# Presentation: 111827

## HIPAA 101: Basic HIPAA Privacy and SecuritySusan McAndrewSenior Privacy Policy AdvisorJune 9, 2005

**Notes:**
Great to be with you here at the HIPAA Summit West
Sorry I couldn’t be with you in person.  You’ll be glad to know I am not tied to my desk because we’ve received an unanticipated flood of Privacy Rule complaints. –
 in fact, as we’ll discuss, the number and nature of the complaints we have received are well within our expectations.
Some 6 weeks out from the April 14 compliance date, we are generally finding that covered entities and consumers are settling in, and that misconceptions are dissolving.  That’s because of
Good events like this conference that continue to get the word out
Extensive guidance and technical assistance that we keep adding to:  more about that later
Countless press interviews that help us address misconceptions.
Speaking of these misconceptions, it seems that HIPAA is getting the blame for a lot of things that we have nothing to do with.  For instance:
HIPAA is not pro-divorce.   Urgent report that a hospital told a wife that because of HIPAA, she couldn’t visit her husband. Of course, HIPAA doesn’t affect hospital visitation rules– so we told them to check back.  Word filtered back that it wasn’t HIPAA or the Hospital, but maybe the husband, who was limiting the visit!)
HIPAA is not anti-religion!  Clergy newsletters and even in a sermon, clergy said they couldn’t visit patients.  Now I know most clergy are overworked, so I hope its good news that as far as HIPAA is concerned, as long as patients don’t object, their info (including religious affiliation) can be listed in the patient directory. 	
Now that those are cleared up, let me turn to today’s topic:  compliance and enforcement with the Privacy Rule.  I’m going to start out with a description of our approach to compliance, an update on where we are, and talk about some technical aspects of the Rule.

## Legislative History

- Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- Subtitle F--Administrative Simplification
- Encourage development of (electronic) health information technologies (transactions)
- Easier information sharing—security and privacy

- HHS/OCR June  2005

## HIPAA in HHS

- OCR (with respect to the Privacy Rule	):
- Sets Policy through Regulations
- Promotes Voluntary Compliance
- Investigates and Resolves Complaints
- CMS/OESS (other Admin. Simp. Rules):
-  Security Rule
- Transactions and Code Sets
- Provider and Plan Identifiers

- HHS/OCR June  2005

**Notes:**
First, a word about OCR, which is responsible for Privacy Rule compliance and enforcement
OCR is responsible for enforcing some 20 civil rights laws, mostly with respect to the obligations of recipients of federal financial assistance made available through the department of health and human services.
We have 10 regional offices, with experienced staff nationwide who work with recipients to ensure compliance with the various laws we are responsible for.
With respect to the Privacy Rule, our responsibilities fall into three primary categories:
Promoting voluntary compliance:  more about this important concept in a second.
Investigating and resolving compliants alleging violation of the Privacy Rule
Issuing “exception determinations:”  Let me pause a say a bit about that here.  HIPAA and the privacy rule provide that, in certain circumstances where  state law is “contrary” to the Privacy Rule, and would be preempted by it, then the Secretary can issue a determination that would avoid preemption of the state law.  This can only happen where certain criteria are met, and where the law is actually contrary to the Privacy Rule– not just different from it.  We have a series of Q&A on exception determinations on our website which are helpful in this regard.
As I said earlier, and as we have repeatedly emphasized, our approach to compliance and enforcement starts with voluntary compliance.  [next slide]

## Who is Covered?

- Limited by HIPAA to:
- Health care providers who transmit health information electronically in connection with a transaction for which there is a HIPAA standard
- Health plans
- Health care clearinghouses
- Business associate relationships

- HHS/OCR June  2005

## Business Associates

- Agents, contractors, others hired to do work of or for covered entity that requires use or disclosure of protected health information
- Require satisfactory assurance – usually a contract – that a business associate will safeguard protected health information, limit use and disclosure

