Violation of Privacy Rule Leads to $800,000 HIPAA Settlement

June 23, 2014 By

Indiana-based Parkview Health System (“Parkview”) has agreed to settle potential violations of the HIPAA Privacy Rule with the HHS Office for Civil Rights (“OCR”) by paying $800,000 and adopting a corrective action plan to address deficiencies in its HIPAA compliance program. The resolution agreement can be found here.

According to the HHS press release, the OCR opened an investigation after receiving a complaint from a retiring physician alleging that Parkview had violated the HIPAA Privacy Rule. In September 2008, Parkview took custody of medical records pertaining to approximately 5,000 to 8,000 patients while assisting the retiring physician to transition her patients to new providers, and while considering the possibility of purchasing some of the physician’s practice. On June 4, 2009, Parkview employees, with notice that the physician was not at home, left 71 cardboard boxes of these medical records unattended and accessible to unauthorized persons on the driveway of the physician’s home, within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue. It is unclear whether any of these medical records were actually viewed by anyone else.

In addition to the $800,000 payment, Parkview entered into a corrective action plan that requires them to:

  • Develop, maintain and revise, as necessary, written policies and procedures addressing requirements of the Privacy Rule and the corrective action plan (“Policies and Procedures”).  Specifically these Policies and Procedures must at a “minimum, provide for administrative, physical and technical safeguards (“safeguards”) to protect the privacy of non-electronic PHI to ensure that such PHI is appropriately and reasonably safeguarded from any intentional, unintentional or incidental use or disclosure that is in violation of the Privacy Rule.”
  • Provide Policies and Procedures to HHS within 30 days of Resolution Agreement’s Effective Date for HHS’s review and approval.
  • Distribute Policies and Procedures to all Parkview workforce members.
  • Periodically review the Policies and Procedures and update them to reflect changes in operations at Parkview, federal law, HHS guidance and/or any material compliance issues discovered by Parkview.
  • Notify HHS in writing within 30 days if Parkview determines that a workforce member has violated the Policies and Procedures (“Reportable Events”).
  • Provide general safeguards training to all workforce members who have access to PHI, as required by the Privacy Rule.
  • Provide training on its approved Policies and Procedures to all workforce members.
  • Submit to HHS a final report demonstrating Parkview’s compliance with the corrective action plan.

Organizations should pay careful attention to the transfer and disposal of both electronic and paper patient records. The OCR has provided helpful FAQs about HIPAA and the disposal of protected health information. For more information about complying with the HIPAA Privacy Rule, please contact Jefferson Lin or Elana Zana.

 

 

Filed Under: Breach Notification, Health Information Technology, HIPAA, HITECH Tagged With: , , ,

Meaningful Use EP Hardship Exception Deadline – July 1, 2014

June 12, 2014 By

Not able to meet meaningful use this year?  You may qualify for a hardship exception.  Eligible professionals that qualify for certain hardship exceptions can avoid the meaningful use payment adjustments in 2015 by submitting to CMS the 2015 Hardship Exception Application.  CMS has permitted the EPs to apply for a hardship exception based on the following reasons:

  • Infrastructure: Eligible professionals must demonstrate that they are in an area without sufficient internet access or face insurmountable barriers to obtaining infrastructure (e.g., lack of broadband).
  • New Eligible Professionals: Newly practicing eligible professionals who would not have had time to become meaningful users can apply for a 2-year limited exception to payment adjustments. Thus eligible professionals who begin practice in calendar year 2015 would receive an exception to the penalties in 2015 and 2016, but would have to begin demonstrating meaningful use in calendar year 2016 to avoid payment adjustments in 2017.
  • Unforeseen Circumstances: Examples may include a natural disaster or other unforeseeable barrier.
  • Patient Interaction: Lack of face-to-face or telemedicine interaction with patient or lack of follow-up need with patients.
  • Practice at Multiple Locations: Lack of control over availability of CEHRT for more than 50% of patient encounters.
  • 2014 EHR Vendor Issues: The eligible professional’s EHR vendor was unable to obtain 2014 certification or the eligible professional was unable to implement meaningful use due to 2014 EHR certification delays. (Note that CMS has published a proposed rule regarding lack of availability of 2014 CEHRT proposing to permit EPs in certain situations to attest to Stage 1, click here for further information).

– Payment Adjustments & Hardship Exceptions Tipsheet for Eligible Professionals.  This tip sheet further describes the payment adjustments and includes frequently asked questions.

