Outside of the finance industry, healthcare is one of the most regulated industries in the U.S. As the healthcare policy debates rage on, one issue on which most Americans can agree is the need to keep personal healthcare information confidential and secure.
Major regulations such as HIPAA and HITECH have been passed into law to increase the security of our personal health information. For better or worse, a major portion of the burden to comply with the regulations and all of their revisions falls upon the IT professionals.
While HIPAA (Health Insurance Portability Accountability Act), passed in 1996, has received the most attention (see our blog), the more recently implemented HITECH law is quickly having an impact.
HITECH (Health Information Technology for Economic and Clinical Health Act) was passed into law in 2009. The goal for the HITECH is to strengthen the civil and criminal enforcement of already existing HIPAA regulations that require health organizations and their business partners to report data breaches. HITECH also increases the penalties for security violations, and implements new rules for tracking and disclosing patient information breaches.
Under HITECH rules, all data breaches of PHI (protected health information) must be reported to the individuals whose data was compromised. This includes reporting files that may have been hacked, stolen, lost or even transmitted in an unencrypted fashion. If such a breach -- or potential breach -- affects 500 people or more, the media must also be notified. Breaches of all sizes must always be reported to the Secretary of Health and Human Services (HHS), but if fewer than 500 individuals' records are affected, healthcare organizations can report the breach via the HHS website on an annual basis. Larger breaches must be reported to HHS within 60 days.
The HITECH Act implements a four tier system of financial penalties assessed based on the level of "willful neglect" a healthcare organization demonstrated resulting in the breach. Fines range from $100 per breached record for unintended violations all the way up to $50,000 per record (with an annual cap of $1.5 million) when "willful neglect" is demonstrated.
HITECH requires that the software that a health organization uses to manage its EHRs must make a person's electronic PHI records available to the patient and yet remain protected from data breach by encrypting the data and securing the connection. Not surprisingly, email is not considered a secure method of data transmission.
Before HITECH, business associates of healthcare organizations were not held directly liable for privacy and security under the HIPAA rules, even though they had access to PHI. HITECH now requires that all business associates with access to PHI are subject to the HIPAA rules and must maintain Business Associate Agreements with the healthcare organization that provides the PHI. Business associates are also required to report any data breaches and are subject to the same penalties as their healthcare business partners.