ILNews

New HIPAA rule revises breach notification process

Back to TopCommentsE-mailPrint
Indiana Lawyer Focus

Financial institutions sending letters and emails alerting customers of possible unauthorized access to their bank accounts or credit cards are more common that anyone would like. Soon, however, such notices may come from hospitals and medical insurance companies.

The change is being ushered in by the new Health Insurance Portability and Accountability Act of 1996 rule announced in January by the U.S. Department of Health and Human Services. At 563 pages, the regulation is being touted as finalizing a number of provisions in the Health Information Technology for Economic and Clinical Health Act and strengthening the privacy and security protections for health information provided under HIPAA.

eckhardt-chad-mug Eckhardt

When the omnibus rule was unveiled, Kathleen Sebelius, HHS secretary, pointed to the growing use of electronic medical records as part of the cause for the new rule.

“Much has changed in health care since HIPAA was enacted over 15 years ago,” Sebelius stated in a press release. “The new rule will help protect patient privacy and safeguard patients’ health information in an ever expanding digital age.”

Attorneys agreed with the government’s assessment that these are “sweeping changes.”

“It’s a significant piece of regulation enforcing a patient’s privacy rights,” said Chad Eckhardt, an associate in Frost Brown Todd LLC’s Cincinnati office. “It’s going to take a while for covered entities to get their arms around.”

The final omnibus rule addresses four regulatory areas. It provides the final modifications to the HIPAA privacy, security and enforcement rules; sets the final rule adopting the increased civil money penalty structure; issues the final standard on breach notification for unsecured protected health information; and modifies the HIPAA privacy rule that prevents most health plans from using or disclosing genetic information for underwriting purposes.

Most of the regulations have been public for some time and the language of the final rule was expected. Although few surprises were contained in the document, Eckhardt said, the change to the breach notification provision has turned many heads.

ziels-susan-mug Ziel

Namely, the standard of “significant harm” has been dropped which could lead to more people getting letters from their doctors and insurance companies that their medical records may have been compromised.

Breach notification

The push toward electronic medical records was accelerated by the Patient Protection and Affordable Care Act. Early projections that billions of dollars would be saved by moving to electronic records have been dampened, but computerized health information still has advantages. Some can alert physicians to tests a patient needs, reduce mistakes in prescriptions, and aid in research.

Yet, as with bank records and credit card information, going online brings new risks.

“Privacy is a big issue because if health records are more accessible to doctors, they’re also more accessible to everybody else,” said David Orentlicher, professor at the Indiana University Robert H. McKinney School of Law.

Medical records contain a great deal of information from details of a patient’s health to financial account numbers and Social Security numbers.

With an apparent eye on the increased potential health information being lost or stolen, the HHS revised the Breach Notification Rule first published in the 2009 HITECH Act.

Under the initial provision, patients did not have to be notified of any breach if the covered entity, such as health care provider or health insurance company, determined the information improperly accessed did not pose a “significant risk of harm” to those patients.

The covered entities were required to perform a risk assessment to examine elements such as who accessed the information and what type of information was disclosed. Then, if that analysis indicated the breach did not put the patient’s financial or personal wellbeing at risk, no notification had to be sent.

Advocates supporting the significant harm standard pointed to the increased costs and burden that covered entities and their business associates would have to bear if the threshold for notification was lowered. In addition, alerting consumers when there was no risk of damage could cause unnecessary anxiety and, eventually, apathy.

However, opponents countered the significant harm provision set the standard too high.

In the final rule just released, the HHS removed the harm standard and modified the risk assessment. Now, the focus has shifted from assessing the risk to the individual to proving that the improper disclosure did not compromise the protected health information. The HHS is also providing more objective guidelines for doing the risk assessment to determine if a notification is necessary.

Penalties

Accordingly, costs for covered entities and business associates will likely rise because they will have to pay for not only the alert but also repairing the breach and offering any mitigating services like credit monitoring.

Also, since enforcement happens after the breach has occurred, the notification could become even more costly.

The financial penalties were unveiled in the HITECH Act. Fines for improper releases of protected health information have long been a part of HIPAA, but the new reparations are substantially higher.

Prior to HITECH, the fine could not be more than $100 per violation and the total penalty could not exceed $25,000 a year. Attorneys said the dollar amounts were so low that hardly anyone paid them much attention.

zoccola-christine-mug Zoccola

They are paying attention now. The civil money penalty provision divides the violations into four tiers, ranging from “Did Not Know” to “Willful Neglect – Not Corrected.” The fines for each violation go from a low $100 to a high $50,000, and the total penalty could reach $1.5 million per violation of HIPAA rules within a calendar year.

“I think that’s probably what it takes to get people’s attention sometimes, or so the government thinks,” said Susan Ziel, partner at Krieg Devault LLP’s Minneapolis office.

Moreover, the new rule expands the liability. Now, not only are covered entities liable to HIPAA violations but so are their business associates, which includes anyone who has access to medical records like lawyers, transcribers and accountants.

Enforcement activity has been increasing.