- HHS/OCR June  2005

## HIPAA and Preemption

- “Federal Floor” of Privacy Protections
- Federal Standards Preempt Contrary State Law
- Except:
- More stringent privacy requirements
- Public health reporting
- Health plan reporting for audit/oversight
- Secretarial exception determination

- HHS/OCR June  2005

## Privacy Rule Overview

- Balance – Provide Strong Privacy Protections that Do Not Impede Access to Quality Health Care
- Individual Rights
- Limits Uses and Disclosures of PHI
- Recourse for Violations

- HHS/OCR June  2005

## Privacy Rights

- Notice of Privacy Practices
- Access
- Amendment
- Accounting
- Request Restrictions
- Complaints

- HHS/OCR June  2005

## Limited Uses and Disclosures

- Covered Entity may only Use or Disclose PHI as Permitted or Required by Privacy Rule
- Covered Entity must make reasonable efforts to use or disclose only Minimum Necessary
- Protected health information (PHI)
- Individually identifiable health information
- Transmitted or maintained in any form or medium by a Covered Entity or its Business Associate

- HHS/OCR June  2005

## Permitted Uses and Disclosures

**Individual**
**Treatment, Payment and Health Care Operations (TPO) **
**Opportunity to Agree or Object**

**Public policy**
**“****Incident to”**
**Authorized**

- HHS/OCR June  2005

## Treatment, Payment and Health Care Operations (TPO)

- Covered Entity may use/disclose PHI to carry out essential health care functions
- Treatment
- Payment
- Health care operations

- HHS/OCR June  2005

## Public Policy Purposes

**As required by law **
**For public health**
**To report victims of abuse, neglect or domestic violence **
**For health oversight activities**
**For judicial & administrative proceedings**
**For law enforcement purposes**

**About decedents (to coroners, medical examiners, funeral directors)**
**For cadaveric organ, eye or tissue donations**
**For research purposes **
**To avert a serious threat to health or safety**
**For specialized government functions (military, veterans, national security, protective services, correctional institutions)**
**For workers’ compensation**

- HHS/OCR June  2005

## Uses and Disclosures: Public Health

- To a public health authority
- to collect/receive info for preventing/controlling disease, injury, or disability
- To report child abuse/neglect
- To a person subject to the jurisdiction of the FDA
- for adverse event and other reporting related to the quality, safety or effectiveness of FDA-regulated products or activities
- To a person exposed to a communicable disease
- To an employer
- for medical surveillance of the workplace or work-related illness or injury

- HHS/OCR June  2005

## Uses and Disclosures: Research

- PHI can be used for research without individual authorization, as follows:
- If there is documentation of a waiver of authorization by a privacy board or IRB
- For reviews preparatory to research (e.g., to prepare a research protocol)
- For research on decedent’s information
- PHI also can be used for research with individual’s authorization
- PHI (without direct identifiers) can be used for research with a data use agreement

- HHS/OCR June  2005

## Authorized Uses and Disclosures

- Authorizations required for uses and disclosures not otherwise permitted or required by the Privacy Rule:
- Most Marketing
- Special Rules for Psychotherapy Notes

- HHS/OCR June  2005

## Investigations & Compliance Reviews

- OCR may investigate complaints
- OCR may conduct compliance reviews to determine whether Covered Entities are in compliance

- HHS/OCR June  2005

**Notes:**
As we have said before, our process will be complaint, or “event” driven. 

By and large, we intend to respond to allegations of complaints filed with our office, rather than engaging in routine compliance reviews.  

However, we can and will respond to any report of a serious violation of the privacy rule; and remember that any person can file a complaint.  That’s why we might say that our approach will be “event driven”– either by filing a complaint, or by a report of a serious violation of privacy.

