844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Category: HIPAA Compliance

    • What Comes Up, Must Go Down: Regulatory Trends and HIPAA

      Enforcement of HIPAA mandates by the HHS Office for Civil Rights (OCR) are more aggressive than ever before, “totaling $28.7 million from enforcement actions” in 2018, an increase of 22% from the last record total of $23.5 million in 2016.  According to an OCR press release, 2018 saw that office establish “an all-time record year” in HIPAA enforcement activity, settling “10 cases” and being “granted summary judgment in a case before an Administrative Law Judge.” One of these 10 cases was the watershed HIPAA settlement with Anthem, Inc. for $16 million.

      OCR Settlements* and Judgement** for 2018

      Jan – FileFax*  –  $100,000

      Jan – Fresenius Medical Care* – $3,500,000

      Jun – MD Anderson** – $4,348,000

      Aug  – Boston Medical Center*  –  $100,000

      Sep – Brigham & Women’s Hospital* – $384,000

      Sep – Mass. General Hospital* – $515,000

      Sep – Advanced Care Hospitalists* – $500,000

      Oct – Allergy Associates of Hartford* – $125,000

      Oct – Anthem, Inc* – $16,000,000

      Nov – Pagosa Springs* – $111,400

      Dec – Cottage Health* – $3,000,000

      Total – Settlements & Judgement:  $28,683,400

      While the current administration did and continues to tout a posture of deregulation, the reality on the ground for organizations that must comply with HIPAA is that OCR has only strengthened its enforcement mechanisms, showing very little tolerance for security and privacy breaches arising from:

      • The mismanagement, or lack of proper storage, transmission, or disposal of patient PHI and ePHI.
      • An incomplete or missing Business Associate Agreement (BAA) made with any and all vendors who might be considered a Business Associates (BA) under HIPAA.
      • Cyberattacks via successful email phishing attempts targeting not just Covered Entity (CE) workers or employees, but also workers or employees of any vendor affiliated with the  CE.
      • Incompatible or insufficient risk analysis and risk management processes on the part of the CE.

      Out of these 11 instances of verified HIPAA violations,

      • 6 CEs were found to have mismanaged or improperly stored, transmitted, or disposed of patient PHI and ePHI (Fresenius Medical Care North America, FileFax, Inc., MD Anderson, Allergy Associates of Hartford, Pagosa Springs, and Cottage Health)
      • 3 CEs did not have a BAA in place to manage vendors who are considered to be BAs under HIPAA (Advanced Care Hospitalists, Pagosa Springs, and Cottage Health)  
      • 1 CE experienced an email phishing cyber-attack (Anthem, Inc.) 
      • 4 CEs made PHI or patient privacy vulnerable by exposing the same via TV shows, interviews, or recordings (Allergy Associates of Hartford, Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital)
      • 4 CEs lacked HIPAA-mandated risk assessment, risk analysis, risk notification, or risk management protocols (Cottage Health, MD Anderson, Advanced Care Hospitalists, and Fresenius Medical Care North America)

      From this analysis, it can be ascertained that CEs and BAs can avoid facing settlements and judgements due to violations of the HIPAA Privacy Rule and the HIPAA Security Rule by instituting the following “golden rules” and ensuring their staff are fully trained in the same:

      • Do have robust and comprehensive plan to assess, identify, report, respond, and manage all security or privacy risks.
      • Do ensure a signed and completed BAA is on file for all BAs
      • Do have highly specific protocols in place governing the collection, storage, transmission, and disposal of patient PHI and ePHI.

      Best practices include annual and periodic training for their workforce, conducting the required security risk assessment in an ongoing/periodic manner, and internally enforcing HIPAA policies and procedures to cover the organization’s security management processes.

      Organizations, large and small, must be aware of the aggressive posture of enforcement and record settlement amounts under OCR and this current administration. My advice for any organization is to conduct a thorough evaluation of the current HIPAA compliance in place. Make sure all the requirements are covered.  If a compliance program is not is place, consider outsourcing and let a consultant do the heavy lifting. Often times, a consultant can get the program in place much quicker than relying on the organization’s internal staff.

