HIPAA Compliance News

5 Year Jail Term Upheld for Clinic Worker Who Stole PHI

Posted by HIPAA Journal

A clinic worker who stole the protected health information of mentally ill patients and sold the data to identity thieves has failed to get his 5-year jail term reduced.

Jean Baptiste Alvarez, 43, of Aldan, PA, stole daily census sheets from the Kirkbride Center, a 267-bed behavioral health care facility in Philadelphia. The census sheets contained all the information needed to steal the identities of patients and submit fraudulent tax returns in their names – Names, Social Security numbers, dates of birth and other personally identifiable information.

Alvarez had the opportunity to steal the data undetected, as the floor where the sheets were kept did not have security cameras.

Alvarez was paid $1,000 per census sheet by his to-co-conspirators, who used the information to submit 164 fraudulent tax returns in the names of the patients, resulting in a loss of $232,612 in tax revenue for the IRS.

In early 2016, Alvarez was found guilty of conspiracy to defraud, misuse of Social Security numbers, and aggravated identity theft. The latter carried a minimum sentence of 2 years. The maximum sentence for all counts was 24 years in jail, a maximum of three years of supervised release, and potentially a fine.

Judge Michael M. Baylson invoked the vulnerable victim enhancement, and Alvarez was sentenced to 5 years in jail for his crimes, 3 years of supervised release, was ordered to pay $266,985 in restitution, and a $500 special assessment fine.

Alvarez appealed the sentence claiming it was excessively harsh as his victims were not “vulnerable.” He also explained that he did not target the patients because they were mentally ill and had drug addiction issues. He only stole the information because he had access to it.

However, the U.S. Court of Appeals for the Third Circuit rejected his appeal to have the sentence reduced, ruling that Alvarez’s argument was without merit. The victims were suffering from mental health and addition issues and were vulnerable.  Judge D. Michael Fisher also noted that since the patients were not working, the IRS was unlikely to detect the fraud as there would not be any duplicate claim. The patients would similarly be unlikely to discover they had been defrauded due to their mental health issues. The 5-year jail term stands.

The case serves as a warning to healthcare workers that the theft of patients’ personal information can result in lengthy jail terms. The Department of Justice is aggressively pursuing cases of PHI theft, identity theft, and tax fraud, and is punishing criminals to the full extent of the law.

The post 5 Year Jail Term Upheld for Clinic Worker Who Stole PHI appeared first on HIPAA Journal.

How to Handle A HIPAA Privacy Complaint

Posted by HIPAA Journal

Healthcare providers need to be prepared to deal with a HIPAA privacy complaint from a patient. In order for an efficient response to be conducted, policies should be developed covering the complaints procedure and staff must be trained to handle HIPAA privacy complaints correctly.

Patients must also be clearly informed how they can make a HIPAA privacy complaint if they feel that their privacy has been violated or HIPAA Rules have been breached. This should be clearly stated in your Notice of Privacy Practices.

A HIPAA Privacy Complaint Should be Taken Seriously

When a HIPAA privacy complaint is filed, it is important that it is dealt with quickly and efficiently. Fast action will help to reassure patients that that you treat all potential privacy and security violations seriously.

While patients may be annoyed or upset that an error has been made, in many cases, patients are not looking to cause trouble. They want the issue to be investigated, any risks to be mitigated, the problem to be addressed to ensure it does not happen again, and in many cases, they seek an apology. If the complaint is dealt with quickly and efficiently, it may not be taken any further.

If a verbal complaint is made, the patient should be asked to submit the complaint in writing. You should provide a form for the patient to do this. The HIPAA privacy complaint form can then be passed on to your Privacy Officer to investigate.

Investigate All Complaints and Take Prompt Action

All HIPAA privacy complaints should be investigated to determine who was involved, and how the privacy of the patient was violated. The privacy breach may not be a one-off mistake. It could be an indication of a widespread problem within your organization. The Privacy Officer must identify the root cause of the privacy violation and take action to ensure that any issues are corrected to prevent similar privacy breaches from occurring in the future.

All individuals involved in the breach must be identified and appropriate action taken – disciplinary action and/or additional training. A report of the incident should be given to law enforcement if a crime is suspected, and policies and procedures may need to be updated to introduce new safeguards to prevent a recurrence.

The Privacy Officer will need to determine whether there has been a HIPAA breach, and if the incident must be reported. The investigation must determine whether any other patients are likely to have had their privacy violated. If so, they will need to be notified within 60 days.

If a HIPAA breach has occurred, the Breach Notification Rule requires covered entities to report the breach to OCR without unnecessary delay. State laws may also require healthcare organizations to notify appropriate state attorneys general of the breach.

