Despite wave of data breaches, official says patient privacy isn’t dead

A. The ability to access electronic health records is something that we obviously have clarified and expanded over time since HIPAA was enacted. And I anticipate that we will continue to evaluate the application of HIPAA standards to emerging issues, whether they are posed by new technology or new forms of risk that aren’t being adequately addressed. From a macro perspective, we are seeing an explosion of new approaches to delivering health care, to treating patients, to sharing information. And that changes on an exceptionally rapid basis, and so ensuring that we are providing adequate guidance about how HIPAA applies and what the standards are in these new environments is something that’s a high priority.

Q. Some people have suggested that the notion of patient privacy is sort of outmoded and that you really don’t have privacy anymore. Do you accept that?

A. No. I think that you are talking about some of the most intimate facts about any individual, whether it is their health condition or their diagnosis or their treatment choices, and that it is really critical to ensure that they feel confident that that information will be protected from public disclosure. That’s the underlying premise of patient involvement in health care decision-making, that they can entrust their providers with this really intimate information knowing that it won’t be misused or inappropriately disclosed. Although there are new threats and cybercriminals get smarter every day, we have to do our best to keep up and ensure that there are adequate protections in place so that we can gain the benefits that technology and delivery system reform are promising.

Q. Let’s talk numbers. OCR staff is small and yet you receive a ton of complaints every year, thousands, tens of thousands. Can you get to them?

A. Do we have resource constraints? Absolutely. Do we have an increasing caseload? Yes. We have to learn to be as effective and efficient with our resources as we possibly can because those are two factors that cut in opposite directions and create a situation that we have to address. So, some of the ways that we’ve done it are we’ve created centralized systems to respond to telephone calls, to process complaints as they come in, and these have produced significant efficiencies. We are freeing up our regional [office] resources to engage in substantive investigations when those are necessary.

Q. Your office has the ability to issue fines in ways that a lot of federal agencies can’t and in denominations that a lot of federal agencies can’t. You’ve noted that you used them about two dozen times. Is that enough?

A. You know, each case depends on its facts and I do think that we have been committed to using settlement agreements and monetary recoveries in situations where we think that the conduct has been egregious or where we want to create a deterrent or where we feel that the monetary settlement will help to reinforce the message that we’re serious about HIPAA compliance. That said, we are very serious about HIPAA compliance even in situations where we don’t seek monetary settlements or civil money penalties. And I think if you look at our corrective action plans [agreements in which providers promise to make changes following a complaint], you will see that those are uniformly robust efforts to ensure that covered entities and business associates undertake the infrastructure and structural reforms that are necessary to ensure compliance going forward. And at the end of the day, ensuring that they have the policies and procedures in place to protect information in the future is a significant component of the kind of remedial relief that we seek.

Q. It seems that the Office for Civil Rights receives far more reports of smaller breaches than larger ones, and these don’t get the same amount of attention, at least publicly. Are these less important?

A. As I mentioned, every case depends on its facts. That’s why we do monitor the small breach reports that come in. To the extent we identify situations that warrant further investigation, we engage in that investigation. And in fact we’ve entered into two settlement agreements that were based on small breach reports that resulted in monetary relief. I think it is critical in our efforts to efficiently allocate our resources to identify where we can have the greatest impact in promoting compliance going forward and to the extent in the small breaches that we see types of conduct or egregiousness of mindset of the covered entity or examples of pervasive problems that we think the industry needs to be aware of. Those are the kinds of things that will lead us to undertake investigations of small breaches even though we don’t trigger them automatically.

See also:

Will you top the HIPAA audit candidate list?

On the Third Hand: PPACA subsidies and financial professionals

Anthem hack may have involed millions who aren’t customers