      This blog was previously posted February 12, 2019

    • How Do HIPAA Breach Reporting Requirements Affect State Reporting

      For those of us involved in the world of HIPAA compliance, we are certainly aware by now that the Breach Notification Rule requires Covered Entities (CE) and Business Associates (BA) to notify affected parties of any breach that has occurred to their protected health information. Those notification requirements and timelines are based on the “500 rule” of individuals affected, and there are different rules based on whether more or fewer than 500 were affected by the breach.

      But another important factor to consider, besides the Federal requirement, is what do State breach reporting laws require? This is a topic that has been getting a lot of attention lately.

      According to the National Conference of State Legislatures (NCSL), all 50 U.S. states and its territories have enacted laws that require both private and public entities to notify anyone who has been affected by a security breach of their personally identifiable information.

      The NCSL website explains that these laws specify exactly who must comply with the law, what constitutes “personal information,” what constitutes a breach, requirements for notice (e.g., timing or method of notice, who must be notified), and any exemptions that may apply.

      HIPAA Data Breach Reporting at the State Level

      At the State level, there exists a somewhat different landscape of potential pitfalls compared to the compromise of any of the 18 HIPAA Identifiers. Also, State reporting is not in lieu of the Federal reporting but in conjunction. Both Federal HIPAA and State breach reporting requirements must be adhered to.

      It is important to remember that State reporting timelines may be shorter than what is mandated by the HIPAA Breach Notification Rule.

      As an example, the State of California Civil Code states that for medical information, “Affected patients and the California Department of Health Services must be notified no later than 15 business days after the unauthorized access, use, or disclosure has been detected by the licensee.” There is an exception to delay the notification for law enforcement purposes in accordance with the Code.

      When Business Associates Are Breached

      Further complications to the breach notification requirements kick in when CEs engage the services of vendors that are designated BAs. We know about the requirement to execute Business Associate Agreements (BAA) when these vendors have accesses to a Covered Entity’s ePHI/PHI. What happens when CEs have hundreds of BAs and then some of those BAs have subcontractor BAs? How does an organization keep track of all the timelines in reporting? Oftentimes, this is done with a time-consuming manual review, causing organizations to spend excessive funds on complying – or, more commonly, not doing this exercise at all.

      Organizations commonly try and use ‘standard templates’ to standardize timelines, but reporting timeframes are often the center of agreement negotiations and are often changed.

      The 500 Rule

      According to the Breach Rule, if a breach affects 500 or more people, then the entity that is responsible for the breach must notify the Secretary of the applicable governmental entity as soon as possible, and no later than 60 days after the breach occurred.

      If the breach affects fewer than 500 people, however, then the responsible entity is only required to notify the Secretary annually, and no more than 60 days past the affected calendar year. Therefore, if a CE gives a BA 60 days to make the report but the breach affects 500 or more individuals, that CE will actually fail to meet the reporting deadline.

      Managing this process of timeline reporting is critical, especially with downstream BA vendors.

      “Understanding reporting time frames, both contractual and regulatory, is critical for healthcare organizations. But many compliance teams struggle to keep up with changing laws and the growth of their organizations as it relates to obligations to regulators and business partners,” says Jason Silverstein, COO, PHIflow. “Rather than depending on manual document review (which is expensive and time-consuming) to understand reporting timeframes, today’s leading compliance and privacy departments leverage innovative new technologies to automate many of the mundane tasks previously associated with antiquated compliance processes.”

      A summary of U.S. State Data Breach Notification Statutes per state provided by NCSL can be accessed here: http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx

      Need Help with HIPAA Compliance?

      If you would like to discuss how Colington Consulting can help your organization meet these ever-changing governmental standards, call us at (800) 733-6379 today.

    • Not Worried About Your Patients? Worry About Your Bottom Line?

      We’re always talking about how not complying with HIPAA regulations badly affects patients. Their data is exposed to malicious entities. Their trust in your organization wanes. Even if you’re not worried about the moral implications or your public perception, the fact is you’re not off the hook for noncompliance. There are severe penalties for not following the rules. And that’s what we’ll be discussing in today’s article.

      A Breakdown of HIPAA Fines

      Penalties for HIPAA noncompliance are broken down into four categories of fines:

      1. Willful neglect with no corrective action taken.
      2. Willful neglect with corrective action taken.
      3. Reasonable cause for noncompliance.
      4. No knowledge of noncompliance.