It is very likely that we will receive a complaint from some source if a serious privacy violation occurs. 
	-- In fact, among the allegations we have currently received are allegations from persons who work for covered entities and believe violations have occurred, rather than from the persons whose privacy rights may not have been protected.
[next slide]

## Status of Complaints      (Through May 31, 2005)

- 13,168 logged in nationally, 65% already closed
- Most common closure reasons:
- Non-jurisdictional (Not Covered Entity or Violation alleged predated 4/14/2003)
- Allegation not prohibited by the Privacy Rule
- Matter was resolved through voluntary compliance and technical assistance

**     **

- HHS/OCR June  2005

## Entities Most Complained Against (as of 5/31/2005)

- Private Practices
- General Hospitals
- Pharmacies
- Outpatient Facilities
- Group Health Plans

- HHS/OCR June  2005

## Common Allegations (through May 31, 2005)

- Impermissible Uses/Disclosures
- Inadequate safeguards
- Access to records denied or charged excessive fees
- Failure to adhere to minimum necessary procedures
- Failure to obtain a valid authorization where one is required

- HHS/OCR June  2005

## Why Voluntary Compliance?

- Promoted by HIPAA statute and Privacy Rule
- Education, Cooperation, Technical Assistance
- Permitted even after investigation commences
- Can help mitigate CMPs
- Most efficient way to promote privacy

- HHS/OCR June  2005

**Notes:**
That is because 
1.  HIPAA and the Privacy Rule expressly call for the Department to promote it, 
	--education. etc
	-- permitted after investigation commences
	-- can help mitigate damages
2.  But also because Voluntary compliance is simply the most efficient way to accomplish our goal, and the goal of the HIPAA privacy rule:
	-- Protect the privacy of patient information
	-- permit continued, efficient access to quality 			healthcare. 	
The Office for Civil Rights long experience in compliance and enforcement, with respect to our other authorities, tells us that the most efficient way to accomplish our purposes is where we can work with covered entities  that want to efficiently resolve a complaint.  
Of course, the statute also provides for the imposition of civil money penalties by HHS, and even criminal penalties, where appropriate, by DOJ, and if necessary, we can resort to those remedies as well to protect patient privacy.  
We’ve been working hard to promote voluntary compliance, and those efforts are continuing, and will continue, even now that the compliance date has passed: [next slide]

## Civil Monetary Penalties (CMPs)

- CMPs can be imposed by OCR:
- $100 per violation
- Capped at $25,000 for each calendar year for each identical requirement or prohibition that is violated
- Covered Entity has a right to notice and a hearing before a CMP becomes final

- HHS/OCR June  2005

## Criminal Penalties for Wrongful Disclosures

- For knowingly obtaining or disclosing identifiable health information relating to an individual in violation of the Rule:
- Up to $50,000 & 1 year imprisonment
- Up to $100,000 & 5 years if done under false pretenses
- Up to  $250,000 & 10 years if intent to sell, transfer, or use for commercial advantage, personal gain or malicious harm
- Enforced by DOJ

- HHS/OCR June  2005

## E-Privacy

- President/Secretary Commitment to HIT to Improve Quality of Care Includes Privacy and Security of Patient Information
- Initiatives Must Comply with HIPAA Requirements for Privacy
- Initiatives May Present New Opportunities to Facilitate Individuals’ Rights and Privacy Protections

- HHS/OCR June  2005

## More Information

- _[www.hhs.gov/ocr/hipaa](http://www.hhs.gov/ocr/hipaa/)__[/](http://www.hhs.gov/ocr/hipaa/)_
- OCR Privacy Toll Free Number:
- (866) 627-7748

- HHS/OCR June  2005

**Notes:**
Summing up on where we are:

Voluntary compliance efforts (yours and ours) have paid off well.
More guidance is continuing to be issued, and will be made available.
We are processing complaints, and the numbers and types of complaints are reasonable
The Interim final enforcement rule just issued, and the integrated procedural and substantive rule we eventually intend to issue, will assist covered entities in understanding how compliance will proceed. 
These rules are important and signal our continued efforts to efficiently and fairly promote compliance with the Privacy Rule; and they are completely consistent with our approach to promote voluntary compliance wherever possible, as a means of effectuating our two goals:
Protecting patient health information, and 
Permitting continued, efficient access to quality healthcare.

      Questions?