844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Author: Colington Consulting

    • How Do HIPAA Breach Reporting Requirements Affect State Reporting

      For those of us involved in the world of HIPAA compliance, we are certainly aware by now that the Breach Notification Rule requires Covered Entities (CE) and Business Associates (BA) to notify affected parties of any breach that has occurred to their protected health information. Those notification requirements and timelines are based on the “500 rule” of individuals affected, and there are different rules based on whether more or fewer than 500 were affected by the breach.

      But another important factor to consider, besides the Federal requirement, is what do State breach reporting laws require? This is a topic that has been getting a lot of attention lately.

      According to the National Conference of State Legislatures (NCSL), all 50 U.S. states and its territories have enacted laws that require both private and public entities to notify anyone who has been affected by a security breach of their personally identifiable information.

      The NCSL website explains that these laws specify exactly who must comply with the law, what constitutes “personal information,” what constitutes a breach, requirements for notice (e.g., timing or method of notice, who must be notified), and any exemptions that may apply.

      HIPAA Data Breach Reporting at the State Level

      At the State level, there exists a somewhat different landscape of potential pitfalls compared to the compromise of any of the 18 HIPAA Identifiers. Also, State reporting is not in lieu of the Federal reporting but in conjunction. Both Federal HIPAA and State breach reporting requirements must be adhered to.

      It is important to remember that State reporting timelines may be shorter than what is mandated by the HIPAA Breach Notification Rule.

      As an example, the State of California Civil Code states that for medical information, “Affected patients and the California Department of Health Services must be notified no later than 15 business days after the unauthorized access, use, or disclosure has been detected by the licensee.” There is an exception to delay the notification for law enforcement purposes in accordance with the Code.

      When Business Associates Are Breached

      Further complications to the breach notification requirements kick in when CEs engage the services of vendors that are designated BAs. We know about the requirement to execute Business Associate Agreements (BAA) when these vendors have accesses to a Covered Entity’s ePHI/PHI. What happens when CEs have hundreds of BAs and then some of those BAs have subcontractor BAs? How does an organization keep track of all the timelines in reporting? Oftentimes, this is done with a time-consuming manual review, causing organizations to spend excessive funds on complying – or, more commonly, not doing this exercise at all.

      Organizations commonly try and use ‘standard templates’ to standardize timelines, but reporting timeframes are often the center of agreement negotiations and are often changed.

      The 500 Rule

      According to the Breach Rule, if a breach affects 500 or more people, then the entity that is responsible for the breach must notify the Secretary of the applicable governmental entity as soon as possible, and no later than 60 days after the breach occurred.

      If the breach affects fewer than 500 people, however, then the responsible entity is only required to notify the Secretary annually, and no more than 60 days past the affected calendar year. Therefore, if a CE gives a BA 60 days to make the report but the breach affects 500 or more individuals, that CE will actually fail to meet the reporting deadline.

      Managing this process of timeline reporting is critical, especially with downstream BA vendors.

      “Understanding reporting time frames, both contractual and regulatory, is critical for healthcare organizations. But many compliance teams struggle to keep up with changing laws and the growth of their organizations as it relates to obligations to regulators and business partners,” says Jason Silverstein, COO, PHIflow. “Rather than depending on manual document review (which is expensive and time-consuming) to understand reporting timeframes, today’s leading compliance and privacy departments leverage innovative new technologies to automate many of the mundane tasks previously associated with antiquated compliance processes.”

      A summary of U.S. State Data Breach Notification Statutes per state provided by NCSL can be accessed here: http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx

      Need Help with HIPAA Compliance?

      If you would like to discuss how Colington Consulting can help your organization meet these ever-changing governmental standards, call us at (800) 733-6379 today.

    • Not Worried About Your Patients? Worry About Your Bottom Line?

      We’re always talking about how not complying with HIPAA regulations badly affects patients. Their data is exposed to malicious entities. Their trust in your organization wanes. Even if you’re not worried about the moral implications or your public perception, the fact is you’re not off the hook for noncompliance. There are severe penalties for not following the rules. And that’s what we’ll be discussing in today’s article.

