Privacy and Security Challenges of Meaningful Use

Transcription

1 Privacy and Security Challenges of Meaningful Use Rich Cohan, MBA, FACHE, CHC, CCEP Adam H. Greene, JD, MPH DISCLAIMER: The views and opinions expressed in this presentation are those of the author and do not necessarily represent official policy or position of HIMSS.

2 Conflict of Interest Disclosure Rich Cohan and Adam H. Greene Have no real or apparent conflicts of interest to report HIMSS

3 Learning Objectives Analyze the impact of the adoption of certified EHR technology on compliance with the HIPAA Security Rule Describe how provision of patient access to EHR under Meaningful Use program differs from right of access under HIPAA Identify new areas of electronic protected health information that are created by certified EHR technology and subject to HIPAA 3

4 Agenda MU and the Providence Approach Relation of MU, EHR Certification Criteria, and HIPAA laws Impact of CEHRT on HIPAA Compliance MU and HIPAA 4

5 EHR Electronic health record HIPAA Administrative Simplification Subtitle of Health Insurance Portability and Accountability Act, as amended, and implementing regulations HITECH Act Health Information Technology for Economic and Clinical Health Act MU Meaningful use program for EHR incentive payments CEHRT Certified electronic health record technology EH Eligible hospital or critical access hospital EP Eligible professional emar Electronic medication administration record 5

6 MEANINGFUL USE AND THE PROVIDENCE APPROACH

7 MU and the Providence Approach Providence Vision: Together, we answer the call of every person we serve: Know me, care for me, ease my way. Providence and MU: 32 eligible hospitals totaling over 7,000 beds Several thousand EPs Numerous EHRs Historically Decentralized Organization Coming Together 7

8 MU and the Providence Approach Governance Structure Charter Routine Meetings Senior Leadership sponsorship and regular reporting Challenges Competition for resources (e.g. EHR implementation) Changes in EHR implementation schedule Bandwidth issues Managing costs 8

9 PH&S Mission: As people of Providence, we reveal God s love for all, especially the poor and vulnerable, through our compassionate service. Role of MU: The HITECH Act provides Medicare and Medicaid EHR incentive programs that provide incentive payments to eligible providers, eligible hospitals and critical access hospitals (CAHs) as they adopt, implement, upgrade or demonstrate Meaningful Use of certified EHR Technology. The purpose of the Meaningful Use Leadership Council is to ensure that Providence receives the fullest possible benefit allowed under the American Recovery Reinvestment Act of 2009 (ARRA) and that required activities to achieve full reimbursement are coordinated across Providence. 9

10 Meaningful Use Program Organization OCIO OCFO Regional Executive Steering Committees Leadership Council Executive Sponsor EHR Team System Program System Program Executive Leadership Team System Program Work Team Program Sponsor Informatics Business Meaningful Use Leadership Council Owner Chair and Facilitator Program Manager Finance Working Group Facilitator: Project Managers Working Group Facilitator AK Sponsor: IT PM: PHC Sponsor: PMG PM: Regional Steering Committees CA Sponsor: Finance PM: SER Sponsor: Finance PM: NWR Sponsor: Operations PM:: SWR Sponsor: Finance PM: OR Sponsor: Operations PM: WMR Sponsor: Finance PM: Clinical Quality Compliance & Audit Communications Finance IT EHR Vendor Rep EHR Project PMG Providers Regional Leads

11 Responsibility Executive Oversight Program Mgmt System Office Regional Shared Services Facility/Ministry EHR Project Team Project Sponsor/Steering Committee PMG Operations Program Lead Program Manager Administrative Support Provider Compliance System Accounting Office System Reimbursement Office Physician Division / PMG Operations Audit & Compliance Project Sponsor/Steering Committee Regional Hospital CFO System Information Services Reimbursement Team MU Project Manager CEO CFO Hospital Clinical Managers Provider Clinic Manager System Project Director Finance Director Regional Project Directors EHR Clinical Champions 11

12 Responsibility Executive Oversight Program Management System Office Regional Shared Services Facility/Ministry EHR Project Team Project Sponsor/Steering Committee PMG Operations Program Lead Program Manager Administrative Support Provider Compliance System Accounting Office System Reimbursement Office Physician Division / PMG Operations Audit & Compliance Project Sponsor/Steering Committee Regional Hospital CFO System Information Services Reimbursement Team MU Project Manager CEO CFO Hospital Clinical Managers Provider Clinic Manager System Project Director Finance Director Regional Project Directors EHR Clinical Champions Financial Analysis & Accounting Determine Provider Eligibility Define Accounting Processes Define MU Cost Allocation Method for CAH A C I I C R I I I I I A C I I R C C C C C I I C I A I I R C C C C I C I I C C 12

