HIPAA violations pack a hefty punch for Maryland-based clinics

For the first time, the U.S. Department of Health and Human Services (HHS) has issued a civil monetary penalty for violations to the Health Insurance Portability and Affordability Act (HIPAA). And the price tag is significant -- a whopping $4.3 million!

The unlucky recipient of this substantial penalty was Cignet Health Center, a group of clinics based in Prince Georges County, MD. The organization received the multimillion-dollar penalty for two key reasons: 1) Failing to share medical records with patients who requested them and 2) Failing to cooperate with an HHS investigation.

The case dates back to September 2008, when more than 40 Cignet patients came forward with complaints about not being able to get copies of their medical records to share with new doctors. The HHS Office of Civil Rights, which enforces HIPAA's privacy rule, gave the organization's executives two years to comply with the request to release documents and resolve the issue.

In spite of this and numerous other prompts by the agency (including letters, orders, multiple deadlines and hearings), Cignet didn't budge. Not until April 2010, that is. Without any explanation of its prior lack of cooperation, Cignet sent 59 boxes of medical records to the U.S. Department of Justice -- records that included those of the 41 patients, as well as 4,500 other patient whose records should have remained private. The damage was already done, however. Cignet levied a two-part fine: $3 million for not cooperating with the investigation and $1.3 million for not turning over the medical records requested by patients.

According to Rachel Seeger, spokeswoman for the HHS agency, "Cignet's failure to respond to the investigation was unprecedented."

This case sends a clear compliance message to all health care professionals: Follow the privacy rules and fully cooperate with investigations by the HHS ... or pay the price.

Would your HIPAA practices receive a clean bill of health? Be certain you're meeting all mandatory HIPAA laws, including recent changes made by the HITECH ACT, with the necessary forms and support materials.

HIPAA violations pack a hefty punch for Maryland-based clinics

Are you doing enough to prevent breaches of protected health information?

HIPAA violations can have serious legal consequences.

Case in point: A federal grand jury has indicted a former employee at the University of Pittsburgh Medical Center for allegedly stealing patient data. The defendant disclosed to other people the names, birth dates and Social Security numbers of patients – information later used to file false tax returns. The law carries of maximum sentence of 80 years in prison, a fine of more than $4.7 million, or both.

In another case, a former researcher at the UCLA School of Medicine has been sentenced to four months in federal prison for HIPAA violations. Upon learning that he was being dismissed from his job, the UCLA employee accessed the medical records of his superior and coworkers, as well as more than 320 patient records (many of them celebrities) during the following four weeks. Charges were filed in 2009 and the defendant pleaded guilty in early 2010 to four misdemeanor counts of illegally reading private and confidential medical records.

Not only do these cases demonstrate the long reach of HIPAA enforcement, but also the importance of bumping up security and other safeguards to prevent these types of medical data breaches.

What is a breach?

A breach occurs when 1) there has been “unauthorized” access, use or disclosure of “unsecured” PHI that violates the HIPAA Privacy Rule, and 2) the disclosure “compromises the security or privacy” of the PHI, which means that it “poses a significant risk of financial, reputational or other harm to the individual.”

What is “unsecured” PHI?

The rules define “unsecured” PHI as any information that has not been rendered unusable, unreadable or indecipherable to unauthorized individuals through the application of a technology such as encryption and destruction.

Encryption - Proper encryption should use an algorithmic process to transform data into a form that is meaningless without a confidential process or key (which also must be protected).

Destruction - Hard copy PHI, such as paper or film, needs to be thoroughly shredded or destroyed so that it cannot be read or reconstructed.

How do I protect my business?

To steer clear of HIPAA violations and breaches, you should:

Establish breach notification procedures and update policies - Develop guidelines for determining when a breach has occurred, who will prepare individual notifications, and when a breach will trigger a requirement for notice to the media or immediate notice to HHS. Amend your HIPAA privacy and security policies, too, to cover the security breach notification rules.

Maintain a breach incident log - Set up a system to log security breaches affecting fewer than 500 individuals, which you must file with HHS within 60 days after the end of the year.

Revise business associate agreements - Discuss with your business associates (and put in writing) when they should notify you of a breach by their organization, what information should be reported, and which party will issue the required notifications.

Train employees on proper procedures - Employees should understand when they have encountered a breach and how to report it. A successful training program will provide formal instruction on HIPAA-related policies and procedures, as well as build awareness through workplace postings and other employee materials.

