Source: https://www.wisbar.org/NewsPublications/WisconsinLawyer/Pages/Article.aspx?ArticleID=11017
Timestamp: 2019-04-25 11:05:30+00:00

Document:
Not only lawyers who concentrate on health care law but also many lawyers whose work merely brings them in contact with health information must understand and be ready to help clients work with new HIPAA regulations that rigorously affect privacy of such information. The new regulations are effective Sept. 22, 2013.
Do you provide legal services to health care providers, health insurers, or health care clearinghouses? Do your clients support health care entities? In the course of representation, do you use, disclose, create, access, transmit, or maintain health information? If so, keep reading. You may now be subject to expanded liability under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), and these acts’ implementing regulations.
It is important for lawyers1 to take note of the new changes to the HIPAA landscape, even lawyers who generally practice outside of the health law field. Lawyers in many areas – labor and employment, litigation, corporate, banking – may be subject to new, expanded liability as a result of the recently released omnibus final rule.
On Jan. 25, 2013, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) published the omnibus final rule to implement changes to the HIPAA privacy, security, and breach notification rules (Omnibus Rule).2 The Omnibus Rule was highly anticipated and an exciting read for lawyers who focus on health law and privacy law, but the rule landed largely unnoticed by many lawyers in other practice areas. This article will help any attorney who deals with health information understand the new changes and what the changes might mean for his or her law practice.
Meghan O’Connor, Marquette 2010, is a member of the health care and government and regulatory law sections at von Briesen & Roper S.C., Milwaukee. Her practice focuses on regulatory compliance, HIPAA, and other federal and state privacy law, managed care and provider contracting, general corporate, business transactions, and risk management. She previously worked for the U.S. Department of Health and Human Services, Centers for Medicare and Medicaid Services.
com dwelsh vonbriesen Diane M. Welsh, American Univ. 1998, is a shareholder at von Briesen & Roper S.C., Madison. Her practice includes litigation, health care, government law, regulatory matters, and crisis management. She focuses, in part, on HIPAA and other federal and state privacy laws. She previously was chief legal counsel for the Wisconsin Department of Health Services and an assistant attorney general at the Wisconsin Department of Justice.
Although the HITECH Act required lawyers to comply with several privacy and security requirements beginning in 2009, the Omnibus Rule’s expanded liability has increased the scope of requirements for lawyers and the probability of enforcement by the federal government.
Because the Omnibus Rule includes significant changes and consequences for business associates, the question of whether a lawyer is a business associate is crucial to the scope of privacy and security compliance requirements.
The Omnibus Rule expands the definition of a business associate to include persons or entities – other than members of the covered entity’s workforce – who create, receive, maintain, or transmit health information on behalf of a covered entity. The Omnibus Rule also expressly revised the definition of business associate to include subcontractors of business associates (more on subcontractors below). See Figure 2: Are You a Business Associate?
Lawyers who work for or on behalf of a covered entity or business associate, and who use health information to perform that work, fall squarely within that definition. The Omnibus Rule establishes that a person or organization becomes a business associate by definition, not by the act of executing a BA agreement with a covered entity.7 This means that lawyers are not immune from HIPAA business-associate liability even if they have failed to enter into BA agreements with their clients.
In other words, if an attorney represents a covered entity, and the work requires access to health information, the attorney is a business associate.
Not all lawyers who use health information are covered by HIPAA. Notably, a lawyer is not acting as a HIPAA-covered business associate or subcontractor when the lawyer is representing an individual or organization that is neither a HIPAA-covered entity nor a business associate – even if the lawyer is using health information. For example, a family-law practitioner, employment attorney, or defense attorney might need to access, use, or disclose health information. The health information will likely be accessed by way of an authorization form, the statutory provision that allows for use of health records for worker’s compensation matters,8 or court order.
and that identifies the individual, or for which there is a reasonable basis to believe, can be used to identify the individual.
See 45 C.F.R. §§ 160.103, 164.514.
If the lawyer is not acting as a business associate of a covered entity or another business associate, then the OCR would not have enforcement authority over the attorney for HIPAA compliance. Nonetheless, lawyers should be knowledgeable about HIPAA requirements for accessing and protecting health information. Moreover, Wis. Stat. sections 51.30 and 146.82 create legal obligations to properly use and limit disclosure of any health information received during the course of representation.
What are the Obligations of a Business Associate?
Lawyers who fit within the definition of a business associate must meet requirements of the HIPAA rules, including certain privacy, security, and breach-notification rule requirements. Significant requirements and considerations for lawyers and law firms are discussed below.
