While the future of the Patient Protection and Affordable Care Act and any potential replacement legislation is still in question, the Office for Civil Rights (“OCR”) within the U.S. Department of Health and Human Services (“HHS”) has clarified through its recent actions that the HIPAA privacy, security, and breach notification rules contained at 45 C.F.R. Parts 160 and 164 (the “Administrative Simplification Rules”) are here to stay. Audits initiated by OCR and investigations resulting from reported violations reveal that HIPAA compliance continues to be a governmental priority under the new administration. Indeed, nine representative resolution agreements have been released by HHS thus far in 2017 (the latest being released earlier this week) assessing a range of penalties from $31,000 to $5.5 million for a covered entity’s failure to comply with various aspects of HIPAA (including but not limited to failure to conduct a thorough and accurate risk analysis, failure to have a business associate agreement in place, failure to have comprehensive policies and procedures in place and implemented, and failure to protect protected health information (“PHI”) from improper use and disclosure). Thus, it is as important as ever for employer-sponsored group health plans to ensure that they are complying with HIPAA’s encompassing and technical requirements. As the various resolution agreements detail, failure to do so can have dire financial consequences on the group health plan (and correspondingly on the sponsoring employer).
HIPAA’s Administrative Simplification Rules require covered entities and their business associates to protect the confidentiality, integrity, and availability of PHI from improper use and disclosure. A group health plan falls within the definition of “covered entity.” Third parties who create, receive, maintain and/or transmit PHI for or on behalf of a covered entity are generally considered “business associates.” See 45 C.F.R. 160.103. Complying with HIPAA’s Administrative Simplification Rules can be a daunting task for group health plans and the employers sponsoring them. For example, administratively, group health plans are required to create, maintain, implement, and periodically review and update several written documents. The following provides a “checklist” approach of some important documents that group health plans need to have in place in order to comply with the Administrative Simplification Rules. Please keep in mind, however, that merely having the documents in place is insufficient from a HIPAA compliance standpoint; group health plans (and plan sponsors) also need to ensure that they are actually implementing, adhering to, and periodically reviewing the substance of the documents. Thus, it is imperative for employer-sponsored group health plans to continually evaluate their HIPAA compliance position with experienced HIPAA legal counsel. Even minor deficiencies can result in substantial penalties.
1. Business Associate Agreements
A covered entity may permit a business associate to create, receive, maintain or transmit PHI on its behalf only after it obtains satisfactory assurances in the form of a written business associate contract that the business associate will appropriately safeguard the information. See 45 C.F.R. sections 164.502, 164.504, and 164.314. A business associate agreement is a cornerstone HIPAA requirement that is commanding more and more scrutiny by the government.
For example, a resolution agreement released on April 20, 2017, demonstrated that a covered entity’s failure to have a business associate agreement in place with a third party vendor that had access to the covered entity’s PHI was a $31,000 mistake. Interestingly, the compliance review of the covered entity was initiated by OCR following OCR’s investigation of the business associate. The two-year corrective action plan associated with the $31,000 fine required, among other things, that the covered entity revise its HIPAA policies and procedures to require: (1) the designation of one or more individual(s) who are responsible for ensuring that the covered entity enters into a business associate agreement with each of its business associates prior to disclosing PHI to the applicable business associate; (2) the creation of a standard template business associate agreement; (3) a process for assessing current and future business relationships to determine whether each relationship is with a “business associate;” (4) a process for negotiating and entering into business associate agreements with business associates prior to disclosing PHI to the business associate; (5) a process for maintaining documentation of business associate agreements for at least six years beyond the date of when the business associate relationship is terminated; and (6) a process to limit disclosures of PHI to business associates to the minimum necessary amount of PHI that is reasonably necessary for business associates to perform their duties.
The government’s demand for the creation of a standard template business associate agreement is of particular note for employers sponsoring group health plans for some important reasons. First, HIPAA’s Administrative Simplification Rules contain detailed provisions that must be included in a business associate agreement; variations from these strict regulatory requirements can make the agreement noncompliant. If a group health plan has a template business associate agreement in place prepared by experienced HIPAA legal counsel, it can be assured that the agreement is HIPAA compliant. When the document has been prepared by another party (such as the business associate), the group health plan should have the agreement carefully reviewed to ensure each of the regulatory provisions are correctly stated. Second, like any contract, business associate agreements can be drafted in a one-sided manner. A group health plan will want to have its standard business associate agreement prepared to adequately address, among other items, reporting time limits and indemnification requirements in the group health plan’s favor. While the HIPAA Administrative Simplification Rules set forth minimum requirements, keep in mind that additional information can be included within the agreement. Thus, each contract should be reviewed to ensure that the additional provisions are in fact desirable to be included from the group health plan’s perspective.
