1 Page1 Implementing Electronic Medical Records (EMR): Mitigate Security Risks and Create Peace of Mind The use of electronic medical records (EMRs) to maintain patient information is encouraged today and will soon be common practice in healthcare. Furthermore, the government is supporting the trend by advocating the implementation of EMRs in 2004, President George W. Bush said his goal is for the majority of Americans to have computerized medical records by 2014 i and providing financial incentives to healthcare The movement to create an electronic health record system nationally has physicians and hospitals increasingly abandoning traditional methods of record keeping and turning to EMRs the change brings with it emerging privacy and security concerns that need to be understood. providers who make the conversion. The movement to create an electronic health record system nationally has physicians and hospitals increasingly abandoning traditional methods of record keeping and turning to EMRs with the expectations that the EMR will reduce costs, improve medical outcomes and increase data reliability. While the reasoning behind the transition to EMRs is justifiable, the change brings with it emerging privacy and security concerns that need to be understood. The guidelines for the privacy and security of protected health information (PHI) contained within a patient s medical record were defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and expanded upon by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). HIPAA provides the compliance standards with how PHI should be safeguarded and protected, while HITECH specifically addresses the privacy and security associated with the transmission of PHI electronically and imposes civil monetary penalties in the event of a data breach.
2 Page2 As with traditional records, the potential liabilities associated with EMRs arise when access to PHI has been breached. HITECH defines a breach as an impermissible use or disclosure (under the Privacy Rule) that compromises the security or privacy of the PHI such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual ii. While healthcare providers may already have policies and procedures to defend against breaches of paper files, these measures would likely do little to protect against stolen laptops, lost Maintaining PHI electronically allows a single breach incident to potentially affect a greater number of individuals. This is significant because the violations correspond to the violator s level of culpability. The penalties are enforced by the Office of Civil Rights (OCR). blackberries, computer hackers and numerous other sources of potential liability that relate to electronic data. Additionally, the updated HIPAA/HITECH regulations further limit the disclosures as well as extend the requirements for business associates of covered entities in terms of who is permitted access. Maintaining PHI electronically allows a single breach incident to potentially affect a greater number of individuals - for example, one stolen laptop could contain the PHI for thousands of patients admitted to a particular hospital. This is significant because the violations correspond to the violator s level of culpability. The penalties are enforced by the Office of Civil Rights (OCR) and are as follows iii : Unintentional violations: $100 to $50,000 per violation Violations due to reasonable cause: $1,000 to $50,000 per violation Violations due to willful neglect that are corrected: $10,000 to $50,000 per violation Violations due to willful neglect that are not corrected: $50,000 per violation The maximum penalty for all violations of an identical provision in a given year would be $1.5 million. However, entities that correct violations within 30 days of discovering an unknown violation may avoid the imposition of a civil monetary penalty.