A breach impacting 500 or more individuals must be reported to OCR within 60 days of the discovery of the breach, and within 60 days of year end for smaller breaches. The failure to investigate promptly may see that deadline missed. In 2017, OCR issued its first HIPAA penalty solely for a Breach Notification Rule violation.

It is important that all stages of the complaint and investigation are documented. Those documents are likely to be requested in the event of an audit or investigation by OCR or state attorneys general. If any documents are missing, that aspect of the complaint investigation cannot be easily proven to have taken place.

Once the investigation into the HIPAA privacy complaint has been completed, it is important to report back to the complainant and explain that their complaint has been investigated, and the actions taken to mitigate harm and prevent similar incidents from occurring in the future should be explained.

Summary of How to Correctly Handle a HIPAA Complaint

  • Request the HIPAA privacy complaint is made in writing
  • Pass the compliant to the Privacy Officer
  • Privacy Officer should find out who was involved and what PHI was breached
  • The root cause of the breach must be established
  • Action should be taken to mitigate harm
  • Pass information to HR to take disciplinary action against employees (if appropriate)
  • Report the breach to law enforcement (if appropriate)
  • Policies and procedures should be updated to prevent a recurrence
  • Retrain staff
  • Determine whether the breach is a reportable incident
  • Collate all documentation in relation to the breach and investigation
  • Contact the complainant and explain the findings of the investigation

If the breach is determined to be a reportable incident

  • Submit a breach report to OCR
  • Submit breach reports to appropriate state attorneys general
  • Provide a toll-free number for patients to find out more information
  • Notify all affected individuals by mail
  • Post a breach notice in a prominent place on the home page of your organization’s website for 90 days if current contact information for 10 or more individuals is not held

If the breach is discovered to affect more than 500 individuals

  • Issue a press release to a prominent media outlet

Privacy Violations Can Result in Financial Penalties

When patients believe their privacy has been violated, or HIPAA Rules have been breached, they may report the incident to the Department of Health and Human Services’ Office for Civil Rights. Some patients may choose to take this course of action rather than contact the covered entity concerned.

OCR is likely to take an interest in an organization’s HIPAA policies covering privacy complaints. Financial penalties await organizations that do not have documented policies and procedures in place, and the penalties for HIPAA violations can be severe.

OCR wants to see that complaints are treated seriously, they are adequately investigated and resolved, and that prompt action is taken to ensure they do not happen again. A fast and efficient response to a HIPAA privacy complaint – and correction of any HIPAA violations uncovered – will reduce the risk of a HIPAA violation penalty, and the amount of the penalty if it cannot be avoided.

The post How to Handle A HIPAA Privacy Complaint appeared first on HIPAA Journal.

Is Google Hangouts HIPAA Compliant?

Posted by HIPAA Journal

Is Google Hangouts HIPAA compliant? Can Google Hangouts be used by healthcare professionals to transmit and receive protected health information (PHI)?

Is Google Hangouts HIPAA Compliant?

Healthcare organizations frequently ask about Google services and HIPAA compliance, and one product in particular has caused some confusion is Google Hangouts. Google Hangouts is the latest incarnation of the Hangouts video chat system, and has taken the place of Huddle (Google+ Messenger). Google Hangouts is a cloud-based communication platform that incorporates four different elements: Video chat, SMS, VOIP, and an instant messaging service.

Google will sign a business associate agreement for G Suite, which currently covers the following Google core services

  • Gmail
  • Calendar
  • Google Drive (Includes Google Docs, Google Sheets, Google Slides, and Google Forms)
  • Apps Script
  • Keep
  • Sites
  • Jamboard
  • Google Cloud Search
  • Vault (If applicable)
  • Google Hangouts (Chat messaging)
  • Hangouts Meet

The Business Associate Agreement does not cover Google Groups, Google Contacts, and Google+, none of which can be used in conjunction with protected health information. Google also advises users to disable the use of non-core services in relation to G suite – for example YouTube, ​Blogger ​and Google ​Photos.

So, certain elements of Google Hangouts are HIPAA compliant and can be used by HIPAA covered entities without violating HIPAA Rules, provided that prior to the use of the services with PHI, the covered entity has entered into a business associate agreement with Google.

However, even with a BAA in place, not all elements of Google Hangouts are HIPAA compliant, so covered entities must exercise caution. Video chat for instance, is not covered by the BAA so cannot be used, and neither the SMS and VOIP options.

To help make Google Hangouts HIPAA compliant, Google has released a guide for healthcare organizations.

