Monthly Archives: June 2015

The Most Detailed and Costly Compliance Agreement You Are Ever Likely to See”

The Most Detailed and Costly Compliance Agreement You Are Ever Likely to See

Corporate integrity agreements or the consent agreements which are reached between the government (HHS) and Covered Entities and Business Associates can be extremely detailed, comprehensive and costly.

In my last post (http://bit.ly/1RsCwLP )  I went so far as to say that these agreements and their implementation are often more expensive than the actual fines, and that I would discuss one of the most far reaching consent agreements I had ever seen, namely, the corporate integrity agreement between OIG-HHS and Nason Medical Center.

While I cannot incorporate the totality of an agreement that is over 50 pages long into a few paragraphs, I think that I can convey the spirit of this agreement.

  1. The length of the agreement is five years.
  2. The people covered by the agreement include all owners, officers, directors, managers (which include members of the mandated “Management Committee”) and all employees, contractors, subcontractors, agents and other persons who provide patient care items or services or who perform billing or coding functions on behalf of Nason, as well as all physicians or other non-physician practitioners who work within one or more of Nason’s facilities.
  3. Establishment of a Compliance Officer and Compliance Committee – and with respect to the Compliance Officer, that individual must be a member of senior management, report directly to the CEO, cannot be subordinate to the General Counsel or CFO, and must be required to visit each location where Nason provides patient services at least every two weeks.

Responsibilities include developing and implementing policies, procedures and practices designed to ensure compliance, making periodic (at least quarterly) reports regarding compliance matters directly to the “Management Committee” with written reports to the “Management Committee” made available to OIG on request, as well as monitoring the day-to-day compliance activities engaged in by Nason.

Not surprisingly, Nason must report to OIG in writing any changes in the identity or description of the compliance officer.

  1. Compliance committee, which at a minimum must include the Compliance Officer and other members of senior management, including senior executives of relevant departments such as billing, clinical, human resources, audit, and operations as well as at least one employee who works at least 20 hours per week at each building where Nason sees patients. The Compliance Officer chairs the Compliance Committee. The Compliance Committee must support the Compliance Officer in fulfilling his/her responsibilities.
  2. Management Committee’s compliance obligations include meeting at least quarterly to review and oversee Nason’s compliance program, the performance of the Compliance Officer and the Compliance Committee, submitting to OIG a description of the documents and other materials reviewed as well as any additional steps taken in its oversight of the compliance program. In addition, each reporting period, the committee must adopt a resolution signed by each “manager” of the “Management Committee” summarizing its review and oversight of Nason’s compliance with Federal Health Care program requirements and the obligations of the agreement.

This resolution at a minimum must certify that the Management Committee” has made reasonable inquiry into the operations of Nason’s compliance program including the performance of the Compliance Officer and the Compliance Committee. Based on its inquiry and review, the Management Committee must be able to conclude that, to the best of its knowledge, Nason has implemented an effective compliance program to meet Federal Health Care program requirements and the obligations of this agreement. Conversely, if they are unable to provide the required conclusion, they must provide an explanation to OIG explaining why.

  1. In addition, managers (people with management responsibilities) are specifically expected to monitor and oversee activities within their areas of authority and annually certify that the applicable Nason department is in compliance with applicable Federal Health Care requirements and with the obligations of this agreement. These employees include but are not limited to the billing manager; director of Human Resources; medical director; Nason medical center manager and CEO; laboratory director; radiology director; business administration manager; accounting director; director of business analysis; and parent company CEO.

The certification must include language that “I have been trained on and understand the compliance requirements and responsibilities as they relate to my department, and/or facility, an area under my supervision” ensuring that the department complies with all applicable Federal Health Care program requirements, obligations of the agreement, and Nason policies, and that they have taken steps to promote such compliance. To the best of their knowledge, except as specifically stated in the certification, they must attest that Nason is in compliance with all applicable Federal Health Care program requirements and the obligations of this agreement.

The list goes on and on, and in fact I have just turned to page six of the agreement. At this point, you could probably imagine that the cost of compliance, and the responsibility placed on the majority of the organizational chart (including new positions that were created based on this agreement) will have a heavy impact on the operations of the organization.

  1. An independent monitor selected by OIG must be retained. The monitor may retain additional personnel including independent consultants to help meet the monitor’s obligation under the agreement. The monitor may confer and correspond with Nason, OIG, or both. The monitor is not an agent of OIG; the monitor, however, may be removed by OIG at its sole discretion. If the monitor resigns or is removed, Nason must retain another monitor selected by OIG within 60 days. The monitor is granted virtually unlimited access to all of Nason’s records and documents. The length and breadth of the reports that the monitor must prepare is extensive. Nason is responsible for all reasonable costs incurred by the monitor in connection with the engagement, including labor costs, indirect labor costs, consultant and subcontractor costs, material costs and other direct costs such as travel, etc.

Nason must pay the monitor’s bills within 30 days of receipt. Failure to timely pay the bills constitutes a default under the agreement with OIG, unless said bills are contested and taken up with OIG.

