Healthcare Law and IT

Brittany

Technology is constantly evolving and advancing. As the healthcare industry becomes more electronic the laws protecting patient health information also need to evolve to cover the ever changing technologic advances. The concerns of protecting patients’ private healthcare information have grown as the use of electronic medical records has become more prevalent throughout the industry. In the 1960s computers began being used for generalizing human behavior. A physician established the idea of the Electronic Medical Record (Srinivasan, 2013). Unfortunately, the usage of electronic medical records did not become more mainstream until two decades later. (Srinivasan, 2013). As the use of EMRs became more prevalent healthcare information technology has played a “pivotal role in improving healthcare quality, cost, effectiveness, and efficiency,” (Srinivasan, 2013). However, the use of healthcare information technology has brought up concerns about privacy and protection of patient health information.

In 1996, the Health Information Privacy and Accountability Act also known as HIPAA was passed. This was the first federal law regulating the privacy of health information. HIPAA was “designed primarily to modernize the flow of health information” (Solove, 2013). While at this time medical records were still in paper form, it was clear that health records would become digital in the future. (Solove, 2013). In the early years of HIPAA there was much confusion and no civil enforcement actions were taken. The Department of Health and Human Services (HHS) proposed a privacy regulation that was finalized in 2000. The Privacy Rule “governs personal health information, which is any ‘individually identifiable health information’ a broad definition including paper records.” (Solove, 2013). The HIPAA Security Rule, established in 2003, provides a detail series of administrative, physical, and technical requirements for electronic PHI (Solove, 2013). As HIPAA became a part of everyday practices the HIPAA enforcement and compliance changed. In 2009 the Health Information Technology for Economic and Clinical Health Act (HITECH) was passed as part of the American Recovery and Reinvestment Act (ARRA). HITECH included the first federal data security breach notification requirement and also required Department of Health and Human Services to conduct HIPAA privacy and security audits (Solove, 2013).

The process of the audit starts internally; healthcare organizations are expected to monitor for breaches of personal health information from both internal and external sources. The HITECH Omnibus Rule, “implies that organizations perform reasonable due diligence by actively auditing and monitoring for PHI breaches. Exercising this due diligence protects organizations in the event that a violation occurs, and it may help to identify violations that wouldn’t have otherwise been uncovered” (AHIMA). Electronic medical records allow many people within a healthcare organization to have access to a medical record. “According to the American Health Information Management Association an average of 150 people have access to a patient’s medical records during the course of a typical hospitalization” (Solove, 2013). Healthcare organizations must establish a security audit strategy and process to govern who those people are, and what information they are able to see. To do this a security official leads a multidisciplinary team including IT, risk management and health information management. This team is responsible for identifying strategy and process. Some actions these teams should take are: creating a diagram of how electronic personal health information (ePHI) flows within the organization, create warning banners on all network and application screens, involve application owners to determine what user activities should trigger an entry into the audit trails, and determine how random audits will be conducted as well as the frequency of those audits. (AHIMA). The team would also need to determine what to audit, this would mean the team would need to identify “trigger events.” Trigger events are the criteria that will flag questionable access of confidential ePHI and prompt further investigation. (AHIMA). Healthcare organizations should have a process for a regular internal review of their audit reports. The Office of Civil Rights will conduct external audits.

The Office of Civil Rights enforces the HIPAA privacy and security rules. According to the Office of Civil Rights website, “one way OCR carries out this responsibility is to investigate complaints filed with it.” If OCR accepts a complaint for investigation, OCR will notify the person who filed the complaint and the covered entity. During the investigation the OCR reviews the information or evidence it gathers in each case. The Office of Civil Rights will determine if the covered entity did or did not violate the requirements of the Privacy or security rule. If the covered entity was not in compliance the OCR will attempt to resolve the case by obtaining voluntary compliance, corrective action and/or a resolution agreement. (OCR).