Google Hangouts HIPAA Compliance Depends on Users

If you decide to allow the use of Google Hangouts in your organization, it important to address the allowable uses of Google Hangouts with respect to PHI through policies and procedures. Staff must be trained on the correct use of the platform, and instructed which elements of Google Hangouts can be used and which are prohibited. If video chat is important for your organization, you should seek a HIPAA-compliant alternative platform.

As we have mentioned in a previous post, simply obtaining a BAA from Google is no guarantee of HIPAA compliance – that will depend on how Google services are configured and how they are used – See this page for further information of G Suite HIPAA Compliance.

Don’t Forget to Implement Additional Safeguards for Mobile Devices

One area where HIPAA-covered entities could easily violate HIPAA Rules is the use of Google Hangouts on mobile devices. Google does have excellent security controls that can alert users to potential unauthorized access of their Google account. These should be configured to ensure inappropriate access attempts are identified rapidly. Controls should also be implemented on mobile devices to ensure that the devices are protected in case of loss or theft.

Access controls on the device should be implemented to prevent the device, and any ePHI stored on it, from being easily accessed. Policies and procedures should also be developed to ensure lost and stolen devices are reported promptly, and actions taken to secure accounts. It is also recommended to implement controls that allow lost and stolen devices to be located, locked, and remotely wiped.

The post Is Google Hangouts HIPAA Compliant? appeared first on HIPAA Journal.

President Trump Nominates Alex Azar for HHS Secretary

Posted by HIPAA Journal

Former Deputy Secretary of the Department of Health and Human Services, Alex Azar, is tipped to take over from former Secretary Tom Price after receiving the presidential nomination for the role. Azar previously served as general counsel to the HHS and Deputy Secretary during the George W. Bush administration.

President Trump confirmed on Twitter that he believes Azar is the man for the job, tweeting “Happy to announce, I am nominating Alex Azar to be the next HHS Secretary. He will be a star for better healthcare and lower drug prices!”

The position of Secretary of the Department of Health and Human Services was vacated by former Secretary Tom Price in September, following revelations about his controversial use of military aircraft and expensive charter flights to travel around the country.

While there were several potential candidates tipped to receive the nomination, including commissioner of the Food and Drug Administration, Scott Gottlieb, and administrator of the Centers for Medicare and Medicaid Services, Seema Verma, President Trump has made a controversial choice.

Alex Azar is a trained lawyer, but has spent the past ten years working in the pharmaceutical industry – an industry regulated by the HHS. In 2007, Azar joined pharmaceutical giant Eli Lilly taking on the role of senior vice president of corporate affairs and communications before becoming the head of the U.S. division of the firm until January 2017, when he left to start up his own consulting firm.

The nomination of Azar has raised many eyebrows. While President Trump has tweeted that he sees Azar as the man to help lower drug prices, Eli Lilly has attracted considerable criticism in the past for hikes in drug prices, notably for price rises to Insulin, one of the firm’s major pharmaceutical products. President Trump has previously claimed the pharmaceutical industry is ‘getting away with murder’ setting prices for their products.

Democrats have already expressed skepticism about how Azar would be able to help lower healthcare costs, not sharing Trump’s optimistic view that Azar can help drive prices down.

Azar has also been a harsh critic of the Affordable Car Act, sharing President’s Trump’s view that the ACA should be repealed. Despite repeated attempts, the failure to repeal ACA will mean that if appointed, Azar will be responsible for overseeing enforcement of the ACA.

Before Azar can take the helm of the Department of Health and Human Services, he must first be approved by Congress. Azar’s record while serving in the pharmaceutical industry is certain to be scrutinized, as will his commitment to enforcing the Affordable Care Act that he has previously strongly opposed.

The post President Trump Nominates Alex Azar for HHS Secretary appeared first on HIPAA Journal.

In What Year Was HIPAA Passed into Legislature?

Posted by HIPAA Journal

The Health Insurance Portability and Accountability Act or HIPAA was passed into legislature on August 21, 1996, when Bill Clinton added his signature to the bill.

Initially, the purpose of HIPAA was to improve portability and continuity of health insurance coverage, especially for employees that were between jobs. HIPAA also standardized amounts that could be saved in pre-tax medical savings accounts, prohibited tax-deduction of interest on life insurance loans, enforced group health plan requirements, simplified the administration of healthcare with standard codes and practices, and introduced measures to prevent healthcare fraud.

Many of the details of the five titles of HIPAA took some time to be developed, and several years passed before HIPAA Rules became enforceable. The HIPAA Enforcement Rule, which allows the Department of Health and Human Services’ Office for Civil Rights to impose financial penalties for noncompliance with HIPAA Rules, was not passed until February 16, 2006 – A decade after HIPAA was first introduced.