The following categories of EPs do not have to apply for a hardship exception but will automatically be granted one based on their status with CMS:

  • New providers in their first year (both eligible professionals and eligible hospitals).
  • Eligible professionals who are hospital-based: a provider is considered hospital-based if he or she provides more than 90% of their covered professional services in either an inpatient (Place of Service 21) or emergency department (Place of Service 23) of a hospital.
  • Eligible professionals with certain PECOS specialties (Anesthesiology-05, Pathology-22, Diagnostic Radiology-30, Nuclear Medicine-36, Interventional Radiology-94).

Eligible professionals that have not participated in the EHR Incentive Program in the past have the option of avoiding the 2015 payment adjustment if they successfully attest to meaningful use by October 1, 2014.  Those eligible professionals that qualify for any of the above hardship exceptions and will not be able to attest to meaningful use by October 1, 2014 may still apply for a hardship exception, but must do so by July 1, 2014.

For more information about the EHR Incentive Programs and meaningful use please contact Elana Zana.

 

 

Filed Under: HITECH, Incentive Payments, Meaningful Use Tagged With: , , ,

CMS Proposed Revisions to Meaningful Use – A Welcome Delay

May 21, 2014 By

CMS has issued proposed revisions to meaningful use Stages 2 and 3 in response to numerous industry complaints that hospitals and provider groups will not be able to implement the 2014 certified EHR technology with enough time to meet meaningful use in 2014.  CMS, recognizing that EPs and hospitals are either using 2011 CEHRT, 2014 CEHRT, or a mixture of both, issued proposed rules addressing what each category must attest to in 2014.  In a substantial change from the Final Rules issued in September 2012, CMS has agreed to extend Stage 1 in 2014 for those EPs and hospitals that cannot successfully obtain or deploy 2014 CEHRT.  Further, CMS has proposed to delay Stage 3 meaningful use by one year. 

Medicaid Modification

The proposed rule modifies the AIU (adopt, implement and upgrade) exception for those EPs and hospitals attesting for the first time in 2014.  Hospitals and EPs attesting to AIU in 2014 must adopt, implement or upgrade to 2014 Edition CEHRT only, attesting to the 2011 Edition or a combination Edition will not satisfy the definition in 2014.

Meaningful Use Timeline

Originally, all Medicare EPs and hospitals were required to meet meaningful use using the 2014 Edition CEHRT for Stage 1 or Stage 2 in 2014.  This proposed rule delays this process as follows:

Table 2:  Proposed CEHRT Systems Available for Use in 2014

If you were scheduled to demonstrate: You would be able to attest for Meaningful Use:

Using 2011 Edition

CEHRT to do:

Using 2011 & 2014

Edition CEHRT to do:

Using 2014 Edition

CEHRT to do:
Stage 1 in 2014

2013 Stage 1 objectives and measures*

2013 Stage 1 objectives and measures*

-OR-

2014 Stage 1 objectives and measures*

2014 Stage 1 objectives and measures
Stage 2 in 2014

2013 Stage 1 objectives and measures*

2013 Stage 1 objectives

and measures*

-OR-

2014 Stage 1 objectives and measures*

-OR-

Stage 2 objectives and measures*

2014 Stage 1 objectives and measures*

-OR-

Stage 2 objectives and measures

 *Only providers that could not fully implement 2014 Edition CEHRT for the reporting period in 2014 due to delays in 2014 Edition CEHRT availability.  Note: Table 2 is directly from the CMS proposed rule (similar table in press release does not contain asterisk).

To take advantage of the delays, EPs and hospitals must attest that they were not able to upgrade or fully implement to the 2014 Edition CEHRT because of issues related to availability.  Providers that were planning on meeting Stage 2 in 2014 and are now going to attest to Stage 1 in 2014 will be required to begin Stage 2 in 2015.

Stage 3 Delay

CMS also proposed a delay in Stage 3 for a year.  This is welcome news considering that CMS has not yet built-out Stage 3 and is waiting for the results from Stage 2 to “inform [its] development of the criteria for Stage 3 meaningful use.”  Stage 3 will begin on January 1, 2017 for EPs and October 1, 2016 for hospitals and CAHs.  The proposed revised schedule is as follows:

TABLE 3–PROPOSED STAGE OF MEANINGFUL USE CRITERIA BY FIRST PAYMENT YEAR

 

First Payment Year

Stage of Meaningful Use
2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021
2011 1 1 1 1 or 2* 2 2 3 3 TBD TBD TBD
2012 1 1 1or 2* 2 2 3 3 TBD TBD TBD
2013 1 1* 2 2 3 3 TBD TBD TBD
2014 1* 1 2 2 3 3 TBD TBD
2015 1 1 2 2 3 3 TBD
2016 1 1 2 2 3 3
2017 1 1 2 2 3

*3-month quarter EHR reporting period for Medicare and continuous 90-day EHR reporting period (or 3 months at State option) for Medicaid EPs.  All providers in their first year in 2014 use any continuous 90-day EHR reporting period.  Note: Table 3 is directly from the CMS proposed rule (similar table in press release does not contain asterisk).

