HIPAA Privacy, Security, Enforcement, and Breach Notification Standards
Released: 2015-04-17T00:00:00

Introduction to the HIPAA Administrative Simplification Standards

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 was enacted to improve the availability and continuity of health insurance coverage; promote long-term care insurance and the use of health savings accounts; and combat waste, fraud, and abuse, particularly in Medicare and Medicaid. Many of those provisions have since been expanded and superseded by other laws, most notably by the Patient Protection and Affordable Care Act (ACA).

HIPAA also included a series of requirements under the subtitle "Administrative Simplification" to promote electronic record-keeping and claims processing in the health care system and to protect the privacy of electronic health information. The Secretary of Health and Human Services (HHS) was instructed to adopt electronic format and data standards for certain administrative and financial transactions that occur routinely between health care providers and payers (e.g., patient eligibility, claims processing), and list the code sets that must be used in these electronic transactions to identify specific diagnoses and clinical procedures. The Secretary also was directed to adopt unique identifiers (ID numbers) for health care providers, health plans, and employers for use in standard electronic transactions. Finally, the Secretary was required to adopt security standards—administrative, physical, and technical safeguards—to ensure the integrity and confidentiality of electronic health information and protect it against unauthorized access, use, or disclosure.

HIPAA specified that the Administrative Simplification standards apply to the following three types of entities, collectively referred to as covered entities: (1) health plans, (2) health care clearinghouses, and (3) health care providers.

Health Information Privacy

At the end of the Administrative Simplification subtitle, lawmakers added language instructing the HHS Secretary to submit to Congress within 12 months of the law's enactment detailed recommendations for standards to protect the privacy of individually identifiable health information. The recommendations were to address patient privacy rights, procedures for exercising those rights, and uses and disclosures of patient information that should be authorized or required. Lawmakers also included a three-year deadline for enacting health privacy legislation. If Congress and the President were unable to enact such legislation by the deadline, the Secretary was instructed by regulation to adopt privacy standards based on the recommendations. HIPAA stipulated that the standards would not preempt (i.e., supersede) state health privacy laws that are more protective of medical information.

On September 11, 1997, the Secretary submitted to Congress a framework and set of recommendations for health privacy legislation (see text box). Several legislative proposals were introduced and debated, but lawmakers could not reach agreement and were unable to meet the deadline (i.e., August 21, 1999) they had set for themselves to enact legislation. Consequently, the Secretary proposed and finalized a set of health privacy standards by regulation.

The HIPAA Privacy Rule was published by the Clinton Administration in December 2000 and modified by the Bush Administration in August 2002. The compliance deadline for most covered entities was April 14, 2003. A companion Security Rule, composed of a set of standards to safeguard health information from unauthorized access, use, or disclosure, was published in February 2003, with a compliance deadline for most covered entities of April 20, 2005.

The HHS Office for Civil Rights (OCR) administers and enforces the Privacy and Security Rules. HIPAA established civil monetary penalties for failure to comply with the Administrative Simplification standards, including the privacy and security standards. It also created criminal penalties for certain instances involving the wrongful acquisition or disclosure of individually identifiable health information in violation of the standards. OCR refers such cases to the Department of Justice (DOJ) for criminal prosecution. OCR maintains an extensive website with information on the HIPAA privacy and security standards, including information on compliance and enforcement activities.

HHS finalized a HIPAA Enforcement Rule in February 2006. The rule addressed the investigation of noncompliance with the Administrative Simplification standards and the imposition of civil monetary penalties. It covered the investigation process, bases for liability, determination of the penalty amount, grounds for a waiver, conduct of hearings, and the appeals process.

Concerns About the HIPAA Privacy and Security Standards

The Privacy and Security Rules have been contentious and the subject of ongoing debate since they were first implemented. Privacy advocates have complained about the limited scope of the rules. HIPAA applies all the Administrative Simplification standards to three entities—health plans, health care clearinghouses, and health care providers—but personal health information is handled by many other types of organizations that are not covered under the law. In an effort to address this issue, HHS took steps when it promulgated the Privacy and Security Rules to broaden their scope so that they apply to the business associates of HIPAA-covered entities. These actions were further strengthened by Congress in subsequent legislative action (discussed later in this report) to expand the HIPAA standards.

