CLOSE X
RSS Feed LinkedIn Instagram Twitter Facebook
Search:
FMG Law Blog Line

Posts Tagged ‘HHS’

HHS Waives Some HIPAA Sanctions During the Coronavirus Pandemic

Posted on: March 20th, 2020

By: David Cole

The HHS Office for Civil Rights (OCR) issued two important bulletins this week in response to the coronavirus pandemic. Each one announced that OCR will temporarily waive certain sanctions and penalties for noncompliance with HIPAA Rules to help deliver care to people in need.

Limited Waiver for Privacy Rule Requirements

First, OCR issued a Limited Waiver of HIPAA Sanctions and Penalties for not complying with certain parts of the Privacy Rule. Specifically, the Waiver says that healthcare providers will not be sanctioned or penalized for not complying with the following usual requirements:

  • The requirement to obtain a patient’s consent before speaking with family members or friends involved in the patient’s care;
  • The requirement to honor a request to opt-out of the facility directory;
  • The requirement to distribute a Notice of Privacy Practices;
  • The patient’s right to request privacy restrictions; and
  • The patient’s right to request confidential communications.

The Waiver became effective on March 15, 2020, but currently only applies (1) in the emergency area identified in the public health emergency declaration; (2) to hospitals that have instituted a disaster protocol; and (3) for up to 72 hours from the time the hospital implements its disaster protocol. It is unclear if OCR will extend the time for this Waiver given the widespread and potentially prolonged nature of the coronavirus outbreak. A copy of the bulletin is available here.

Video Technology Allowed for Telemedicine

Second, OCR issued a Notification of Enforcement Discretion allowing healthcare providers to use “any non-public facing remote communication product that is available” to communicate with patients to provide telehealth during the coronavirus national emergency. As examples, OCR said it will allow healthcare providers to use video chat application like Apple FaceTime, Facebook Messenger, Google Hangouts, or Skype, to provide telehealth without risk of penalty for noncompliance with HIPAA Rules. However, Facebook Live, Twitch, TikTok, and other similar public-facing video applications are not allowed. Healthcare providers are still expected to enter into Business Associate Agreements with the technology companies providing the video communication services, but OCR says it will not impose penalties for failing to do so during the time of the national emergency. A copy of the Notice is available here.

Additional information: 

The FMG Coronavirus Task Team will be conducting a series of webinars on Coronavirus issues every day for the next week. We will discuss the impact of Coronavirus for companies in general, but also for business in insurance, healthcare, California specific issues, cybersecurity, and tort. Click here to register.

FMG has formed a Coronavirus Task Force to provide up-to-the-minute information, strategic advice, and practical solutions for our clients. Our group is an interdisciplinary team of attorneys who can address the multitude of legal issues arising out of the Coronavirus pandemic, including issues related to Healthcare, Product Liability, Tort Liability, Data Privacy, and Cyber and Local Governments. For more information about the Task Force, click here.

You can also contact your FMG relationship partner or email the team with any questions at [email protected].

**DISCLAIMER: The attorneys at Freeman Mathis & Gary, LLP (“FMG”) have been working hard to produce educational content to address issues arising from the concern over COVID-19. The webinars and our written material have produced many questions. Some we have been able to answer, but many we cannot without a specific legal engagement. We can only give legal advice to clients. Please be aware that your attendance at one of our webinars or receipt of our written material does not establish an attorney-client relationship between you and FMG. An attorney-client relationship will not exist unless and until an FMG partner expressly and explicitly states IN WRITING that FMG will undertake an attorney-client relationship with you, after ascertaining that the firm does not have any legal conflicts of interest. As a result, you should not transmit any personal or confidential information to FMG unless we have entered into a formal written agreement with you.  We will continue to produce educational content for the public, but we must point out that none of our webinars, articles, blog posts, or other similar material constitutes legal advice, does not create an attorney client relationship and you cannot rely on it as such. We hope you will continue to take advantage of the conferences and materials that may pertain to your work or interests.** 

