Science Applications International Corporation · NASDAQ:SAIC
Science Applications International — Conference Presentation (February 2010)
25 slides from Science Applications International's conference presentation, February 2010
Slide 1: ARRA Impacts on Privacy and Security
American Recovery and Reinvestment Act (ARRA) Impacts on Privacy and Security Dixie B. Baker, PhD, Chief Technology Officer, SAIC Health Solutions and Member HIT Standards Committee, Chair Privacy and Security Workgroup February 2010 09-2217
Slide 2: Introduction
Introduction • The American Recovery and Reinvestment Act (ARRA – a.k.a. “stimulus bill”) attempted to accelerate the adoption of health information technology (HIT) by offering immediate funding, assistance, and incentives (that diminish over time, ultimately leading to penalties) • To help mitigat
Slide 3: American Recovery and Reinvestment Act (ARRA)
American Recovery and Reinvestment Act (ARRA) • H.R. 1, signed into law on February 17, 2009 • Aims to stimulate the economy through investments in infrastructure, unemployment benefits, transportation, education, and healthcare • Title XIII – Health Information Technology for Economic and Clinical
Slide 4: What ARRA Privacy and Security Provisions Attempt to Accomplish
What ARRA Privacy and Security Provisions Attempt to Accomplish • Broaden the scope of applicability for the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules to encompass business associates • Provide transparency for breach victims • Tighten restrictions on the
Slide 5: ARRA Privacy and Security Provisions
ARRA Privacy and Security Provisions • §13401 – Application of HIPAA security provisions and penalties to business associates (BAs) • §13402 – Breach notification • §13403 – Education on health information privacy • §13404 – Application of HIPAA privacy provisions and penalties to BAs • §13405 – Res
Slide 6: ARRA Privacy and Security Provisions – Business Associates
ARRA Privacy and Security Provisions – Business Associates • §13401 – Application of HIPAA security provisions and penalties to business associates (BAs) • §13402 – Breach notification • §13403 – Education on health information privacy • §13404 – Application of HIPAA privacy provisions and penalties
Slide 7: Business Associate Provisions
Business Associate Provisions • Business associates (BAs) must comply with HIPAA Security Rule – Administrative safeguards – Physical safeguards – Technical safeguards – Policies and procedures and documentation requirements • BAs must comply with HIPAA Privacy Rule – Including new privacy provision
Slide 8: Business Associate (BA) Impacts
Business Associate (BA) Impacts • By extending HIPAA’s scope to include BAs, new provisions expose BAs to direct regulation by the Department of Health and Human Services and oversight and enforcement by the Office of Civil Rights (OCR) – Increases business risk for BAs, while reducing risk for cove
Slide 9: Business Associates (BAs): What You Should Do
Business Associates (BAs): What You Should Do 1.Review BA agreements, and revise and renegotiate to reflect new BA liability (for example, indemnity provisions, limits of liability). 2.Assess risk impact, and develop mitigation strategies. 3.If healthcare represents only a portion of the business (“
Slide 10: ARRA Privacy and Security Provisions – Breach Notification
ARRA Privacy and Security Provisions – Breach Notification • 13401 – Application of HIPAA security provisions and penalties to business associates (BAs) • 13402 – Breach notification • 13403 – Education on health information privacy • 13404 – Application of HIPAA privacy provisions and penalties to
Slide 11: Breach Notification Provisions
Breach Notification Provisions • If “unsecured” protected health information (PHI) is accessed, acquired, or disclosed as a result of a breach: – No later than 60 days after discovery, a covered entity must provide written notification to each individual whose PHI was breached – If more than 500 ind
Slide 12: “Breach” Definition
“Breach” Definition • A breach is defined as the acquisition, access, use, or disclosure of protected health information (PHI) in a manner that is not permitted by the Privacy Rule and that compromises the security or privacy of the PHI (that is, it poses a significant risk of financial, reputationa
Slide 13: Breach Notification: Impacts
