Photo of Jordan Cohen

Jordan Cohen is an Associate in the Health Law Practice and is based in the firm’s New York office. He provides clients with advice and counsel relating to federal health care laws and regulations, including the Stark Law, the Anti-Kickback Law, the Anti-Markup Rule, and state health care laws and regulations. Jordan also counsels clients on compliance with HIPAA’s Privacy Rule and Security Rule, including new requirements under the HITECH Act and 2013 Omnibus Regulations.

Last week the Health Care Compliance Association hosted its annual “Compliance Institute.”  Iliana Peters, HHS Office for Civil Rights’ Senior Advisor for HIPAA Compliance and Enforcement, provided a thorough update of HIPAA enforcement trends as well as a road map to OCR’s current and future endeavors.

Continuing Enforcement Issues

Ms. Peters identified key ten enforcement issues that OCR continues to encounter through its enforcement of HIPAA. These issues include:

  1. Impermissible Disclosures. HIPAA’s Privacy Rule prohibits covered entities and business associates from disclosing PHI except as permitted or required under HIPAA. Impermissible disclosures identified by Ms. Peters all center on the need for authorization, and include:
    • Covered entities permitting news media to film individuals in their facilities prior to obtaining a patient’s authorization.
    • Covered entities publishing PHI on their website or on social media without an individual’s authorization.
    • Covered entities confirming that an individual is a patient and providing other PHI to reporters without an individual’s authorization.
    • Covered entities faxing PHI to an individual’s employer without the individual’s authorization.
  2. Lack of Business Associate Agreements. OCR continues to see covered entities failing to enter into business associate agreements.
  3. Incomplete or Inaccurate Risk Analysis. Under HIPAA’s Security Rule, covered entities are required to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI (ePHI). According to Ms. Peters, organizations frequently underestimate the proliferation of ePHI throughout their environment, including into systems related to billing, faxing, backups, and medical devices, among others.
  4. Failure to manage identified risks. HIPAA requires regulated entities to put in place security measures to reduce risks and vulnerabilities. According to the presentation, several OCR breach investigations found that the causes of reported breaches were risks that had previously been identified in a risk analysis but were never mitigated. In some instances, encryption was included as part of the remediation plan, but was never implemented.
  5. Lack of transmission security. While not required in all cases, HIPAA does require that ePHI be encrypted whenever it is deemed appropriate. The presentation identified a number of applications in which encryption should be considered when transmitting ePHI, including email, texting, application sessions, file transmissions (e.g., FTP), remote backups, and remote access and support services (e.g., VPNs).
  6. Lack of Appropriate Auditing. HIPAA requires the implementation of mechanisms (whether hardware, software or procedural) that record and examine activity in systems containing ePHI. HIPAA-regulated entities are required to review audit records to determine if there should be additional investigation. The presentation highlighted certain activities that could warrant such additional investigation, including: access to PHI during non-business hours or during time off, access to an abnormally high number of records containing PHI, access to PHI of persons for which media interest exists, and access to PHI of employees.
  7. Patching of Software. The use of unpatched or unsupported software on systems which contain ePHI could introduce additional risk into an environment. Ms. Peters also pointed to other systems that should be monitored, including router and firewall firmware, anti-virus and anti-malware software, and multimedia and runtime environments (e.g., Adobe Flash, Java, etc.).
  8. Insider Threats. The presentation identifies insider threats as a continuing enforcement issue. Under HIPAA, organizations must implement policies and procedures to ensure that all members of its workforce have appropriate access to ePHI and to prevent those workforce members who do not have access from obtaining such access. Termination procedures should be put in place to ensure that access to PHI is revoked when a workforce member leaves.
  9. Disposal of PHI. HIPAA requires organizations to implement policies and procedures that ensure proper disposal of PHI. These procedures must guarantee that the media has been cleared, purged or destroyed consistent with NIST Special Publication 800-88: Guidelines for Media Sanitization.
  10. Insufficient Backup and Contingency Planning. Organizations are required to ensure that adequate contingency planning (including data backup and disaster recovery plans) is in place and would be effective when implemented in the event of an actual disaster or emergency situation. Organizations are required to periodically test their plans and revise as necessary.