Another key concern is whether the Privacy Rule strikes the right balance between protecting individual privacy and supporting important societal goals. The Secretary's 1997 recommendations recognized the importance of balancing the privacy rights of individuals and the amount of control they have over the use and disclosure of their health information, with the need to permit health information to be used not just for routine health care activities (e.g., treatment and payment) but also for other purposes related to health care that are in the public interest (e.g., oversight, research, law enforcement, public health and safety).

Researchers, in particular, have criticized the Privacy Rule. They claim its privacy protections are unnecessarily impeding their access to and use of health information. These concerns, some of which have been addressed administratively by HHS, are part of a broader set of challenges posed by the rapid digitization of medical information. Since 2009, the federal government has spent over $30 billion to promote the adoption of electronic health records (EHRs) and the development of an infrastructure that allows providers, patients, and other stakeholders to share electronic health information in ways that improve health care quality and outcomes. But in order to realize the full value of EHR use, researchers need to be able to access and analyze clinical data from patient records to identify best practices, and then share those findings with others to create a learning health care system.

To ensure public trust in the analytic uses of health data for learning purposes, patient privacy concerns must be effectively addressed. A lack of trust in the privacy of medical information can have important implications for both individual and population health. Surveys show that individuals may avoid needed care, withhold information from providers, or lie about their medical conditions if they are concerned about the privacy and security of their health information.

The HIPAA privacy standards were developed in the late 1990s, when most medical information was still paper-based. While many privacy advocates view the Privacy Rule as a good start, one that creates a foundation of privacy protections, they are concerned that the rule does not sufficiently protect digital health information maintained and exchanged by EHR systems.

Implementation of the Privacy Rule continues to challenge covered entities. The rule is complex and seeks largely to preserve the traditional right of health care providers to exercise discretion and professional judgment in deciding whether and how to use or disclose patient information. Providers who are unsure of the rule's requirements, and who perhaps have been warned of the potential penalties for violating it, will sometimes err on the side of caution. They will refuse to disclose health information in an otherwise routine situation—for example, to a family member who calls inquiring about a hospital inpatient—claiming (incorrectly) that the disclosure is prohibited by HIPAA. In fact, the Privacy Rule accommodates such routine circumstances and neither requires nor prohibits the provider from using or disclosing health information. Instead, the rule leaves that decision up to the provider.

The growing number of breaches of electronic health data also has led to renewed criticism of the Security Rule, whose standards are intended to protect electronic information when stored in place and during transmission from one location to another. The standards are technology-neutral and scalable, based on the size and complexity of the organization. HIPAA-covered entities have considerable latitude in how they implement them.

Congress addressed some of the concerns about the Privacy and Security Rules in the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. The HITECH Act expanded and strengthened the privacy and security standards, principally by addressing enforcement of the standards and by establishing a breach notification requirement. The Genetic Information Nondiscrimination Act (GINA) of 2008 also amended the Privacy Rule. In addition, HHS has made other changes through administrative (non-statutory) action.

Report Roadmap

This report is intended to introduce the reader to the HIPAA Privacy and Security Rules, and the accompanying enforcement and breach notification requirements. It begins with an overview of each rule as it was originally promulgated. Those sections are followed by a discussion of the HITECH Act and other significant modifications that have been made. A list of all the HIPAA Administrative Simplification standards and their location in the Code of Federal Regulations (CFR) is provided in the Appendix .

An Overview of the HIPAA Privacy Standards

The HIPAA Privacy Rule established a set of federal standards for the protection of personal health information. First, it required covered entities (i.e., health plans, health care clearinghouses, and health care providers that conduct HIPAA electronic transactions) to put in place safeguards to protect health information from unauthorized access, use, or disclosure. Second, it described the circumstances under which covered entities are permitted to use or disclose an individual's health information. Finally, the rule gave individuals certain rights with respect to their health information. Those rights include the right of access to inspect and obtain a copy of their medical information, the right to amend inaccurate or incomplete information, and the right to an accounting of certain types of disclosures of the information.