Clinical Quality Measures

CMS has also relaxed the requirements related to reporting on clinical quality measure in 2014.  Specifically, the method of CQM submission to CMS will depend on the edition of CEHRT deployed by the provider (States will still have discretion for submission requirements).

 

2011 Edition CEHRT

2011 & 2014

Edition CEHRT

2013 Stage 1 objectives
Method of Reporting Attestation Attestation
EP Reporting Requirements 3 core/alternate
3 additional
3 month reporting period (90 days if 1st year)		 3 core/alternate
3 additional
3 month reporting period (90 days if 1st year)
Derived exclusively from 2011 CEHRT
Hospital/CAH Reporting Requirements 15 Stage 1 Measures
3 month reporting period (90 days if 1st year)		 15 Stage 1 Measures
3 month reporting period (90 days if 1st year)
Derived exclusively from 2011 CEHRT

For those providers using a combination of 2011 and 2014 Edition CEHRT to report on either the 2014 Stage 1 measures or Stage 2 measures or the 2014 Edition CEHRT they should report CQMs as originally indicated in the Stage 2 final rule (i.e submitting electronically) and subsequent rule making.

ONC Modifications

In order to support the CMS revisions, ONC has made modifications to its CEHRT definition to reflect the proposed new required start dates.  ONC’s proposed revisions would move the required start dates for the 2014 Edition of CEHRT to October 1, 2014 for hospitals and CAHs and January 1, 2015 for EPs.

For more information on the EHR Incentive Program and meeting meaningful use please contact Elana Zana.

Filed Under: Health Information Technology, HITECH, Incentive Payments, Meaningful Use Tagged With: , ,

$4.8 Million HIPAA Settlement – Patient Data on the Web

May 13, 2014 By

On May 7, 2014, HHS announced that New York-Presbyterian Hospital (“NYP”) and Columbia University (“CU”) agreed to collectively pay $4.8 million in the largest HIPAA settlement to date. The organizations settled charges that they potentially violated the HIPAA Privacy and Security Rules by failing to secure thousands of patients’ electronic protected health information (“ePHI”).

NYP and CU operate a shared data network that links patient information systems containing ePHI. On September 27, 2010, the two entities submitted a joint breach report following the discovery that the ePHI of 6,800 individuals had been impermissibly disclosed due to a deactivated server, resulting in ePHI being accessible on internet search engines. The ePHI included patient statuses, vital signs, medications, and laboratory results.

HHS Office for Civil Rights’ (“OCR”) subsequent investigation determined that neither entity had conducted an accurate and thorough risk analysis or developed an adequate risk management plan to address potential threats and hazards to ePHI security. Further, OCR found that NYP failed to implement appropriate policies and procedures for authorizing access to its databases and failed to comply with internal policies on information access management.

NYP agreed to pay $3.3 million and CU agreed to pay $1.5 million. In addition, both entities agreed to Corrective Action Plans that require each entity to:

  • Conduct a comprehensive and thorough risk analysis;
  • Develop and implement a risk management plan;
  • Review and revise policies and procedures on information access management and device and media controls;
  • Develop an enhanced privacy and security awareness training program; and
  • Provide progress reports.

Additionally, CU must also “develop a process to evaluate any environmental or operational changes” that impact the security of ePHI it maintains.

This settlement again highlights the necessity for healthcare organizations and business associates to create and implement Security policies and procedures, and to engage in a security management process that ensures the security of patient data.

For assistance on the HIPAA Security Rule requirements, drafting and implementing Security policies and procedures, or general HIPAA assistance please contact Elana Zana or Jefferson Lin.