Upcoming Guidance and FAQs

OCR also identified upcoming guidance and FAQs that it will use to address the following areas:

  • Privacy and security issues related to the Precision Medicine Initiative’s All of Us research program
  • Text messaging
  • Social media
  • Use of Certified EHR Technology (CEHRT) & compliance with HIPAA Security Rule (to be release with the Office of the National Coordinator for Health Information Technology (ONC))
  • The Resolution Agreement and Civil Monetary Penalty process
  • Updates of existing FAQs to account for the Omnibus Rule and other recent developments
  • The “minimum necessary” requirement

Long-term Regulatory Agenda

The presentation also identifies two long-term regulatory goals to implement certain provisions of the HITECH Act. One regulation will relate to providing individuals harmed by HIPAA violations with a percentage of any civil monetary penalties or settlements collected by OCR, while the second will implement a HITECH Act provision related to the accounting of disclosures of PHI.

Audit Program Status

The presentation discussed the current status of OCR’s audit program. As we have previously discussed, OCR is in the process of conducting desk audits of covered entities and business associates. These audits consist of a review of required HIPAA documentation that is submitted to OCR. According to Ms. Peters, OCR has conducted desk audits of 166 covered entities and 43 business associates. Ms. Peters also used the presentation to confirm that on-site audits of both covered entities and business associates will be conducted in 2017 after the desk audits are completed. We will continue to follow and report on developments in the audit program.

Commentary

The list of continuing enforcement issues provides covered entities and business associates with a helpful reminder of the compliance areas that are most likely to get them in compliance trouble. Some of the enforcement issues may require HIPAA-regulated entities to revisit decisions that they previously made as part of a risk analysis. Transmission security (#5, above) is an example of such an area that may warrant reexamination. In the past, encrypting data was often too expensive or too impracticable for many organizations. However the costs of encryption have decreased while it has become easier to implement. A covered entity or business associate that suffers a breach due to transmitting unencrypted PHI over the internet will likely garner little sympathy from OCR going forward. The presentation is also notable for the long list of guidance and FAQs that OCR will be publishing, as well as their plan to issue regulations to address changes ushered in by the HITECH Act that were not captured by the 2013 Omnibus Rule. These regulations, particularly the regulations related to accounting for disclosures of PHI, could have a far-reaching impact on how covered entities and business associates comply with HIPAA in the future.

Last week, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) released new guidance on reporting and monitoring cyber threats.  The guidance urges covered entities and business associates to report suspicious activity, including cybersecurity incidents, to the United States Computer Emergency Readiness Team (US-CERT). US-CERT is an organization within the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) that is responsible for analyzing and reducing cyber threats and vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities. It is operational 24 hours a day, and accepts, triages, and collaboratively responds to incidents. Continue Reading OCR Releases Guidance on Reporting and Monitoring Cyber Threats

On February 16, 2017, the HHS Office for Civil Rights (OCR) disclosed a $5.5 million settlement with Memorial Healthcare Systems (MHS) for HIPAA violations affecting the protected health information (PHI) of 115,143 individuals. The Resolution Agreement, which can be found here, also contains a detailed corrective action plan (CAP).

The Florida-based health system reported to OCR that the PHI had been impermissibly accessed by MHS employees and impermissibly disclosed to affiliated physician office staff. The PHI consisted of names, dates of birth, and social security numbers.

Continue Reading $5.5 Million HIPAA Settlement Underscores Importance of Audit Controls

Earlier this week, the U.S. Department of Homeland Security (DHS) updated a prior advisory revealing cybersecurity vulnerabilities in St. Jude Medical’s Merlin@home transmitter.

The Merlin@home transmitter is used by patients with St. Jude implantable cardiac devices to wirelessly transmit data from the patient’s cardiac device to the Merlin.net Patient Care Network. The uploaded data can then be monitored by a physician to determine whether the device is functioning properly.  This past January, DHS released an advisory detailing a vulnerability that could allow an unauthorized user to remotely access a patient’s RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered transmitter could then be used to modify the implanted device to rapidly deplete its battery and/or administer inappropriate pacing or shocks to the patient. St. Jude quickly made an update available to patch this vulnerability.