The Privacy Rule covers "protected health information" (PHI) that is created or received by a covered entity. PHI is broadly defined as individually identifiable information in any form or format—oral, paper-based, electronic—that "[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual."

The rule includes a de-identification standard. Health information is de-identified if 18 specified types of identifiers are removed, or if a qualified statistician, using accepted principles, determines that the re-identification risk is very small. De-identified information that meets this standard is not subject to the rule and may be used or disclosed by covered entities without regard to the rule's requirements.

General Requirements for Use and Disclosure

In the broadest sense, the Privacy Rule prohibits a covered entity from using or disclosing PHI except as expressly permitted or required by the rul e . The rule specifies only two circumstances when a covered entity is required to disclose PHI. A covered entity must disclose PHI to the individual who is the subject of the information (i.e., patient right of access), and to HHS officials investigating potential violations of the rule. The rest of the rule describes a wide range of circumstances under which it is permissible to use or disclose PHI. In all such instances, covered entities can choose whether to use or disclose PHI based on their professional ethics and using their own best judgment. Thus, the Privacy Rule seeks to preserve the discretion that health care professionals have traditionally exercised when using or disclosing patient or beneficiary information. For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered entities must obtain a patient's written authorization.

Minimum Necessary

The Privacy Rule includes a minimum necessary standard for the use or disclosure of PHI. It requires a covered entity that uses or discloses PHI, or requests such information from another covered entity, to make reasonable effort to limit the information to the minimum amount necessary to accomplish the intended purpose of the use or disclosure. There are several circumstances in which the minimum necessary standard does not apply. These include health care providers sharing a patient's PHI for treatment purposes, disclosures to individuals who request access to their information, any use or disclosure for which an authorization was obtained, and uses or disclosures that are required by other law.

In most instances, covered entities do not need to make a minimum necessary determination for each separate use or disclosure. The rule instructs covered entities to implement policies and procedures governing routine and recurring uses and disclosures of PHI. These include identifying persons or categories of persons within an organization who need specific types of information and limiting their access to just that information. Disclosures that are not made on a routine and recurring basis must be individually reviewed to determine the minimum amount of PHI necessary to accomplish the specified purpose.

Business Associates

Health plans and health care providers routinely hire companies and consultants to help them operate as businesses and meet their responsibilities to patients and beneficiaries. These third parties provide claims processing, billing, legal, actuarial, accounting, transcription, data management, peer review, quality assurance, accreditation, and financial services, among others. Most of them need access to at least some patient information in order to perform those functions. Initially, the Privacy Rule did not directly regulate such "business associates" of covered entities. However, HHS in its rulemaking required covered entities to manage their business associates through contractual relationships. Covered entities were required to obtain satisfactory written assurance in the form of a Business Associate Agreement, or BAA, that their business associates would, among other things (1) use PHI only for the purposes permitted or required by the contract, and (2) implement appropriate safeguards to prevent misuse of PHI.

Authorization

The Privacy Rule specifies the types of information that must be included in an authorization form. Initially, the rule prohibited combining an authorization with any other legal permission to create a "compound" authorization, with a few specified exceptions. However, as discussed later in this report, the restriction on compound authorizations has since been loosened.

Health care providers may not require an individual to sign a HIPAA authorization as a condition of treating the individual, unless the treatment is being provided as part of a research study. However, health plans may condition enrollment in a plan, or eligibility for benefits, on obtaining an authorization prior to an individual's enrollment in the plan, if the plan is seeking access to PHI for eligibility or enrollment determinations, or for other underwriting purposes.

Specific Requirements for Use and Disclosure

In general, covered entities may use or disclose PHI for the purposes of treatment, payment, and other routine health care operations with few restrictions. A covered entity may use or disclose PHI for its own treatment, payment, or health care operations. In addition, a covered entity may disclose PHI for the treatment or payment activities of a health care provider; for the payment activities of another covered entity; and for certain health care operations of another covered entity, if each entity has or had a relationship with the individual who is the subject of the PHI, and the requested information pertains to that relationship. An individual has the right to request restrictions on uses or disclosures of PHI for treatment, payment, or health care operations. For example, an individual may request that a particular medical procedure be kept confidential and not shared with other providers. The covered entity is not required to agree to such a restriction. But if they do, they must abide by the agreement, except in emergency circumstances.