In compliance with HITECH the Office of Civil Rights has also put together an audit program. The audit program “analyzing processes controls and polices of selected covered entities pursuant to the HITECH Act audit mandate.” (HHS) This audit protocol “covers privacy rule requirements for (1) notice of privacy practices for PHI, (2) rights to request privacy protection for PHI, (3) access of individuals to PHI, (4) administrative requirements, (5) uses and disclosures of PHI, (6) amendment of PHI, (7) accounting of disclosures.” (HHS) The protocol also covers “security rule requirements for administrative, physical and technical safeguards and breach notification rule.” (HHS). Every covered entity and businesses associates are eligible for an audit. In order to begin the process for an audit the Office of Civil Rights will notify the covered entity in writing. The OCR expects the covered entity to provide the requested information within 10 business days of the request for information. Covered entities will be notified between 30 and 90 days of an onsite visit. (HHS) The first key activity of the audit is to conduct risk assessment. During this activity the OCR inquires management as to whether formal or informal policies or practices exist to conduct an accurate assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI (HHS). The next step of the audit is to acquire the IT systems. During this part the OCR and management discuss formal and informal policies that evaluate the content in relation to the specified performance to meet the HIPAA security rule. The OCR then checks to see that the covered entity has implemented procedures to “regularly review records of information system activity such as audit logs, access reports and security incident tracking reports” (HHS). This is where the internal auditing logs are used. Those logs show that an appropriate review process is in place to review the information systems activities. The covered entity is also required to have security measures in place to reduce risk and vulnerabilities to a reasonable and appropriate level. This is reviewed during the risk management activity of the audit. The final step of the audit is to determine the security official. The performance criteria states “the responsibility for security should be assigned to a specific individual or organization to provide an organization focus and importance to security and that assignment be documented” (HHS). After the audit the Office of Civil Rights will determine if the covered entity is within compliance of the HIPAA privacy and security rules. As described earlier if the covered entity is not compliant the Office of Civil Rights will attempt to resolve the case by obtaining “voluntary compliance, corrective action and/or resolution agreement” (HHS). “If the covered entity does not take action to resolve the matter in a way that is satisfactory, OCR may decide to impose civil money penalties (CMPs) on the covered entity. If CMPs are imposed, the covered entity may request a hearing in which an HHS administrative law judge decides if the penalties are supported by the evidence in the case” (HHS).

Another form of checking if an entity is HIPAA compliant is Joint Commission Audits. The Joint Commission is “an independent, not-for-profit organization that accredits and certifies more than 20,500 health care organizations and programs in the United States. Joint Commission accreditation and certification is recognized nationwide as a symbol of quality that reflects an organization’s commitment to meeting certain performance standards” (Joint Commission). In July 2013, the Office of National Coordinator for Health IT (ONC) contracted with the Joint Commission “to better detect and proactively address potential health IT-related safety issues across a variety of health care settings” (HHS). In the Joint Commission manuals there are two information management standards that address a healthcare organization’s responsibility to maintain privacy and security. The first standard states: “The hospital protects the privacy of health information.” The second standard states: “The hospital maintains the security and integrity of health information.” Both these standards require written policies, policy enforcement, monitoring policy compliance and monitoring information to improve policy, confidentiality and security (AHIMA).

A section of the Joint Commission audit is meaningful use. The meaningful use audit requires vendors to demonstrate that their product meet the “technical safeguards” in the HIPAA security rule. The vendors must participate in the ONC multi-stage “meaningful use” electronic health record incentive and become certified through the Office of National Coordinator for Health IT (AHIMA). Each year the Joint Commission sets the National Patient Safety Goals. These goals are used to improve patient safety. In 2011 it was proposed that the National Patient Safety Goals became part of the meaningful use certification. This would allow healthcare organizations to use data to track the goals. For example, January 1st, 2014 the 2014 National Patient Safety Goals for Hospitals was released. The priorities for hospitals improvement were: identify patients correctly, improve staff communication, use medicines safely, use alarms safely, prevent infection, identify patient safety risks and prevent mistakes in surgery. (Joint Commission). Identify patients correctly; this goal states that two patient identifiers must be used. For example, the patient’s name and date of birth should both be used to insure the patient is receiving the correct treatment. If the National Patient Safety Goals were made a part of the meaningful use certification these would be requirements of the system before it would even be used in a healthcare organization.

The healthcare industry is changing rapidly. The use of electronic medical records has increased significantly within the last decade. But as the use of technology grows, the concerns for protecting personal health information also grow. In 1996 when the Health Information Privacy and Accountability Act or HIPAA was first passed it was not actively enforced. Soon later it became clear as more records became electronic that the law would have to evolve in order to protect healthcare information. In 2009 the Health Information Technology for Economic and Clinical Health Act (HITECH) was passed as part of the American Recovery and Reinvestment Act (ARRA). HITECH included the first federal data security breach notification requirement and also required Department of Health and Human Services to conduct HIPAA privacy and security audits (Solove, 2013). These audits being conducted today help to determine if a covered entity is compliant with the HIPAA security and privacy acts. The Department of Health and Human Services, along with the Joint Commission work to ensure that all healthcare organizations and business associates protect patients’ most personal information, their health records. It is clear that the healthcare industry and the laws protecting patient safety must be prepared to constantly evolve with the technologic advances that are clearly going to continue to happen.

Resources

AHIMA. "Privacy and Security Audits of Electronic Health Information." Journal of AHIMA 88, no.3 (March 2014): 54-59.

Department of Health and Human Services. How OCR Enforces HIPAA Privacy and Security Rules. Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/enforcement/process/howocrenforces.html

Joint Commission. About Joint Commission. Retrieved from: http://www.jointcommission.org/about_us/about_the_joint_commission_main.aspx

Solove, Daniel J. "HIPAA Turns 10: Analyzing the Past, Present and Future Impact." Journal of AHIMA 84, no.4 (April 2013): 22-28.

Srinivasan, D. (2013). Impact of Healthcare Informatics on Quality of Patient Care and Health Services