In case you thought that this was not oppressive enough, the agreement also requires engaging an independent review organization.

  1. The independent review organization, such as an accounting, auditing or consulting firm, must perform various reviews on Nason. This organization is charged with the responsibility of reviewing Nason’s coding, billing and claims submission to Medicare and state Medicaid programs and the reimbursement received. Of course, OIG reserves the right to do its own independent reviews. The independent review organization must certify its independence and objectivity.

I could go on and “get into the weeds” regarding the highly detailed requirements (both in terms of staff compliance, report generation, and resulting certifications) but I am concerned that I will lose the readers’ attention and distract them from the point I am trying to make.

Noncompliance with HHS-OIG may result in a corporate integrity agreement or consent agreement which is set forth in news releases. The cost of the actual fine, however, does not necessarily begin to give the reader the picture of the burdens, costs, and potential liability that these agreements create.

HIPAA, HITECH and the Omnibus Rule place specific requirements on covered entities and their business associates. Audits can be triggered randomly (as HHS is ramping up audits) or can be triggered by a reported breach by the entity or by an individual whose privacy was violated. In addition, audits have been triggered by media reports and/or reports brought by members of the public at large.

The bottom line is that an ounce of prevention is worth a pound of cure. What do you think?

Seven Noteworthy HIPAA Breaches & the Recent Enforcement Actions

Puzzle words

The following unlucky seven were subject to substantial fines. The costs associated with defending the audit, negotiating the settlement and the cost of implementing the invariable forward-going consent agreements/corporate action plans (CAP), however, are separate and above (and often higher) than the reported fine.

These cases range from relatively small to admittedly large breaches, from the unlikely event to situations that could happen to any entity without implementation of well thought out and vigorously monitored policies and procedures.

In my next post, I will detail one of the most burdensome consent agreements I have ever seen, namely, the Corporate Integrity Agreement between the Office of Inspector General of the Department of Health and Human Services and Nason Medical Center.

It is evident that the ever increasing enforcement of HIPAA and the Omnibus Rule, as well as both the increased use of electronic data and the commonplace reports of mass data breaches are forcing Covered Entities (CE) and their business associates (BA) to increase the resources dedicated to compliance with the Omnibus Rule.

1.    Cornell Prescription Pharmacy ($125,000)

The Denver compounding pharmacy will pay this fine after HHS learned of the potential HIPAA violations from a television news report that PHI was improperly disposed of after a garbage dumpster with un-shredded PHI was discovered. Cornell also agreed to develop and implement a comprehensive set of policies and procedures to comply with HIPAA rules, and to provide staff training. OCR Director Jocelyn Samuels stated that “Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons.”

2.    Anchorage Community Mental Health Services, Inc. ($150,000)

Malware compromised the security of ePHI due to a failure to update software patches as well as unsupported software.

HHS Office for Civil Rights (OCR) received notification from ACMHS, a non-profit, regarding a breach of unsecured electronic protected health information (ePHI) affecting 2,743 individuals due to malware compromising the security of its information technology resources. It was later determined that ACMHS had not timely installed patches to its software as mandated by its very own policies and procedures. The takeaway is that entities are not only required to follow the regulations, but they are also being held accountable for compliance with their own policies and procedures.

3.    Parkview Health System ($800,000)

OCR opened an investigation after receiving a complaint from a retiring physician alleging that Parkview had violated the HIPAA Privacy Rule. In September 2008, Parkview took custody of medical records pertaining to approximately 5,000 to 8,000 patients while assisting the retiring physician to transition her patients to new providers, and while considering the possibility of purchasing some of the physician’s practice.  On June 4, 2009, Parkview employees, with notice that the physician was not at home, left 71 cardboard boxes of these medical records unattended and accessible to unauthorized persons on the driveway of the physician’s home, within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue. Parkview entered into a one year corrective action plan without admission of any wrongdoing.

4.    NY Presbyterian Hospital and Columbia University Medical Center ($4.8 million)

An investigation revealed that a breach was caused when a physician employed by Columbia University Medical Center who developed applications for both New York  Presbyterian Hospital  and CU attempted to deactivate a personally-owned computer server on the network containing NYP patient ePHI. The noteworthy point is that it seems that the person who caused the breach had all the right intentions but the result was catastrophic.

Because of a lack of technical safeguards, deactivation of the server resulted in ePHI being accessible on Internet search engines. The entities learned of the breach after receiving a complaint by an individual who found the ePHI of the individual’s deceased partner, a former patient of NYP, on the Internet. Another noteworthy point is that knowledge of a breach is often only discovered by the breaching entity after receiving reports from third parties. This general situation was confirmed to me by an FBI cybercrime agent.

In addition to the impermissible disclosure of ePHI on the Internet, OCR’s investigation found that neither NYP nor CU made efforts prior to the breach to assure that the server was secure and that it contained appropriate software protections.  Moreover, OCR determined that neither entity had conducted an accurate and thorough risk analysis that identified all systems that access NYP ePHI.  As a result, neither entity had developed an adequate risk management plan that addressed the potential threats and hazards to the security of ePHI.  Lastly, NYP failed to implement appropriate policies and procedures for authorizing access to its databases and failed to comply with its own policies on information access management.