There have been several important dates in the past two decades since HIPAA was originally passed – Notably the introduction of the HIPAA Privacy Rule, HIPAA Security Rule, HIPAA Breach Notification Rule, and the HIPAA Omnibus Rule.

The HIPAA Privacy Rule introduced many provisions to better protect the privacy of patients. The Security Rule was primarily concerned with the security of electronic protected health information. The Breach Notification Rule ensures that all breaches of protected health information are reported, while the Omnibus Rule introduced a broad range of changes, including new requirements required by the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Four key updates to HIPAA legislation are detailed below.

The Privacy Rule of HIPAA Passed into Legislature

The Privacy Rule of HIPAA was passed into legislature on December 28, 2000. The official name of the update to HIPAA is the “Standards for Privacy of Individual Identifiable Health Information.” The HIPAA Privacy Rule compliance date was April 14, 2003.

The HIPAA Privacy Rule details the allowable uses and disclosures of protected health information without first obtaining consent from patients. The HIPAA Privacy Rule also gives patients the right to obtain copies of their health data from HIPAA-covered entities.

The Security Rule of HIPAA Passed into Legislature

The Security Rule of HIPAA was passed into legislature on April 21, 2003, although the effective date was not until April 21, 2005. While the HIPAA Privacy Rule was concerned with all forms of protected health information, the HIPAA Security Rule is primarily concerned with the creation, use, storage and transmission of electronic PHI. The HIPAA Security Rule requires administrative, physical, and technical safeguards to be introduced to keep PHI secure. The Security Rule also introduced requirements for when PHI is no longer required.

The Breach Notification Rule of HIPAA Passed into Legislature

The HIPAA Breach Notification Rule came from the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was passed on February 17, 2009. The HIPAA Breach Notification Rule took effect from August 24, 2009.

The Breach Notification Rule requires HIPAA-covered entities to submit notifications of breaches of protected health information to the Secretary of the Department of Health and Human Services within 60 days of the discovery of a breach if the breach involved 500 or more records. Smaller breaches must still be reported, no later than 60 days after the end of the year in which the breach was discovered. The Breach Notification Rule also requires notifications of a breach to be sent to affected patients within 60 days of the discovery of the breach.

The Omnibus Rule of HIPAA Passed into Legislature?

The HIPAA Omnibus Final Rule was issued on January 17, 2013. The HIPAA Omnibus Rule introduced several changes to the HIPAA Privacy, Security, and Breach Notification Rules.

One of the most important changes affected HIPAA business associates – individuals or entities that are contracted to HIPAA-covered entities to provide services that require access to PHI.

Since the passing of the HIPAA Omnibus Rule, business associates of HIPAA-covered entities, and their subcontractors, must implement safeguards to protect ePHI as required by the HIPAA Security Rule. Since the introduction of the Omnibus Rule, business associates of HIPAA-covered entities can be fined directly for HIPAA violations.

Another important update was clarification of “significant harm.” Prior to the introduction of the Omnibus Rule, many covered entities failed to report breaches as there was determined to have been no significant harm caused to patients as a result of the breach. After the Omnibus Rule, covered entities must be able to prove there was no significant harm if they decide not to report a breach.

Infographic Summary of Milestones in the History of HIPAA

In addition to the above major changes to HIPAA legislation, there have been numerous milestones in the history of HIPAA, which have been summarized in the infographic below. The infographic details legislation changes, clarifications of HIPAA Rules, major enforcement actions, and HIPAA audits – Click the image below to view the graphic in full size.

HIPAA History

The post In What Year Was HIPAA Passed into Legislature? appeared first on HIPAA Journal.

What is a Limited Data Set Under HIPAA?

Posted by HIPAA Journal

A limited data set under HIPAA is a set of identifiable healthcare information that the HIPAA Privacy Rule permits covered entities to share with certain entities for research purposes, public health activities, and healthcare operations without obtaining prior authorization from patients, if certain conditions are met.

In contrast to de-identified protected health information, which is no longer classed as PHI under HIPAA Rules, a limited data set under HIPAA is still identifiable protected information. Therefore it is still subject to HIPAA Privacy Rule regulations.

A HIPAA limited data set can only be shared with entities that have signed a data use agreement with the covered entity. The data use agreement allows the covered entity to obtain satisfactory assurances that the PHI will only be used for specific purposes, that the PHI will not be disclosed by the entity with which it is shared, and that the requirements of the HIPAA Privacy Rule will be followed.