2. Security Policies and Procedures
A covered entity is required to implement reasonable and appropriate written policies and procedures to comply with the standards, implementation specifications, and other requirements of the security rules. See 45 C.F.R. 164.316. This requires the covered entity to implement administrative, physical, and technical safeguards to protect the confidentiality and integrity of electronic PHI (“EPHI”). Various resolution agreements highlight the need: (1) for comprehensive security policies and procedures; (2) to train workforce members on the policies and procedures; and (3) periodically evaluate the scope of the policies and procedures.
One of the cornerstones of a covered entity’s security policies and procedures is its security management process. This requires the covered entity to: (1) periodically conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI held by the covered entity; (2) implement security measures sufficient to reduce the detected risks and vulnerabilities to a reasonable and appropriate level; (3) apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures; and (4) implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
Indeed, two April 2017 resolution agreements demonstrate the need to conduct a thorough and accurate risk analysis to assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of EPHI and to implement security measures sufficient to reduce those risks and vulnerabilities. In an April 24, 2017 resolution agreement, the covered entity’s HIPAA deficiencies resulted in a $2.5 million settlement. A resolution agreement released April 12, 2017 resulted in a $400,000 settlement. Among other things, the corrective action plan in both cases requires the covered entity to conduct and provide the results of a comprehensive risk analysis to HHS. Thereafter, the covered entity is required to review the risk analysis annually (or more frequently, if appropriate) and promptly update the risk analysis in response to environmental or operational changes affecting the security of EPHI. Thus, through its resolution agreements, HHS is emphasizing the fluid need to ensure that electronic systems adequately safeguard EPHI and that covered entities are appropriately minimizing risk.
3. Privacy Policies and Procedures
Pursuant to 45 CFR 164.530, a covered entity is required to implement written policies and procedures with respect to PHI that are designed to comply with the HIPAA privacy rules and breach notification rules. A limited exception to this requirement is available under 45 CFR 164.530(k) for certain fully-insured group health plans that maintain a “hands off” status (i.e., the group health plan does not create or receive PHI except for certain summary health information and/or enrollment/disenrollment information). Among other items, the privacy policies and procedures must address how a covered entity may use and disclose PHI. They also must address an individual’s rights with respect to his or her PHI and which employees will be granted access to PHI. One May 2017 resolution agreement resulted from a covered entity’s improper disclosure of PHI to the media and various public officials without proper authorization. Another May 2017 resolution agreement resulted from a covered entity’s improper disclosure of PHI to his workplace. The corrective action plans associated with the resolution agreements required the covered entity to develop/review, maintain, and revise as necessary written policies and procedures (which relevantly would set forth the permissible uses and disclosure of PHI), to distribute such policies and procedures to the workforce, and to assess, update, and revise, as necessary, the policies and procedures at least annually. Thus, implementation of comprehensive privacy policies and procedures is deemed a necessity by HHS.
4. Notice of Privacy Practices
Pursuant to 45 CFR 164.520, an individual has a right to adequate notice of the uses and disclosures of PHI that may be made by the covered entity and of the individual’s rights and the covered entity’s legal duties with respect to PHI. The notice of privacy practices is essentially a summary of the covered entity’s privacy policies and procedures. The plan sponsor is obligated under the privacy rules to ensure that the notice is prepared and timely and appropriately distributed to plan participants, except in the case of certain fully-insured group health plans that maintain a hands off status, in which case the insurer has the duty. The content and distribution requirements for notices of privacy practices are strict. Thus, it is imperative for plan sponsors to ensure legal compliance.
5. Plan Sponsor Certifications
A group health plan may disclose PHI to the plan sponsor for plan administration functions only after: (1) the plan document has been amended to incorporate various regulatory requirements related to the plan’s use and disclosure of PHI, and (2) the plan sponsor has certified to the plan, in writing, that the plan has been amended and that the plan sponsor agrees to the restrictions contained in the amendment. See 45 C.F.R. 164.504 and 164.314. Plan sponsors must ensure that their plans have been appropriately amended and that proper written certification is in place.
6. Workforce Training
A covered entity is required to provide training to all members of its workforce on its HIPAA policies and procedures, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity. Various resolution agreements stress the necessity of conducting and documenting comprehensive training. For example, two May 2017 resolution agreements indicate that training must be reviewed at least annually, and, where appropriate, updated to reflect changes in the law, issues discovered during internal or external audits, and other relevant developments. Thus, plan sponsors must continually evaluate the need for workforce training and tailor such training to their internal structure.
These are just some of the written documentation requirements that group health plans must adhere to under HIPAA’s Administrative Simplification Rules. Regulatory provisions must be reviewed in conjunction with the group health plan’s administrative practices when drafting these documents. The resolution agreements released this year reaffirm the notion that employer-sponsored group health plans must evaluate their HIPAA compliance position with experienced HIPAA legal counsel. Deficiencies can result in substantial penalties. Please feel free to contact us with any questions you may have with respect to your HIPAA compliance endeavors.
Copies of the resolution agreements are available by clicking HERE.
This email serves solely as a general summary of complex proposed legislation and government initiatives. It does not constitute legal guidance. Please contact us with any questions related to the Proposed Legislation and what impact finalization might have on your employer-sponsored plans.