Are you doing enough to prevent breaches of protected health information?

Survey reveals heavy financial burden of class action lawsuits

Based on the sixth annual Workplace Class Action Litigation Report by Seyfarth Shaw LLP – a leading law firm handling complex employment litigation – employers should be aware of several key trends that occurred in federal and state courts last year:

• Class action filings seeking recovery for unpaid wages and 401(k) losses increased. More age discrimination and Worker Adjustment and Retraining Notification (WARN) lawsuits were filed, too, due to workers being displaced in layoffs.

• Wage and hour litigation outpaced all other types of employment-related cases, especially in CA, FL, IL, NJ, NY, MA, MN, PA and WA.

• The Obama Administration’s renewed focus on regulation and enforcement, mostly through the DOL and EEOC, continues to increase exposure for employers.

• Massive settlements were seen in several nationwide class actions, as plaintiffs’ lawyers pushed for greater damages. The top 10 employment discrimination settlements in 2009 totaled $86.2 million, while the top 10 wage and hour settlements reached $363.6 million.

Just one major, costly lawsuit could be devastating to your business. Stay on the right side of the law and reduce your risk with legally compliant products and services – from Poster Guard® Compliance Protection to the latest FMLA, FLSA, OSHA and HIPAA compliance materials.

Survey reveals heavy financial burden of class action lawsuits

Life's a "breach" if you mishandle protected health information

In late August 2009, the Department of Health and Human Services (HHS) issued new regulations requiring entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their protected health information (PHI) is compromised. Specifically, the HITECH Act requires businesses to report breaches affecting 500 or more individuals to HHS within 60 days of discovering the breach. It also requires that HHS post on its website a list of these reported breaches.

The “Breach Notification Rule’ is now in full play. Last week, HHS posted a list of breaches of unsecured PHI that affected 500 or more people. As summarized in the report, 27 of the breaches resulted from thefts of paper or electronic records. Other breaches were described as “Hacking/IT Incident,” “Loss,” “Incorrect Mailing,” “Unauthorized Access,” “Misdirected Email,” and “Phishing Scam.” The breach affecting the largest number of individuals was reported by Blue Cross Blue Shield of Tennessee. There, a theft of hard drives resulted in breaches of unsecured PHI affecting half a million individuals.

Does the new rule apply to you?

It does if you’re a HIPAA-covered entity or business associate, including most health care providers, health plans and health care clearinghouses. Employers who act as sponsors of group health plans may also be covered entities, depending upon their level of involvement.

What is a breach?

A breach occurs when 1) there has been “unauthorized” access, use or disclosure of “unsecured” PHI that violates the rule and 2) the disclosure “compromises the security or privacy” of the PHI, which means that it “poses a significant risk of financial, reputational or other harm to the individual.”

“Unsecured” PHI is any information that has not been rendered unusable, unreadable or indecipherable to unauthorized individuals through the use of a technology such as encryption and destruction.

Encryption - Proper encryption should use an algorithmic process to transform data into a form that is meaningless without a confidential process or key (which also must be protected).

Destruction - Hard copy PHI, such as paper or film, needs to be thoroughly shredded or destroyed so that it cannot be read or reconstructed.

Beyond enhancing your data security efforts, you have a responsibility to:

=> notify individuals when their health information has been compromised
=> update your HIPAA policies and procedures
=> educate employees on new procedures

Cover all the bases with our HIPAA Forms CD-ROM and Poster Bundle. It includes all the HIPAA compliance materials you need - from an Employee Information Poster and HIPAA Privacy and Security Policy to a Breach Incident Log and other essential forms - to stay in compliance.

For additional direction with your compliance questions, go to HIPAA FAQs.

Life's a "breach" if you mishandle protected health information

New HIPAA Breach Notification Rules kick in today

With medical data breaches on the rise, the federal government is taking action to help stem the problem. The Department of Health and Human Services (HHS) recently issued new regulations requiring health care providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their protected health information (PHI) is breached. The HHS regulations came two days after the Federal Trade Commission (FTC) issued regulations outlining similar requirements for personal health record (PHR) vendors, PHR-related entities and third-party service providers.