The updated advisory extends the vulnerability to Merlin transmitters that are used by providers. These transmitters contain the same hardware and software as the models used by patients in their home, but have an additional functionality called MerlinOnDemand that allows providers to use one transmitter in their office to obtain device data from multiple patients. According to the advisory, the endpoints between the implanted device and the Merlin.net website are not verified. This makes the transmission vulnerable to a “man-in-the-middle” that would allow an attacker to remotely access the device. St. Jude has said that the MerlinOnDemand-enabled devices will receive the same patch that was provided to the home-based models.

The new vulnerability comes on the heels of the U.S. Food and Drug Administration’s release of final guidance on the postmarket management of cybersecurity in medical devices.

While 2016 marked one of the least productive years in the history of Congress, the same cannot be said of health care enforcement and regulatory agencies.  Perhaps motivated by the impending change in administration, these agencies promulgated a number of notable regulations in 2016, including:

  • A Department of Justice (DOJ) Interim Final Rule that significantly increases penalties under the False Claims Act (FCA), making already high stakes litigation even higher.
  • An Interim Final Rule from the Office of Inspector General for the U.S. Department of Health and Human Services (OIG) and other agencies increasing civil penalties for violations of various statutes and regulations, including the Civil Monetary Penalties Law (CMPL) and its implementing regulations.
  • A Final Rule that addresses the OIG’s expanded authority under the CMPL.
  • A long-awaited Final Rule from the Center for Medicare & Medicaid Services (CMS) concerning the “60 Day Rule” for returning overpayments.
  • A Final Rule from the OIG that amends the safe harbors under the federal Anti-Kickback Statute (AKS) and adds exceptions under the CMPL’s beneficiary inducement prohibition.

Below we discuss the highlights of each rule and how we expect each to impact the enforcement environment in 2017 and beyond. Continue Reading Health Care Enforcement Review and 2017 Outlook: Significant Regulatory Developments

Last week, the Office of Inspector General (OIG) of the U.S. Department of Health and Human Services released a report analyzing CMS’ readiness to implement major parts of the Medicare Access and CHIP Reauthorization Act  of 2015 (MACRA). The report provides an inside look at the steps CMS is taking to implement MACRA’s Quality Payment Program (QPP), which is an ambitious transformation of the way in which the federal government reimbursements health care providers. The report highlights two key vulnerabilities for the MACRA transition, a process that will hopefully be smoother than the troubled roll out of HealthCare.gov.

Continue Reading OIG Report Offers Glimpse into CMS Progress Towards MACRA Implementation

On Wednesday, the U.S. Senate overwhelmingly passed the 21st Century Cures Act (the “Act”) by a vote of 94 to 5.  Spearheaded by Michigan Representative Frank Upton, the bill now heads to President Obama who has promised to sign it. The Act is ambitious, and will impact a wide swath of the U.S. health care system. The Act provides, among other things:

  • $4.8 billion over 10 years to support NIH research on precision medicine, neuroscience, cancer and regenerative medicine.
  • $1 billion in state grants to increase opioid abuse prevention and treatment services, including prescription drug monitoring programs, training programs and treatment programs.
  • Substantial changes to FDA regulations to accelerate the pace of bringing pharmaceuticals and medical devices to market.
  • New obligations on the part of both FDA and industry stakeholders to implement the research initiatives and regulatory changes mentioned above.
  • Other health care initiatives addressing health information technology, vaccines, national security and health care delivery.

At 996 pages, the Act cannot be summarized in one post. Instead, we plan to analyze the various aspects of the Act in multiple posts over the coming weeks. The remainder of this post will highlight provisions that support one of the Act’s primary objectives: the acceleration of drugs and devices to market. Continue Reading Senate Passes 21st Century Cures Act, but Can It Cure an Ailing FDA?

As we reported earlier this week, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights described a phishing campaign that is attempting to convince recipients of their inclusion in OCR’s Phase 2 audit program. The email, which was disguised as an official communication, suggests that recipients click on a link. This link takes recipients to a non-governmental website marketing cybersecurity services.

