HIPAA Changes for 2022 and Beyond - Today's and Tomorrow's HIPAA Compliance

HIPAA in 2022 and Beyond
Being Ready for Compliance Today
and in the Future
Jim Sheldon-Dean
Director of Compliance Services
Lewis Creek Systems, LLC
www.lewiscreeksystems.com
June 14, 2022
1
© Copyright 2022 Lewis Creek Systems, LLC All Rights Reserved
jim@lewiscreeksystems.com www.lewiscreeksystems.com

Agenda
• Overview of HIPAA Regulatory Expectations
• Telemedicine and Communication during the Emergency
• Issues in Individual Access of Records under HIPAA
• HIPAA Accounting of Disclosures Changes
• Potential and Proposed Rules Changes
• HIPAA Controls and New Technologies
• Q&A
2

Part 1
• Overview of HIPAA Regulatory Expectations
– New Regulatory Directions
– New Proposed Changes for the HIPAA Privacy Rule
– Overdue Regulatory Action
– Court Ruling Limiting Regulations
– Rule Modifications and Guidance on the COVID-19
Pandemic
3

Information Blocking and HIPAA
• Information blocking a hot topic at HHS
– New rules in place to facilitate exchange of PHI
• It’s time to stop information blocking
– Do what you can to facilitate patient access of records
– Do what you can to facilitate transfer of records to other providers
when requested by a patient
• TWENTY-SEVEN settlements for not providing timely access under
HIPAA since September, 2019
– Called Information Blocking penalties by HHS
• Proposed changes to the Privacy Rule strengthen individual access
rights and codify prior guidance and court decisions
– Shorter deadlines to respond
– Easier access and transmission to other providers
4

Telemedicine and HIPAA
• Using HIPAA-compliant fully encrypted services under a HIPAA
Business Associate Agreement is fully compliant for
telemedicine use
– Skype for Business, Updox, VSee, Zoom for Healthcare, Doxy.me,
and Google G Suite Hangouts Meet
• Can follow the usual processes for Risk Analysis and secure
implementation, including a HIPAA BAA
• HIPAA has allowances for emergencies and life threatening
situations, even without a Pendemic
• Patients and providers LOVE Telemedicine! It will be with us
after the emergency
5

Telemedicine, HIPAA, and COVID-19
• HHS has issued an enforcement advisory on telemedicine during
the COVID-19 emergency: Relaxed enforcement for using services
that are non-public facing but may not meet HIPAA requirements
(such as providing a BAA)
– OK: Apple FaceTime, Facebook Messenger video chat, Google Hangouts
video, or Skype
• BUT: Do NOT use public-facing services that are not private
– Facebook Live, Twitch, TikTok, and similar
• And: Once the emergency is over you will need to use HIPAA
compliant services, under a Business Associate Agreement,
according to a HIPAA Security Risk Analysis
• See: https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-
preparedness/notification-enforcement-discretion-telehealth/index.html
6

HIPAA Allowances for Communication with Family and
Friends of Patients,
and to Prevent a Serious and Imminent Threat
• HIPAA has reasonable rules for communication and emergencies
built-in
• You can share information as needed with family and friends of the
patient without an Authorization; get a permission if you can but
don’t let it get in the way of good judgement!
– Share only what’s necessary for the purpose
• Sharing is permitted for Public Health purposes and in an
emergency
• If someone is about to get hurt, HIPAA gets out of the way
– The proposed changes to the HIPAA Privacy Rule soften this to
make it less dire, more reasonable to share information “in the
patient’s best interest”
7

Part 2
• Issues in Individual Access of Records under
HIPAA
– New Emphasis on Enforcement of Individual
Access Rules
– New Court Ruling Limiting Third-Party Access
Requests
– New Limitation of Business Associate Liability for
Compliance
8

Information Blocking Penalties in 2022
• March 28, 2022: #26 and 27:
– Jacob and Associates, a psychiatric medical services provider
with two office locations in California, said it would take
corrective actions and pay $28,000 to settle potential violations
of the HIPAA Privacy Rule, according to OCR, including
provisions of the right of access standard
– Dr. Donald Brockley, a solo dental practitioner in Butler,
Pennsylvania, failed to provide a patient with a copy of their
medical record, OCR alleges. Brockley requested a hearing
before an Administrative Law Judge; the litigation was resolved
before the court made a determination by a settlement
agreement in which Brockley agreed to pay $30,000 and take
corrective actions to comply with the HIPAA Privacy Rule's
right-of-access standard
9

Part 3
• HIPAA Accounting of Disclosures Changes
– Current Accounting of Disclosures Requirements
– Required Changes and Difficulties Implementing
Them
– Likely Regulation to be Proposed
10

Part 4
• Potential (and Proposed) Rules Changes
– Acknowledgement of Receipt of Notice of Privacy
Practices
– TCPA and Cell Phone Communications
– Impact of Potential Changes to Affordable Care
Act
– Getting Back to Normal After the Pandemic
Emergency
11

