slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq. PowerPoint Presentation
Download Presentation
Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq.

Loading in 2 Seconds...

play fullscreen
1 / 35

Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq. - PowerPoint PPT Presentation

  • Uploaded on

Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq. Covering the Basics. HIPAA 42 CFR Part 2 Other potential privacy laws: Privacy Act, FERPA, AK PIPA, other State laws

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

Privacy, Security and Compliance Concerns for Management and Boards November 15, 2013 Carolyn Heyman-Layne, Esq.

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Privacy, Security and Compliance Concerns for Management and Boards

November 15, 2013

Carolyn Heyman-Layne, Esq.

covering the basics
Covering the Basics
  • 42 CFR Part 2
  • Other potential privacy laws: Privacy Act, FERPA, AK PIPA, other State laws
  • Other healthcare liability concerns for management and board members
  • Effective compliance plans
hipaa and 42 cfr part 2 degrees of confidentiality
HIPAA and 42 CFR Part 2: Degrees of Confidentiality

HIPAA is usually the minimum for confidentiality, and 42 CFR Part 2 is usually the maximum.

Least Strict

Most Strict

hipaa history
HIPAA History
  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) contains three parts:
    • Privacy Rule
      • Who can access medical records and why?
    • Security Rule
      • Are the medical records properly and safely stored?
    • Transactions and Code Set Standards
      • Are healthcare transactions conducted under the proper standards?
purpose of privacy rule
Purpose of Privacy Rule
  • To protect the rights of consumers and control inappropriate use of health information
  • To improve quality of health care by restoring trust in the system
  • To improve efficiency and effectiveness of health care delivery
hipaa key concepts privacy
HIPAA Key Concepts: Privacy
  • Quick summary of key concepts:
    • HIPAA applies to Covered Entities.
    • Covered Entities are required to protect Protected Health Information.
    • Uses and disclosures are allowed for treatment, payment and health care operations.
hipaa key concepts covered entities
HIPAA Key Concepts: Covered Entities
  • Privacy Rule obligations are imposed only on Covered Entities:
    • Health plans
    • Health care providers
    • Health care clearinghouses
  • Persons who are not Covered Entities may still be affected by HIPAA
  • Persons who do not handle health information may still be subject to HIPAA
hipaa key concepts phi
HIPAA Key Concepts: PHI
  • HIPAA governs the use and disclosure of protected health information (PHI)
  • PHI is individually identifiable health information (IIHI), written or oral.
  • PHI excludes information in education records covered by the Family Educational Rights and Privacy Act, and employment records held by a covered entity in its role as employer.
hipaa key concepts treatment payment health care operations
HIPAA Key Concepts: Treatment, Payment & Health Care Operations
  • A Covered Entity may use and disclose PHI without patient permission for treatment, payment, and health care operations (TPO).
  • These terms are broadly defined and can apply to a number of uses and disclosures.
hipaa key concepts minimum necessary
HIPAA Key Concepts: Minimum Necessary
  • The Privacy Rule generally requires covered entities take reasonable steps to limit use or disclosure to the minimum necessary to accomplish the intended purpose.
  • Disclosures for treatment purposes or pursuant to an authorization are excluded from the minimum necessary requirements.
  • Covered entity decides the minimum necessary!
hipaa key concepts business associates
HIPAA Key Concepts: Business Associates
  • In addition to treatment, payment and healthcare operations, Covered Entities can disclose PHI to Business Associates.
  • Business Associate: A person other than a member of the Covered Entity’s workforce who performs a function or activity on behalf of a Covered Entity involving the use or disclosure of PHI.
business associate agreements
Business Associate Agreements
  • It is the responsibility of the Covered Entity to enter into Business Associate Agreements with their business associates.
  • Business Associate Agreement can be separate document or included as provision in larger contract.
  • Covered Entity may be a business associate, as well as a covered entity.
hipaa key concepts basic obligations
HIPAA Key Concepts: Basic Obligations
  • Provide information to patients about their privacy rights and how their information can be used (Notice of Privacy Practices).
  • Adopt clear privacy procedures.
  • Train employees to understand privacy procedures.
  • Protect patient records that contain IIHI.
  • Report breaches of PHI.
hipaa security rule
HIPAA Security Rule
  • The Security Rule was enacted to physically protect health information.
  • Focuses on administrative, physical and technical security of information.
    • Administrative: Employee access rights
    • Physical: Workstation locations
    • Technical: Automatic logoff
  • HITECH – HIPAA now includes breach reporting requirements.
security rule administrative
Security Rule: Administrative
  • Conduct Risk Assessment
  • Security Management Process
  • Assigned Security Responsibility
  • Access Authorization
  • Termination
  • Awareness & Training
  • Security Incidents
  • Contingency Plans
  • Evaluation
  • Business Associate Agreements
security rule physical
Security Rule: Physical

Facility Walkthrough

Security Plan

Contingency Operations – can be part of overall emergency response plan

Maintenance records


Disposal & Destruction

Backup & Copy

Reuse & Recycling of Equipment

Encyrption& Decryption

security rule technical
Security Rule: Technical

Access controls

Automatic Logoff


Audit Controls


Person or Entity Authentication

Data Transmission

what is a breach
AK Personal Information Protection Act (AK PIPA)What is a “breach”?


Acquisition, access, use or disclosure of PHI in a manner not permitted under HIPAA, which compromises the security or privacy of the PHI.

Only applies to “unsecured PHI”, such as unencrypted data on a laptop, etc.

