Privacy & Information Security Law Blog : Privacy Lawyer & Attorney : Hunton & Williams Law Firm : Personal Data, Information Security

Some of the major changes to the HIPAA Rules include:

• Adding “subcontractors” to the definition of “business associate” to provide that subcontractors that perform functions for or provide services to a business associate are also business associates to the extent they require access to protected health information (“PHI”);
• Requiring business associates to enter into written contracts with those subcontractors (previously, business associates were only required to “ensure” that subcontractors agree to the same restrictions on the use and disclosure of PHI);
• Applying the Security Rule and the Enforcement Rule penalty provisions directly to business associates;
• Revising the definition of “marketing” in the Privacy Rule to delineate which specific activities constitute marketing of PHI;
• Clarifying that a business associate is not making a permitted use or disclosure under the Privacy Rule if it does not apply the minimum necessary standard, where appropriate; and
• Requiring covered entities to obtain an authorization from an individual for any disclosure of the individual’s PHI in exchange for direct or indirect remuneration (with a few exceptions such as exchanges for public health activities).

HHS will be accepting comments to the notice of proposed rulemaking for a period of 60 days after the notice of proposed rulemaking is published in the Federal Register on July 14, 2010.

In addition to the changes to the HIPAA Rules, HHS announced a new privacy website designed to “provide further confidence in the expectations Americans have for the privacy of their personal information” and to “inspire added trust in HHS’ efforts to improve our nation’s health through safe and secure health information exchanges.”  HHS also announced enhancements to its breach notification website that will provide consumers with more information regarding breaches involving PHI and ongoing breach investigations.  Currently, the HHS breach notification website lists only basic details about breaches, such as the name of the covered entity at issue and the number of individuals affected by the relevant breach.
 

Nevada’s law requires “data collectors,” including government agencies and businesses, that accept payment cards and are “doing business” in Nevada to comply with the Payment Card Industry Data Security Standard (“PCI DSS”).  Although Minnesota has codified the PCI DSS requirement that prohibits businesses from retaining certain credit or debit card data after a transaction, Nevada now becomes the only state to require compliance with PCI DSS in its entirety. 

For businesses that do not accept payment cards, the new Nevada law prohibits  electronically transmitting a customer’s personal information “outside of the secure system of the business” or moving any data storage device containing a customer’s personal information “beyond the logical or physical controls” of the business unless the transmission or data storage device is encrypted.  The statute defines “encryption” to include both (1) encryption technologies to render data indecipherable which have been adopted by an established standard-setting body such as the National Institute of Standards and Technology (“NIST”) and (2) appropriate management and safeguarding of cryptographic keys using guidelines promulgated by an established standard-setting body such as NIST. 

Although several states previously have rejected codifying PCI DSS into law, it remains to be seen whether Nevada’s new law will create a nationwide domino effect similar to that which occurred after California enacted the first information security breach notification statute.  Since California’s breach notification statute became effective in 2003, all but five states have enacted similar statutes.

The new law in New Hampshire requires health care providers and business associates to (1) obtain an authorization from individuals before using or disclosing their protected health information (“PHI”) for marketing, and (2) provide an opportunity for individuals to choose not to receive any fundraising communications that involve their PHI.  New Hampshire’s law also requires health care providers and business associates to notify individuals in writing of any use or disclosure of their PHI that is not permitted by New Hampshire law, even if such use or disclosure is allowed under federal law.  For example, New Hampshire prohibits all marketing communications (including those authorized by individuals) by voicemail, facsimile, or “other methods of communication that are not secure,” while federal law contains no such prohibitions. 

New Hampshire’s new law adds to the list of state and federal laws regulating breaches of health information:  in August 2009, Missouri’s information security breach notification statute, which applies to breaches of “medical information” and “health insurance information,” took effect, and in February 2010, the federal regulations addressing breaches of unsecured PHI will become effective.

The interim final rule amends HIPAA’s enforcement regulations.  Specifically, the rule incorporates the HITECH Act’s categories of violations, tiered ranges of civil penalty amounts, and revised limitations on the Secretary of HHS’s authority to impose civil penalties for violations of HIPAA's rules.  Pursuant to the interim final rule, covered entities may be subject to tiers of penalties as described below:

• If a covered entity did not know and, by exercising reasonable diligence, would not have known that it was in violation, the minimum civil penalty is $100 per violation.
• If a violation was the result of “reasonable cause” involving circumstances that would make it unreasonable for the covered entity (despite the exercise of ordinary business care and prudence) to comply, the minimum penalty is $1000 per violation.
• The minimum penalty for a violation that is the result of willful neglect and subsequently corrected is $10,000.
• The minimum penalty for a violation that is the result of willful neglect and is not corrected is $50,000.
• The maximum penalty amount for multiple violations is set at $1.5 million per calendar year.

HHS will be accepting comments on the interim final rule until December 29, 2009.  Read our earlier blog posting for further information regarding the HITECH Act.

Access a copy of the interim final rule.

The FTC Final Rule requires PHR vendors and PHR related entities to notify U.S. citizens and residents if their PHR identifiable health information is subject to a security breach, and requires additional notification of the FTC and prominent media outlets for breaches that affect 500 or more individuals.  Third party service providers must notify the PHR vendor, or PHR related entities to which they provide services, of any breaches they discover.  To facilitate the notification process, the FTC has developed a standard form entitled “Notice of Breach of Health Information” that PHR vendors and PHR related entities can complete and send to the FTC.  Both the form and the FTC Final Rule are available on the FTC’s website.
 
