HIPAA Security Trends and Future Expectations

HIPAA Security Trends and Future
Expectations
December 3, 2019
Presented by:
Barry Mathis
Principal | PYA, P.C.

(800) 270-9629
bmathis@pyapc.com
PYA, P.C.
2220 Sutherland Avenue
Knoxville, TN 37919
Barry has nearly three decades of experience in the information technology
(IT) and healthcare industries as a CIO, CTO, senior IT audit manager, and
IT risk management consultant. He has performed and managed complicated
HIPAA security reviews and audits for some of the most sophisticated
hospital systems in the country. Barry is a visionary, creative, results-oriented
senior-level healthcare executive with demonstrated experience in planning,
developing, and implementing complex information-technology solutions to
address business opportunities, while reducing IT risk and exposure. He is
adept at project and crisis management, troubleshooting, problem solving,
and negotiating. Barry has strong technical capabilities combined with
outstanding presentation skills and professional pride. He is a prudent risk
taker with proficiency in IT risk management, physician relations, strategic
development, and employee team building.
Barry is a member of United States Marine Corps, Health Care Compliance
Association, Association of Healthcare Internal Auditors, Healthcare
Information Management Systems Society and Information Systems Audit
and Control Association. He was an Honor Graduate in Systems
Programming from the United States Marine Corps Computer Sciences
School (MCCDC) in Quantico, VA. He is a Certified Database Management
Specialist and a Certified Cyber Security Framework Practitioner.
Barry Mathis
Principal

 HIPAA Then and Now
 Enforcement Without Funding
 Meaningful Use Impacts
 Expectations Today
 Hot Enforcement Trends by the OCR
 Current Impact of Ransomware
 Breach Notification and Incident Response
 Managing Cybersecurity Threats
 Potential Changes to HIPAA Based on Recent OCR
Communications
 Additional Case Studies
Agenda

HIPAA Then and Now
 Enforcement Without Funding
 1996 unfunded mandate
 Lots of talk, but mostly ignored with the exception of privacy
 If IT security had been “enforced,” it would have crippled the industry
 2003 Transaction and Code Set Standards
 Finally something useful
 The goal was to simplify
 2012 Transaction and Code Set Update

HIPAA Then and Now
 2013 Omnibus
 Business associates must comply independently of the covered
entity
 BAAs all the rage in three waves
 Everybody gets one
 Wait, don’t sign
 Evaluate the need, and sign when your lawyer agrees
 2019
 HIPAA Risk Analysis results and HIPAA audit results are
common requests during OCR, CMS, and civil investigations

HIPAA Then and Now
 Meaningful Use Impacts
 Money makes a difference
 $30 billion gets the HIPAA train moving
 Can’t have federal $ without federal audits
 Office of the National Coordinator
 OCR & OIG
 Many healthcare organizations complete their very first HIPAA
Security Risk Analysis in 2012
 Electronic medical record boom
 Lots of money for limited long-term returns

HIPAA Then and Now
 Impact of Ransomware
 Initially there were two basic types of ransomware
 Lock - Locked user out of systems, unless passcode was provided
 Crypto – Encrypted data, so it could not be used without a key
“According to the FBI, total ransomware payments in the U.S. have, in
some years, exceeded $1 billion. There were scant high-profile
ransomware victims in recent months, but the problem is highly likely to
bounce back strongly in 2019. Ransomware attacks come in waves, and
the next one is due.”
FBI, December 2018

HIPAA Then and Now
 Current environment for ransomware
 Now there is a third type of ransomware that is gaining ground
quickly
 DataKeeper – Franchised ransomware
 To become an affiliate and have a hands-on experience with the Datakeeper
ransomware, it is necessary to sign up on its website, without any activation
fee; the owner of a new Datakeeper-based infection is promised a share of
every ransom fee paid by the victim
 Franchised clients of the Datakeeper ransomware are provided with a pack of
features enabling them to customize their destructive software
 A Datakeeper-based threat may also be instructed to attempt running
administrative rights such as deleting backups or recovery points