      A Breakdown of HIPAA Fines

      Penalties for HIPAA noncompliance are broken down into four categories of fines:

      1. Willful neglect with no corrective action taken.
      2. Willful neglect with corrective action taken.
      3. Reasonable cause for noncompliance.
      4. No knowledge of noncompliance.

      Each level of noncompliance comes with its own financial penalty for your company or organization. Let’s take a closer look at what each one means, and what its penalty is.

      Willful Neglect with No Corrective Action

      This is by far the most severe form of noncompliance, and therefore comes tagged with the harshest of government fines. From a legal standpoint, willful neglect is defined as a “conscious, intentional failure or reckless indifference.” If you work in the healthcare industry, there’s a good chance you’ve at least heard of HIPAA. We’ve reached a point where it is very difficult for organizations to claim ignorance of it. If it looks as though you haven’t even bothered to make the necessary changes, there’s a good chance you could be hit with this very serious charge. It comes with a nasty $50,000 minimum penalty for each violation, and can cost your organization up to a whopping $1,500,000 annually.

      Willful Neglect with Corrective Action

      If a company or organization is found guilty of willful neglect as defined above, resolving the noncompliance issue in a timely fashion will reduce the associated penalty. It’s still a hefty price that’s nothing to sneeze at however, and your best option of course is to comply with the regulations in the first place. After making the necessary changes, you could instead be hit with a $10,000 penalty for each violation, up to a maximum of $250,000 annually. The difference isn’t negligible at least, and is greatly preferable to ignoring the problem – both for your patients and for your company’s bottom line.

      Reasonable Cause

      The legal definition for reasonable cause in regard to HIPAA compliance is as follows:

      “An act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.” While not as serious as “willful neglect,” it still comes with a heavy price tag of $1,000 for each violation and up to $100,000 annually.

      No Knowledge

      Noncompliance is to be considered “without knowledge” if the covered entity or individual did not know (and by exercising reasonable diligence would not have known) the action in question was a HIPAA violation. This is incredibly common, and is a huge culprit for many violations. This is why it is especially important to train your employees and make absolutely certain everyone knows and follows the regulations. Not rigorously training – and refreshing – your employees in HIPAA compliance can cost you $100 for every single violation, and up to $25,000 a year in damages. Teaching your staff the right way of doing things, taking the right precautions and putting processes in place will help you best to avoid these fines.

      Remember, there can be hefty fines for not following regulations. But most importantly, it’s important to protect the people you’re serving. Their lives are in your hands. Let us help you help them – and yourselves.  Give us a call today at 800-733-6379 for a free, no obligation, initial consultation. 

    • Protect Our Health by Protecting our Healthcare

      Our healthcare system, while far from perfect, is an absolute necessity for living. It would make sense then to be sure that it was well-protected.

      Unfortunately, this is often not the case. As we have seen over and over again, database breaches are more common in the healthcare industry than anywhere else. We’re not just experiencing a loss of data, but a loss of trust as well. How can people live their lives and stay safe from data theft at the same time?

      HIPAA Compliance

      It starts with a set of rules. Such a set has already been put together: The Health Insurance Portability and Accountability Act of 1996 (HIPAA). But rules are meaningless if no one is following them. According to the HIPAA journal, breaches in patient records during 2018 doubled to more than 13 million records. This is unacceptable – both from a patient standpoint and a legal one. And it’s only going to get worse as technology grows.

      Data Breaches and Technology

      Our healthcare technology has improved in leaps and bounds since the 1990’s. This is terrific. The average lifespan of Americans has also increased thanks to amazing breakthroughs and wearable devices like smart inhalers and insulin pens. Patients can have their glucose levels monitored from almost anywhere. We have remote MRI machines and smart beds. These are all helpful things. They greatly improve our quality of life.

      But what happens when all of these terrific inventions are used for ill purpose?

      Each of these devices works because they’re connected in some way shape or form to a database. Every patient uploads a massive amount of data about themselves whenever they’re used. Then, attackers breach these databases, access patients records, steal them and sell them on the dark web. In countries like the U.S., attackers from anywhere in the world can access expensive medical services, products, and drugs with the help of stolen medical records. The healthcare sector has proven to be extremely profitable for attackers, with a single record costing an average of $408.