On August 19, 2009, as required by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), the Department of Health and Human Services ("HHS") issued an interim final rule ("HHS Interim Final Rule") addressing security breaches of unsecured protected health information ("PHI").  The regulations will apply to all breaches occurring on or after September 23, 2009 that are discovered by covered entities and business associates, but the HHS Interim Final Rule indicates that HHS will not impose sanctions for failure to notify with respect to breaches that are discovered within the first 180 days after the effective date. 

Notably, unlike the FTC Final Rule, the HHS Interim Final Rule includes a harm threshold limiting the breach notification requirement to breaches that present a significant risk of harm.  This disparity may be due to the fact that breaches common to HIPAA-covered entities, such as those involving disclosures to other HIPAA-covered entities, are less likely to result in actual harm than the kinds of breaches suffered by the service providers and vendors covered under the FTC's Final Rule.  Similar to the FTC Final Rule, the HHS Interim Final Rule requires covered entities to (1) notify individuals if their PHI is subject to a security breach, and (2) notify the Secretary of HHS and prominent media outlets in the event of a breach that affects 500 or more individuals.  Business associates must notify the covered entity to which they provide services of any breaches they discover.  Finally, the HHS Interim Final Rule updated the  information security guidance issued by HHS in April 2009 to emphasize encryption and destruction as the only methods for securing PHI in a manner consistent with the HITECH Act’s breach notification provisions.  The HHS Interim Final Rule is available on the HHS website.

In the event PHI is used or disclosed in violation of the New Hampshire law, the health care provider must notify affected individuals whose PHI was disclosed. Business associates will be responsible for the cost of notification if the non-compliant disclosure or use was by the business associate. The terms "business associate," "use," "disclosure" and "protected health information" have the same meanings as under HIPAA. Under the New Hampshire law individuals may file civil suits for violations of the marketing and fundraising restrictions, with possible damages of $1,000 or more per violation, plus legal fees and costs.

The full text of the New Hampshire bill (as signed into law) may be viewed here.
 

The FTC's Rule will apply to vendors of personal health records and entities that offer products or services through the websites of such vendors. Also included in the Rule's scope are entities that are not covered by the Department of Health and Human Services' rules, but that offer products or services through the websites of DHHS-covered entities, and those that interface with an individual's personal health records. Because ARRA does not limit the FTC's enforcement authority to its enforcement jurisdiction under Section 5 of the FTC Act, the proposed FTC Rule would apply to these entities whether or not they would otherwise fall within the scope of the FTC's regulatory jurisdiction.

Public comments on the proposed rule are due by June 1, 2009. Currently, the rule is set to apply to breaches discovered on or after September 18, 2009. The text of the Federal Register Notice can be accessed on the FTC's website by clicking here.

Interestingly, the guidance specifies only two methods for securing PHI in a manner that would avoid the application of the HITECH Act’s breach notification provisions.  First, the guidance provides that PHI will be deemed unusable, unreadable or indecipherable if it has been encrypted, provided the encryption key has not also been breached.  In this regard, HHS has followed the lead of more than 45 state breach notification laws that likewise provide “safe harbors” for encrypted information.  HHS does, however, specify that encryption must comply with the HIPAA Security Rule’s provisions and further provides two specific examples of encryption that have been deemed to meet this standard: (1) for data at rest, encryption consistent with National Institute of Standards and Technology Special ("NIST") Publication 800-111 and; (2) for data in transit, encryption that complies with Federal Information Processing Standard 140-2. 

Second, the guidance provides that PHI will be deemed unusable, unreadable or indecipherable if media on which it is stored or recorded has been destroyed by one of the following methods: (1) paper, film or other hard copy media have been shredded or destroyed such that PHI cannot be read or reconstructed; and (2) electronic media have been cleared, purged or destroyed consistent with NIST Special Publication 800-88 such that PHI cannot be retrieved. 

The guidance is clear that its recitation of information safeguards, though a proposal pending public comment, is intended to be exhaustive.  The guidance, developed jointly by the Office for Civil Rights, Office of the National Coordinator for Health Information Technology, and Centers for Medicare and Medicaid Services, acknowledges that use of the technologies and methodologies described therein are not required but, if used, “create the functional equivalent of a safe harbor” with respect to the breach notification provision contained in the HITECH Act.  The guidance also notes that any other applicable requirements, such as mitigation requirements contained in the Privacy Rule and state breach notification laws, must be followed to the extent applicable, regardless of adherence to the guidance.

As above, this information security guidance relates to two sets of forthcoming breach notification regulations.  The first, applicable to covered entities and business associates, will be issued by HHS and the second, applicable to vendors of personal health records and certain other non-HIPAA covered entities, was issued by the Federal Trade Commission in proposed form on April 16.

Public comments on the HHS information security guidance are due by May 21, 2009.  HHS has specifically signaled interest in receiving comments regarding whether limited data sets of PHI should be considered, by definition, to render PHI unusable, unreadable or indecipherable such that the HITECH Act’s breach notification provisions would not apply. 

In addition to the guidance, HHS also issued a request for information soliciting public comment on the breach notification provisions of the HITECH Act to inform its future rulemaking and its annual updates to the guidance.  The guidance is available here  and both the guidance and the request for information are available here.