The data use agreement, which must be accepted prior to the limited data set being shared, should outline the following:

  • Allowable uses and disclosures
  • Approved recipients and users of the data
  • An agreement that the data will not be used to contact individuals or re-identify them
  • Require safeguards to be implemented to ensure the confidentiality of data and prevent impermissible uses and disclosures
  • State the discovery of impermissible uses and disclosures must be reported back to the covered entity
  • State that any subcontractors who are required to access or use the data also enter into a data use agreement and agree to comply with its requirements.

In all cases, the HIPAA minimum necessary standard applies, and information in the data set must be limited to only the information necessary to perform the purpose for which it is disclosed.

What Information Must be Removed From a Limited Data Set Under HIPAA?

A limited data set under HIPAA cannot contain any of the following identifiers:

  • Names – including those of relatives, employers, and household members
  • Street addresses or postal address information with the exception of town/city, state, and zip code
  • Phone/Fax numbers
  • E-mail addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Other account numbers
  • Certificate and license numbers
  • Vehicle identifiers and serial numbers, including license plate numbers
  • Device identifiers and serial numbers
  • URLs and IP addresses
  • Biometric identifiers such as fingerprints, retinal scans and voice prints
  • Full face photos and comparable images

Limited Data Sets: FAQs

What are the differences between a limited data set under HIPAA and de-identified protected health information?

The differences are that the content of a limited data set is still subject to Privacy Rule standards for uses and disclosures and it is necessary for a Covered Entity to enter into a data use agreement with the recipient of the limited data set prior to sharing the information with the recipient. De-identified protected health information has neither of these requirements because de-identified protected health information contains no individually identifiable health information.

What individually identifiable information can remain in a limited data set?

The list of identifiers in a limited data set can include the town, city, or state of the individual, their gender, and dates relating to the individual. Additionally, there is no requirement to remove “any other unique identifying number, characteristic, or code” as there is for de-identifying protected health information – notwithstanding that the list of identifiers for de-identifying protected health information is very out-of-date.

What is the purpose of a limited data set if most identifiers are removed?

As mentioned in the article, a limited data set under HIPAA can be used for research purposes, public health activities, and healthcare operations. Consequently, the set could be used to (for example) determine how many minors were treated in ED, establish the proportion of male vs female patients in geriatric care, or calculate what resources might be required to cope with a patient surge during a pandemic or other emergency.

Is the information left in a limited data set still protected health information?

Yes, as a limited data set includes information relating to an individual´s past, present, or future health conditions, treatments for the conditions, and payments for the treatments AND information that could be used to identify the individual, the information left in a limited data set meets the definition of protected health information in §160.103 of the Administrative Simplification Regulations.

What happens if the recipient of a limited data set misuses the information or impermissibly discloses the information?

As soon as the Covered Entity learns of any misuse or impermissible disclosure, it must conduct a risk assessment to determine whether the misuse/impermissible disclosure constitutes a notifiable data breach under the Breach Notification Rule. If so, the breach must be reported to the affected individual(s) and the HHS´ Office for Civil Rights.

The post What is a Limited Data Set Under HIPAA? appeared first on HIPAA Journal.

Can A Patient Sue for A HIPAA Violation?

Posted by HIPAA Journal

Yes, a patient can sue for a HIPAA violation and there are an increasing number of class action suits for protected health information data breaches, although not under the provisions of the HIPAA law. There is no private cause of action in HIPAA, so it is not possible for a patient to directly sue for a HIPAA violation under the HIPAA law. Even if HIPAA Rules have clearly been violated by a healthcare provider, and harm has been suffered as a direct result, it is not possible for patients to seek damages, at least not for the violation of HIPAA Laws. So, if it is not possible for a patient to directly sue for a HIPAA violation, does that mean legal action cannot be taken against a covered entity when HIPAA has clearly been violated? While HIPAA does not have a private cause of action, it is possible for patients to take legal action against healthcare providers and obtain damages for violations of state laws.

In some states, it is possible to file a lawsuit against a HIPAA covered entity on the grounds of negligence or for a breach of an implied contract, such as if a covered entity has failed to protect medical records. In such cases, it will be necessary to prove that damage or harm has been caused as a result of negligence or the theft of unsecured personal information.

Taking legal action against a covered entity can be expensive and there is no guarantee of success. Patients should therefore be clear about their aims and what they hope to achieve by taking legal action. An alternative course of action may help them to achieve the same aim.

Filing Complaints for HIPAA Violations

If HIPAA Rules are believed to have been violated, patients can file complaints with the federal government and in most cases complaints are investigated. Action may be taken against the covered entity if the compliant is substantiated and it is established that HIPAA Rules have been violated. The complaint should be filed with the Department of Health and Human Services’ Office for Civil Rights (OCR).

While complaints can be filed anonymously, OCR will not investigate any complaints against a covered entity unless the complainant is named and contact information is provided.

