Get the full JHIM column by clicking here
An overall concern in security risk assessment (SRA) is ongoing PHI breaches and why they are occurring. A proper HIPAA risk assessment tool such as PHI Vulnerability Assessment can save your company a lot of stress.
Read more: What are HIPAA Security Risk Assessments?
Assess, Assess, Assess
To reduce the risk of phi breaches, covered entities and business associates first need to identify where they are vulnerable for breach, evaluate risk and implement a mitigation plan. We call this kind of assessment a “PHI Vulnerability Assessment”. It should include considerations for hard copy and electronic PHI.
Common Reason for Breach
The most common reported reason for electronic PHI breaches has been lost or stolen unencrypted portable devices and other electronic media. We can easily see that just by looking at the HHS “Wall of Shame.”
Typical portable devices and media include laptops, tablets, flash drives, CDs, external hard drives, smartphones, and more. The keyword is “unencrypted.” If lost or stolen devices are encrypted according to HHS standards, there is no breach.
Willful Neglect
Breach notifications are required by HITECH Act, the Breach Notification Interim Final Rule, and now Omnibus Rule requirement. If a breach event is due to an unencrypted portable device, the conclusion is potentially going to be willful neglect. Resulting penalties for improper security measures and lack of a risk management plan will then be very costly. For example, larger entities will be fined millions of dollars and almost one million dollars for smaller entities.
Add to that the potential for civil action lawsuits, cost of providing free credit report access to the individuals involved in the breach, damage to reputation, potential for additional audits and corrective action plans, and the overall negative impact can be very extensive. And all of the above could simply be due to a copier hard drive or a flash drive.
Breach Examples
We are certain that many, if not all of you, have read news about breach events. This is why a PHI Vulnerability Assessment is necessary. Just in case, here are some phi breach examples:
The OCR settled a case with Affinity Health Plan for $1.2 million that involved several photocopiers that they had rented. Affinity surrendered the tools to the owner without erasing the data. The photocopiers were then sold to a national news network and they did a TV expose when they discovered the ePHI.
In the summer of 2013, there was a major problem at a safety net organization about the release of 3,700 individuals’ information in an e-mail. Families and caregivers spoke out after an inadvertent release of ePHI in an e-mail chain.
The OCR settled with the Massachusetts Eye and Ear Infirmary (MEEI) for $1.5 million for the theft of an unencrypted laptop. MEEI also has a corrective action plan in place and had to retain an independent monitor. The information on the laptop included patient prescriptions and clinical information. MEEI previously self-reported this breach.
In 2012 BlueCross and BlueShield of Tennessee settled with OCR for $1.5 million when 57 unencrypted computer hard drives containing PHI of over 1 million individuals had been stolen from a leased facility. This was also a self-reported breach.
Tip of the Iceberg
One of your reporters writes a weekly healthcare information report and can state unequivocally that these reports are only the tip of the iceberg.
When the OCR reports that they are going to do more aggressive enforcement they really mean it. To back this up Leon Rodrigues, OCR Director stated in a September 2013 HIMSS Privacy and Security Forum that if the breach is by a Business Associate, OCR will investigate both the Business Associate and its Covered Entity.
Beyond the Firewall
In today’s world, the security perimeter has changed dramatically; it no longer ends at the firewall. And the firewall is now very porous—often with our permission.
Many healthcare entities’ perimeter is now so far beyond the edge that it is a dim horizon. We may not even be able to predict the edge of the security perimeter as it encompasses cloud storage and use. Do you know where all your cloud vendor(s) severs are? Do you know if your cloud vendor owns all the servers or do they rent them? Do you know where your ePHI is stored? Is it stored within the United States borders or “offshore” where information privacy and security rules may be very different? Are you notified by your cloud vendor(s) when new servers are added and does it include the entity name and country?
Remember when you wanted no openings in your firewall that the IT shop did not approve of and control? Well, any and all security perimeters now have many, many openings, such as for more and more remote workers, such as portal access for patients and providers, such as mobile tools including laptops, tablets, and smartphones that travel with your workforce, such as websites and other social media.
PHI Vulnerability Assessment: Get started!
To get started make a list of all categories of locations where PHI can exist in your organization. Typical examples are:
- Portable devices
- Multi-user workstations in public settings
- Single user workstations
- Servers
- Remote access
- Remote hosts
- Wi-Fi transmission
- Email transmission
- Other transmissions to the open network
- Copiers
- Fax machines
- External hard drives
- Backup tapes
- Transporting of PHI, BYOD, and/or BYOA
- Portals
- Hard copy and electronic disposal and more.
For each category or “type” of PHI location, examine current controls (policy, physical, technical) and future plans; gaps; risk likelihood and impact, and whether risk mitigation is necessary. If so, assign risk mitigation tasks and manage them. If not, document why.
Conclusion
It is no mystery that the HITECH Omnibus Rule includes increased responsibilities and liabilities for business associates and more requirements for covered entities to know how their BAs are protecting their PHI; no mystery that encryption is considered to be a business requirement to protect vulnerable PHI; no mystery why penalties have skyrocketed along with the potential for civil action lawsuits and more; no mystery why Office of Civil Rights audits are mandated for covered entities and business associates. Enough is enough! Yes, the technology revolution and the categories of locations of unprotected health information have increased tremendously over the years and that is why we keep reading about breaches. But that is no longer an excuse. CEs and BAs now know via the Omnibus Rule that they must put the word “Protected” back into their PHI.
Vulnerability Assessment Tools
Analyze your current security measures and SRA tools (security risk assessment). Get proper help with your PHI Vulnerability Assessment and avoid PHI breaches. ComplyAssistant can help. To learn more about the HIPAA security risk analysis process, HIPAA compliance software, GRC software, health insurance portability, and more, visit our healthcare cybersecurity services page or healthcare compliance software page. Or, contact one of our licensed HIPAA consultants to learn more about HIPAA privacy and what HIPAA security rule requires.
About the Authors
Gerry Blass is the President & CEO of ComplyAssistant. Gerry has over 35 years of experience in healthcare IT and compliance. ComplyAssistant provides IT and compliance consulting services and software, also called ComplyAssistant. The software is a compliance management cloud portal that provides guidance, organization, collaboration alerts, and notifications for more effective management and documentation of healthcare compliance activities.
To learn more visit our healthcare cybersecurity services page or healthcare compliance software page.