In September, the Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates Inc., reached a settlement agreement with the HHS to pay $1.5 million for potential HIPAA violations. The settlement came after the infirmary filed a breach notification, reporting the theft of an unencrypted personal laptop containing the electronic protected health information of patients and research subjects.

Getting started

The final omnibus rule was published Jan. 25 and goes into effect March 26. Compliance must be met by Sept. 23.

Many health care providers and insurance companies have not updated their HIPAA policies since the act took effect in 2003. Christine Zoccola, partner at Bose McKinney & Evans LLP in Indianapolis, noted attorneys will be working not only to educate their clients on the final rule but also to revise procedures, forms and contracts to meet the new provisions.

“It is a big change,” Zoccola said. “It is a massive overhaul.”•

ADVERTISEMENT

Post a comment to this story

COMMENTS POLICY
We reserve the right to remove any post that we feel is obscene, profane, vulgar, racist, sexually explicit, abusive, or hateful.
 
You are legally responsible for what you post and your anonymity is not guaranteed.
 
Posts that insult, defame, threaten, harass or abuse other readers or people mentioned in Indiana Lawyer editorial content are also subject to removal. Please respect the privacy of individuals and refrain from posting personal information.
 
No solicitations, spamming or advertisements are allowed. Readers may post links to other informational websites that are relevant to the topic at hand, but please do not link to objectionable material.
 
We may remove messages that are unrelated to the topic, encourage illegal activity, use all capital letters or are unreadable.
 

Messages that are flagged by readers as objectionable will be reviewed and may or may not be removed. Please do not flag a post simply because you disagree with it.

Sponsored by

facebook - twitter on Facebook & Twitter

Indiana State Bar Association

Indianapolis Bar Association

Evansville Bar Association

Allen County Bar Association

Indiana Lawyer on Facebook

facebook
ADVERTISEMENT
Subscribe to Indiana Lawyer
  1. Am I the only one who sees that the City is essentially giving away the MSA site AND giving millions to build new buildings on the site when this site would be the perfect place for the Justice Complex? Across from City-County, check; keeping it centrally located, check, etc. It's my understanding that the GM site must be purchased by the City from Motors Liquidation Company. STOP WASTING WHAT WE ALREADY HAVE AND OUR TAX DOLLARS! The Ballard Administration has not been known for it's common sense...never voted for him and never will!

  2. This guy sounds like the classic molester/manipulator.

  3. Louis D. Brandeis was born in 1856. At 9 years of age it would have been 1865. The Brandeis family did not own slaves. My source Louis D. Brandeis: A Life, by Melvin L. Urofsky.