A complaint should be filed before legal action is taken against the covered entity under state laws. Complaints must be filed within 180 days of the discovery of the violation, although in limited cases, an extension may be granted.

Complaints can also be filed with state attorneys general, who also have the authority to pursue cases against HIPAA-covered entities for HIPAA violations.

The actions taken against the covered entity will depend on several factors, including the nature of the violation, the severity of the violation, the number of individuals impacted, and whether there have been repeat violations of HIPAA Rules.

The penalties for HIPAA violations are detailed here, although many complaints are resolved through voluntary compliance, by issuing guidance, or if an organization agrees to take corrective action to resolve the HIPAA issues that led to the complaint. Complaints may also be referred to the Department of Justice to pursue cases if there has been a criminal violation of HIPAA Rules.

Complaints about individuals can also be filed with professional boards such as the Board of Medicine and the Board of Nursing.

How to File a Lawsuit for a HIPAA Violation

If you have been informed that your protected health information has been exposed as a result of a healthcare data breach, or you believe your PHI has been stolen from a specific healthcare organization, you may be able to take legal action against the breached entity to recover damages for any harm or losses suffered as a result of the breach.

The first step to take is to submit a complaint about the violation to the HHS’ Office for Civil Rights. This can be done in writing or via the OCR website. If filing a complaint in writing, you should use the official OCR complaint form and should keep a copy to provide to your legal representative.

You will then need to contact an attorney to take legal action against a HIPAA covered entity. You can find attorneys through your state or local bar association. Try to find an attorney or law firm well versed in HIPAA regulations for the greatest chance of success and contact multiple law firms and speak with several attorneys before making your choice.

There will no doubt be many other individuals who are in the same boat, some of whom may have already taken legal action. Joining an existing class action lawsuit is an option. The more individuals involved, the stronger the case is likely to be.

Many class action lawsuits have been filed on behalf of data breach victims that have yet to experience harm due to the exposure or theft of their data. The plaintiffs claim for damages for future harm as a result of their data being stolen. However, without evidence of actual harm, the chances of success will be greatly reduced.

Can a Patient Sue for a HIPAA Violation? FAQs

What kind of lawyer deals with HIPAA violations?

Most lawyers will be prepared to offer advice about whether you have a claim for a HIPAA violation; and, if the violation occurred with the previous 180 days, may pursue a civil claim on your behalf against a Covered Entity or Business Associate. Often the lawyer´s willingness to take on a claim will depend on the nature of the violation, the nature of harm you suffered, and the state laws that apply in your location.

What happens after a HIPAA complaint is filed?

This depends on who you make the complaint to. If you complain directly to the organization that violated your HIPAA rights, the complaint will be dealt with internally (unless it involves a breach of unsecured PHI, in which case the organization is required by law to notify HHS´ Office for Civil Rights.

If you complain to a state Attorney General, the Office of the Attorney General may investigate the organization directly on your behalf or escalate your complaint to HHS´ Office for Civil. If the complaint is escalated – or you complain directly to the Office for Civil Rights – your compliant will be acknowledged and sent for review.

If the review confirms a HIPAA violation, the organization will be contacted to obtain their “side of the story”. Depending on how the organization responds, the Office for Civil Rights may initiate an investigation or reject your compliant. You will be informed of the decision and any subsequent outcome of an investigation.

Has a patient ever successfully sued for a HIPAA violation?

No. However, the HIPAA Privacy Standards have been used in court cases as a benchmark of the level of privacy an individual can reasonably expect. One of the most frequently-quoted cases in this respect is Byrne versus the Avery Center for Obstetrics and Gynecology. This case was originally denied when the plaintiff pursued compensation for a violation of HIPAA, but the decision was reversed on appeal when the claim was changed to a violation in the duty of confidentiality.

Have there ever been successful class actions for a HIPAA violation?

There have been several settled class actions involving HIPAA Covered Entities who have failed to adequately protect personal information (note: not for violating HIPAA). Furthermore, class actions are frequently settled without an admission of liability (as in Jessie Seranno et al. v. Inmediata Corp.), so it would be incorrect to classify the class actions as “successful”.

How can I find out if my state has a privacy law I can use to claim for a HIPAA violation?

The International Association of Privacy Professionals maintains a web page tracking privacy legislation by state. It is important to note that many of the privacy laws listed on the web page are still to be passed or enacted, and some may not contain provisions that could support a claim for a HIPAA violation. To establish whether you have a claim for a HIPAA violation under your state´s consumer rights legislation, you should speak with an attorney.

I have received a letter stating my health data has been breached. What should I do?