Cyber Attack on HHS is a Reminder for Businesses to Remain Vigilant About Cybersecurity During the COVID-19 Pandemic

Posted on: March 17th, 2020

By: Renata Hoddinott

Amidst all the information and news flooding the internet regarding COVID-19, another troubling headline emerged this morning: an unknown actor launched a cyber attack on the Department of Health and Human Services (HHS) on Sunday. The attack was not a hack in the traditional sense, and no data was stolen from HHS’s systems. Rather it was an attempt to slow down HHS’s COVID-19 response by flooding the site with millions of requests over the course of several hours. It was a distributed denial of service – or DDOS – attack. The distinction is important because there was no apparent breach of the system of the lead agency responding to the coronavirus pandemic, and none of HHS’s critical functions were interrupted. HHS’s system was largely able to repel the intrusion, the agency was fully functioning at all times, and its site never crashed. But while the attack was unsuccessful, it is a harbinger of things to come and businesses should take note.

Most corporations and firms with the capability to do so have permitted, encouraged, or even mandated their employees to work from home for an extended amount of time to limit the spread of the virus. All of that remote access may be on potentially less secure networks should raise some concerns for those businesses. Bad actors will no doubt use the opportunity to gain access to less secure devices and networks to penetrate systems they may not have had access to previously due to the security in place for devices “in-house.”

Now is the time to remind remote employees to practice basic sense and security in ensuring they are only accessing company systems on private, password-protected networks. Employees also need to be watching for social engineering and phishing attacks. It may seem as though the email from the boss asking for password information or the firm’s credit card number is legitimate because employees do not have the ability to walk down the hall and ask.

And, for some smaller enterprises who may be new to remote-access, some systems may have been rolled out untested in certain circumstances to ensure business continuity. In those cases, it will be important to ensure that when restrictions are lifted and employees are able to return to work that those remote system are analyzed and secured from future threats.

This pandemic has unexpectedly and almost immediately changed the way business is conduct day-to-day around the globe. It remains to be seen whether those changes will be permanent. While most people are pulling together in this outbreak, malicious actors will always be looking for every opportunity to take advantage of the situation. During the period of social distancing and self-quarantining, individuals are desperate for up to the minute information on the crisis. Businesses need to be aware that attackers will attempt to exploit the human element now more than ever. And, as we all know, there is almost always a human element – whether an honest mistake or negligence – in most cybersecurity incidents.

In addition, FMG has formed a Coronavirus Task Force to provide up-to-the-minute information, strategic advice, and practical solutions for our clients. Our group is an interdisciplinary team of attorneys who can address the multitude of legal issues arising out of the coronavirus pandemic, including issues related to Healthcare, Product Liability, Tort Liability, Data Privacy, and Cyber and Local Governments. For more information about the Task Force, click here.

You can also contact your FMG relationship partner or email the team with any questions at [email protected].

**DISCLAIMER: The attorneys at Freeman Mathis & Gary, LLP (“FMG”) have been working hard to produce educational content to address issues arising from the concern over COVID-19. The webinars and our written material have produced many questions. Some we have been able to answer, but many we cannot without a specific legal engagement. We can only give legal advice to clients. Please be aware that your attendance at one of our webinars or receipt of our written material does not establish an attorney-client relationship between you and FMG. An attorney-client relationship will not exist unless and until an FMG partner expressly and explicitly states IN WRITING that FMG will undertake an attorney-client relationship with you, after ascertaining that the firm does not have any legal conflicts of interest. As a result, you should not transmit any personal or confidential information to FMG unless we have entered into a formal written agreement with you. We will continue to produce educational content for the public, but we must point out that none of our webinars, articles, blog posts, or other similar material constitutes legal advice, does not create an attorney client relationship and you cannot rely on it as such. We hope you will continue to take advantage of the conferences and materials that may pertain to your work or interests.**

New HIPAA Rule Brings Sweeping Changes

Posted on: May 2nd, 2013

By: David Cole

The wait is over. The new HIPAA omnibus rule that the Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) issued in January officially took effect on March 22, 2013. The deadline for compliance with most provisions is 180 days later on September 23, 2013. This means that covered entities, business associates, and subcontractors have limited time to ensure compliance. As discussed below, taking proper steps now is important, because the new rules implement a number of significant changes to HIPAA that expand the types of entities responsible for protecting patient data and reporting data breaches.

