There is a great post over at Infosec Island regarding a letter that was received from the Office of Civil Rights (OCR) after a data breach that occurred at a small medical practice. The breach was the result of a burglary. No details were given on what was stolen or what kind of patient information was obtained.
The post lists the following 11 items that were requested in the letter from OCR and states that the practice only had 21 days to respond.
1. Documentation of the covered entity’s admission, denial, or a statement indicating that the covered entity has obtained insufficient evidence to make a determination regarding the allegations.
2. Documentation of an internal investigation conducted by the covered entity in response to the allegations including a copy of the incident report prepared as a result of the laptop and server theft.
3. Documentation of the covered entity’s corrective action taken or plan for actions the covered entity will take to prevent this type of incident from happening in the future, including documentation specifically addressing, if applicable:
a. sanctioning of the workforce member(s) who violated the Privacy and Security Rules, in accordance with the covered entity’s current policies and procedures, and as required by the Privacy Rule.
b. re-training of appropriate workforce members.
c. mitigation of the harm alleged, as required by the Privacy Rule.
4. A copy of your HIPAA policies and procedures related to the disclosure of and safeguarding of PHI and specifically EPHI.
5. A copy of the policies and procedures implemented to safeguard the CE’s facility and equipment.
6. Evidence of physical safeguards implemented for computing devices to restrict access to PHI.
7. A copy of the most recent risk assessment performed by or for the CE, per Security Rule requirements.
8. Evidence of security awareness training for involved workforce members including training on workstation security.
9. Evidence of the implementation of a mechanism to encrypt EPHI stored on the workstations.
10. A copy of the written notification of the breach provided to the affected individuals.
11. A copy of the written notification given to the media. This should include a list of all media sources to whom this notification was given and any media reports (news stories or articles) stemming from this notification.
The first take away from this is that OCR is asking for a lot of information in a very short period of time. 21 days to provide this information is not enough time if the practice didn’t have all of this documentation in place already. And maybe that is the point, the short period of time to respond does not give an organization time to scrabble and put this together and say it was in place prior to the breach.
The second take away is that OCR clearly wants to see written documentation that you have a security program in place to protect patient information and are in compliance with the HIPAA regulations.
Items #4 and #5 clearly states that they want to see written policies and procedures on how an organization is protecting patient information. Unless you have gone through the exercise of preparing the policies and procedures, I doubt that telling them you discussed these with your staff but haven’t documented them will carry much weight.
Item #7 clearly states that they want evidence that you have performed a Risk Assessment on how you are protecting patient information. A Risk Assessment is required under the HIPAA Security rule and will identify areas where an organization needs to focus on to better protect patient information. Not having a Risk Assessment will make it very difficult to defend yourself and prove that you have taken HIPAA Security regulations and protecting patient information seriously.
Item #8 addresses providing evidence that each of an organization’s workforce have received HIPAA Security training. Again this seems to be looking for documented proof that each workforce member has been trained. If you do not have a formalized training program, saying you discussed training in staff meetings might not be sufficient especially when they are looking for formal documentation.
Item #9 is very interesting because it is asking for documentation addressing the encryption of information on workstations. Encryption is an addressable implementation specification in the HIPAA Security Rule. OCR wants to see how the organization has implemented this specification. Remember, an addressable implementation specification is not optional and documentation must exist on how an organization has or has not implemented the specification. For example, an organization might require laptops to be encrypted but data at rest on servers or desktops does not need to be encrypted. The take away is that you need to document how you have or have not implemented encryption along with reasons to support your decisions.
Items #10 and #11 address how an organization has prepared itself for a security breach and how it has responded to the current security breach. The Breach Notification Rule as defined in the HITECH Act states that an organization has to issue a notification to affected individuals within 60 days of discovery of a breach. Below is more information from the HHS website:
These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include, to the extent possible, a description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity. Additionally, for substitute notice provided via web posting or major print or broadcast media, the notification must include a toll-free number for individuals to contact the covered entity to determine if their protected health information was involved in the breach.
All in all this insight into what to expect from OCR if your organization experiences a data breach should make you very apprehensive. If you do not have these items in place prior to a breach it will cast a very negative light on your security program. If you cannot provide the written documentation for the 11 items that they are requesting, there is a chance that OCR will determine that you are in violation of “Willful Neglect” of the HIPAA Regulations. Fines associated with “Willful Neglect” are substantially more expensive and carry a penalty of $50,000 per violation, with an annual maximum of $1.5 million.
The time to worry about complying with HIPAA security is before a data breach and not after. OCR has made it clear of what they will demand from an organization. If you do not have these items in place, NOW is the time to act!