Under certain other circumstances (e.g., disclosures to family members and friends, disclosures from public directories maintained by hospitals and other facilities, fundraising), the Privacy Rule requires covered entities to give the individual the opportunity to object to the disclosure (i.e., opt out). The rule also permits the use or disclosure of PHI for specified "national priority purposes" that are not directly connected to the treatment of the individual. These uses and disclosures, which are summarized in the text box below, are permitted by the rule in recognition of the important uses made of health information outside of the health care context.

Administrative Requirements for Covered Entities

The Privacy Rule established a series of administrative obligations for covered entities. First, they must provide individuals with a written notice that includes the following information: (1) a description of patients' rights under the rule and how to exercise those rights; (2) the legal duties of the covered entity; (3) a description of the required and permissible uses and disclosures of PHI; (4) how an individual can file a complaint with the covered entity or the HHS Secretary; (5) how the covered entity will provide a revised notice if it needs changing; and (6) a contact person for additional information.

Second, covered entities are required to adopt reasonable administrative, technical, and physical safeguards in order to protect PHI from unauthorized access, use, or disclosure. The Security Rule—applicable only to PHI in electronic form—established specific standards for those safeguards.

Finally, the rule requires a covered entity to designate a privacy official to develop and implement its policies and procedures for protecting PHI under the Privacy Rule. Each covered entity must train all members of its workforce on those policies and procedures.

Special Rules for Employers and Other Entities

The Privacy Rule includes provisions that apply to specific types of organizations that perform health care functions covered by the rule but do not fit neatly within the definition of a covered entity. For example, an organization that is a single legal entity and conducts both covered and non-covered functions (e.g., a manufacturing company that operates a health clinic) has the option to become a "hybrid entity" under the rule. This requires the company to designate in writing the segments of its business that perform covered functions as one or more "health care components." Once this designation is made, most of the rule's requirements apply only to the health care components. They are prohibited from sharing PHI with the larger organization unless the disclosure has been authorized by the individual or is otherwise permitted by the rule.

The rule's treatment of employers as sponsors of group health plans is of particular interest given the fact that so many individuals obtain their health insurance coverage through their employer. Employers are not HIPAA-covered entities, but they may need access to individual health information to administer the group health plan that they sponsor. Employees, on the other hand, are concerned that health information shared with employers may be used inappropriately to make employment decisions. In an attempt to reconcile these competing interests, the rule permits a health insurance issuer or HMO (with respect to a group health plan) to disclose certain PHI to the plan sponsor (i.e., employer) for plan administration purposes, but prohibits disclosure for employment-related actions (e.g., promotion, termination).

Specifically, the following PHI may be disclosed to a plan sponsor:

information on whether an individual is, or is no longer, enrolled in the plan; summary claims information stripped of all identifiers other than five-digit zip codes for the sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan; or enrollee PHI for the plan sponsor to use to administer the plan. For such disclosures to occur, the plan documents must be amended to limit the uses and disclosures of PHI by the sponsor to those that are consistent with the rule. Furthermore, the sponsor must certify that it will not use the information for employment-related purposes, and that it will establish adequate firewalls so that only those personnel who need the information to perform functions on behalf of the group health plan have access to such information.

Enforcement and Compliance

An individual or organization who believes a covered entity is not complying with the Privacy Rule may file a complaint with OCR. The rule lists the requirements for filing a complaint. It also describes the responsibilities of covered entities to provide records and compliance reports and to permit access to information for investigations and compliance reviews.

HIPAA established civil and criminal penalties for violations of all its Administrative Simplification standards, including the Privacy and Security Rules. Initially, OCR could impose a civil monetary penalty (CMP) on any covered entity that it determined had violated an Administrative Simplification requirement of not more than $100 per violation, up to a maximum of $25,000 per year for multiple violations of the same requirement. CMPs could not be imposed if (1) the violation was a criminal offense under HIPAA's criminal penalty provisions; (2) the person did not have actual or constructive knowledge of the violation; or (3) the failure to comply was due to reasonable cause and not willful neglect, and was corrected within 30 days.