“This new federal law ensures that covered entities and business associates are
accountable to the Department and to individuals for proper safeguarding of the
private information entrusted to their care. These protections will be a
cornerstone of maintaining consumer trust as we move forward with meaningful use
of electronic health records and electronic exchange of health information,”
said Robinsue Frohboese, Acting Director and Principal Deputy Director of OCR.
(HHS Press Release)

Under the new rules, businesses must immediately notify individuals of a breach, as well as the HHS (or the FTC) and the media when a breach affects more than 500 individuals. This new notice requirement is designed to help consumers make informed decisions when their health information is released to unauthorized users, while also prompting companies to enhance security. Businesses are also required to update their HIPAA policies and train employees on new procedures.

What is a breach?

A breach occurs when 1) there has been “unauthorized” access, use or disclosure of PHI, which violates the HIPAA Privacy Rule and 2) the disclosure “compromises the security or privacy” of the PHI, which means that it “poses a significant risk of financial, reputational or other harm to the individual.”

Let’s say, for example, your company sponsors a group health insurance plan and a laptop containing enrollment information constituting PHI is lost or stolen. You most likely would be required to notify the affected individuals. Or perhaps you operate a HIPAA-covered medical practice and a staff member impermissibly downloads patients’ PHI to his personal computer. Again, you would need to notify the affected patients.

The effective date of the new HIPAA Breach Notification Rules is today, September 23, 2009. However, HHS has stated it will not impose penalties until February 22, 2010.

New HIPAA Breach Notification Rules kick in today

New FMLA regulations, what employers need to know

The U.S. Department of Labor released the final regulations under the Family and Medical Leave Act (FMLA), clarifying employer and employee rights under the law. The new FMLA regulations were published in the Federal Register on November 17, 2008 and will take effect on January 16, 2009. New forms and posters reflecting the latest changes will be required for employers subject to the FMLA.

This is the first set of revisions to the FMLA regulations since its enactment in 1993 and will affect all employers that must adhere to FMLA guidelines. The final rule helps workers and employers better understand their responsibilities and will speed the implementation of a new law that expands FMLA coverage for military families.

"This final rule, for the first time, gives America's military families special job-protected leave rights to care for brave service men and women who are wounded or injured, and also helps families of members of the National Guard and Reserves manage their affairs when their service member is called up for active duty," said U.S. Secretary of Labor Elaine L. Chao in a recent press release. "At the same time, the final rule provides needed clarity about general FMLA rights and obligations for both workers and employers."

The final rule includes two notable benefits for some military families:

Military Caregiver Leave: Expands FMLA protections for family members caring for a covered service member with a serious injury or illness incurred in the line of duty on active duty. These family members are able to take up to 26 workweeks of leave in a 12-month period.

Leave for Qualifying Exigencies for Families of National Guard and Reserves: The law allows families of National Guard and Reserve personnel on active duty to take FMLA job-protected leave to manage their affairs — "qualifying exigencies." The rule defines "qualifying exigencies" as: (1) short-notice deployment (2) military events and related activities (3) childcare and school activities (4) financial and legal arrangements (5) counseling (6) rest and recuperation (7) post-deployment activities and (8) additional activities where the employer and employee agree to the leave.


Additional highlights from the new FMLA regulations:

Waiver of Rights: The department has finalized its position that employees may voluntarily settle their FMLA claims without court or departmental approval. However, prospective waivers of FMLA rights will continue to be prohibited.

Serious Health Condition: The new rule clarifies that if an employee is taking leave involving more than three consecutive calendar days of incapacity plus two visits to a health care provider, the two visits must occur within 30 days of the period of incapacity. Additionally, it defines "periodic visits to a health care provider" for chronic serious health conditions as at least two visits per year.

Light Duty: Time spent in "light duty" work does not count against an employee's FMLA leave entitlement, and the employee retains the right to job restoration during the light duty period.

Employer Notice Obligations: The final rule clarifies and strengthens the employer notice requirements to employees in order that employers will better inform employees about their FMLA rights and obligations, and allow for a smoother exchange of information between employers and employees.

Employee Notice: Under the new regulations, employees must follow their employer’s normal call-in procedures when taking FMLA leave. Under current rules, employees may notify their employer up to two days after an absence on their need for FMLA leave.

Medical Certification Process: The final rule recognizes the Health Insurance Portability and Accountability Act (HIPAA) and its impact on medical privacy. Responding to concerns about medical privacy, the new provisions prohibit direct supervisors from obtaining employee medical information for FMLA certification.


View the final rule as it appears in the Federal Register, here.

New forms and posters will be required for employers subject to FMLA guidelines. G.Neil’s top legal experts are working to provide you with the information and resources needed to stay in full FMLA compliance.