      Each level of noncompliance comes with its own financial penalty for your company or organization. Let’s take a closer look at what each one means, and what its penalty is.

      Willful Neglect with No Corrective Action

      This is by far the most severe form of noncompliance, and therefore comes tagged with the harshest of government fines. From a legal standpoint, willful neglect is defined as a “conscious, intentional failure or reckless indifference.” If you work in the healthcare industry, there’s a good chance you’ve at least heard of HIPAA. We’ve reached a point where it is very difficult for organizations to claim ignorance of it. If it looks as though you haven’t even bothered to make the necessary changes, there’s a good chance you could be hit with this very serious charge. It comes with a nasty $50,000 minimum penalty for each violation, and can cost your organization up to a whopping $1,500,000 annually.

      Willful Neglect with Corrective Action

      If a company or organization is found guilty of willful neglect as defined above, resolving the noncompliance issue in a timely fashion will reduce the associated penalty. It’s still a hefty price that’s nothing to sneeze at however, and your best option of course is to comply with the regulations in the first place. After making the necessary changes, you could instead be hit with a $10,000 penalty for each violation, up to a maximum of $250,000 annually. The difference isn’t negligible at least, and is greatly preferable to ignoring the problem – both for your patients and for your company’s bottom line.

      Reasonable Cause

      The legal definition for reasonable cause in regard to HIPAA compliance is as follows:

      “An act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.” While not as serious as “willful neglect,” it still comes with a heavy price tag of $1,000 for each violation and up to $100,000 annually.

      No Knowledge

      Noncompliance is to be considered “without knowledge” if the covered entity or individual did not know (and by exercising reasonable diligence would not have known) the action in question was a HIPAA violation. This is incredibly common, and is a huge culprit for many violations. This is why it is especially important to train your employees and make absolutely certain everyone knows and follows the regulations. Not rigorously training – and refreshing – your employees in HIPAA compliance can cost you $100 for every single violation, and up to $25,000 a year in damages. Teaching your staff the right way of doing things, taking the right precautions and putting processes in place will help you best to avoid these fines.

      Remember, there can be hefty fines for not following regulations. But most importantly, it’s important to protect the people you’re serving. Their lives are in your hands. Let us help you help them – and yourselves.  Give us a call today at 800-733-6379 for a free, no obligation, initial consultation. 

    • Protect Our Health by Protecting our Healthcare

      Our healthcare system, while far from perfect, is an absolute necessity for living. It would make sense then to be sure that it was well-protected.

      Unfortunately, this is often not the case. As we have seen over and over again, database breaches are more common in the healthcare industry than anywhere else. We’re not just experiencing a loss of data, but a loss of trust as well. How can people live their lives and stay safe from data theft at the same time?

      HIPAA Compliance

      It starts with a set of rules. Such a set has already been put together: The Health Insurance Portability and Accountability Act of 1996 (HIPAA). But rules are meaningless if no one is following them. According to the HIPAA journal, breaches in patient records during 2018 doubled to more than 13 million records. This is unacceptable – both from a patient standpoint and a legal one. And it’s only going to get worse as technology grows.

      Data Breaches and Technology

      Our healthcare technology has improved in leaps and bounds since the 1990’s. This is terrific. The average lifespan of Americans has also increased thanks to amazing breakthroughs and wearable devices like smart inhalers and insulin pens. Patients can have their glucose levels monitored from almost anywhere. We have remote MRI machines and smart beds. These are all helpful things. They greatly improve our quality of life.

      But what happens when all of these terrific inventions are used for ill purpose?

      Each of these devices works because they’re connected in some way shape or form to a database. Every patient uploads a massive amount of data about themselves whenever they’re used. Then, attackers breach these databases, access patients records, steal them and sell them on the dark web. In countries like the U.S., attackers from anywhere in the world can access expensive medical services, products, and drugs with the help of stolen medical records. The healthcare sector has proven to be extremely profitable for attackers, with a single record costing an average of $408.