For certain wrongful PHI disclosures, OCR may refer the case to DOJ for criminal prosecution. The criminal penalty for a person who knowingly obtains or discloses PHI in violation of HIPAA is a fine of up to $50,000 and/or up to one year in prison. The penalty increases to $100,000 and/or up to five years in prison if the wrongful conduct involves false pretenses. It further increases to $250,000 and/or up to 10 years in prison if the offense is committed with the intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm.

There is no private right of action under HIPAA. Individuals cannot sue covered entities or business associates for violations of the law. However, HIPAA violations may result in a variety of claims against covered entities and business associates under state law.

Preemption of State Laws

Covered entities must comply with both the HIPAA Privacy Rule and any applicable state privacy laws unless the state laws are contrary to the Privacy Rule, in which case they are preempted by it. Contrary means that it would be impossible for a covered entity to comply with both the state and federal requirements, or that the state law is an obstacle to accomplishing the full purpose of HIPAA.

There are a number of exceptions to this general preemption requirement. If the contrary state privacy law is "more stringent" than the Privacy Rule, meaning that it provides greater privacy protection, then the state law takes precedence. A state law is more stringent when it prohibits or restricts a use or disclosure that would be permitted under the Privacy Rule, or when it provides individuals with greater access to their information. Thus, HIPAA establishes a federal floor for protecting health information privacy that allows states to implement additional privacy protections.

In addition, the Privacy Rule does not preempt state laws that provide for the reporting of a disease or injury, child abuse, birth, or death, or for conducting public health investigations. Nor does it preempt state laws that require health plans to report or grant access to health information for the purpose of audits, evaluation, or licensure, even if they are less protective of individuals' privacy.

An Overview of the HIPAA Security Standards

The HIPAA Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of all electronic PHI (ePHI) that they create, receive, maintain, or transmit (see text box). Covered entities and business associates are to protect against any reasonably anticipated threats or hazards to the security of ePHI, and any reasonably anticipated uses or disclosures of such information that are in violation of the Privacy Rule. U nlike the Privacy Rule, which applies to PHI in any form or format, the Security Rules applies only to ePHI.

The Security Rule and the Privacy Rule are closely interconnected. While the Privacy Rule established standards for who may have access to PHI, and for what purposes, the Security Rule created the standards for ensuring that only those who should have access to ePHI will in fact have access. When it developed the Security Rule, HHS adhered closely to the requirements of the Privacy Rule. As noted in the previous section, the Privacy Rule requires covered entities to adopt reasonable administrative, technical, and physical safeguards in order to protect PHI from unauthorized access, use, or disclosure. But the Privacy Rule does not specify what those safeguards should be. That is the purpose of the Security Rule, under which each of the safeguards—administrative, physical, and technical—is composed of a number of standards.

Implementation Specifications

Covered entities and business associates have considerable discretion and flexibility in how they implement the security standards. Each standard generally consists of one or more implementation specification (i.e., detailed instructions for implementing the standard) that are either "required" or "addressable." If an implementation specification is required, the organization must adopt the policies and/or procedures described for that specification. If an implementation specification is addressable, the organization must assess whether it is a "reasonable and appropriate safeguard in its environment." If the organization chooses not to implement an addressable implementation specification based on its assessment, it must document the reasons and implement an "equivalent alternative measure if reasonable and appropriate."

Table 1 lists all the security standards and provides a brief summary of the policies, procedures, or programs that must be implemented to meet each one. The table also shows the implementation specifications, if any, associated with each standard and indicates whether they are required or addressable.

Flexible and Scalable Standards

The security standards are designed to be flexible and scalable from the largest and most complex organizations to the smallest provider practices. In deciding which security measures to use, a covered entity or business associate must take into account the size, complexity, and capabilities of the organization; its technical infrastructure, hardware, and software security capabilities; the costs of security measures; and the probability and impact of potential risks to ePHI. The security standards are technology-neutral to accommodate the continual emergence of new technologies. They do not prescribe the use of specific technologies.