 

Filed Under: Breach Notification, Compliance, Health Information Technology, HIPAA, HITECH Tagged With: , , ,

Stolen Laptops Lead to $2 Million in HIPAA Settlements

April 28, 2014 By

Last week HHS announced close to $2 Million dollars in HIPAA settlements with Concentra and QCA Health Plan due to the theft of unencrypted laptops.  However, the message from HHS is not just the importance of data encryption, rather its performance and follow through with security risk analysis and implementation of security policies and procedures.  Further, the close to $2 million in fines do not include the additional costs and time it will take both of these health care organizations to comply with the OCR corrective action plans.

Concentra

The larger settlement and corrective action plan involved Concentra Health Services, a subsidiary of Humana, Inc., which operates more than 300 medical clinics nationally, including urgent care, occupational and physical therapy, and wellness services.  Concentra agreed to a $1,725,220 settlement with HHS for potential violations resulting from the breach notification associated with a stolen unencrypted laptop.  Specifically, the Resolution Agreement identified the following two deficiencies:

(1) Concentra failed to adequately remediate and manage its identified lack of encryption or, alternatively, document why encryption was not reasonable and appropriate and implement an equivalent alternative measure to encryption, if reasonable and appropriate, from October 27, 2008, until June 22, 2012 (date on which a complete inventory assessment was completed and Concentra immediately took action to begin encrypting all unencrypted devices) (see 45 C.F.R. § 164.312(a)(2)(iv)).

(2) Concentra did not sufficiently implement policies and procedures to prevent, detect, contain, and correct security violations under the security management process standard when it failed to adequately execute risk management measures to reduce its identified lack of encryption to a reasonable and appropriate level from October 27, 2008, (date of Concentra’s last project report indicating that 434 out of 597 laptops were encrypted) until June 22, 2012 (date on which a complete inventory assessment was completed and Concentra immediately took action to begin encrypting all unencrypted devices) (see 45 C.F.R. § 164.308(a)(1)(i)).

Interestingly, while the Security Rule allows for flexibility in implementation for certain measures, including data encryption under 45 CFR 164.312, this high settlement amount indicates that healthcare organizations (including now business associates) who choose not to implement encryption standards must be able to explain themselves.  HHS, in the Resolution Agreement, faults Concentra not only for failing to encrypt the data, but in light of a decision not to encrypt, Concentra was faulted for failing to implement an alternative to encryption (though unclear what a reasonable alternative to encryption would be).  Now, not only does Concentra have this large settlement payment due to HHS, but it has to comply with the corrective action plan, which includes the implementation of a security management plan (with a security risk analysis baked in), encryption obligations, security awareness training, and annual reports to HHS.  And if Concentra fails to comply, HHS has reserved its right to impose civil monetary penalties (which were significantly increased under the HITECH Act).

QCA Health Plan of Arkansas

The smaller settlement of $250,000 was with QCA Health Plan of Arkansas, a healthcare insurance provider.  The impetus for this settlement and corrective action plan was the theft of an unencrypted laptop from an employee’s car which contained PHI belonging to 148 individuals (note that this breach affected less than 500 individuals).  The Resolution Agreement determined that:

A.  QCA did not implement policies and procedures to prevent, detect, contain, and correct security violations, including conducting an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI it held, and implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 45 C.F.R. § 164.306 from the compliance date of the Security Rule to June 18, 2012.

B. QCA did not implement physical safeguards for all workstations that access ePHI to restrict access to authorized users on October 8, 2011.

C. QCA impermissibly disclosed the ePHI of 148 individuals on October 8, 2011.

Unlike Concentra, QCA was not directly faulted for failing to encrypt its laptops, or failing to implement a reasonable alternative. Rather, this settlement focused instead on the lack of sufficient HIPAA Security policies and procedures, inadequacy in conducting a security risk assessment, and the failure to implement security measures, most specifically physical safeguards. The corrective action plan is also noticeably different, with a focus instead on workforce training and reporting of workforce non-compliance, rather than on encryption requirements (the press release notes that QCA encrypted its laptops following the breach).

Though like most breach cases the simple solution is to encrypt the data to avoid an actual breach, these settlements expose the depth of compliance obligations and monetary consequences associated with the failure to securely protect the PHI.  Concentra and QCA, like other health care organizations who have settled with HHS, will have years of compliance reporting obligations and security management requirements that will likely create significant cost burdens in addition to the monetary settlement obligations.  HHS has made it quite clear in its press releases and corrective action plans, healthcare organizations and business associates must create and implement Security policies and procedures, and must engage in a security management process that ensures the security of patient data post the initial implementation.