Breach Notification: Impacts • Establishes a federal mandate requiring notification of individuals whose protected health information (PHI) is unlawfully disclosed • Updated guidance specifying encryption and destruction technologies and methodologies that effectively render PHI unusable, unreadable
Slide 14: Breach Notification: What You Should Do
Breach Notification: What You Should Do 1.Begin by reviewing the HHS Interim Final Rule (IFR), making sure you understand what a “breach” is – and simplify the definition for use in communicating within the organization. 2.Figure out whether any protected health information that currently is “unsecu
Slide 15: ARRA Privacy and Security Provisions – Enforcement and Sanctions
ARRA Privacy and Security Provisions – Enforcement and Sanctions • 13401 – Application of HIPAA security provisions and penalties to business associates (BAs) • 13402 – Breach notification • 13403 – Education on health information privacy • 13404 – Application of HIPAA privacy provisions and penalti
Slide 16: Enforcement and Penalty Provisions
Enforcement and Penalty Provisions • Criminal penalties can be applied to individuals (not just companies) • New system of civil monetary penalties that incorporates concept of “willful neglect” • Establishment of methodology to distribute to harmed individuals a portion of civil penalties collected
Slide 17: Enforcement and Penalties: Impact
Enforcement and Penalties: Impact • Security and Privacy enforcement now centralized in the Office of Civil Rights • Increased enforcement of the HIPAA rules (essentially none previously) – at both federal and state levels • Heightened efforts to pursue and heavily penalize individuals and employers
Slide 18: Enforcement and Penalties: What You Should Do
Enforcement and Penalties: What You Should Do 1.Update your HIPAA Compliance Program, privacy and security policies and procedures, and training to incorporate new ARRA provisions. 2.Factor new penalties, individual exposures, and increased probability of audit into your privacy and security risk as
Slide 19: Sorting Out ARRA and Its Impacts: Pre-ARRA
Sorting Out ARRA and Its Impacts: Pre-ARRA Laws Regulations Purposes Audiences Protect Security Rule electronic protected health Covered Entities information (PHI) and Business HIPAA Associates (1996) Privacy Rule Protect privacy of PHI and rights of consumers Acronyms defined on page 25 19 Energy |
Slide 20: Sorting Out ARRA and Its Impacts: Post-ARRA
Sorting Out ARRA and Its Impacts: Post-ARRA Laws Regulations Purposes Audiences Protect electronic Security Rule protected health information (PHI) Covered Entities and Business HIPAA Protect privacy of Associates Privacy Rule PHI and rights of (1996) consumers Eligible Professionals FTC Personal Pr
Slide 21: Sorting Out ARRA: Current Status
Sorting Out ARRA: Current Status Laws Regulations • Security Final Rule published February 20, 2003 • Privacy Final Rule published August 14, 2002 Security Rule • FTC Health Breach Notification Final Rule HIPAA published August 25, 2009 (1996) Privacy Rule • Electronic Health Record (EHR) “Meaningfu
Slide 22: The ARRA Transformation
The ARRA Transformation • Before ARRA, the Office of the National Coordinator (ONC) was an office established by Executive Order to oversee activities relating to the development of health information technology (HIT) standards – ARRA established the ONC as an office reporting to the Secretary HHS •
Slide 23: FACA Committees’ Contributions and Directions
FACA Committees’ Contributions and Directions • HIT Policy Committee recommended “meaningful use” goals, objectives, and measures that were incorporated into the Centers for Medicare and Medicaid Services (CMS) Incentive Program Notice of Proposed Rule Making (NPRM) – Recently added three new Workgr
Slide 24: Sorting Out ARRA: What You Should Do
Sorting Out ARRA: What You Should Do 1. Review EHR Incentive Program NPRM within the context of your business and experience, paying special attention to specific solicitations for input; submit comments at www.regulations.gov by March 15, 2010. 2. Review Initial Set of Standards, Implementation Spe
Slide 25: Acronyms
Acronyms • ARRA – American Recovery and • HIPAA – Health Insurance Portability Reinvestment Act and Accountability Act • BA – Business Associate • HIT – Health Information Technology • CMS – Centers for Medicare and • HITECH – Health Information Medicaid Services Technology for Economic and Clinical
Science Applications International — Conference Presentation (February 2010) on 6ix