13 MU Compliance Development of compliant processes Configuration of compliant EHR Compliance Reporting Tracking Tool Development Tracking Tool Initial Implementation Tracking Tool Rollout Identification of MU Criteria/Quality Objectives to Report Hospital Identification of MU Criteria/Quality Objectives to Report Providers Entry of compliance reports/data into tracking tool Hospitals Entry of compliance reports/data into tracking tool EPs Attestation Initial Develop Attestation Process Hospital Develop Attestation Process Provider Attest Hospitals Attest Eligible Providers Record MU Costs on CAH Cost Report 13

14 Attestation Initial Develop Attestation Process Hospital Develop Attestation Process Provider Attest Hospitals Attest Eligible Providers Record MU Costs on CAH Cost Report 14

15 2012 Objectives Measurement EOY Status MEDICARE 90 Day Attestation complete for > 70% of all Stage 1, Year 1 Providence eligible hospitals Target Goal Stretch Goal MEDICARE 365 Day Attestation complete for initial set of hospitals MEDICARE 90 Day Attestation complete for > 50% of all Providence eligible providers Achieve meaningful use of health information systems to promote superior clinical outcomes and to comply with funding from the Health Information Technology for Economic and Clinical Health (HITECH) Act All Providence regions ARRA MU project teams have working ministry level MU sponsors / local team. Effectively aligned with region and system governance 15 xx xx Stage 1, Year 2 Target Goal Stretch Goal xx xx Stage 1, Year 1 Target Goal Stretch Goal xx xx Three management tools used to achieve consistent, system wide reporting & collection of ARRA incentive funds. Target Goal Stretch Goal xx xx Ministry leads identified Epic reports monitored by mgt. Target Attestation dates met

16 MU and the Providence Approach Status Reporting Please find below the Meaningful Use System Initiative status report for the biweekly period ending x/x/201x: Meaningful Use Target Incentive Revenue Booked: $X % Approved Dedicated Roles Filled Hospital & Provider Attestations Actual Total to Date: $Y On Track On Track 16

17 MU and the Providence Approach 17

18 RELATION OF MEANINGFUL USE, EHR CERTIFICATION CRITERIA, AND HIPAA

19 Relation of Laws EHR Certification Criteria Governs software, not conduct Primarily intended to support MU Includes features that are not required by MU Secondarily supports HIPAA compliance Certification Criteria 19

20 Relation of Laws Meaningful Use Voluntary incentive program Requires use of certified EHR technology Governs conduct of health care providers Primary focus is adoption and use of EHRs Meaningful Certification Criteria Use 20

21 Relation of Laws HIPAA Compliance is required Covers all protected health information Focused entirely on privacy and security Meaningful Use Certification Criteria HIPAA 21

22 IMPACT OF CERTIFIED EHR TECHNOLOGY ON HIPAA COMPLIANCE

23 2011 EHR 2014 EHR HIPAA Required? Certification Criteria & HIPAA Access control Access control (a)(1) R Emergency access Emergency access (a)(2)(ii) R Automatic log off Automatic log off (a)(2)(iii) A Audit log Audit log (default on, limited ability to turn off) (b) Integrity Integrity (e)(2)(i) A R 23

24 2011 EHR 2014 EHR HIPAA Required? Certification Criteria & HIPAA Authentication Authentication (d) R Encryption at rest Encryption in transit Accounting of disclosures (optional) Encryption at rest (no unencrypted data left on end user device) (a)(iv) Encryption in transit (e)(2)(ii) A Accounting of disclosures (optional) A R Amendment R Secure messaging (e)(2)(ii) A 24

25 Impact of CEHRT on Providence Planning in an organization with 55,000 (now 65,000) employees and across thousands of credentialed physicians Focus on the patient How to share and still protect Tools tools tools 25

26 MEANINGFUL USE AND HIPAA

27 Stage 1 MU & eaccess Core: ecopy of health information on request (50% w/in 3 business days, EH/EP) Core: edischarge instructions on request (50%, EH only) Core: Hard copy of clinical summary (50% all patients within 3 days, EP only) Menu: eaccess (10% availability w/in 4 days, EP only) Stage 2 Core: eaccess (view, download, or transmit) (50% availability w/in 36 hrs (EH) or 4 days (EP), 5% actually access) 27

28 eaccess: MU vs. HIPAA MU Shorter time frames (3 to 4 days) Limited EHR information Percentage of patients E copy as provided by EHR HIPAA days + 30 day extension Medical record, billing record, anything else used for treatment/payment All patients Form and format of patient s choice, if readily producible 28

29 Providence E-Challenges Faced eaccess Community Value: Available personal health information any time Reduced time between test and shared results Parent needs for school/sports do not require office visit Reminders for follow-up actions keep patients on path toward healing Links to support groups or health-sheets/videos from trusted sources 29

30 Providence E-Challenges Faced ecopies: Encrypted CDs eaccess: Patient eaccess Methods Patient Identification Spreading the word and encouraging participation 30

31 Stage 1 MU and Treatment HIE Core: Capability to electronically exchange key clinical information (one attempt, EH/EP) Menu: Exchange summary of care w/ transition (50% of transitions, EP) Stage 2 Core: Exchange summary of care w/ transition (50% of transitions, 10% electronically, one with other vendor system or CMS interface, EH/EP) 31