For assistance on the HIPAA Security Rule requirements, drafting and implementing Security policies and procedures, or general HIPAA assistance please contact Elana Zana.

Filed Under: Breach Notification, Compliance, Health Information Technology, HIPAA, HITECH, Security Tagged With: , ,

HHS Releases Security Risk Assessment Tool

March 28, 2014 By

Need help performing your HIPAA/Meaningful Use Security Risk Assessment?  Good news, HHS has released a tool to help!  In partnership with the Office of the National Coordinator, HHS created a tool, user guide, software, tutorial, videos and even an iOS App to help HIPAA covered entities and business associates perform the required HIPAA Risk Analysis.

The HIPAA Security Rule specifically requires (this is not an addressable specification) a Security Risk Analysis:

“Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”  45 CFR 164.308(a)(1)

In addition, those hospitals and eligible professionals seeking to meet meaningful use in order to receive the EHR Incentive dollars or avoid the Medicare payment adjustments must fulfill a HIPAA Security Risk Assessment.

Stage 1

Stage 2
Objective. Protect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities.Measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of its risk management process. Objective. Protect electronic health information created or maintained by the Certified EHR Technology through the implementation of appropriate technical capabilities.Measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1), including addressing the encryption/security of data stored in Certified EHR Technology in accordance with requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), and implement security updates as necessary and correct identified security deficiencies as part of the EP’s risk management process.

For those hospitals and eligible professionals looking to meet meaningful use, the Security Risk Assessment tool will generate a report that can be provided to auditors.  However, the report alone is likely insufficient because both the auditors and the  meaningful use requirements (above) require the correction of security deficiencies – so merely running a Security Risk Assessment without taking actions to remedy the problem will not suffice.  To read more about meaningful use audits and security risk assessments click here. 

In addition to releasing the Security Risk Assessment tool, HHS has created a helpful true/false statement with the Top 10 Myths of Security Risk Analysis.  This document highlights the misconceptions regarding the risk assessment requirements, including that all covered entities and business associates (regardless of the size) must conduct a risk assessment pursuant to HIPAA.  Importantly, though only eligible professionals & hospitals are eligible for meaningful use incentives and Medicare payment adjustments, business associates must also comply with the HIPAA Security Rule pursuant to the HITECH Act.  Therefore, business associates must also conduct security risk assessments, and per recent guidance from HHS, business associates are likely part of the next round of HIPAA audits.

For more information about HIPAA, security risk assessments, and meaningful use please contact Elana Zana.

Filed Under: Business Associate, Compliance, Health Information Technology, HIPAA, HITECH, Incentive Payments, Meaningful Use Tagged With: , , , , ,

Skagit County Agrees to Pay $215,000 for HIPAA Violations

March 14, 2014 By

On March 6, 2014, the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) reached a $215,000 settlement with Skagit County in northwest Washington state for violations of the HIPAA Privacy, Security and Breach Notification Rules, according to terms of the Resolution Agreement.  This represents the first OCR settlement with a county government for HIPAA non-compliance. For two weeks in September 2011, the electronic protected health information (“ePHI”) for 1,581 individuals was exposed after the ePHI had been inadvertently moved to a publicly accessible web server maintained by Skagit County.  The accessible files included protected health information about the testing and treatment of infectious diseases.

The OCR investigation revealed that Skagit County failed to provide notification to individuals as required by the Breach Notification Rule and that the county failed to implement sufficient policies and procedures to prevent, detect, contain, and correct security violations. Further, Skagit County failed to provide necessary and appropriate security awareness and training for its workforce members.  As part of the settlement, the county has agreed to enter into a Corrective Action Plan to address deficiencies in various HIPAA compliance areas, including written policies and procedures, documentation requirements, training, and other measures.

This settlement highlights the importance for all covered entities and business associates, whether in the government or private sector, to implement policies and procedures to safeguard ePHI and, in case of a breach, to respond promptly and effectively. For more information about this OCR settlement or for assistance with HIPAA compliance, please contact Jefferson Lin or David Schoolcraft.

Filed Under: Breach Notification, HIPAA, HITECH, Washington Tagged With: , ,

Meaningful Use Exception Includes EHR Vendor Delays

March 11, 2014 By

Following its announcement at HIMSS, CMS has published its hardship exception application for 2014 along with its new exception due to vendor delays.  The new exception permits eligible hospitals and eligible professionals to request an exception from the 2015/2016 payment adjustments due to 2014 EHR Vendor Issues.  Specifically, CMS now permits an exception due to the inability of the vendor to obtain 2014 certification or if the hospital or EP was unable to implement meaningful use due to 2014 EHR certification delays.  Along with filling out the EP or Hospital exception forms, those requesting the exception must submit a notification from the EHR vendor.