In the legal field, considerations include, for example, whether 1) document-management programs can limit the searchable nature of and access to records containing health information once matters have been closed; and 2) documents containing health information from an old matter are used as templates in unrelated matters.
Tracking and Monitoring Data. Lawyers must be able to provide covered-entity and business-associate clients with a full list of the uses and disclosures of health information if the uses or disclosures were made 1) beyond the scope of the patient’s authorization (if applicable); or 2) for a purpose other than the health-care-entity client’s payment or health-care-operations activities.17 Lawyers should ensure that their staff and systems can track each disclosure.
Breaches can lead to serious consequences, including investigation, fines, mitigation costs, and reputational harm. Covered entities must notify the U.S. Department of Health and Human Services (HHS) of any breach of unsecured health information (including by a business associate). The covered entity also must report to the media breaches involving more than 500 individuals.
Return, Destroy, or Maintain Health Information. When the business-associate relationship between lawyers and covered entities ends, lawyers must return or destroy all health information received by the lawyer (and any of its subcontractors) from or on behalf of the covered entity.25 If returning or destroying health information is not feasible – which is often true for lawyers – lawyers must extend HIPAA protections of the health information for so long as the lawyer maintains the health information.26 Consequently, lawyers should be prepared to maintain privacy and security protections indefinitely or for as long as health information is maintained.
Lawyers who are business associates face new risks, including the OCR’s new mandatory investigatory authority and direct enforcement authority over business associates, the potential for criminal and civil money penalties, and public relations considerations.
If the OCR determines there has been a violation of HIPAA, the OCR is now permitted to resolve the matter through an informal process or move directly to a formal process, including the imposition of penalties, without first exhausting informal resolution efforts.29 These penalties can be significant.30 Penalties may be imposed regardless of whether a BA agreement is in place.31 See Figure 3: Penalties of HIPAA Violations.
Lawyers should consider the reputational harm that would likely result from a HIPAA violation or enforcement action. Health care entities take their responsibility to safeguard health information very seriously. A breach by an entity’s lawyer will also implicate the covered entity through the required notice to the HHS and affected individuals. Moreover, breaches of health care information often are well publicized in trade publications and the popular press.
Fortunately, protecting the privacy of information is something that lawyers have been trained to do. And, the obligation to maintain the privacy and security of health information is consistent with a lawyer’s obligation to maintain the confidentiality of information relating to the representation of a client under Wisconsin Supreme Court Rule (SCR) 20:1.6.32 However, the responsibilities under HIPAA are broader and more proscriptive than those of SCR 20:1.6.
If a firm has determined that it is a business associate covered by HIPAA, then the firm should start by determining if it is able to comply with the HIPAA privacy and security rules. The firm should conduct a gap analysis, comparing the rules against the firm’s current policies, procedures, and practices.
The analysis should include an assessment of the firm’s security compliance capabilities, examining its technical, administrative, and physical safeguards. Review whether the IT department (or contractor) is up to snuff and able to help ensure compliance. The firm should also assess its capabilities to use encryption and de-identification to protect health information.
Existing BA agreements between law firms and clients or subcontractors must be updated and compliant with Omnibus Rule provisions by Sept. 22, 2014.34 For firms that do not currently have BA agreements with covered-entity and business-associate clients and subcontractors, new BA agreements should be put in place now. Compliance with new requirements is necessary by Sept. 22, 2013.
Create or update HIPAA compliance plans, policies, and procedures. Areas covered should include IT, privacy, security, access, and breach notification policies and procedures.
Develop a team that can appropriately respond to breaches and security incidents.
State Bar members can comment on the article in the box at the bottom of the page. If you haven't already, login and join the conversation.
Any lawyer who works with health information should take proactive steps to remain in – or come into – compliance with HIPAA. Doing so will be an expectation of your clients and will help prevent unintentional breaches. These steps will also protect lawyers against enforcement actions, negative audit findings, or damage to professional reputations.
Because of the general nature of this article, the information provided may not be applicable to all situations and should not be acted on without specific legal advice based on particular circumstances.
1 We use the terms “lawyers” and “law firms” throughout this article. These terms apply to lawyers in any size practice, from solo practitioner to large firm, as well as governmental legal offices. Under the Omnibus Rule, any person, including a natural person, partnership, corporation, or other entity, public or private, may be a business associate under HIPAA. See 78 Fed. Reg. 5598 (Jan. 25, 2013).