Importance of Risk Analysis and Risk Management

The initial, and most important, actions that covered entities and business associates are required to take under the Security Rule are to conduct an accurate and thorough risk analysis and develop a risk management strategy (see Table 1 ). These actions form the foundation upon which all subsequent security activities are based. The purpose of the risk analysis is to identify all the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI, and to determine the likelihood and magnitude of those risks. Risk management is the process used to identify and implement security measures to reduce risk to a level that is reasonable and appropriate given the organization's circumstances, and that enables it to comply with the general requirements of the Security Rule.

Covered entities and business associates must ensure that risk analysis and risk management are ongoing and dynamic processes—not just a one-time activity—that reflect changes to their operations and environment.

HITECH Act and Other Amendments to the HIPAA Standards

The HITECH Act included a series of provisions designed to expand and strengthen the HIPAA privacy and security standards. Many of the changes were enacted to address the concerns of privacy advocates and other stakeholders. These groups had complained that there was no notification requirement in the event of a breach of PHI, and that OCR was not adequately enforcing the Privacy and Security Rules.

Among its provisions, the HITECH Act (1) established four categories of violations of the rules to reflect increasing levels of culpability, and four corresponding tiers of CMPs that significantly increased the minimum penalty amount for each violation; (2) required HHS to investigate all complaints indicating violations due to willful neglect; (3) made business associates of covered entities—and their subcontractors—directly liable for violations of Privacy and Security Rules; and (4) required covered entities and their business associates to notify individuals whose PHI was breached. In addition, the HITECH Act established new limitations on the use and disclosure of PHI for marketing and fundraising purposes; prohibited the sale of PHI in an otherwise permissible disclosure; and expanded individuals' rights to access their PHI, restrict certain disclosures to health plans, and obtain an accounting of routine disclosures of ePHI.

GINA also amended the Privacy Rule by clarifying that genetic information is PHI, which was already the case, and prohibiting health plans from using or disclosing genetic information for eligibility or enrollment determination, or other underwriting purposes. As noted earlier, the Privacy Rule permits health plans to use or disclose PHI—other than genetic information—for such purposes.

Most of the HITECH Act amendments to the HIPAA privacy and security standards and their enforcement, as well as the changes required by GINA, were finalized in a January 2013 "omnibus" rule. The omnibus rule also included technical and other non-statutory revisions to the HIPAA standards to improve their workability and effectiveness, most notably regarding authorizations for the use or disclosure of PHI for research.

The text box summarizes significant changes made by the HITECH Act and GINA to the HIPAA standards. It includes the new requirements for research authorizations. Several of these provisions are discussed in more detail below.

Business Associates

Prior to the HITECH Act, HIPAA applied directly to covered entities but not to business associates, which as noted earlier were regulated through contractual agreements (i.e., BAAs). Covered entities were not liable for, or required to actively monitor, their business associates. However, if a covered entity found out about a material breach or violation of the BAA, it had to take reasonable steps to remedy the situation and, if unsuccessful, terminate the contract. If termination was not feasible, then the covered entity had to notify HHS.

The HITECH Act made business associates directly liable and subject to civil and criminal penalties for violations of HIPAA or their BAAs (see text box). It also clarified that subcontractors of a business associate are themselves business associates. Thus, subcontractors along the contractual chain are subject to the same compliance obligations and are directly liable for HIPAA violations. Just as business associates may use or disclose PHI only as permitted by the BAA or required by law, and may not use or disclose PHI in a manner that would violate the Privacy Rule, so subcontractors are subject to the same limitations, as documented in subcontracts. A covered entity (or a business associate) that knows of a pattern of activity or practice of its business associate (or subcontractor) that constitutes a material breach or violation of the BAA must take reasonable steps to remedy the problem and, if such steps are unsuccessful, terminate the contract. Neither covered entities nor their business associates (including subcontractors) may intimidate, threaten, discriminate against, or take any other retaliatory action against an individual who files a complaint, cooperates with investigators, or opposes unlawful actions.

Pursuant to the HITECH Act, Patient Safety Organizations, health information exchange organizations and e-prescribing gateways are business associates. The omnibus rule also clarifies that while a data transmission service—acting merely as a conduit for the flow of information (including temporary storage that is incidental to the transmission service)—is not a business associate, a service that provides more persistent storage (e.g., cloud EHRs) is a business associate.