  4. My name is Matthew Lucas Major, I recently went through a jury trial in Bloomington , In. It was the week of Feb 19-21. Although I have been incarcerated since August 5, 2014. The reason I 'am writing to you sir is on the 21 of February the jury came in with a very excessive and wrongful verdict of guilty on 6 child molesting charges against my daughter who was 9 at the time I was accused. I also had 2 other Felonies one of Intimidation and 1 of Sexual Vicarious Gratification. Judge Marc Kellam on the second day of trial gave me a not guilty on those 2 felonies. The jury was sent out during that time and when brought back Judge Kellam told them to not concern themselves with the 2 Felonies that he ruled on them. They were told to not let evidence they had already heard influence there verdicts. I never in my life touched any child sexually and definitely not with my own daughter. When I was arrested Detective Shawn Karr told me I would be convicted guilty just on my daughters word even without evidence. That's just what happened. my public defender did me so wrong he never once proved to the court and jury all the lies the child told, and Jeremy Noel my public defender could of proven the lies easily. The stories in Serenity's depositions and Forensic interview changed and were not consistent as Prosecutor Darcie Fawcett claimed they were. Yet my attorney never mentioned that. The facts that the child accused me of full penetration in her vagina and rectum was proven lies. Doctor Roberta Hibbard of Riley hospital in Indianapolis confirmed Serenity's hymen intact, no scars, no tearing, no signs of rape to her. Yet my attorney didn't use that knowledge . the DNA was all in my favor. I tell you I will spend my entire life in prison going through rape and beatings etc. even Judge Kellam abused his authority by telling the jurors to listen and believe what the prosecutors side in evidence like my daughters testimony. In one interview with the detectives my daughter got flustered with her mom and said on camera " I'm saying what you told me to mom"!! Yet Mr. Noel said nor did anything to even resemble a defense attorney. Judge Kellam allowed edited version of a taped conversation between the child and her mother. Also Judge Kellam allowed the Prosecutor too bring in to my case a knife found under my seat, the knife wasn't part of my case. She was allowed by my attorney and the judge to put a huge picture of it on the screen and huge picture of my naked privates in a full courtroom and open court. Ms. Fawcett says to jury see how easy Mr. Major could reach the knife and cut his Childs throat. Even though I had no weapons charge against these cases. This gave the jurors prejudice thought against me thinking I threatened her with that knife and how scared she would of been knowing i could get it and kill her. On my sentencing court March 19, 2014 my public defender told Judge Kellam he wish to resign from being my attorney and wished for the court to give me outside council to file a error to trial or appeal. We were denied. Now after openly knowing my public defender don't want to represent me he has to. Well when as parents we make our kids clean a room when they really don't wish to, well the child will but don't mean she will do a good job, that's where I'm at with Mr. Noel. please dont ignore mine and my families pleas for your help . we have all the legal proof you could need to prove Im innocent. Please dont make my spend years in prison innocent when you can fix this wrong. Im not saying Im a perfect man or that I was a perfect dad to my 2 children none of us are. Ive made some bad choices in life and I paid for them. But I didnt ever touch or rape my daughter . I love my children with all my heart. And now through needing attention and a ex-wife who told my granny several times she wish she could put me in prison to get me out of their lives. Well my ex finally accomplished her goal. Sad part is she is destroying our daughter with all this horrific lies and things she taught my daughter to say. My daughter will need therapist to ever hope for a chance of a normal life after what she had done to her by her mom and their side of the family. My daughter told everyone even on stand she had a dream months before i supposedly molested her in this dream I was molesting her and when I finally did it matched her dream perfectly. She admitted to watching movies about little girls being molested and watching U-Tube videos about child molesting all before it happened supposedly to her. Doesn't that sound very unusual that a non molested 9 yr old would need to know so much about being molested? The only reason I could think a 9 year old would need so much information is to be prepared to know what to say and be able to say how it felt what took place etc.. So when questioned by authorities she would be prepared. And there again sir if a parent is pre grooming a 9 year old child she would need intimate details . Like telling her daughter about a couple moles on my private area. The child admitted to sneaking my cell and looking many many times at nudes of me and my girlfriend even one where my penis was entering my girlfriends vagina. In that picture my moles are obvious. Yet when prosecutor showed everyone in court my privates and pictures of the moles she said the only way the child would know about them is if she saw them for herself. My attorney once again said nothing about the pictures my child saw. Or could a ex-wife be able to describe my moles to help her case against getting rid of me? I beg you help me. This is my very existence. Ive lost everything , a good job, a wonderful girlfriend, my freedom, but worse thing Ive lost is my children. They were my reason to get up every morning and strive to be better. The wonderful bond I had with my Serenity is gone. After this I would be afraid to even hug her for fear of what next can they do to me. I'm not afraid to tell you I sit here in this cell and try to hold back my tears. Everyone knows you cant show weakness in prison. My life has already been threatened here at Wabash Valley Prison. After only 3 days of arrival. I was tricked into signing a waiver now Im in G Block General Population with 6 child molesting felony charges. Mrs. Hart as a 18 year old I almost died hooked to machines in hospital almost 1 month and now I know that fear was childish compared to this . I cant help but put emotions in this, after all Mrs. Hart Im human and God help Me I never been more afraid in my life. I didnt hurt my little girl I didnt touch her sexually. As much as it shreds me and fills my mind what Im facing I worry more about my mom and granny because of their great love for me mam they are suffering so deeply. I aint done this things but my loved ones suffering right along beside me and If you take my case you will be in essence freeing them also. I sent momma this letter and asked her to email it to you. I'm scared I have been done so unjustly by our legal system and I need you to fix this and give me freedom. I ask you please don't just ignore my pleas. Here in America its nice to be able to trust our legal justice system, well they destroyed my and my loved ones trust in our justice system . And I'm trusting in You !!! My entire family is suffering this nightmare with me. My 77 year old granny had a stroke and isn't doing so well. My single mother that raised 3 kids alone is dying from Lupus and since my arrest has stayed so sick and weary. Our lives torn to peices by a government I was taught I could trust in. my momma has tried so many innocent project and wrongfully accused and cant get anywhere. please please help me. A quote from the late Nelson Mandela: To be free is not merely to cast off ones chains, But to live in a way that respects and enhances The Freedom Of Others. I have Faith in you and your clinic to cast my chains off and give me freedom I do deserve as a wrongfully accused Man, son, brother, father, friend. Matthew Major DOC# 246179 Cause # : 53c02-1308-FA-000779 God Bless you. Please contact me with your decision so I know you made a life changing decision for me , just please at least write me so I know you care enough about your citizens to respond to cries for your help. You can speak openly with my mother Charlotte Spain (828) 476-0406: 71 Lakeview Dr. Canton, NC 28716 Thank You Matthew Major I know yall get thousands of request and inmates claiming innocence, and each person who are innocent deserve to have organizations like yours willing to fight for them and I give yall so much Thanks and I thank God everyday yall are out there caring enough to help free the innocents. Since discovering firsthand how easily lives and families can be destroyed by Poor Defense attorneys not doing their job . And Prosecutors allowed to do as they please in court

  5. Frankly, it is tragic that you are even considering going to an expensive, unaccredited "law school." It is extremely difficult to get a job with a degree from a real school. If you are going to make the investment of time, money, and tears into law school, it should not be to a place that won't actually enable you to practice law when you graduate.

ADVERTISEMENT