  • Unauthorized acquisition, or reasonable belief of unauthorized acquisition of personal information that compromises the security, confidentiality or integrity of the personal information.
  • Only applies to “personal information”: not encrypted or redacted; combination of name and identifying number (SSN, DL#, credit card or bank account, etc.)

Privacy breach insurance is available!!!

hitech vs ak pipa breach reporting
AK PIPAHITECH vs. AK PIPA: Breach Reporting


Only covers unsecured protected health information

Written notification

More than 500 affected requires notice to media

Notice within 60 days of discovery

Specific notice requirements

Notice to HHS or annual log of breaches

  • Covers “personal information” if reasonable likelihood of harm
  • Written or electronic notice
  • More than 300,000 requires notice to media
  • Requires reporting to AG even if no harm caused
  • Make sure this is covered in business associate agreements and vendor contracts
are we a 42 cfr part 2 program
Are we a 42 CFR Part 2 Program?
  • Do you receive federal assistance? If no, no further analysis necessary, you are not a 42 CFR Part 2 Program.
  • If yes, does any of your federal funding go to substance abuse treatment?
    • Separate substance abuse programs; OR
    • Individuals, entities, or units within a facility or organization that hold themselves out as providing alcohol or drug abuse diagnosis, treatment or referral for treatment
  • It is the kind of services provided and the general reputation or promotion of the program, not the name or description of the program that defines whether 42 CFR Part 2 applies.
hipaa vs 42 cfr part 2
42 CFR Part 2HIPAA vs. 42 CFR Part 2


Covered Entities

Protected Health Information (PHI)

Protects medical record numbers

Allows disclosures without authorization for treatment, payment and healthcare operations

Business Associate Agreements

  • Part 2 Programs
  • Information that identifies substance abuser
  • Does not protect medical record numbers
  • Does not allow any disclosure without consent except in very limited special circumstances
  • Qualified Service Organization Agreements
other privacy laws
Other Privacy Laws

Privacy Act of 1974 – primarily Alaska Native programs, but also Federal agencies

Alaska Personal Information Protection Act

FERPA – Family Educational Rights and Privacy Act – schools

State laws re: substance abuse, behavioral health, etc.

why are these laws important
Why are these laws important?
  • Management needs to understand how to implement and comply with these laws
  • Your board may encounter health information as well:
    • Grievance procedures
    • Discussion of compliance issues
    • Direct patient contact
  • Case law has established a board’s duty to oversee a compliance program for healthcare organizations.
  • The Board is ultimately responsible, but management is responsible for getting them information.
healthcare is highly regulated
Healthcare is Highly Regulated

The more regulation, the higher the possibility of violations (intentional or unintentional)

Compliance programs help to mitigate those risks

Government has increased money and resources for enforcing the regulations

compliance focus
Compliance Focus

Effectively prevent, detect and correct noncompliance

Also prevent and address fraud, waste and abuse

Effective communication among all staff and leadership

Seven Elements of an Effective Compliance Program

seven elements of an effective compliance program
Seven Elements of an Effective Compliance Program

Written policies and procedures

Compliance officer, committee and high-level oversight

Effective training and education

Effective lines of communication

Well-publicized disciplinary standards

Effective system for routine monitoring and auditing

Prompt response to compliance issues

compliance checklist
Compliance Checklist
  • Develop written compliance program
  • Develop employee standards and code of conduct
  • Establish and train compliance committee
    • may vary depending on size of organization
  • Distribute standards and code of conduct
  • Conduct Board/owners training
  • Conduct employee training, including info on how to access compliance documents
  • Conduct specialized training as necessary
  • Establish systems for monitoring
on going compliance checklist
On-going Compliance Checklist

Periodically review compliance program, employee standards and code of conduct

Ensure that employee training is conducted and documented

Manage and monitor employee reporting process

Provide ongoing training, as needed

Ensure that compliance related files are maintained as described in plan

Ensure that monitoring and auditing systems are in place and working

Make periodic reports to the Board/owners regarding compliance, even if no violations

what should you ask
What should you ask?

What laws apply to your organization?

What programs are in place to ensure compliance with those laws?

Who are the key employees responsible for compliance?

How and when do compliance issues get reported?

What are the goals of the compliance program?

what should you ask1
What should you ask?

What are the risks to the organization?

What resources are necessary to address those risks?

Have policies and procedures been implemented to address risks and laws?

Have training programs been implemented?

Is the Board informed of changes to regulatory and industry requirements that affect risk?

privacy and board duties
Privacy and Board Duties

Circumstances differ, but basic duty of compliance oversight exists for almost all boards.

Appropriate processes need to be in place to make sure board receives appropriate and objective info in timely manner.

what should you provide ask
What should you provide/ask?

If there is a specific issue, ask for more information, outside expert review, whatever is necessary and reasonable to address the issue

Ask for regular reports and updates on the situation

Form an ad hoc committee to address, as necessary – may want a regular compliance committee

response to issues
Response to Issues

After reporting, how are issues addressed?

Are corrective actions taken in response?

How does the organization evaluate and investigate suspected violations?

Are there protections for whistleblowers?

Does the organization and environment encourage reporting?

Are employees sanctioned appropriately?

response to issues1
Response to Issues

Are there guidelines for reporting violations to the Board?

Does the Board receive enough information to evaluate the appropriateness of the organization’s response?

Is there a policy regarding reporting to government and outside authorities?