3 Page3 In addition to the possible fines in the event of a breach, the provider is obligated to provide notice to any individual who is potentially In addition to the possible fines in the event of a breach, the provider is obligated to provide notice to any individual who is potentially compromised no later than 60 days after the breach has been discovered. In light of these new and potentially significant exposures, healthcare providers should take precautions to minimize the risk of violations. compromised no later than 60 days after the breach has been discovered. The notice must contain dates of the breach and discovery, description of the PHI involved, steps taken to mitigate harm, steps the individual should take to mitigate harm and contact procedures. In light of these new and potentially significant exposures, healthcare providers should take precautions to minimize the risk of violations. This should begin in their own practices and facilities with a review of the HIPAA/HITECH privacy and security rules with their staff, employees and others who have access to PHI. They also need to implement policies and procedures relating to how PHI is stored and accessed (both electronically and otherwise), properly train staff to follow them and schedule audits to ensure compliance on a continual basis. Also, providers need to consider the flow of PHI from their practice and have business associate agreements in place with all organizations or entities with which they share PHI, such as EMR software vendors. Providers and healthcare organizations that are eligible to participate in the EMR incentive funding programs under the American Recovery and Reinvestment Act (ARRA) of 2009 should review the meaningful use security requirements and technical capabilities outlined under HITECH. One of the considerations healthcare providers may undertake is to gain insurance to provide them with protection before a breach might occur. The insurance coverage offers additional peace of mind and supports the internal processes undertaken to prevent a potential breach. In fact, some physician professional liability carriers currently offer the breach coverage to doctors in concert with their medical malpractice policies at no cost or for a minimal cost. Similar coverage is available for hospitals, long term care centers and other healthcare facilities. In evaluating the coverage available, it is important to consider what is covered (and excluded), limits of liability and premiums. Some of the features to consider include:
4 Page4 Network security and privacy insurance - including coverage for both online and offline information and coverage for defense costs and fines/penalties Network asset protection - coverage to replace or recover data that is lost, compromised, damaged or corrupted Notification expenses - coverage for the costs associated with having to notify individuals whose information has been compromised. This usually includes customer support and credit monitoring expenses for those individuals While the emergence of EMRs exposes healthcare providers to a number of risks associated with the handling and transmission of electronic PHI, a proactive risk management approach can help mitigate potential liability. Not all cyber liability insurance products are the same and healthcare providers interested in this coverage should carefully review the products and discuss them with their agents. The ultimate goal of the privacy and security regulations is to enable health information to follow the patient wherever and whenever it is needed across the continuum of healthcare delivery. Safeguarding this process as well as building the confidence of patients and providers creates a real advancement in health information collection, exchange and technology. Further, while the emergence of EMRs exposes healthcare providers to a number of risks associated with the handling and transmission of electronic PHI, a proactive risk management approach can help mitigate potential liability. This includes: Staff training Policies and procedures that delineate what is collected and who has access Security plans in place in concert with the EMR vendor or partner Monitoring systems to ensure that any unsuspected attempted breaches can be detected Breach Disaster Plan in place to act quickly in the case of a breach to meet the notification requirements under HITECH
5 Page5 Becoming aware of the risks and the privacy and security requirements outlined under HIPAA/HITECH, purchasing cyber coverage and instituting a proactive risk management plan can work in concert to create a peace of mind for healthcare providers utilizing EMRs. Drew Becker Manager, Physician Underwriting & Program Management Clarity Group, Inc Chicago, IL For more information, please contact Drew Becker at or visit our website at 2011 Clarity Group, Inc. i Associated Press (January 27, 2005). Bush pushes computerized medical records. Retrieved from ii U.S. Department of Health & Human Services. Retrieved from iii Federal Register, Vol. 74, No. 209 (October 30, 2009). Rules and Regulations. Retrieved from
2014 Healthcare IT Security Checklist & Recommendations www.nuvodia.com 2014 HEALTHCARE IT SECURITY CHECKLIST & RECOMMENDATIONS WHILE IT SERVICES ARE AN INTEGRAL PART OF DAILY OPERATIONS FOR EVERY INDUSTRY,
Data Breach Response Guide By Experian Data Breach Resolution 2013-2014 Edition Trust the Power of Experience. 2013 ConsumerInfo.com, Inc. Table of Contents Introduction 3... Data Breach Preparedness 4...
Privacy and Security of Electronic Health Information Version 2.0 April 2015 The information contained in this Guide is not intended to serve as legal advice nor should it substitute for legal counsel.