Cases that OCR closes fall into five categories:
1. Resolved After Intake & Review (No Investigation)
OCR closes these cases after determining that OCR lacks
jurisdiction, or that the complaint, referral, breach report, news
report, or other instigating event will not be investigated
For example, OCR will close cases where: the organization
alleged to have violated the HIPAA Rules is not a covered entity
or business associate and/or no protected health information
(PHI) is involved; the behavior by the organization does not
implicate the HIPAA Rules; the complainant refuses to provide
consent for his/her information to be disclosed as part of the
investigation; or OCR otherwise decides not to investigate the
allegations
Source: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/index.html

2. Technical Assistance (No Investigation):
OCR provides Technical Assistance to the covered entity,
business associate, and complainant through early
intervention by investigators located in Headquarters or a
Regional Office

3. No Violation* (Investigated):
OCR investigates and does not find any violations of the
HIPAA Rules

4. Corrective Action Obtained* (Investigated):
OCR investigates and provides technical assistance to or
requires the covered entity or business associate to make
changes regarding HIPAA-related privacy and security
policies, procedures, training, or safeguards; in some cases,
technical assistance is provided after investigation without
requiring specific corrective action--for example, when the
covered entity or business associate has already taken
corrective action during the investigation or within the 60-
day window prior to notifying OCR of the breach incident

5. Other:
OCR may decide not to investigate a case further if:
(A). It is referred to the Department of Justice for prosecution
(B). It involved a natural disaster
(C). It was pursued, prosecuted, and resolved by state authorities
(D). The covered entity or business associate has taken steps to
comply with the HIPAA Rules, and OCR determines enforcement
resources are better/more effectively deployed in other cases

Hot Enforcement Trends by the OCR
 Settlement numbers over the past 3 years were greater than the
total settlements in the decade prior (33 settlements since 2016)
 $25.7 million dollars worth of HIPAA settlements in 2018
 The OCR Director expressed interest in finding “big, juicy,
egregious” privacy breaches to send a clear message
 There is now a clear punitive element to resolutions
 As of August 31, 2019, OCR has settled or imposed a civil money
penalty in 65 cases resulting in a total dollar amount of
$102,681,582
 In another 11,907 cases, OCR investigations found no violation had
occurred

The data table below shows the enforcement results by calendar year
according to the type of closure for each category; this is the number of
investigations that OCR had resolved
Source: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-results-by-year/index.html

Results of 2018 Investigations
Source: https://www.hhs.gov/sites/default/files/ocr-enforcement-results-2018.jpg

Recent November 2019 Breaches
2,500 4,200 8,800 12,000 16,000
55,000
106,000
268,000
0
50,000
100,000
150,000
200,000
250,000
300,000
Laptop Mobile
Electronic
Device
Printed
Media
Desktop
Computer
Electronic
Health
Record
Servers Other Email
November 2019 Breaches by People Affected
(rounded)
Skewed as a result of the
Texas Health Resources
breach (87,000 affected)
Source Data: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-results-by-year/index.html

Breach Notification
 HIPAA requires notification in the event of a breach of
unsecured PHI
 Notification must be made to the patient, government, and in
some cases the media
 Breach  acquisition, access, use, or disclosure of PHI in a
manner not permitted under the Privacy Rule which
compromises the security or privacy of the PHI
 ePHI encrypted by ransomware has been acquired (i.e.,
unauthorized individuals have taken possession or control of the
information)
 That makes the attack a BREACH unless

Low Probability of Compromise
 Factors you must consider:
 Nature and extent of PHI
 Who used the PHI or to whom the disclosure was made
 Was PHI acquired/viewed
 Has risk been mitigated
 May also want to consider:
 Risk of unavailability of data
 Risk to integrity of data
 Was PHI exfiltrated
 Must maintain documentation of the risk assessment