Your response to the breach should be appropriate to nature of the data disclosed. The nature of the data exposed should be explained to you in the letter as well as advice on the measures you should take to protect yourself from fraud and theft. The letter should also contain contact information to find out more about the breach. In several cases, healthcare organizations have provided free credit monitoring services, and it may be in your best interests to find out if these are available to you.

What happens after a HIPAA complaint is filed?

This depends on who the complaint is made to, the nature of the violation, and whether it involves a criminal motive. Complaints made by patients directly to their healthcare provider are usually dealt with internally unless they involve an impermissible disclosure of unsecured PHI – in which case the healthcare provider will escalate it to HHS´ Office for Civil Rights under the Breach Notification Rule.

When a complaint is escalated – or when a complaint is made directly to HHS´ Office for Civil Rights – the complaint is reviewed to see if it is justifiable and, if so, if it can be resolved via technical assistance. If the resolution of the complaint requires more than technical assistance, HHS´ Office for Civil Rights will conduct an investigation and potentially impose a correct action plan or fine.

Complaints can also be made to state attorneys general, who work with HHS´ Office for Civil Rights to resolve the violation. However, if a violation potentially involves a criminal motive, the Office for Civil Rights will refer the complaint to the Department of Justice for investigation. In these cases, the person making the complaint may be required to provide evidence for the investigation to proceed.

The post Can A Patient Sue for A HIPAA Violation? appeared first on HIPAA Journal.

When Should You Promote HIPAA Awareness?

Posted by HIPAA Journal

All employees must receive training on HIPAA Rules, but when should you promote HIPAA awareness? How often should HIPAA retraining take place?

HIPAA-covered entities, business associates and subcontractors are all required to comply with HIPAA Rules, and all workers must receive training on HIPAA. HIPAA training should ideally be provided before any employee is given access to PHI.

Training should cover the allowable uses and disclosures of PHI, patient privacy, data security, job-specific information, internal policies covering privacy & security, and HIPAA best practices.

The penalties for HIPAA violations, and the consequences for individuals discovered to have violated HIPAA Rules, must also be explained. If employees do not receive training, they will not be aware of their responsibilities and privacy violations are likely to occur.

Additional training must also be provided whenever there is a material change to HIPAA Rules or internal policies with respect to PHI, following the release of new guidance, or implementation of new technology.

HIPAA Training Cannot be a One-Time Event

The provision of training at the start of an employment contract is essential, but training cannot be a one-time event. It is important to ensure employees do not forget about their responsibilities, so retraining is necessary and a requirement for continued HIPAA compliance.

HIPAA does not specify how often retraining should occur, as this is left to the discretion of the covered entity. HIPAA only requires retraining to be conducted ‘regularly.’ The industry best practice is for retraining to take place annually.

The HIPAA Privacy Rule Administrative requirements, detailed in 45 CFR § 164.530, require all members of the workforce to receive training on HIPAA Rules and policies and procedures with respect to PHI. Training should be provided, as appropriate, to allow employees to conduct their work duties and functions within the covered entity. One training program therefore does not fit all. HIPAA training for the IT department is likely to be different to training provided to administrative workers. The Privacy Rule requires training to be provided for all new employees “within a reasonable timeframe”.

The HIPAA standard 45 CFR § 164.308(a)(5) covers two types of training – Job-specific training and security awareness training, neither of which can be a one-time event.

While it is important to provide training for HIPAA compliance and security awareness, it is also important to ensure that training has been understood, that it is remembered, and to ensure HIPAA Rules are followed on a day to day basis. It therefore recommended that you promote HIPAA awareness throughout the year.

How to Promote HIPAA Awareness

There is no hard and fast rule for HIPAA retraining and there are many ways that healthcare organizations can promote HIPAA awareness. While formal training sessions can be conducted on an annual basis, the use of newsletters, email bulletins, posters, and quizzes can all help to raise and maintain awareness of HIPAA Rules.

In the case of security awareness training this is especially important. Annual training on HIPAA is a good best practice, but it is important to promote HIPAA awareness with respect to security more frequently. It is a good best practice to provide security awareness training biannually and issue cybersecurity updates on a monthly basis. Any specific threats to the workforce should be communicated as necessary – new phishing threats for instance. However, care should be taken not to bombard employees with threat information, to avoid employees suffering from alert fatigue.

When HIPAA Retraining Required?

In addition to annual refresher training sessions, retraining on HIPAA Rules is recommended following any privacy or security violation and after a data breach has been experienced.

While the individuals concerned should be retrained, it is a good best practice to take these incidents as a training opportunity for all staff to ensure similar breaches do not occur in the future. If one employee makes a mistake with HIPAA, it is possible that others have failed to understand HIPAA requirements or are making similar mistakes.