32 HIPAA and Treatment HIE Will not be subject to minimum necessary standard because for treatment Patient can request restriction (e.g., opt-out), but provider not required to agree Have potential threats and vulnerabilities been addressed in risk analysis? Is transmission encrypted if reasonable and appropriate? 32

33 Providence Experience with MU Treatment HIE Establish process and test test test Providence Hospital Non-Providence Providers Provider Owned Clinics Non-Providence Providers Support with policy Use HL7 for communication with non-providence providers 33

34 MU and Public Health HIE Stage 1 Menu: Immunization registries (one test, EH) Menu: Lab results (one test, EH) Menu: Syndromic surveillance (one test, EH) Stage 2 Core: Immunization registries (ongoing, EH/EP) Core: Lab results (ongoing, EH) Core:/Menu: Syndromic surveillance (ongoing, core EH, menu EP) Menu: Cancer cases (ongoing, EP) 34

35 HIPAA and Public Health HIE Do all disclosures comply with Privacy Rule? To a public health authority? Minimum necessary? Have potential threats and vulnerabilities been addressed in risk analysis? Is transmission encrypted if reasonable and appropriate? If partnering with HIE, is business associate agreement in place? Does BA contract permit disclosure to public health authorities? 35

36 Providence and HIEs Establish process and test test test Providence HIE (state by state) Support with privacy and security policies Know HIE s business model Execute Business Associate Agreement(s) 36

37 Patient Reminders and MU Stage 1 Menu: Reminders per patient preference (20% of > 65 yrs old and < 5 yrs old, EP) Stage 2 Core: Reminders per patient preference (10% of all patients w/ two or more visits in past 24 months, EP) 37

38 Patient Reminders and HIPAA HIPAA requires provider to accommodate reasonable requests to receive communications by alternative means or at alternative locations MU fits well with HIPAA due to recognition of patient preference HHS guidance suggests that unencrypted s for reminders may be permissible if consistent with patient preference 38

39 Providence and Patient Reminders Secure communication through the EHR/patient portal Respect patient preference for communication where reasonable 39

40 Secure Messaging and MU Stage 2: Core: Secure message sent by patient (5% of patients seen during EHR reporting period, EP) Secure message can take any encrypted form (encrypted , portal message, etc.) 40

41 Secure Messaging with Patients MU focuses on patient-initiated communications, while HIPAA focuses on provider-initiated communications Provider-initiated communications should be addressed in risk analysis Consider likelihood of risk (e.g., interception, misdirection) Consider impact of risk (may vary based on content) Some communications may not require secure system 41

42 Providence and Secure Messaging EHR/Patient Portal Focus Encryption of messages Data Loss Prevention system and policy drive use of other communication Risk Assessment Addressed 42

43 Stage 2 emar and MU Core: Electronically track medications (10% of medication orders, EH) Right patient Right medication Right dose Right route Right time 43

44 emar and HIPAA Is new ephi related to emar included in risk assessment (including any ephi that resides on devices)? What are the threats and vulnerabilities (e.g., loss of devices, interception of transmissions)? Are all risks managed to a reasonable and appropriate level? Is information encrypted if reasonable and appropriate? (at rest and in transit) 44

45 Providence and emar Working on it!! Possible 3 rd party solution that searches pharmacy records Question: How to get an accurate starting point? EHR to manage process moving forward is the easy part when the patient is going to a Providence provider, outpatient facility or hospital 45

46 Stage 1 Risk Assessment and MU Core: Risk analysis in accordance with HIPAA, implement security updates and correct identified security deficiencies as part of risk management process (EH/EP) Stage 2 Core: Same as Stage 1, plus addressing the encryption/security of data stored in CEHRT (EH/EP) 46

47 Risk Analysis Under MU & HIPAA Risk Analysis is required under both MU and HIPAA MU focused on EHR; HIPAA applies to all PHI HIPAA does not state how often; MU requires updating once/year MU Stage 2 measure emphasizes analysis of encryption of EHR data at rest Under HIPAA, don t forget about non-ehr on mobile devices Follow HIPAA and you should be fine 47

48 Risk Assessment at Providence Significant focus on security across enterprise Led by world class CISO and team! Formal risk management process Ties to Enterprise Risk Management approach Results feed Security Strategic Plan and Annual Work Plan Reports made to System Compliance Committee (Senior Leaders) and Board Audit and Compliance Committee 48

49 Providence Summary Governance! Governance! Governance! MU journey is not a project it is a long-term program Business Analysis is KEY to success Engage Compliance, Privacy, Security and Internal Audit early on in process in consulting role Sticking with standard technology stack allows the app to grow organically Development standards count! It s estimated that additional phases will take only 40 hours dev/phase at Providence 49

50 Thank You! Rich Cohan, MBA, FACHE, CHC, CCEP Adam H. Greene, JD, MPH