As of today, our legal team is developing a new E-Guide to explain the new FMLA rules in plain English. Check back regularly for the most up-to-date information to help you understand and take action on the latest legal requirements that affect your business.

Read our new Q & A reviewing the latest Family and Medical Leave Act Changes.

New FMLA regulations, what employers need to know

Don’t let patient records float away

The past several years have taught us that no building is safe from the wrath of Mother Nature ... not even a hospital. When your facility is threatened by a hurricane, flood, blizzard or tornado, the safety of your patients and staff is the number one priority.

Once arrangements are made for protecting the people, you need to protect the medical records. And while all businesses need to develop a plan to back up and safely store records, electronic files, and papers, the disaster preparedness needs for a medical facility are even more critical.

Critical and irreplaceable data – The paper and images stored in medical files and electronically are a matter of life and death to patients. When medical records are key to a diagnosis or treatment plan, missing records can dramatically affect the prognosis.

Confidentiality – Medical records are far more personal and private than any other type of business records. If these files abandoned, scattered or otherwise unprotected, patient privacy is unprotected as well.

Non-centralized storage and use – Medical records in a hospital do not stay in one place. At any given time, the records of a single patient could be in the lab, the floor nurses’ station, the surgical suite, and a dozen other places.


Preparing in advance to protect your patients

Start with the location

In many hospitals, the medical records are stored at the lowest level in the building. This puts them at the highest risk of destruction, whether from flood or building collapse. If possible, select a new location that is:

• Above flood level
• More likely to be accessible following building collapse. Basement locations are often completely inaccessible once filled with the material from the former building.
• Fireproof
• In an area with two or more access points. Single door rooms can quickly become blocked and inaccessible because of debris

Develop and practice a disaster preparedness drill and recovery process

Long before the first hurricane watch or blizzard alert is issued, your facility needs to have a thorough and tested disaster preparedness plan and disaster recovery plan.

• Designate a representative from each department or area of the hospital. Have them designate a backup in the same area.


• Have a meeting with the representatives to determine their data and file responsibilities.


• Develop a 72, 48 and 24 hour plan for each area in the hospital. Detail the steps personnel would take to gather and secure medical records. Be clear on who does what ... great procedures are of no use if everyone thinks someone else will do it!


• Test your procedures under a variety of possible situations ... full notice, as with a hurricane, short notice, and emergency evacuation. Make adjustments as needed.


• Develop a post disaster recovery plan for data bases, electronically stored records and paper records. Test this also under a variety of scenarios.


• Make sure the plan is:
  


• Understood
• Accessible
• Updated, as needed

Backup records electronically

Paper charts, lab reports, daily notes, and other hardcopy materials can be scanned directly into a centralized data base. Most radiological results are already in electronic format. Store the records onsite, and in a remote location far from your facility’s geographic location. Be sure your data base is secure ... HIPAA laws require you to protect confidentiality of records in all formats, even in a crisis.

Encourage virtual file checkout

Encourage the hospital staff to check out patient files virtually on a secure intranet. This allows the main paper files to remain in your secure area while doctors, therapists and other professionals use the files throughout the hospital. Not only does it protect your files from loss, it means that updates are instantaneous and accessible to all members of the medical team. Again, make sure HIPAA rules are followed in protecting patient information.

Disaster preparedness is not optional

Disaster preparedness and disaster recovery plans are critical to your hospital, and to the patients you serve. Make sure your facility is ready for anything.

Don’t let patient records float away

Friday HR Humor - HIPAA/HIPPA

HIPAA - One of the most misspelled acronyms in the HR vocabulary.

What it stands for (if you don’t know already): Health Insurance Portability and Accountability Act.

HIPAA or HIPPA? You say tomato, I say tomahto? Potato, potahto?

Instead of calling the whole thing off, here’s some ideas for what HIPPA could stand for:


For bureaucrats:

Help in Paper Proliferation Acceleration

Help Incompetents Push Paper Around


For cautious optimists:

Hopefully Inclusive Patient Protection Act


For realists:

Hopelessly Incomplete Patient Protection Act


For health care big business:

Healthy Individuals Push Profits Away


For the rest of us:

Hospitals Inspire Patently Pitiful Appetites

How is Paperwork Protecting Anybody

Hell’s Infernal Paperwork Proliferation Act

How Intelligent People Prevaricate Administratively

Friday HR Humor - HIPAA/HIPPA