2 The full name of the Omnibus Rule is: Modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules. 78 Fed. Reg. 5566 (Jan. 25, 2013). The Omnibus Rule took effect on March 26, 2013, and the compliance date is Sept. 23, 2013, when covered entities and business associates must be in compliance with a majority of the Omnibus Rule provisions.
3 See, e.g., 45 C.F.R. §164.502 (general rules on use and disclosure of PHI); see 45 C.F.R. §160.103 (definitions of covered entity, business associate, and protected health information).
4 See 45 C.F.R. § 164.504(e).
5 A subcontractor is a person or entity to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate. 45 C.F.R. § 160.103.
6 See 78 Fed. Reg. 5573, 5589, 5591, 5598, 5601.
7 See 78 Fed. Reg. 5599.
8 Worker’s compensation matters fall under Wis. Stat. sections 102.13(2)(a) and 102.33. When an employee files a worker’s compensation claim, the employee waives provider-patient privilege with regard to health information (that is, any condition or complaint) reasonably related to the condition for which the employee is claiming compensation. This waiver of provider-patient privilege includes health information subject to protections of Wis. Stat. sections 51.30 and 146.82, but only to the extent such health information is related to the condition for which the employee is claiming compensation. Despite waiving provider-patient privilege, the employee does not waive HIPAA requirements. This means that, among other requirements, when handling a worker’s compensation matter, attorneys should expect that they will have access to only the information related to the worker’s compensation claim.
9 See, e.g., 45 C.F.R. §§ 164.502, 164.506, 164.508, 164.510, 164.512, 164.514.
10 45 C.F.R. § 164.502(b).
11 45 C.F.R. §§ 164.308(a)(5), 164.530(b).
12 45 C.F.R. §§ 164.306(a), 164.308, 164.310, 164.312.
13 45 C.F.R. § 164.308(a)(1)(ii)(A)-(B).
14 45 C.F.R. §§ 164.304, 164.312(2)(iv); 78 Fed. Reg. 5671, 5682, 5644. The OCR has outlined its interest in encryption several times. According to OCR director Leon Rodriguez, “Encryption is an easy method for making lost information unusable, unreadable and undecipherable.” Press Release, U.S. Department of Health & Human Services, HHS announces first HIPAA breach settlement involving less than 500 patients (Jan. 2, 2013), available at www.hhs.gov/news/press/2013pres/01/20130102a.html.
15 45 C.F.R. § 164.316.
16 45 C.F.R. §§ 164.308(a)(2), 164.530(a)(1).
17 45 C.F.R. § 164.528.
18 An acquisition, access, use, or disclosure of protected health information in a manner not permitted under the HIPAA privacy rule (45 C.F.R. pt. E) and that compromises the security or privacy of the PHI is presumed to be a breach unless the entity can demonstrate a low probability that the PHI was compromised. See 45 C.F.R. § 164.402. To determine whether the security or privacy of the PHI has been compromised, the Omnibus Rule requires an assessment of a minimum of four factors outlined in 45 C.F.R. section 164.402. See also 45 C.F.R. § 164.410 (business associate breach notification requirements).
19 A security incident is an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. 45 C.F.R. § 164.304.
20 See 45 C.F.R. §§ 164.410, 164.503(f).
21 45 C.F.R. § 160.402(c); see 78 Fed. Reg. 5572-73, 5598, 5677.
22 78 Fed. Reg. 5581.
23 For a discussion of a shredding company, see 78 Fed. Reg. 5573.
24 See 45 C.F.R. §§ 164.504(e)(2)(ii)(B)-(D), 164.504(e)(2)(ii)(H); see also 78 Fed. Reg. 5600.
25 45 C.F.R. § 164.504(e)(2)(i)(J).
27 45 C.F.R. § 160.308; 78 Fed. Reg. 5578.
28 45 C.F.R. § 160.306(c)(1); 78 Fed. Reg. 5578.
29 45 C.F.R. § 160.302(a); 78 Fed. Reg. 5578.
30 45 C.F.R. § 160.404. See 78 Fed. Reg. 5583-86 for a discussion of how violations are calculated and the factors considered in determining the amount of CMPs. See also 42 U.S.C. § 1320d-6 for criminal penalties.
31 78 Fed. Reg. 5599.
33 See 78 Fed. Reg. 5601.
34 However, if the scope of engagement between the firm and covered entity or business associate clients changes before Sept. 22, 2014, an updated BA agreement must be put into place with the new engagement letter.

References: §164
 §160
 § 164
 § 160
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 160
 § 164
 § 160
 § 160
 § 160
 § 160
 § 1320