Breach Notification

The HIPAA breach notification program was established in 2009, pursuant to the HITECH Act. Under the program, covered entities and their business associates must notify all individuals affected by a breach of unsecured ePHI without unreasonable delay, but no later than 60 days after the discovery of the breach (see text box). Unsecured ePHI means information that has not been rendered unusable, unreadable, or indecipherable to unauthorized individuals through encryption. The law exempted encrypted PHI from the definition of a breach in an effort to encourage the practice of encrypting health information.

Covered entities also must notify the HHS Secretary of breaches of unsecured PHI. A "major" breach affecting 500 or more individuals must be reported to the Secretary at the same time the affected individuals are notified. Entities may maintain a log of breaches involving fewer than 500 individuals and submit the log to HHS annually. OCR is required to maintain a website listing all the major breaches (i.e., affecting at least 500 individuals).

The HITECH Act defines a breach as the "unauthorized acquisition, access, use, or disclosure of [PHI] which compromises the security and privacy of such information.... " The definition excludes unintentional access or use of PHI, inadvertent disclosures, and disclosures where the covered entity has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain the information.

In its initial rulemaking to implement the breach notification program, HHS stated that the phrase "compromises the security and privacy of PHI" means "poses a significant risk of financial, reputational, or other harm to the individual." Covered entities and business associates faced with an incident involving the unauthorized acquisition, access, use or disclosure of PHI first had to determine whether it met this harm threshold. If it did, and the incident constituted a breach, then notification was required.

The harm threshold was controversial. Consumer advocacy organizations and others criticized it for being too subjective and for discouraging reporting. They argued for its modification or elimination. HHS responded in the omnibus rule by removing the harm threshold and modifying the risk assessment portion of the breach notification rule to require the use of a more objective assessment. An impermissible use or disclosure of PHI "is presumed to be a breach unless the covered entity or business associate ... demonstrates that there is a low probability that the [PHI] has been compromised based on a risk assessment.... " The modified rule lists the factors that must be included in the risk assessment. Now the default is notification, and the burden is on the covered entity or business associate to perform a risk assessment to determine whether there is a low probability that PHI was compromised. If that determination is made (and documented), then the covered entity or business associate need not provide notification.

The Secretary is required annually to submit a report to Congress on the number and nature of the breaches reported to OCR, and the actions taken in response to such breaches. To date, the Secretary has submitted two reports, each analyzing two years of information. The first report covers 2009-2010, and the second one covers 2011-2012.

Cumulatively, through December 31, 2012, OCR received 710 reports of major breaches affecting a total of approximately 22.5 million individuals. Over the same period, OCR received 77,420 reports of breaches affecting fewer than 500 individuals. In all, these breaches affected approximately 400,000 individuals. Thus, while the major breaches made up about 1% of breach reports, they accounted for more than 98% of all the individuals who were affected by a breach of their PHI.

Of all the categories of causes of breaches, theft accounted for about half of all incidents. OCR identified the following lessons learned from the two breach reports:

Ensure that an organization's risk analysis and risk management plan is thorough and addresses all potential risks and vulnerabilities to ePHI, regardless of location or media. That includes ePHI on computer hard drives, USB drives, laptops, mobile phones, and other portable devices, as well as ePHI transmitted across networks. Ensure that security evaluations are conducted when there are operation changes (e.g., office moves) and technical upgrades for hardware and software so that ePHI remains secure. Ensure that ePHI stored on portable electronic devices is properly secured, including through encryption, with clear policies on the use and removal of such devices from a facility. Implement clear policies and procedures for the proper disposal of PHI in all forms. Ensure physical safeguards are in place to limit access to facilities and workstations that maintain PHI. Ensure that employees are fully trained on the organization's privacy and security policies and procedures.

Enforcement and Compliance Audits

The HITECH Act's provisions to expand and strengthen HIPAA enforcement were in part a response to the approach taken initially by OCR to work with entities in violation of the HIPAA standards and encourage voluntary compliance through corrective action. Privacy advocates criticized the agency for not being more aggressive in its enforcement activities and for not penalizing noncompliant organizations. At the time of the HITECH Act enactment, OCR had not levied a single civil penalty against a covered entity, though cases had been referred to DOJ for criminal prosecution.