      Data Breaches and Ransomware

      It’s not always about buying, selling, and manipulating patient data. Disturbingly often, it’s about holding hospitals hostage to fund criminals, political actors abroad and even terrorism. That might sound like an extremely bold declaration, but it’s an unfortunate and well-known truth. Ransomware attacks account for 85% of all the cyber-attacks on the healthcare sector. In one example which we mention in a previous article, Indiana-based healthcare system, Hancock Health, was hit by a ransomware attack that completely locked down all of their computers. In many instances, those computers were depended upon for keeping critical hospital systems running. They felt they had no choice but to pay the ransom in order to keep their patients safe. That attack had cost the company about $55,000 in Bitcoin.

      It was a risky move either way. Historically, only 19% of ransomware victims who pay the ransom actually get their files back. And the worst part is, that money goes to places that are in no way good.

      Our healthcare system is possibly the most important institution in our country. It definitely has its flaws, but it’s literally what keeps us alive. The absolute least we can do is follow the rules that were originally put in place to protect it. We’re here to help you make sense of those rules.  Call us today at 800-733-6379 to schedule a free, initial consultation.

    • Ransomware Threatens More Than Livelihood – It Threatens Lives

      Ransomware does a lot more than hurt your organization’s bottom line. It can actually risk the lives of hospital patients. And we’re not talking about just privacy concerns this time. A recent story in the news earlier in October has painted a truly frightening and all-too-real scenario: patients being sent away because of hospital systems being down.

      Here’s an overview of what happened.

      Which Hospitals Were Hit with Ransomware?

      There were a total of ten hospitals that were infected all around the same time. Seven of them were in Australia, and three of them were here in the U.S. in the state of Alabama. The two groupings are not suspected to be connected to the same attacker, but all ten were forced to take the same drastic actions. All three hospitals that make up the DCH Health System in Alabama were closed to new patients when the attack paralyzed the health network’s computer system.

      At the time this news broke, the hospitals – DCH Regional Medical Center in Tuscaloosa, Northport Medical Center, and Fayette Medical Center – were forced to turn away all but the most critical new patients. Non-critical patients were diverted to nearby hospitals, and even some emergency patients were also relocated once they were stabilized.

      How did the Hospitals Respond?

      DCH representatives wrote in a release that a criminal was limiting their ability to use their computer systems in exchange for a payment amount that was not known at the time. Eventually, the Alabama hospitals felt they had no choice but to pay the ransom demands in order to obtain the decryption keys necessary to rebuild their networks. The Tuscaloosa News reported that DCH officials made a payment to the people responsible for the ransomware attack, but didn’t state how much was paid. In exchange for the payment, according to a statement from DCH, “this included purchasing a decryption key from the attackers to expedite system recovery and help ensure patient safety.”

      How Can HIPAA Compliance Prevent Ransomware?

      According to an FAQ published by DCH, the strain of ransomware that hit the hospitals is known as “Ryuk,” which specializes in burrowing deep into infected networks to exact big payments. Thus far, Ryuk has nearly always been associated with phishing campaigns directed at employees of target companies. The United States’ healthcare system is one of the largest targets by far for such campaigns, and it’s quite possible that strict adherence to HIPAA guidelines could have potentially prevented this attack from happening altogether.

      We’ve reached a tipping point in the world of cybersecurity and data protection. It’s no longer just about protecting privacy. Even though the leaking of patient data can most certainly ruin lives, we are now seeing examples of how this battleground can physically endanger lives. You can be sure to see more such examples as technology continues to evolve.

      How can organizations expect to adapt to new challenges by applying new safeguards if they’re not yet following those standards that are already currently in place? HIPAA exists for a reason.

      Take Action Now

      Does your organization have a fully implemented HIPAA Risk Management Plan that includes how to address ransomware attacks? If not, we can develop one for you as part of our comprehensive package of HIPAA services.  Give us a call today at 800-733-6379 or drop us an email at info@cchipaa.com for a free, initial consultation.

    • Office for Civil Rights (OCR) – Two Significant Announcements

      The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) had two significant announcements this past week resulting in total of $4.6 million for a settlement and imposed penalty.  The two cases, one involving a public agency, the Texas Health and Human Services Commission (TX HHSC) and the second, a university medical center, the University of Rochester Medical Center (URMC).

