HHS guts health-care breach notification law, groups warn

HHS Security Breach Notice Regulations - Update

A series of privacy advocates have expressed displeasure with the HHS “harm standard” as articulated in the recent Covered Entity .  However, I believe the “harm standard” is reasonable and appropriate.  One recent article is available here (published by computer world): HHS guts health-care breach notification law, groups warn Posted using ShareThis

I am a little unclear as to why privacy advocates and security vendors believe that the harm standard, found within the new HHS regulations for security breaches, in any way hampers the HITECH Act’s security breach notice rule for covered entities and business associates.  Many states use a similar risk based type analysis, in fact only seven states have a strict acquisition based standard, of those only a couple of these states link their definition of encryption to FIPS 140-2.*  In comparison to risk based states where one assesses the potential risk to a consumer resulting from theft of sensitive information, the federal standard is more helpful in the sense that it highlights key criteria to be evaluated in assessing risk to consumers.

*I am not certain on this, but I believe the most problematic state is California.  California includes health information within the definition of personal information, California references FIPS 140-2, California is an acquisition based state, and guidance documents issued by the state are extremely draconian.

Second, implementing a FIPS 140-2 approved encryption system is an expensive and complicated process — it seems reasonable that HHS should temper FIPS 140-2 with a harm standard analysis.  As many covered entities have started to dissect the requirements of what would constitute acceptably encrypted data under the HITECH act they have quickly realized that process of implementing what is largely a FISMA (Federal Government/ Military) based encryption standard presents many problems.  FIPS approved algorithms and processes require precise configuration; such systems are designed to fail closed.  Failing closed means denying access — this could be a good thing with money but a bad thing when dealing with clinical data in an emergency situation.  Security controls in the health care industry are a delicate balance of confidentiality, integrity and availability. (http://law2point0.com/wordpress/2009/09/15/50-state-security-breach-notice-law/).  Pushing out government grade security safeguards too fast could create serious issues in the event a provider needs immediate access to patient records but hospital A cannot communicate with hospital B due to a conflicting encryption schema.

Without the harm standard, covered entities would be forced into over-reporting incidents — over-reporting can be just as damaging as not reporting any security incidents.  There are two studies that help to put the “harm” or risk-based standard for security breach reporting in an appropriate (real-world) context.
The first study is a report prepared by the General Accounting Office (GAO) from 2007 entitled PERSONAL INFORMATION — Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown (the report is available for free at http://www.gao.gov/new.items/d07737.pdf).  This report evaluated the 24 largest breaches reported in the media from January 2000 through June 2005.  The study found that:

1. In only three instances was there evidence of fraud on existing accounts and in only one instance of the three identified cases did the GAO find evidence of unauthorized creation of a new account;
2. For 18 of the breaches, no clear evidence was uncovered linking the breach to identity theft; and
3. In the remaining two cases there was insufficient information to make a determination.

A second article, by S. Romanosky, R. Telang, and A. Acquisti, entitled Do Data Breach Disclosure Laws Reduce Identity Theft? (available for free at  http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1268926) summarizes the debate surrounding security breach notification laws and their impact.  The authors’ analyses reveal a modest effect of security breach disclosure laws in reducing identity theft rates by approximately 2%.  However, this article also notes that over-reporting has many negative consequences — including unnecessary costs and desensitizing consumers such that when a real incident that they should take notice of is ignored.

The FIPS-140-2 standard is a Federal Standard and the guidance cited by HHS (OMB Memorandum M-07-16 is also a federal standard (available at http://www.whitehouse.gov/OMB/memoranda/fy2007/m07-16.pdf)).  The OMB the guidance and the FIPS 140-2 are both compoennts of the federal government program to protect against harm resulting from a security breach.  It seems logical if that we are following a FISMA structure that OMB Memorandum M-07-16 should be considered when assessing the scope and consequences of a security breach.

The harm standard may result in fewer notices, in some states where there are exceptions for HIPAA covered entities for some provisions of state reporting requirements, but absent an applicable exception an entity could still be bound by the state standard and the federal standard.  Many states are including health information within the definition of personal information; even so it is frequently the case that when health information is compromised the triggering elements for a given state’s reporting statute are present within the compromised health data.  Unfortunately, the end result will likely be a negligible  reduction in notice unless the seven states and the DC that have an acquisition based standard move to a risk based / harm based analysis.  In my opinion an acquisition based standard reaches the wrong result for both consumers and companies.  The one benefit will be that the Federal standard does provide a rational framework for entities absent other guidance that can be used to frame analysis of a security incident and what mitigation efforts are appropriate.