      Data Breaches and Ransomware

      It’s not always about buying, selling, and manipulating patient data. Disturbingly often, it’s about holding hospitals hostage to fund criminals, political actors abroad and even terrorism. That might sound like an extremely bold declaration, but it’s an unfortunate and well-known truth. Ransomware attacks account for 85% of all the cyber-attacks on the healthcare sector. In one example which we mention in a previous article, Indiana-based healthcare system, Hancock Health, was hit by a ransomware attack that completely locked down all of their computers. In many instances, those computers were depended upon for keeping critical hospital systems running. They felt they had no choice but to pay the ransom in order to keep their patients safe. That attack had cost the company about $55,000 in Bitcoin.

      It was a risky move either way. Historically, only 19% of ransomware victims who pay the ransom actually get their files back. And the worst part is, that money goes to places that are in no way good.

      Our healthcare system is possibly the most important institution in our country. It definitely has its flaws, but it’s literally what keeps us alive. The absolute least we can do is follow the rules that were originally put in place to protect it. We’re here to help you make sense of those rules.  Call us today at 800-733-6379 to schedule a free, initial consultation.

    • More Big Penalties for HIPAA Violations as the Year Comes to End

      Huge fines for HIPAA violations are making the news once again. And these are some doozies. The Office for Civil Rights (OCR) are two for two this time – Texas Health and Human Services Commission (TX HHSC) was hit for $1.6 million, and University of Rochester Medical Center (URMC) for $3 million.

      Large penalties like these are certainly newsworthy and further outline the seriousness of HIPAA noncompliance. Here’s what happened with both organizations and why it’s such a big deal.

      TX HHSC HIPAA Violations – $1.6 Million Fine

      An investigation found that a division of TX HHSC had a data breach that enabled unauthorized users to view the electronically protected health information (ePHI) of 6,617 people. According to a press release from the Office for Civil Rights, the information exposed included names, addresses, social security numbers and treatment information.

      The OCR found that in addition to the data breach, TX HHSC failed to conduct an enterprise-wide security risk analysis, failed to implement access and audit controls on the information technology system, and was unable to determine how many people accessed the ePHI while it was publicly accessible.

      Although the OCR provided TX HHSC with the opportunity to provide “written evidence of mitigating factors or affirmative defenses and/or written evidence in support of a waiver of a CMP within thirty (30) days from the date of the receipt of the letter,” TX HHSC did not respond.

      OCR Director Roger Severino stated – and quite correctly – “No one should have to worry about their private health information being discoverable through a Google search.”

      URMC HIPAA Violations – $3 Million Fine

      In this case, the OCR imposed the fine on the University of Rochester Medical Center in response to multiple instances of the health system failing to encrypt mobile devices. This lack of encryption resulted in a breach of patients’ protected health information more than once. In one example, it was an unencrypted laptop that was lost. In two others, it was a lost flash drive.

      OCR’s investigation into the incidents found that URMC had “neglected to utilize device controls and employ encryption for electronic protected health information,” among other security measures. The health system had also failed to conduct a systemwide risk analysis. (In case you haven’t noticed a pattern yet, performing said risk analysis is a big deal, and should be taken seriously.)

      In addition to the $3 million settlement, the URMC will also be forced to implement a corrective action plan which includes HHS monitoring the health system’s compliance with HIPAA for two years.

      How Can Your Organization Avoid Potential Penalties and Settlements?

      In about 95% of the cases when breaches are reported, OCR resolves non-compliance issues with technical guidance. However, organizations subject to these breach investigations must be able to demonstrate their comprehensive HIPAA compliance programs. This includes providing OCR documentation regarding policy and procedures; a copy of the most recent HIPAA Security Risk Assessment; training records; contingency/disaster recovery plans; and other records supporting a compliance program.

      Find Out if Your Organization is Meeting Regulatory Requirements

      If HIPAA compliance assistance is needed for your organization, we specialize in putting compliance programs in place or assessing your current program. We provide a full range of services that include conducting the required HIPAA Risk Assessment, writing and customizing a HIPAA Risk Management Plan (HIPAA Policies and Procedures) for your organization, and providing your entire staff annual required HIPAA Security Awareness & Privacy Training through our web-based platform. 

      Let’s start the process with a free, initial consultation. In as little as 15 minutes, we can evaluate your current compliance program to determine if all mandatory privacy and security safeguards are in place to meet government regulations.