On Wednesday, OCR followed up their alert with additional details about the phishing campaign. According to OCR, the phishing email originates from the email address OSOCRAudit@hhs-gov.us and directs individuals to a URL at http://www.hhs-gov.us. OCR points out the subtle difference from the official email address for its HIPAA audit program, OSOCRAudit@hhs.gov, noting that such subtlety is typical in phishing scams.

OCR also took the opportunity to confirm that it has notified select business associates of their inclusion in the Phase 2 HIPAA audits.  For more information about the Phase 2 audit program please visit our earlier post.

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published an alert on Monday describing a phishing campaign disguised as an email from OCR. The email is being circulated on mock HHS letterhead under the signature of OCR’s Director Jocelyn Samuels and is being sent to HIPAA covered entities and their business associates.  The email prompts recipients to click a link regarding possible inclusion in the HIPAA Privacy, Security, and Breach Rules Audit Program. When clicked, the link takes the recipient to a non-governmental website marketing a firm’s cybersecurity services. In its alert, HHS clarified that it is in no way associated with the firm.

Covered Entities and Business Associates should be aware of this email and should make their workforces aware of it.  This can also serve as an important reminder of the importance of being vigilant about phishing campaigns and not clicking links in any email that seems suspicious or unexpected.

While the firm’s specific claims of inclusion in the audit program are not based in fact, OCR’s audit program is itself quite real. This past July we discussed the audit letters that were sent to health care providers and health care clearinghouses alerting them to their inclusion in the audit. We also described how OCR would be auditing businesses associates during the fall season. Given that fall is upon us, it is now more critical than ever for business associates to review their compliance efforts.

Most of the post-election discussion of the ACA has focused on how promises to repeal the law could impact the newly insured. But one priority area of the ACA that has received very little discussion is the federal government’s strategy to try to reign in health care costs by reducing volume and promoting quality.  Complicating the push to fully repeal the ACA is the fact that key elements of the ACA’s cost control strategy have found their way into the Medicare and CHIP Reauthorization Act (MACRA) passed by Congress in 2015.

MACRA was passed on a bipartisan, bicameral basis, creating a two-track system for Medicare provider reimbursement incentive payments. On one track is the more traditional fee-for-service reimbursement structure that will be subject to payment adjustments under a consolidated quality reporting system called the Merit-Based Incentive Payment System (MIPS). The second track, which entails greater incentive payments, addresses reimbursement for providers participating in alternative payment models (APMs) like accountable care organizations (ACOs) and other demonstration programs that have been created under CMS’s Center for Medicare & Medicaid Innovation (CMMI). We discussed these changes at length in our post last month.

While the sweeping Republican election victory portends extensive changes in many areas of health care, MACRA is not likely to see extensive changes–at least not directly.  Moving payment policy away from volume and towards quality was a goal for all the Congressional offices participating in the construction of MACRA. However, the implementation of MACRA could still face challenges if Congressional Republicans decide to repeal or constrain the ACA sections that give CMS the authority to operate the CMMI. Such a move would not be outside the realm of possibility; as we previously discussed, the CMMI has been a frequent target of criticism by Congressional Republicans. A full repeal of the ACA, or even limitations to the CMMI’s authority or budget, could cripple the government’s ability to operate the demonstration projects that are the cornerstones of MACRA.

Stakeholders need to engage with CMS moving forward, albeit a CMS under new management, to ensure that changes to the ACA do not have unintended consequences on MACRA’s implementation.  CMS may seek to streamline the numerous payment policies that have been proposed under the current Administration. Alternatively, it is possible that CMS will be active in creating its own versions of alternative payment models. One area of potential focus for further reform might be the so-called ACO Track 2 and 3 under the Medicare Shared Savings Program (MSSP), participation in which will now make providers eligible to receive APM incentive payments. Yet CMMI to date has struggled to find the right mix of payment reform, such as requiring two-sided risk, with payment incentives to show significant MSSP savings. In either case, the provider community will be closely watching the developments related to this already complex and daunting transition.