It’s summertime at the Bar! We’re talking about privacy, specifically HIPAA. We’ve seen some new enforcement actions from the Office of Civil Rights at the department of Health and Human Services. What do these new enforcement actions mean? What does your company need to know? Kerri and Ed are here to break down the risks, and the cross-functional teamwork that might be needed to navigate the risks. And in Last Call, Kerri pays tribute to a friend we’ve just reluctantly said goodbye to…the World Cup.
It’s summertime at the Bar! We’re talking about privacy, specifically HIPAA. We’ve seen some new enforcement actions from the Office of Civil Rights at the department of Health and Human Services. What do these new enforcement actions mean? What does your company need to know? Kerri and Ed are here to break down the risks, and the cross-functional teamwork that might be needed to navigate the risks. And in Last Call, Kerri pays tribute to a friend we’ve just reluctantly said goodbye to…the World Cup.
Kerri Willis: Hello again, everyone, and welcome back to The Bar. The Bar on Healthcare is a monthly podcast from Aon’s Health Solutions about the legal and regulatory issues surrounding employer group health plans. I'm Kerry Willis from Aon’s Compliance and Policy Consulting Group
Ed Doherty: And I'm Ed Doherty, also from the Compliance and Policy Consulting Group here at Aon. If you're listening to us on aon.com, we would love it if you made "The Bar" a regular part of your feed. search "The Bar and Healthcare" on your favorite podcast app, and if you're so inclined, leave us a review. With that, Carrie, "The Bar" is open.
Kerri Willis: Great. Well, thanks, Ed. It feels like we're in a bit of a lull in Washington at the moment. The Supreme Court's term is over. Congress has been in and out of recess, and while there's been some discussion about some health priorities, nothing has really passed, and we know that Congress will be focused on the midterm elections for the foreseeable future. We are expecting some new regulations from the administration, but those haven't come out yet. So, I mean, what should we talk about this month? I mean, the new Su- Spider-Man movie isn't even out yet.
Ed Doherty: Well, it's the dog days of summer, but I want to talk about HIPAA.
Kerri Willis: Ooh, HIPAA. Well, that sounds good to me. but maybe we should remind our listeners what HIPAA is other than the most misspelled acronym related to healthcare on the internet. And oh, by the way, HIPAA was in the episode of The Pitt that I watched last night.
Ed Doherty: Oh, good. No, we love a HIPAA reference. Now, HIPAA is one of those things where I feel like a lot of people know the acronym but don't understand precisely what it does, it does do a couple different things. And providing a HIPAA training for our clients, I like to call it the healthcare reform that was before the Affordable Care Act, because it did include a whole bunch of reforms with respect to HIPAA, certificates of or whatever they call them. I can't even remember what they were called anymore.
Kerri Willis: and creditable
Ed Doherty: Affordable coverage, right. It, it truly was something that was out the door by the start time I started practicing. But one thing that w- it did, it-- that is really important, still very pertinent to us today, is provide a lot of protection for what is called protected health information. In other words, it says what healthcare providers and healthcare plans use protected health information for, how they have to protect it, and how they can disclose it. So, it is something that is definitely applicable to your employer health plan, and it's something that most folks understand. It’s one of those things that fairly often it's up maybe once a decade where there's some change. You look at your policies and procedures, you make some tweaks, you change your notice of privacy practices, but then you shelve it, and you don't think about it too much in the interim
Kerri Willis: So, we're talking about just to kind of drill down a little bit. We're talking about the privacy provisions of HIPAA, right? Not this, the old certificates of creditable coverage that we just mentioned. But this is really about protecting people's health information and how h- a person's health information can be used or disclosed, and the compliance obligations that a group health plan and, you know, in most cases, employers, because they're the sponsor of a group health plan, they have to do in order to comply with HIPAA. Is that right?
Ed Doherty: Right. And, and it's, it is the privacy provisions, maybe if you're fully insured, you don't actually all have to do all that much because if you're fully insured, you have this exemption. If you are completely fully insured, you don't have a health FSA, you don't have any self-insured component like an HRA, and also you're not using or collecting protected health information besides enrollment information, then you can rely on the carriers for doing most of the compliance. But if you're self-insured or have any self-insured component, you're supposed to have a notice of privacy practices, you're supposed to have written policy and procedures, you're supposed to perform training, which is usually the first thing that people think of, there's a few other things that you do have to do. So, it's really important, especially if you have any self-insured component, be aware of all the HIPAA.
Kerri Willis: And, and when you talk about self-insured components, just to be clear there, we're also talking about a healthcare flexible spending account, right?