      Both cases demonstrate OCR is continuing on an aggressive path to address reported breaches and investigate how organizations are just not being proactive with HIPAA compliance requirements.These investigations uncovered a slew of problems, especially in the Texas case.  What was troubling about this case, is the TX HHSC had such poor audit controls, it could not determine the number of persons who inappropriately accessed the protected health information in question.

      In the URMC case, it determined “identification of a lack of encryption as a high risk to ePHI, URMC [still] permitted the continued use of unencrypted mobile devices.”  This is a clear case of somebody dropping the ball due to reasons one can only speculate about. 

      If OCR’s track record is similar to recent years, expect more settlement announcements to be made before the end of the year.  With the holidays quickly approaching, OCR may not be spreading good cheer for some.

      Read the TX HHSC Press Release

      Read the URMC Press Release

    • More Big Penalties for HIPAA Violations as the Year Comes to End

      Huge fines for HIPAA violations are making the news once again. And these are some doozies. The Office for Civil Rights (OCR) are two for two this time – Texas Health and Human Services Commission (TX HHSC) was hit for $1.6 million, and University of Rochester Medical Center (URMC) for $3 million.

      Large penalties like these are certainly newsworthy and further outline the seriousness of HIPAA noncompliance. Here’s what happened with both organizations and why it’s such a big deal.

      TX HHSC HIPAA Violations – $1.6 Million Fine

      An investigation found that a division of TX HHSC had a data breach that enabled unauthorized users to view the electronically protected health information (ePHI) of 6,617 people. According to a press release from the Office for Civil Rights, the information exposed included names, addresses, social security numbers and treatment information.

      The OCR found that in addition to the data breach, TX HHSC failed to conduct an enterprise-wide security risk analysis, failed to implement access and audit controls on the information technology system, and was unable to determine how many people accessed the ePHI while it was publicly accessible.

      Although the OCR provided TX HHSC with the opportunity to provide “written evidence of mitigating factors or affirmative defenses and/or written evidence in support of a waiver of a CMP within thirty (30) days from the date of the receipt of the letter,” TX HHSC did not respond.

      OCR Director Roger Severino stated – and quite correctly – “No one should have to worry about their private health information being discoverable through a Google search.”

      URMC HIPAA Violations – $3 Million Fine

      In this case, the OCR imposed the fine on the University of Rochester Medical Center in response to multiple instances of the health system failing to encrypt mobile devices. This lack of encryption resulted in a breach of patients’ protected health information more than once. In one example, it was an unencrypted laptop that was lost. In two others, it was a lost flash drive.

      OCR’s investigation into the incidents found that URMC had “neglected to utilize device controls and employ encryption for electronic protected health information,” among other security measures. The health system had also failed to conduct a systemwide risk analysis. (In case you haven’t noticed a pattern yet, performing said risk analysis is a big deal, and should be taken seriously.)

      In addition to the $3 million settlement, the URMC will also be forced to implement a corrective action plan which includes HHS monitoring the health system’s compliance with HIPAA for two years.

      How Can Your Organization Avoid Potential Penalties and Settlements?

      In about 95% of the cases when breaches are reported, OCR resolves non-compliance issues with technical guidance. However, organizations subject to these breach investigations must be able to demonstrate their comprehensive HIPAA compliance programs. This includes providing OCR documentation regarding policy and procedures; a copy of the most recent HIPAA Security Risk Assessment; training records; contingency/disaster recovery plans; and other records supporting a compliance program.

      Find Out if Your Organization is Meeting Regulatory Requirements

      If HIPAA compliance assistance is needed for your organization, we specialize in putting compliance programs in place or assessing your current program. We provide a full range of services that include conducting the required HIPAA Risk Assessment, writing and customizing a HIPAA Risk Management Plan (HIPAA Policies and Procedures) for your organization, and providing your entire staff annual required HIPAA Security Awareness & Privacy Training through our web-based platform. 

      Let’s start the process with a free, initial consultation. In as little as 15 minutes, we can evaluate your current compliance program to determine if all mandatory privacy and security safeguards are in place to meet government regulations.