NYP has paid OCR a monetary settlement of $3,300,000 and CU paid $1,500,000, with both entities agreeing to a substantive corrective action plan which includes undertaking a risk analysis, developing a risk management plan, revising policies and procedures, training staff and providing progress reports.

5.    Concentra Health Services ($1,725,220)

OCR opened an investigation following a reported breach that an unencrypted laptop containing the ePHI of 870 individuals was stolen from one of its facilities, the Springfield Missouri Physical Therapy Center.

The investigation found that Concentra had previously recognized, in multiple risk analyses, that a lack of encryption on its laptops, desktop computers, medical equipment, tablets and other devices containing electronic protected health information was a critical risk.  While steps were taken to begin encryption, Concentra’s efforts were “incomplete and inconsistent over time,” according to an HHS press release, leaving patient PHI vulnerable throughout the organization.

Essentially, Concentra did not sufficiently implement policies and procedures to prevent, detect, contain, and correct security violations under the security management process standard when it failed to adequately execute risk management measures to reduce its identified lack of encryption to a reasonable and appropriate level from October 27, 2008, (date of Concentra’s last project report indicating that 434 out of 597 laptops were encrypted) until June 22, 2012 (date on which a complete inventory assessment was completed and Concentra immediately took action to begin encrypting all unencrypted devices).

Concentra did not make any admissions of liability but entered into a CAP – corrective action plan.

6.    Adult & Pediatric Dermatology, P.C. ($150,000)

An investigation of Adult & Pediatric Dermatology was initiated upon receiving a report that an unencrypted thumb drive containing the electronic protected health information (ePHI) of approximately 2,200 individuals was stolen from a vehicle of one its staff members. The thumb drive was never recovered.  The investigation revealed that A&P Derm had not conducted an accurate and thorough risk analysis as part of its security management process.  Further, it did not fully comply with requirements of the Breach Notification Rule to have in place written policies and procedures and train workforce members. It did not admit liability and entered into a CAP.  The takeaway is that the use of thumb drives to store ePHI is inherently problematic and the use of unencrypted storage devices is courting disaster.

7.    Affinity Health Plan, Inc. ($1,215,780)

OCR’s investigation indicated that Affinity impermissibly disclosed the protected health information of up to 344,579 individuals when it returned multiple photocopiers to a leasing agent without erasing the data contained on the copier hard drives. In addition, the investigation revealed that Affinity failed to incorporate the electronic protected health information stored in copier’s hard drives in its risk analysis as required by the Security Rule, and accordingly failed to implement policies and procedures when returning the hard drives to the companies from whom it leased its copiers.  Affinity did not admit liability and entered into a short term CAP.  The takeaway is the required scope, detail and individual nature of the required risk analysis.

 

About Mendel Zilberberg:

An attorney, visionary and entrepreneur admitted to practice in New York, New Jersey and Florida who has represented and counseled clients with nationwide interests in many areas of the healthcare arena.

The use of ePHI is growing exponentially, the likelihood of a breach is ever increasing, and the regulating authorities are ramping up their audit/enforcement programs.  Covered Entities (CE) and Business Entities (BA) must understand the importance of maintaining the integrity of ePHI, compliance with the relevant regulations as well as thoroughly understand the potential consequences for non-compliance. 

The Seven Most Likely Causes of Major HIPAA Breaches

Computer Security

While it is important to comply with all of the mandates of the Omnibus Rule, I think it is instructive to know from where the most vulnerable areas of breach of PHI arise.

In a recent presentation to a limited number of attorneys in which I participated, an investigator for the Office for Civil Rights (OCR) advised that with respect to breach notification of major HIPAA breaches (those in which the PHI of 500+ individuals had been disclosed), as of February 27, 2015,  OCR’s  records indicate that the following were the percentages attributable to the causes/circumstances for those breaches:

  1.   Paper records 22%
  2.   Laptop 21%
  3.   Desktop computer 12%
  4.   Network server 12%
  5.   Portable Electronic device 11%
  6.   Email 7%
  7.   EMR 4%
  8.   Other 11%

 

The Five Most Likely Types of Major HIPAA Breaches

The Five Most Likely Types of Major HIPAA Breaches

While it is important to comply with all of the mandates of the Omnibus Rule, I think it is instructive to know from where the most vulnerable areas of breach of PHI arise.

In a recent presentation to a limited number of attorneys in which I participated, an investigator for the Office for Civil Rights (OCR) advised that with respect to breach notification of major HIPAA breaches (those in which the PHI of 500+ individuals had been disclosed), as of February 27, 2015, OCR’s records indicate that the following were the percentages attributable to the types of breaches:

  1.   Theft 51%
  2.   Unauthorized Access/Disclosure 19%
  3.   Loss 9%
  4.   Hacking /IT Incident 7%
  5.   Improper Disposal 4%
  6.   Other 9%
  7.   Unknown 1%