Ed Doherty: Yes, it is, does include a health FSA, healthcare flexible spending account. that's something that I feel like a lot of folks forget about that is a little self-insured component. So that is something that if you do have a health FSA, but otherwise fully insured, then HIPAA is something you do have to be more concerned about
Kerri Willis: And so, as I recall, the HIPAA privacy rules first went into effect back in 2003. And I say, as I recall, which I recall very well because I was helping clients implement them, and I was nine months pregnant with my daughter, at the time. So, I remember it quite well. And since that time, we've seen the employers implementing the requirements, but what have we seen on the enforcement side?
Ed Doherty: So, on the enforcement side, a lot of the enforcement is focusing on healthcare providers. And again, the covered entities under HIPAA include healthcare providers and health plans. So naturally, the Office of Civil Rights at the Department of Health and Human Services, the entity that's in charge of enforcement for HIPAA, first looking at the healthcare providers because they're the ones who are dealing with a lot of protected health information. And so a lot of the enforcement actions first focused on things like healthcare providers dumping paper records in dumpsters out behind the physician office. That's something that…
Kerri Willis: so archaic in this day and age
Ed Doherty: Right? It is, it is something that it's, it's sounding a little bit archaic at this point. but that's because they dumped them out already. So, in that case, OCR would say, "No, you can't just throw them out back. What you're supposed to do is hire somebody to appropriately destroy those records." And when you have somebody who is destroying records, they're technically a business associate, and you're supposed to have a contract that says, "In the meantime, before you're destroying them, you do owe us obligations to ensure that PHI doesn't go anywhere." The next wave of enforcement actions were around laptops that went walking. so that is another thing that is fairly common, and even in the employer kind of context could be a problem, is that if you have laptops that contain protected health information, and they go missing, and they're not encrypted, is a of that protected health information because we don't know what happened to it.
Kerri Willis: So we were seeing, it sounds like you're saying, you know, we have historically seen OCR, the Office of Civil Rights, as you said, at, at HHS, f- really focusing on provider compliance with HIPAA, what doctors and hospitals and facilities, healthcare facilities doing and, and, or not doing when it comes to HIPAA compliance. is that changing, do we think?
Ed Doherty: Well, yes. there, there is also a bunch of enforcement actions against health plans, but typically that would be carriers or business associate agreements or business associates of those carriers. But now, and the reason why I want to talk about this right now, is we've seen the first couple of agreements, which are essentially settlement agreements between the Office of Civil Rights and employer health plans specifically. And that is something that relatively new because when you think about the employer health plan, typically the employer doesn't have all that much health information on their own systems. A lot of times they have a carrier, and they have all the PHI, or the only information that you have on your own systems tends to be just enrollment. Now we're seeing, and this is actually a security rule, which is with respect to electronic PHI, that it is specifically the employer health plan that is the subject to the enforcement action, and that is new.
Kerri Willis: So, what do you think is driving this, additional enforcement around cybersecurity and, the HIPAA security rules?
Ed Doherty: Well, it is a general and broad-based, realignment to realizing we don't have so many paper records anymore, and so electronic security is just broadly speaking, a higher priority. And cybersecurity is something that there is a greater focus on. is right now, proposed changes to the security rule to increase the, that covered entities must have in place with respect to electronic PHI. But also, that's really the, the source of risk here, is that what we've seen in both of these resolution agreements against the employer plans is that the employer plan is the victim of a ransomware attack. And so, with the of we're dealing with a lot more electronic PHI, plus this is where the risk is, that is where we see the enforcement actions, priorities of OCR towards the security and electronic PHI.
Kerri Willis: So, do you have some suggestions for employers who are concerned about this if they want to, you know, mitigate their risk of non-compliance action against them?
Ed Doherty: Yeah. And first off, it helps us to understand what the problems were. So first, these employers are victims. They were victims of ransomware attack, and then afterwards, now you have the Office of Civil Rights coming after you and saying you were negligent, essentially. they didn't have... Although Part of the agreement is over the next couple of years that they come into full compliance with the HIPAA Security Rule. but they failed to conduct risk analyses under the HIPAA Security Rule. And so, for an employer that is concerned about being in the same position, that would be the solution. If you're listening to this, you're probably in the benefits department, but this is something that is more aligned with the information technology or IT department. So, what the HIPAA Security Rule requires is that covered entity, which is the employer health plan, perform a risk, risk analysis, or risk assessment. They actually use two different terms in different places. But it's a very technical exercise where it analyzes where protected health information is on the systems and how it flows through the systems, what the vulnerabilities are to that electronic PHI, and how the covered entity is seeking to mitigate those vulnerabilities. It's a mapping out of where all the risks may lie so that you can try to pinpoint, "Here's a weak spot. We can fix this over here." And the security rule requires that this be documented, and it's a living document that gets updated as the security architecture changes over time. So, an IT department would be pretty familiar with this kind of exercise.
