$2.5M settlement shows that not understanding HIPAA requirements creates financial risk
The U.S. Department of Health and Human Services, Office for Civil Rights (OCR), recently announced a Health Insurance Portability and Accountability Act (HIPAA) settlement based on the impermissible disclosure of unsecured electronic protected health information (ePHI). In 2012, CardioNet, a company that remotely monitors patients at risk for cardiac arrhythmias, reported to the HHS Office for Civil Rights (OCR) that a workforce member’s laptop was stolen from a parked vehicle outside of the employee’s home. The laptop contained the ePHI of 1,391 individuals. The settlement was not reached until 2017, indicating the length of time that some HIPAA investigations can take, with its attendant costs.
CardioNet has agreed to settle potential noncompliance with the HIPAA Privacy and Security Rules by paying $2.5 million and implementing a corrective action plan. This settlement is the first involving a wireless health services provider, based, in part, on CardioNet’s failure to comply with basic HIPAA rules that are applicable to all “covered entities” and “business associates”. Thus, the compliance steps outlined below for mobile devices are applicable to any device used to store PHI or ePHI.
OCR’s investigation into the impermissible disclosure revealed that CardioNet had insufficient risk analysis and risk management processes in place at the time of the theft. Additionally, CardioNet’s policies and procedures implementing the standards of the HIPAA Security Rule were in draft form and had not been implemented. Further, the organization was unable to produce any final policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices.
HHS and OCR have published a very helpful 5-step guideline for establishing compliance with HIPAA. While the following actions relate specifically to mobile devices, these five steps are applicable to all PHI.
Decide whether mobile devices will be used to access, receive, transmit, or store patients’ health information or used as part of your organization’s internal networks or systems (e.g., your EHR system).
Understand the risks to your organization before you decide to allow the use of mobile devices. Risks (threats and vulnerabilities) can vary based on the mobile device and its use. Some risks may be:
- A lost or stolen mobile device
- Inadvertent downloading of viruses or other malware
- Unintentional disclosure to unauthorized users when sharing mobile devices with friends, family and/or coworkers
- Use of an unsecured Wi-Fi network.
Assess how mobile devices affect the risks (threats and vulnerabilities) to the PHI your organization holds.
Conduct a risk analysis to identify the risks to your organization. If you are a solo provider, you may conduct this risk analysis yourself. If you work in a larger organization, the organization may conduct the risk analysis.
A risk analysis will help determine the safeguards, policies, and procedures your organization needs. It should include reviewing risks created by all mobile devices used to communicate with your internal networks or systems, regardless whether the devices are personally owned or provided by the organization.
Perform a risk analysis periodically and whenever there is a new mobile device, a lost or stolen device, or suspected compromised health information.
After conducting a risk analysis, document, in writing:
- Which mobile devices are being used to communicate with your organization’s internal networks or system (g., the EHR system or Health Information Exchange (HIE)), and
- What information is accessed, received, stored, and transmitted by or with the mobile device.
Identify your organization’s mobile device risk management strategy, including privacy and security safeguards.
The purpose of a mobile device risk management strategy is to develop and implement mobile device safeguards to reduce risks (threats and vulnerabilities) identified in the risk analysis. The risk management strategy should include evaluation and maintenance of the mobile device safeguards you put in place.
Develop, Document, and Implement
Develop, document, and implement the organization’s mobile device policies and procedures to safeguard health information.
Organizations should develop and implement reasonable and appropriate policies and procedures to safeguard health information, including those specific to mobile devices. Here are some topics and questions to consider when developing mobile device policies and procedures:
- Has the organization identified all the mobile devices that are being used in the organization? How is the organization keeping track of them?
- Should the organization let providers and professionals use their personally owned mobile devices within the organization?
- Should providers and professionals be able to connect to the organization’s internal network or system with their personally owned mobile devices, either remotely or on site?
- Does the organization restrict how providers and professionals can use mobile devices?
- Will the organization institute standard configuration and technical controls on all mobile devices used to access internal networks or systems, such as an EHR?
- Are there restrictions on the type of information providers and professionals can store on mobile devices?
- Does the organization have written procedures for addressing misuse of mobile devices?
- Does the organization have procedures to wipe or disable a mobile device that is lost or stolen or when providers and professionals end their employment or association with the organization?
- How is the organization training its workforce (management, doctors, nurses, and staff) on policies and procedures and holding them accountable?
Train and conduct mobile device privacy and security awareness and training for providers and professionals.
Providers and professionals who use mobile devices must have privacy and security awareness and training, on an annual basis, to avoid costly mistakes that can result in loss of patient trust.
Privacy and security awareness and training should include a discussion of the following topics:
- How to assess risks (threats and vulnerabilities) when using mobile devices for work;
- How to secure mobile devices;
- How to protect and secure health information;
- How to avoid mistakes when using mobile devices.
Finally, the organization should train its workforce so that they understand the organization’s mobile device policies and procedures and how to follow them.
Jennifer Snow practices in the areas of health care law and business litigation. She is the author of numerous articles on health care law. Jennifer represents physicians and physician groups in health law matters, and she represents companies and executives in business litigation.
Ms. Snow has been named to the list of “Rising Stars” by Texas Monthly Magazine and Texas Super Lawyers (a Thomson Reuters service) in every year since 2014.
Scott Chase has practiced health law, corporate law, and intellectual property law for over 35 years. Mr. Chase is Board Certified in Health Law by the Texas Board of Legal Specialization.
Scott’s primary practice focus is business transactions for physicians and healthcare facilities, as well as healthcare regulatory issues such as the Affordable Care Act, HIPAA and peer review. Mr. Chase handles general corporate matters and trademark/copyright issues for physicians and also for a variety of non-healthcare clients.