Breach Incident Response
 Develop a plan before a breach occurs
 Create a site profile that includes contacts, legal, finance, and public
relations
 The Incident Response Plan should designate:
 Roles and responsibilities:
 Notify your regional FBI field agent, PR firms, legal counsel, your
cybersecurity insurer (only to the extent required in your policy), etc.; and
 Identify a data forensics team to determine the source and scope of the
breach and ensure vulnerable systems are patched as soon as possible
 Timelines
 A communication plan for all audiences (employees, patients, board
members, etc.)
 Determine reporting obligations under federal and state law requirements

Managing Cybersecurity Threats
 This year HHS released a guidance document on Health Industry
Cybersecurity Practices: Managing Threats and Protecting Patients
(HICP)
 The purpose of the HICP is to:
1. Raise awareness of cybersecurity
2. Provide vetted cybersecurity practices
3. Move organizations towards consistency in mitigating cybersecurity
threats to the sector; and
4. Aid healthcare and public health organizations to develop meaningful
cybersecurity objectives and outcomes
 HHS identified e-mail phishing, ransomware, loss or theft of
equipment or data, insider, accidental, or intentional data loss, and
attacks against connected medical devices as the 5 most common
threats to patient health information

Managing Cybersecurity Threats
 The HICP noted 10 cybersecurity practices to mitigate those
threats:
1. E-mail protection systems
2. Endpoint protection systems
3. Access management
4. Data protection and loss prevention
5. Asset management
6. Network management
7. Vulnerability management
8. Incident response
9. Medical device security
10. Cybersecurity policies
 Technical Guides were included within the HICP for small
organizations and medium/large organizations to implement
these practices

Potential Changes to HIPAA
 On December 12, 2018, the OCR released an RFI requesting
public comments on potential changes to HIPAA
 The RFI focused on HIPAA requirements that limit or discourage
coordination of care without meaningfully contributing to the
protection of the privacy or security of an individual’s PHI
 Potential revisions to the following requirements:
 Accounting of disclosures
 Patient’s right to access
 Timeframes for responding to information requests
 Potential exceptions to the minimum necessary rules
 Public comments are due by February 11, 2019

Potential Changes to HIPAA
 The Office of the National Coordinator for Health Information
Technology (ONC) has also indicated potential changes on the
horizon:
 Draft Strategy on Reducing Burden Relating to the Use of Health
IT and EHRs
 Three goals noted in the draft strategy:
1. Reduce the effort and time required to record health information in
EHRs for clinicians;
2. Reduce the effort and time required to meet regulatory reporting
requirements for clinicians, hospitals, and healthcare organizations;
and
3. Improve the functionality and intuitiveness (ease of use) of EHRs
 Comments ended February 11th, 2019

Top HIPAA Breaches 2019

Top 10 Breaches Reported for 2019
• An agency was hacked for eight months between August 1, 2018, and
March 30, 2019, 25 million patients affected
• An insurer reported a nine-year hack on its servers, which potentially
breached the data of 2.96 million patients
• A health information services group’s misconfigured database led to a
personal health data breach of 1.57 million
• A healthcare system’s misconfigured server resulted in
974,000 patients having their data exposed online for three weeks
• A cyberattack on a statement processing group potentially
compromised a wide range of data from a host of clients, including
demographic details and Social Security numbers of approximately
600,000 patients
Source: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/all-cases/index.html#case20

Top 10 Breaches Reported for 2019
• A breach at a state agency caused by a massive phishing campaign;
in total, 625,000 patients and 2.5 million emails were compromised
• A hacking incident at a medical group impacting 400,000 patients in
February
• Several employees of an academic medical center fell victim to
phishing attacks; the personal and health data of about
326,629 patients was potentially breached
• An unauthorized third-party gained access to employee and hosted
email accounts at a hospital, a potential data breach of 278,016
patients
• A server migration error at a software solutions company exposed
277,319 patients’ personal and medical data