This is a pretty standard of exercise in, IT controls and the like. And so, it's possible that if you're a large organization, you may already be doing this, but if you're in the benefits department, you may not be aware. And either way, though, if you're performing it or not, now is a great time to reexamine that and then ensure that this is being done on your systems, that there is already this sort of process in IT taking place, then evaluate whether or not the process as it is, is incorporating HIPAA requirements, so it doesn't necessarily need to be a whole separate process. But rather, as you're going through and checking these systems and documenting this sort of thing, you say, "Also, this is for-- with respect to electronic PHI for HIPAA Security Rule compliance purposes." So, you can sort of reuse or tag on to that existing process, so it's not a complete lift. But this is not benefits. This is IT
Kerri Willis: But it sounds like something that the, the benefits folks and the IT folks need to partner on to make sure that the, the technical implementation of it, which would, it sounds like be led by their IT folks, but that the benefits folks are involved to make sure that it-- the IT folks are looking at it from a, from a HIPAA perspective and a, and a plan, a health plan perspective. And I realized I said folks like four times in that sentence.
Ed Doherty: I like folks. Folks is a great term.
Kerri Willis: a good Midwestern term. You and I are good Midwesterners.
Ed Doherty: but, yeah, that's the problem is that the benefits folks will be aware of HIPAA obligations but do not have the line of sight or technical expertise to perform this analysis. And the IT folks are just not aware that they're a-- there is an entity on their systems. And also, I do want to point out, shout out to my hospital and healthcare clients, is that this is one of those areas where the hospital, I am pretty confident you're going to have HIPAA security risk analysis that is performed on the hospital systems with respect to the hospital as a covered entity, as a provider. But it should also incorporate the health plan as a separate covered entity to ensure that that information is also captured in the policy and procedures, in the security role risk analysis, and everything. And so, something that I do like to remind our healthcare providers that they have this HIPAA role as well.
Kerri Willis: Yeah, I think that's a really good point because I do think, you know, when we talk about HIPAA, we do tend to think about it, from the provider perspective, which is how we, you know, started out this call. But it really does have implications for a group health plan and a group health plan that's self-insured, where the employer has access to the PHI under the plan. That it's, it's really important that plan sponsors take a look at these requirements and make sure that they feel, you know, good about, that they are addressing them and complying with them to potentially and hopefully avoid bad things happening. not only just, you know, enforcement actions, but just a, a breach of, of PHI, which in and of itself, you know, is an expense and something that plan sponsors don't want to have to deal with
Ed Doherty: Right. It's stressful. It's-- can be expensive, especially if there is a breach and it gets reported to the Department of Health and Human Services, and then you have the Office of Civil Rights coming in. Resolution agreements are doing two things. They, one, require the employer health plans to come into compliance, but two, they're also charging a civil penalty against the employer health plans. In the one instance, it was $245,000. In the other instance, it was $450,000. both of them were roughly around between 9,000 and 10,000 individuals covered by these plans. So, it, stressful, and it's a huge expense. But going through this process of having a risk analysis and then at where those vulnerabilities are and then proactively trying to mitigate those vulnerabilities, that reduces the risk of one of these things happening in the first place, which is the entire point of this exercise, is that we don't want to have bad actors gaining access to this protected health information
Kerri Willis: Yeah. So that's really helpful, and it sounds like something, you know, our listeners should be thinking about and taking a look at and engaging with their IT folks, if needed to, to make sure that they're complying with all of this. So, thanks for that reminder and that deep dive into HIPAA. and now it's time for Last Call.
So, the World Cup is done as of yesterday, and beyond the final, which was super exciting, and as everyone who w- watched it knows, Spain came out the, the winner in, in overtime. I don't know, do they call it overtime? Extra time? I don't know. but anyway, it was a memorable tournament for a lot of reasons. Our social media accounts were filled with images of European tourists marveling at the sight of Buc-ee's in the Southwest, Australians discovering Waffle House, and Korean fans becoming BFFs with Mexican fans over tequila shots. was a great lesson in the value of traveling to new places and experiencing new cultures. But maybe the best part was seeing the watch parties like the ones for Cape Verde in Massachusetts, where more Cape Verdeans live than anywhere outside of West Africa, seeing bars in Chicago overrun with Dutch orange jerseys, reminding us how many different communities make up our own. Now, it's just a short 11 months until next year's Women's World Cup, which will be held in Brazil. I feel like a sports commentator with that Last Call.
Ed Doherty: Yeah, no, it's great. The Women's World Cup where the United States has a chance to actually win it because, that's where our strengths lie. And that's it for our report today. thanks as always to our editor, Michael Thibodeaux, and our producer, Don Moorhead, for make us- making us sound better than we deserve, and that will be an, a chance for them to, to make me sound better than I deserve. And we'd like to thank you for joining us this time. And until next time, the bar is closed.