until the spread of the disease can be curbed. In the absence of a vaccine to provide protection, steps need to be taken by the entire population to limit exposure and prevent the spread of the disease.

There has been significant progress towards a vaccine in a short space of time. Some pharma firms having already developed potential vaccines, but they now need to be tested for safety on humans in clinical trials. Even if the process can be fast tracked, it is unlikely that a vaccine will be available before 2021.

The post HIPAA Compliance and COVID-19 Coronavirus appeared first on HIPAA Journal.

Henry Mayo Newhall Hospital Fires Employees for Snooping on Medical Records

Posted by HIPAA Journal

Henry Mayo Newhall Hospital in Santa Clarita, CA has fired several employees for snooping on the medical records of the Saugus High School shooter.

Under Health Insurance Portability and Accountability Act (HIPAA) Rules, hospital staff are only permitted to access the medical records of patients with whom they have a treatment relationship of if there is an otherwise legitimate business relationship for accessing the records.

The HIPAA Security Rule requires HIPAA-covered entities to implement mechanisms to record activity in information systems containing patient’s electronic protected health information and regularly review records of system activity to identify unauthorized access. A sanctions policy is also required, which must be applied when members of the workforce violate patient privacy.

On November 14, 2009, a student of Saugus High School shot five students, killing two before turning the pistol on himself. The shooter was taken to Henry Mayo Newhall Hospital where he died the following day.

An analysis of system activity logs revealed several employees at the hospital had viewed the medical records of the shooter. The hospital investigated the potential HIPAA violations and discovered that in several cases, employees had viewed the records without any legitimate business purpose for doing so.

Henry Mayo Newhall Hospital’s director of marketing, public relations, and community engagement, Patrick Moody, told the Santa Clarita Gazette, “All employees receive extensive annual training on state and federal privacy regulations. The training includes detailed descriptions of the potential consequences of violating any of these regulations. All suspected breaches of our HIPAA policies are thoroughly investigated with appropriate consequences, including termination, implemented for confirmed violations upon conclusion of a review.” The Santa Clarita Gazette reports that an unnamed source said 13 employees were fired.

Ozark Orthopaedics Discovers Breach of 4 Email Accounts

Ozark Orthopaedics in Fayetteville, AR has started notifying 15,240 patients about a recent data security incident involving their protected health information.

Unusual activity was detected in employee email accounts on October 8, 2019. Steps were immediately taken to secure the email system and an investigation was launched to determine the whether any patient information had been compromised. On November 18, 2019, Ozark Orthopaedics learned that four email accounts had been accessed by an unauthorized individual. On December 20, 2019, Ozark discovered the email accounts contained protected health information including patient names, diagnoses, treatment information, prescription or medication information, health insurance information, Medicare/Medicaid ID numbers, Social Security numbers, and financial account information.

No evidence was found to indicate patient information was accessed or stolen and no reports have been received to suggest any patient information has been misused. Patients were notified on February 28, 2020. Ozark Orthopaedics has since taken steps to improve email security to prevent further breaches in the future.

The post Henry Mayo Newhall Hospital Fires Employees for Snooping on Medical Records appeared first on HIPAA Journal.