The HITECH Act clarified that the criminal penalties for wrongful disclosure apply to individuals who without authorization use or disclose such information maintained by a covered entity, whether they are employees or not. This provision was prompted by a Memorandum Opinion issued by the DOJ Office of Legal Counsel in June 2005 clarifying the scope of HIPAA criminal enforcement. The opinion was interpreted by some to mean that employees of covered entities could not be held liable for a HIPAA criminal violation; only covered entities could be prosecuted directly.

Table 2 summarizes the four tiers of CMPs that replaced the original HIPAA penalty of $100 per violation up to an annual maximum of $25,000 for multiple violations of the same requirement. The lowest tier applies to entities that "did not know, and by exercising reasonable diligence would not have known" of the violation. The second tier applies to violations due to reasonable cause and is likely to cover many common violations by otherwise generally compliant covered entities; for example, those that occur due to human error, despite workforce training and appropriate policies and procedures. Reasonable cause covers violations in which the entity "knew, or by exercising reasonable diligence would have known" of the violation, "but did not act with willful neglect."

The final two tiers, both dealing with violations due to willful neglect, are distinguished based on whether the entity took corrective action within 30 days. Willful neglect means "conscious, intentional failure or reckless indifference to the obligation to comply."

OCR must investigate whenever there is evidence of a possible violation due to willful neglect. However, the omnibus rule states that, absent indications of willful neglect, OCR will continue to seek compliance through informal, voluntary action if appropriate.

The HITECH Act requires the Secretary to conduct periodic audits to ensure that covered entities and business associates comply with the Privacy and Security Rules. Unlike complaint investigations or compliance reviews, which are initiated in response to specific events or incidents, audits are based on a set of objective selection criteria.

OCR developed and conducted a pilot audit program that targeted 115 covered entities representing a broad range of sizes and complexities. The audits were conducted according to a protocol that identified the processes, controls, and policies of covered entities in three areas: privacy, security, and breach notification. OCR engaged PricewaterhouseCoopers (PwC) to evaluate the pilot audit program and is using PwC's findings to finalize plans for a permanent audit program. OCR has requested additional funding to establish the audit program, which it believes will generate tools for covered entities to self-evaluate and help spread a culture of compliance within the health care sector as entities become aware of the program and its expectations.

The HITECH Act requires the Secretary annually to submit a report to Congress that summarizes the number and types of complaints received; the compliance reviews and enforcement actions taken; the number of audits performed and their findings; and the Secretary's plan for improving HIPAA compliance and enforcement for the following year. The Secretary has submitted two such reports to date, each covering the same two-year period as the two breach notification reports submitted to Congress, which were described earlier.

Research

In 2009, the Institute of Medicine (IOM) released a report on the Privacy Rule's impact on research. The IOM concluded that the rule does not adequately protect the privacy of health information used for research. It also concluded that the rule, as currently implemented, impedes the conduct of important new research. The report found that there is considerable variation in how organizations that collect and use health data are interpreting and following the rule. It discussed the challenges in reconciling the Privacy Rule with other federal regulations—primarily the Common Rule —that govern human subject research. The report also examined inconsistencies between the Privacy Rule and the Common Rule, neither of which applies uniformly to all health research.

For example, the Privacy Rule generally prohibited combining an authorization with any other legal permission to create a "compound" authorization, unless it was for the same study. Thus, a Privacy Rule authorization for a specific research study could be combined with Common Rule informed consent to participate in the research. But any separate research activity, such as collecting specimens or data for a central research database or repository, would require its own authorization. Unlike Common Rule informed consent, Privacy Rule authorizations also had to be study-specific; authorizations for future research were prohibited.

The omnibus rule addressed some of these inconsistencies. The Privacy Rule now permits compound authorizations for any type of research activity (with limited exceptions) and allows authorizations for future research, provided the description of the future research uses is sufficiently clear that it would be "reasonable for an individual to expect that his or her protected health information could be used or disclosed for such future research."

Appendix. HIPAA Administrative Simplification