Half Way Into 2018 And Data Breaches Have Already Exceeded Last Year’s Totals

The Office for Civil Rights (OCR) Breach Portal reported that more breaches occurred in the first six months of 2018 than in all of 2017. About four million records were exposed in the first half of 2018, according to the OCR, which is one million more than had been reported for 2017. These breaches also set records for the number of individuals affected. Catie Heindel, JD, CHC, CHPC, has a long history of assisting clients with Health Insurance Portability and Accountability Act (HIPAA) privacy and security issues. She makes the point that regulatory compliance is not confined to the Federal Government; there are corresponding privacy protection laws in all of the states as well. However, they vary greatly from one jurisdiction to another. This is the result of increased enforcement, along with growing amounts in penalties for data breaches. Ms. Heindel further notes that compliance officers are focusing more on this area than ever before. Results from the Ninth Annual Healthcare Compliance Benchmark Survey conducted by SAI Global and Strategic Management Services found that nearly two-thirds of respondents cited HIPAA security/cyber-security as their highest concern, and over half of the respondents placed HIPAA privacy as their highest concern. Also, 75 percent of respondents reported the compliance office as having responsibility for HIPAA privacy, and nearly a third reported that the compliance office had responsibility for HIPAA security. Ms. Heindel offered a number of checklist items that may be helpful in guarding against the occurrence of data breaches:

1. Has there been a recent comprehensive security risk and vulnerability assessment?
2. Has a review of both OCR and state regulations regarding data security been conducted?
3. Are the breach assessments procedures up to date?
4. Do all the identified Business Associates have up-to-date contact information and services they supply?
5. Are the privacy and security policies and procedures up-to-date and being followed?
6. Are all laptops and mobile devices (including cell phones and flash drives) registered?
7. Have all laptops and mobile devices been evaluated for appropriate security controls?
8. Have all laptops and mobile devices been encrypted?
9. Do all systems and software that transmit electronic Protected Health Information (PHI) employ encryption technology?
10. Are policies and processes in place to deal with any breach of PHI?
11. Are Security Rule encryption and decryption requirements being met?
12. Are facility access control processes in place?
13. Have Business Associates been trained on breach reporting to Covered Entities?
14. Have action items identified in risk assessments been completed in a timely manner?
15. Are policies and procedures that address uses and disclosures of PHI in place?
16. Are reasonable and appropriate safeguards for paper and verbal PHI in place?
17. Does the workforce receive regular HIPAA training, including how to recognize incidents?
18. Is there an inventory of information system assets, including mobile devices?
19. Are security plans for all facilities that store or otherwise have access to PHI in place?
20. How are data incidents reported internally?
21. Does staff know how to report incidents to the right people?
22. Has there been an independent security risk assessment conducted by outside experts?
23. Are mobile devices monitored to determine if they are being used to exchange electronic PHI?
24. Are proper authentication, encryption, and physical protections in place that secure electronic PHI?
25. Have mobile device users been properly trained on security procedures?
26. Is there continuous monitoring and measurement of HIPAA compliance efforts?

For more information, Catie Heindel can be reached at [email protected] or (847) 707-9830. See also: https://www.compliance.com/how-to-prepare-for-ocr-audit.