Helping your company meet the new challenges

By Amy E. Yates, CIPP

With little enforcement activity occurring prior to the summer of 2008, many companies governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) paid scant attention to  their obligations under the Privacy and Security Rules after the initial flurry of activity in 2003. However, with the enactment of the American Recovery and Reinvestment Act 2009 (ARRA)—which includes provisions related to Health Information Technology (HIT), the Health Information and Clinical Health Act (HITECH Act)—physicians, hospitals, nursing homes, and other healthcare entities will receive grants and payment incentives for adopting and making meaningful use of technology for the creation and management of electronic health records (EHRs). Importantly, the legislation includes significant provisions intended to boost public confidence in the use of EHRs and personal health records by broadening the scope of activities covered by HIPAA, and by increasing enforcement rigor around an entity’s privacy and security obligations.

These new requirements for EHRs will significantly impact providers’ recordkeeping operations. But the HITECH Act and the refocus on HIPAA should cause all covered entities, including the group health plans of companies, to revisit their HIPAA privacy programs to meet the challenges of this new regulatory environment.

Any company that manages group health plan activities should consider the following actions for bolstering its ability to address the increased HIPAA compliance expectations:

•     conduct HIPAA privacy and security assessment; • refresh HIPAA policies and procedures;

•     retrain on HIPAA policies and procedures;

•     implement security and privacy incident response program; and

•     assess business associates and related activities (including a review of business associate agreements).

Conduct HIPAA privacy and security assessment

Any company that has not conducted an assessment of its HIPAA privacy and security program and group health plan activities in a few years should consider undertaking such an assessment now. Understanding where protected health information resides and what controls have been implemented to secure that data takes on increased importance as the Department of Health and Human Services (HHS) intends to issue annual guidance on technical safeguards. Likewise, identifying whether a company’s group health plan has adequately addressed its obligations around providing individual rights (e.g., access, amendment, accounting of disclosures) and remediating identified gaps would be prudent in light of HHS’s intent to increase its audit activities.

Review and refresh HIPAA privacy and security policies and procedures

In connection with their recent enforcement activities, agencies have cited the “disconnect” between the operations of an entity and its policies and procedures as a material factor in imposing significant penalties. It is critical that HIPAA policies accurately reflect the way an entity uses, discloses, and secures protected health information. Importantly, policies should not cite the HIPAA regulation’s chapter and verse. Accordingly, companies should carefully draft policies to describe the manner in which actual business operations function to satisfy HIPAA requirements.

Re-train on HIPAA policies and procedures

Periodic training on the policies surrounding the use, disclosure, and protection of protected health information is important to ensure that employees consistently follow established procedures and understand the importance of protecting such data.

Implement security and privacy incident response program

HITECH’s requirement that individuals be notified of security and privacy breaches that impact their protected health information reflects the increasing trend toward laws requiring transparency in connection with all aspects of the use and disclosure of protected health information. New regulations specify that notification be made to impacted individuals no later than 60 days after the discovery of a breach, and notification must also be made to the Department of Health and Human Services. Beyond discharging notice obligations, a company should have an established and comprehensive process to manage security and privacy incidents in a timely and effective manner, to remediate privacy and security vulnerabilities, and to control the public relations challenges related to these incidents.

Assess business associates and related activities

Liability related to misuse or the inadvertent or inappropriate disclosure of protected health information does not stop at the border of the company’s group health plan. Rather, the group health plan continues to remain obligated for the actions of its business associates. Accordingly, a group health plan should undertake privacy and security assessments of those business associates that use and disclose protected health information on its behalf to enable the group health plan to secure protected health information in a manner no less secure than in its own environment.

Clearly, as HHS issues more guidance and companies establish more robust practices in response to increased requirements around HIPAA, companies and their group health plans should continue to reassess their controls and practices so they reflect and respond to current expectations, requirements, and industry practices. Notwithstanding the fact that changes will continue to emerge, companies should consider the foregoing actions as sound foundational activities.