TCPA and Communicating to Cell Phones
• Telephone Consumer Protection Act of 1991 limits calls and
messages to cell phones without consent
• Limits Robo-calling (including reminder calls)
• There are Penalties for, without consent, calling a cell phone
or leaving:
– A payment related message (voice or text)
– A healthcare related message more than one minute
(voice) or 160 characters (text) long; no more than one per
day or three per week
• Includes healthcare reminders, appointment reminders,
etc.
12

When the COVID-19 Emergency is Lifted
• Allowances for using telemedicine and
vaccination appointment scheduling technologies
outside of a Business Associate Agreement during
the emergency will be ended
– Will need to switch to a HIPAA-compliant platform to
continue telemedicine and vaccination scheduling
• Allowances for special disclosures (such as by
business associates for public health purposes)
during the emergency will be discontinued
13

Part 5
• HIPAA Controls and New Technologies
– Difficulty in Managing Privacy
– Calls for HIPAA Expansions
14

New Technologies
• New technologies in health care every day
– Some new technologies will be very useful
– Some new technologies will be a privacy and security
nightmare
• You can’t deny new technologies
– New Technologies should be addressed head-on
– If you ignore them they don’t go away
– Encourage dialog on new technologies and find ways to
use them productively, securely
• Education addressing new technologies is essential
– Prevent improper uses
– Train in appropriate usage
15

Security and Enforcement
• Issues of portable devices & communications
– Where do the responsibilities lie?
• Mobile Devices in Health Care
– They’re already being used
– Stay Out In Front
– Issues with Transmitted and Stored PHI
– Office Obligations, Strategies
• Clients/Patients/Consumers and Mobile Devices
– Patient Rights
– Patient Care
– Patient Communications Policy
– Documentation
• Apps and Devices controlled by the individual and not provider-
driven are outside of HIPAA, and are under FTC scrutiny and FTC
Health Breach Notification Rules
16

Guidance re HIPAA and Health Apps
• Guidance addresses use of Apps by individuals, and at the request of
providers https://www.fiercehealthcare.com/tech/hhs-guidance-clarifies-hipaa-
liability-use-third-party-health-apps
• New HHS Health Apps page: https://www.hhs.gov/hipaa/for-professionals/special-
topics/health-apps/index.html
• Where are the obligations for Privacy and Security?
– If the patient requests communication to their App, the provider should ask
about the individual’s acceptance of risk for security, and proceed as
requested, no Business Associate Relationship needed
– If the provider requests the patient to use an App that is working on behalf of
the provider, the App provider is a Business Associate, so the provider must
assure security and provide insecure communications only at the request of
the individual
• New Proposed HIPAA Privacy Rule changes clarify some of these
obligations
• Also! FTC is reviewing its rules for Breach Notification and Health Apps
https://www.ftc.gov/news-events/press-releases/2020/05/ftc-seeks-comment-part-
review-health-breach-notification-rule
17

New Technologies and HIPAA
• HIPAA can handle new technologies for PHI
– Security Rule is very flexible, adaptable
– For instance, have you considered Alexa and Amazon Echo?
• New kinds of information, apps, devices, and various uses outside
the formal HIPAA definition of “Protected Health Information”
• New calls for protection of more kinds of patient information than
HIPAA covers
• Proposed HIPAA Privacy Rule changes would address many issues
more clearly
• Don’t be surprised if new laws and regulations result
– Expanded FTC activity
– State laws may also be in the works
– Expansion of existing state breach rules
18

Your to-do list…
✓ Don’t be in denial – willful neglect costs more than
compliance
✓ Keep your ears out for new rules, laws, guidance
✓ Provide individual access – don’t block information
✓ Be careful adopting new technologies
✓ Step up your Security game
✓ Make sure mobile devices are protected
✓ Document your processes for proper methods of
communications with both patients and professionals
✓ Conduct drills in audit and breach response
✓ Make corrections based on results
✓ Always have a plan for moving forward, and follow it!
19

Thank you!
Learn More Here…
Any Questions?
For additional information, please contact:
Jim Sheldon-Dean
Lewis Creek Systems, LLC
www.lewiscreeksystems.com
20

HIPAA Changes for 2022 and Beyond - Today's and Tomorrow's HIPAA Compliance

Recommended

Recommended

More Related Content

Similar to HIPAA Changes for 2022 and Beyond - Today's and Tomorrow's HIPAA Compliance

Similar to HIPAA Changes for 2022 and Beyond - Today's and Tomorrow's HIPAA Compliance (20)

More from Conference Panel

More from Conference Panel (20)

Recently uploaded

Recently uploaded (20)

HIPAA Changes for 2022 and Beyond - Today's and Tomorrow's HIPAA Compliance