Costly investigations
 Big health companies: 6 of 10 payouts last year involved
household names
 $16 million dollar deal involving over 79 million people; no safeguards in
place to detect hackers and failed to conduct an annual risk analysis
 $4.3 million dollar deal for failing to encrypt devices
 Lower fines for smaller companies with specific HIPAA
shortcomings
 $100,000 settlement for failing to properly dispose of PHI
 $125,000 settlement for a doctor’s disclosure of patient PHI to a reporter
 $111,400 settlement for failing to terminate a former employee’s access to
ePHI

Enforcement Trends by the OCR
 OCR Settles First Case in HIPAA Right-of-Access
Initiative
 A health system has paid $85,000 to the Office for Civil Rights at the U.S.
Department of Health and Human Services and has adopted a corrective
action plan to settle a potential violation of the right-of-access provision of
the HIPAA Rules after it failed to provide a mother timely access to
records about her unborn child
 OCR initiated its investigation based on a complaint from the mother
 As a result, the health system directly provided the individual with the
requested health information more than nine months after the initial
request
 The HIPAA Rules generally require covered healthcare providers to
provide medical records within 30 days of the request, and providers can
only charge a reasonable cost-based fee

Software configuration error
Covered Entity: Integrated Delivery Network
Issue: Misconfiguration error in the billing system
 A health system with hospitals and clinics in 16 counties, serving about 7
million patients each year; officials filed breach reports for each of its 15
hospitals impacted by the security incident
 Officials first learned about the security incident on August 23; a
misconfiguration error allowed for patient data to be matched with, and sent to,
the incorrect guarantor for nearly three months between July 19, 2019, and
September 4, 2019, resulting in the breach affecting over 87,000 people

Not every investigation ends costly
Pharmacy Chain Enters into Business Associate Agreement with Law Firm
Covered Entity: Pharmacy Chain
Issue: Impermissible Uses and Disclosures; Business Associates
 A complaint alleged that a law firm working on behalf of a pharmacy chain in
an administrative proceeding impermissibly disclosed the PHI of a customer of
the pharmacy chain; OCR investigated the allegation and found no evidence
that the law firm had impermissibly disclosed the customer’s PHI; however, the
investigation revealed that the pharmacy chain and the law firm had not
entered into a business associate agreement, as required by the Privacy Rule,
to ensure that PHI is appropriately safeguarded; without a properly executed
agreement, a covered entity may not disclose PHI to its law firm; to resolve
the matter, OCR required the pharmacy chain and the law firm to enter into a
business associate agreement

How you react matters
Physician Revises Faxing Procedures to Safeguard PHI
Covered Entity: Healthcare Provider
Issue: Safeguards
A doctor's office disclosed a patient's HIV status when the office mistakenly faxed
medical records to the patient's place of employment instead of to the patient's
new healthccare provider; the employee responsible for the disclosure received a
written disciplinary warning, and both the employee and the physician apologized
to the patient; to resolve this matter, OCR also required the practice to revise the
office's fax cover page to underscore a confidential communication for the
intended recipient; the office informed all its employees of the incident and
counseled staff on proper faxing procedures
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/all-cases/index.html#case3

Cleanup will always be part of the response
Health Plan Corrects Computer Flaw That Caused Mailing of EOBs to
Wrong Persons
Covered Entity: Health Plans
Issue: Safeguards
A national health maintenance organization sent explanation of benefits (EOB) by
mail to a complainant's unauthorized family member; OCR's investigation
determined that a flaw in the health plan's computer system put the protected
health information of approximately 2,000 families at risk of disclosure in violation
of the Rule; among the corrective actions required to resolve this case, OCR
required the insurer to correct the flaw in its computer system, review all
transactions for a six-month period and correct all corrupted patient information
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/all-cases/index.html#case16

Thank You!
Barry Mathis
bmathis@pyapc.com
(800) 270-9629
pyapc.com

HIPAA Security Trends and Future Expectations

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to HIPAA Security Trends and Future Expectations

Similar to HIPAA Security Trends and Future Expectations (20)

More from PYA, P.C.

More from PYA, P.C. (20)

Recently uploaded

Recently uploaded (20)

HIPAA Security Trends and Future Expectations