For EPs and hospitals who are demonstrating meaningful use for the first time, they may apply for this hardship exception to avoid the 2015 payment adjustments.  For those EPs and hospitals who have previously demonstrated meaningful use, they may use this hardship exception to avoid 2016 payment adjustments.

For hospitals, the hardship exception request for 2015 payment adjustments is due April 1, 2014.  For eligible professionals, the hardship exception request for 2015 payment adjustments is due July 1, 2014.  However, for those EPs that have not previously participated in the Medicare EHR Incentive Program they can submit attestation by October 1, 2014 and also avoid the payment adjustments.  CMS has also issued guidance for applying for the EHR Vendor hardship exception for EPs and hospitals.

For more information about the Medicare or Medicaid EHR Incentive Program or applying for these hardship exceptions please contact Elana Zana.

Filed Under: EHR, HITECH, Hospitals, Incentive Payments, Meaningful Use Tagged With: ,

Upcoming HIPAA Audits Will Include Business Associates

March 5, 2014 By

On February 24, 2014, the Department of Health and Human Services (“HHS”) published a notice of its proposed collection of information in connection with its HIPAA audit efforts.  Comments on the proposed collection request must be submitted by April 25, 2014.

The notice indicates HHS’s intent to survey up to 1,200 organizations, including both covered entities and business associates, to determine the organizations’ suitability for HIPAA audits by HHS.  The survey will seek information about an organization’s patient visits, use of electronic information, revenue, and business locations, among other things.  The notice hints that some sort of technology will be used to complete the survey, as HHS’s time estimate of 30-60 minutes to complete the survey includes the time needed to “develop, acquire, install and utilize technology and systems for the purpose of collecting, validating and verifying information…”. The notice does not include details on the criteria HHS will use to select an organization for an audit.

One of the notable items of this notice is HHS’s announcement that this round of HIPAA surveys will include business associates as well as covered entites.  This is a clear signal that HHS is getting serious about HIPAA compliance by all organizations who handle protected health information.

For more information about HIPAA audits and HIPAA enforcement, please contact Lee Kuo.

Filed Under: Business Associate, Compliance, HIPAA, HITECH Tagged With: , ,

The Business Associate Agreement Battle – Understand the Key Issues

February 26, 2014 By

The September 2014 deadline for amending pre-existing HIPAA business associate agreements (BAA) is fast approaching.  Are you ready?  Under the HITECH Act, covered entities and business associates have just under seven months to negotiate and implement amendments to all BAAs entered into prior to January 25, 2013.

In the face of the unprecedented challenge of revising all pre-existing BAAs, covered entities and business associates need to act quickly, but also be mindful of the important terms in BAAs that can lead to increased liability, including the following:

  • Indemnification: Although not required by the HITECH Act, covered entities often push for strong indemnification language that requires the business associate to indemnify the covered entity for a business associate’s breach of protected health information (PHI) and violations of HIPAA.  Acceptable indemnification language for each party depends on the nature of the PHI involved in the transaction and the amount of PHI that is transmitted between the parties. 
  • Limitation of Liability: In order to reduce the risks of receiving and maintaining the covered entity’s PHI, many business associates push for BAA language that limits their liability to a certain amount (i.e. fees paid by covered entity in the underlying agreement).  A covered entity’s acceptance to a business associate’s “limitation of liability” terms can pose significant risks if the business associate violates HIPAA after the BAA is signed. 
  • Breach Notification Time Period: The HITECH Act requires business associates to notify covered entities of a breach of PHI within 60 days of discovery.  However, in order to protect relationships with patients affected by a breach, proposed BAAs from covered entities generally require a business associate to provide notification within 10 days or less.  A business associate’s acceptance to a shorter notification period can put tremendous pressure on it to investigate and disclose accurate information after a breach occurs.

These are just a few terms found in BAAs that can lead to increased liability and risks for covered entities and business associates.  Although it is critical to complete BAA amendments by the September 23, 2014 deadline, business associates and covered entities need to think critically about the language in BAAs prior to signature.

If you would like more information about negotiating business associate agreements, please contact Dave Schoolcraft, Elana Zana or Casey Moriarty.

Filed Under: Business Associate, HIPAA, HITECH Tagged With: ,
Next Page»