Update-

Under the HITECH breach notification requirements, covered entities must notify HHS of all reportable breaches.  HHS recently released a list of breaches, including the covered entity, the business associate, number of individuals affected, and the location of the information lost.  More than 35 HIPAA covered entities have reported breaches involving more than 500 individuals’ PHI since September 2009.  The theft/loss of laptops, desktop and portable media by far represent the majority of the security breaches reported thus far.  A summary of breaches reported thus far appears below.

Reported Breaches of PHI

Older Story – October 12, 2009 — Content of the Notice to the Secretary of HHS for a Reportable Security Breach

The Secretary has delayed enforcement of the Security Breach Rules to give covered entities and business associates a reasonable amount of time to come into compliance.  However, in anticipation of covered entities’ new reporting obligations, HHS on October 7th, released an online form (OMB No. 0990-0346) that appears to be the exclusive mechanism by which a covered entity can provide the required notice to the Secretary in the event of a security breach. (The form is available at http://transparency.cit.nih.gov/breach/index.cfm).  The form is intended only for security breach submissions by covered entities to the Secretary; breaches involving business associates must be reported directly to the Secretary by the affected covered entity and not by the business associate.

Analysis of OMB No. 0990-0346 – HHS’s Security Breach Reporting Form

The form itself offers some insight into HHS’s understanding of security breaches and how HHS believes breaches can be mitigated and/or avoided altogether.  The following are what I consider to be the most interesting questions and potential responses pre-populated within the form:

1. HHS has defined seven categories of breaches within the form: theft, loss, improper disposal, unauthorized access, hacking/IT incident, other, and unknown.  Theft, loss, and improper disposal are breaches that can be easily mitigated by encryption or by following the guidelines referenced by HHS for the destruction of paper/and electronic media;
2. The “locations” where a breach may occur, identified by HHS, include: laptops, desktops, network servers, e-mail, other portable electronic devices, electronic medical records, paper, and other.  Again this question and the pre-populated responses echo HHS’s interest in encryption for data stored on laptops, desktops, and other portable media devices.  Moreover, next to loss of PHI related to theft of computer equipment, e-mail runs a close second as the next biggest source of breaches involving PHI.  It is very easy for someone to mistakenly email a message to the wrong person;
3. The form identifies four categories of PHI–demographic information, financial information, clinical information and other.  Demographic information and especially financial information are high value targets to potential identity thieves; and
4. Probably the most interesting question, from a planning perspective, requires the covered entity identify whether any of the following security controls were in place before the security incident: firewalls, packet filtering (router based), secure browser sessions , strong authentication , encrypted wireless , physical security, logical access controls, anti-virus software, intrusion detection, and biometrics.

This list of security controls is an odd combination of specific types of security controls (e.g. packet filtering router) and general categories of security controls (e.g. physical/ logical access controls).  I find inclusion of biometrics and the exclusion of two factor authentication (a more general category) unusual – the utility of biometric access controls relate more generally to creating systems of two factor authentication.  Two factor authentication techniques are based on any two of the following three types of methods: something you know, something you are, and something you have.  One common example of two factor identification is the use of a security token that generates a seemingly random number in combination with a pin and a password to authenticate a user.  Biometric methods of identification, which include fingerprint scanners, facial recognition, and retinal scanners, are either too expensive to implement as a broad-based solution or are poor quality consumer oriented solutions.

In all, it is obvious what the hot button issues are that may get the enforcement body’s (Office of Civil Rights) attention and more importantly how to avoid them: (i) encrypting portable media, (ii) firewalls, (iii) proper document destruction procedures, (iii) the existence of a physical security plan, (iv) two factor authentication, and (v) antivirus.

The form should be filled out with diligence.  The form contains an attestation that the information provided is accurate, and acknowledgement that the Office of Civil Rights (“OCR”) may be required to release information provided via the form pursuant to the Freedom of Information Act, some of the information will be posted to HHS’s web site, and tOCR will use the information to provide an annual report to Congress required by the HITECH Act.

Related Blogs

          

Related posts:

1. Interim Final Rule on Breach Notification for HIPAA Covered Entities and Business Associates Released by HHS (Effective September 23, 2009) & FTC Releases Final Guidance on PHR Security Breach Notification Requirements Regulations requiring health care providers, health plans, and other entities...
2. Excellent Article from American Health Lawyers Association’s Healthcare Liability & Litigation Health Briefs, on 9/9/09. by Kristen McDonald. (Republished with permission from the author.) What happens if the offices of a covered entity are...
3. Business Associate and Covered Entity HIPAA Compliance — Auditing Questions and NIST 800-53 Security Controls. This article discusses techniques for implementing the updated requirements of...
4. Fear Mongering or Legitimate Criticism — “HHS guts health-care breach notification law, groups warn” I am a little unclear as to why privacy advocates...
5. Key Issues in Privacy and Security for 2010 Next year should be interesting. From Red Flag compliance, federal...