Extension to Business Associates

One of the biggest changes is that business associates are now directly responsible for complying with the Privacy Rule and Security Rule of HIPAA. A “business associate” is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information (“PHI”) on behalf of, or provides services to, a covered entity. These functions and activities include claims processing, data analysis, billing, benefit management, or services such as legal, actuarial, accounting, and financial.

In addition, the new rule adds “subcontractors” to the definition of “business associate,” which means that subcontractors that perform functions for or provide services to a business associate are also deemed business associates when they create, receive, maintain or transmit PHI on behalf of the business associate.  This broad, new definition means that any subcontractor, no matter how far removed from the original contractor, is considered a HIPAA “business associate” if it handles PHI.

Because the new rule applies the HIPAA Privacy Rule directly to business associates, both business associates and their subcontractors must now make “reasonable efforts” to limit their use, disclosure, and request for PHI to the “minimum necessary to accomplish the intended purpose of the use, disclosure, or request.” This will likely change the flow of PHI from business associates and subcontractors by making these organizations focus on the specific PHI they need to use, disclose, or request in order to perform their services.

The new rule also makes business associates and their subcontractors directly responsible for the HIPAA Security Rule. As a result, business associates and their subcontractors must develop comprehensive, written HIPAA security policies and procedures. They also must implement the specific administrative, physical, and technical safeguards of the data that is required by the Security Rule. In addition, business associates must now enter into written contracts with subcontractors that contain specific provisions required by the HIPAA Privacy and Security Rules, whereas they previously were only required to “ensure” that subcontractors agree to the same restrictions on the use and disclosure of PHI.

Breach Notification

The new rule also changes the requirements for breach notifications. Previously, the rules defined a “breach” as occurring only when the compromise of PHI presented a “significant risk of financial, reputational, or other harm to the individual.” This harm threshold will remain in effect until the interim compliance period ends on September 23, 2013. After that time, a new definition of breach will come into play.

Under the new rules, HHS eliminated the harm threshold and replaced it with a standard under which any use or disclosure of PHI that is not allowed by the Privacy Rule is presumed to be a reportable breach unless the covered entity or business associate can demonstrate, through a documented risk assessment, that there is a “low probability” that the PHI has been compromised. This risk assessment must include consideration of the following four factors: (1) the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; (2) the unauthorized person who used the PHI or to whom the disclosure was made; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which the risk to the PHI has been mitigated.

Enforcement and Penalties

Under the new rule, HHS has retained the high penalty structure currently in effect, meaning that penalties can range anywhere from $100 to $50,000 per violation, depending on culpability, up to an annual maximum cap of $1.5 million on a per provision basis. The difference is that business associates and subcontractors are now directly liable for their violations. Of course, covered entities still can be penalized for their violations as well. In addition, HHS is now required to conduct compliance reviews if willful negligence is indicated following a preliminary review of the facts.

These are just a few of the changes made by the new HIPAA rule. In addition, the new rule includes “genetic information” as a new type of health information subject to HIPAA rules, and thus imposes restrictions prohibiting health plans from using genetic information for underwriting purposes. The new rule addresses multiple privacy issues related to uses and disclosures of PHI, such as communications for marketing or fundraising, exchanging PHI for remuneration, disclosures of PHI to persons involved in a patient’s care or payment for care, and disclosures of student immunization records.