The post When Should You Promote HIPAA Awareness? appeared first on HIPAA Journal.

Is G Suite HIPAA Compliant?

Posted by HIPAA Journal

Is G Suite HIPAA compliant? Can G Suite be used by HIPAA-covered entities without violating HIPAA Rules?

Google has developed G Suite to include privacy and security protections to keep data secure, and those protections are of a sufficiently high standard to meet the requirements of the HIPAA Security Rule. Google will also sign a business associate agreement (BAA) with HIPAA covered entities. So, is G Suite HIPAA compliant? G Suite can be used without violating HIPAA Rules, but HIPAA compliance is more about the user than the cloud service provider.

Making G Suite HIPAA Compliant (by default it isn’t)

As with any secure cloud service or platform, it is possible to use it in a manner that violates HIPAA Rules. In the case of G Suite, all the safeguards are in place to allow HIPAA covered entities to use G Suite in a HIPAA compliant manner, but it is up to the covered entity to ensure that G Suite is configured correctly. It is possible to use G Suite and violate HIPAA Rules.

Obtain a BAA from Google

One important requirement of HIPAA is to obtain a signed, HIPAA-compliant business associate agreement (BAA).

Google first agreed to sign a business associate agreement with healthcare organizations in 2013, back when G Suite was known as Google Apps. The BAA must be obtained prior to G Suite being used to store, maintain, or transmit electronic protected health information. Even though privacy and security controls are in place, the failure to obtain a BAA would be a HIPAA violation.

Obtaining a signed BAA from Google is the first step toward HIPAA compliance, but a BAA alone will not guarantee compliance with HIPAA Rules.

Configure Access Controls

Before G Suite can be used with any ePHI, the G Suite account and services must be configured correctly via the admin console. Access controls must be set up to restrict access to the services that are used with PHI to authorized individuals only. You should set up user groups, as this is the easiest way of providing – and blocking – access to PHI, and logs and alerts must be also be configured.

You should also make sure all additional services are switched off if they are not required, switch on services that include PHI ‘on for some organizations,’ and services that do not involve PHI can be switched on for everyone.

Set Device Controls

HIPAA-covered entities must also ensure that the devices that are used to access G Suite include appropriate security controls. For example, if a smartphone can be used to access G Suite, if that device is lost or stolen, it should not be possible for the device to be used by unauthorized individuals. A login must be required to be entered on all mobiles before access to G Suite is granted, and devices configured to automatically lock. Technology that allows the remote erasure of all data (PHI) stored on mobile devices should also be considered. HIPAA-covered entities should also set up two-factor authentication.

Not All Google Services are Covered by the BAA

You may want to use certain Google services even if they are not covered by the BAA, but those services cannot be used for storing or communicating PHI. For example, Google+ and Google Talk are not included in the BAA and cannot be used with any PHI.

If you do decide to leave these services on, you must ensure that your policies prohibit the use of PHI with these services and that those policies are effectively communicated to all employees. Employees must also receive training on G Suite with respect to PHI to ensure HIPAA Rules are not accidentally violated.

What Services in G Suite are HIPAA Compliant?

At the time of writing, only the following core services of G Suite are covered by Google’s BAA, and can therefore be used with PHI:

  • Gmail (Not free Gmail accounts)
  • Calendar
  • Drive
  • Apps Script
  • Keep
  • Sites
  • Jamboard
  • Hangouts (Chat messaging only)
  • Google Cloud Search
  • Vault

Google Drive

In the case of Google Drive, it is essential to limit sharing to specific people. Otherwise it is possible that folders and files could be accessed by anyone over the Internet> drives should be configured to only allow access by specific individuals or groups. Any files uploaded to Google Drive should not include any PHI in titles of files, folders, or Team Drives.

Gmail

Gmail, the free email service offered by Google, is not the same as G Suite. Simply using a Gmail account (@gmail.com) to send PHI is not permitted. The content of Gmail messages is scanned by third parties. If PHI is included, it is potentially being ‘accessed’ by third parties, and deleting an email does not guarantee removal from Google’s servers. Free Gmail accounts are not HIPAA compliant.

G Suite HIPAA Compliance is the Responsibility of Users

Google encourages healthcare organizations to use G Suite and has done what it can to make G Suite HIPAA compliant, but Google clearly states it is the responsibility of the user to ensure that the requirements of HIPAA are satisfied.

Google help healthcare organziations make G Suite HIPAA compliant, Google has developed guidance for healthcare organizations on setting up G Suite: See Google’s G Suite HIPAA Implementation Guide.

The post Is G Suite HIPAA Compliant? appeared first on HIPAA Journal.