After Hours Triage Answering Services (AHTAS) RFP 15-573757-MW Date Issued: July 30, 2015 *QUESTION DUE DATE: August 4, 2015 Buyer Contact: Michael Wegmann *SUBMITTAL DUE DATE: August 13, 2015 Tel # (916)
Data breach notification guide: A guide to handling personal information security breaches August 2014 The Office of the Australian Information Commissioner (OAIC) was established on 1 November 2010 by
What to do When Faced With a Privacy Breach: Guidelines for the Health Sector ANN CAVOUKIAN, PH.D. COMMISSIONER INFORMATION AND PRIVACY COMMISSIONER/ONTARIO Table of Contents What is a privacy breach?...1
Cyber and Data Security Risks and the Real Estate Industry by: Joe Fobert Real Estate and Retail Industry Practice Leader Real Estate Practice Group, AIG Property Casualty M. Leeann Irvin Director Issue
Standards for Internal Control in New York State Government October 2007 Thomas P. DiNapoli State Comptroller A MESSAGE FROM STATE COMPTROLLER THOMAS P. DINAPOLI My Fellow Public Servants: For over twenty
2013 HIPAA/HITECH AMENDMENTS: HOW THE CHANGES IMPACT THE ediscovery PROCESS Brian Brown Danny Tijerina RenewData, an LDiscovery Company Austin, TX Introduction Maintaining compliance with government regulations
New York State Office of the State Comptroller Division of Local Government and School Accountability LOCAL GOVERNMENT MANAGEMENT GUIDE Information Technology Governance Thomas P. DiNapoli State Comptroller
CONSULTATION PAPER P019-2014 SEPTEMBER 2014 GUIDELINES ON OUTSOURCING PREFACE 1 MAS first issued the Guidelines on Outsourcing ( the Guidelines ) in 2004 1 to promote sound risk management practices for
Why HIPAA Compliance Should Scare You and What You Should Ask Your Business Phone Service Provider NOW By Mike McAlpen, 8x8 Executive Director of Privacy, Security and Compliance The Champion For Business
Federal Register / Vol. 65, No. 52 / Thursday, March 16, 2000 / Notices 14289 6. Problems or adverse events connected with a shortage of pharmacists, e.g., medication errors; 7. The impact a drug benefit
CLOUD COMPUTING: IS YOUR COMPANY WEIGHING BOTH BENEFITS & RISKS? Toby Merrill CLOUD COMPUTING: IS YOUR COMPANY WEIGHING BOTH BENEFITS & RISKS? Toby Merrill Toby Merrill, Thomas Kang April 2014 Cloud computing
ICO lo Notification of data security breaches to the Information Commissioner s Data Protection Act Contents Overview... 2 What the DPA says... 2 Reporting a breach... 2 Potential detriment to data subjects...
United States Government Accountability Office Report to Congressional Requesters April 2014 INFORMATION SECURITY Agencies Need to Improve Cyber Incident Response Practices GAO-14-354 April 2014 INFORMATION
THE KROGER CO. POLICY ON BUSINESS ETHICS TO OUR ASSOCIATES AND DIRECTORS: The public and all who scrutinize business behavior expect a high degree of integrity from every business organization. Companies
Action Plan for Import Safety A Report to the President Interagency Working Group on Import Safety November 2007 Interagency Working Group on Import Safety: Department of Health and Human Services Department
CORPORATE RESPONSIBILITY AND CORPORATE COMPLIANCE: A Resource for Health Care Boards of Directors THE OFFICE OF INSPECTOR GENERAL OF THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AND THE AMERICAN HEALTH
V 1.0 November, 2010 CYBERSECURITY The protection of data and systems in networks that connect to the Internet 10 Best Practices For The Small Healthcare Environment Your Regional Extension Center Contact
The Impact of Electronically Stored Information on Corporate Legal and Compliance Management White paper The impact of electronically stored information on corporate legal and compliance management: An
Checklist to Assess Security in IT Contracts Federal Agencies that outsource or contract IT services or solutions must determine if security is adequate in existing and new contracts. Executive Summary
A REPORT BY HARVARD BUSINESS REVIEW ANALYTIC SERVICES Meeting the Cyber Risk Challenge Sponsored by ABOUT ZURICH INSURANCE GROUP Zurich Insurance Group (Zurich) is a leading multi-line insurance provider
Summary of Responses to an Industry RFI Regarding a Role for CMS with Personal Health Records Table of Contents EXECUTIVE SUMMARY... 4 1. INTRODUCTON... 7 2. CMS ROLE WITH PHRs... 9 What PHR functionalities