Julia and I had the pleasure of attending the 2018 Privacy & Security Forum a couple of weeks ago. One of the sessions I attended was focused on what’s happening at OCR these days. The speaker was Roger Severino, Director of OCR, and the moderator was Adam Greene, partner at Davis Wright Tremaine, LLP. I heard about new OCR activity, got an answer to my question about the future use of the OCR audit protocols, and key OCR takeaways. I have the pleasure of passing the Forum’s highlights on to you.
OCR audit protocols use.
The big news to me was the answer to one of my questions about OCR audit protocols. For over a year, we’ve been saying that for investigations and enforcement activity that it’s likely the OCR will use the audit protocols that were updated from the phase 2 audits. I took the opportunity to ask the top authority at OCR about future use of the protocols. Mr. Severino confirmed – that’s just what OCR intends to do and may already be doing so.
Other OCR activity includes:
- Updating HIPAA/FERPA guidance (jointly with the US Department of Education)
- Issuing a notice of proposed rule making (NPRM) request for information (RFI) HITECH Act accounting of disclosures language (the last NPRM was not well received by the industry and privacy advocates)
- Evaluating ways OCR can distribute funds received as part of enforcement related civil monetary penalties and settlement agreements to victims of breaches of their PHI
That’s a fair amount of activity. The only caveat is we don’t know how soon “soon” is.
FBI and FTC weighs in on ransomware attacks.
I also attended a session that featured speakers from the FBI and the FTC. Along with Mr. Severino the FBI said the first step covered entities and business associates should take is to contact the FBI if you’re attacked by ransomware. The FBI has agents in place to investigate ransomware and help covered entities and business associates get their data back without paying a ransom. This is something to keep in mind when you’re updating your security incident response plans especially given local law enforcement may not have the resources to assist with an investigation.
Is the HIPAA Security Rule being updated?
There has been much talk over the past few years about the need to update the HIPAA Security Rule. The Director indicated that he things there is nothing fundamentally broken with security rule so it’s unlikely the rule will be amended any time soon. The Security Rule is technology neutral and is flexible. It hasn’t become obsolete due to changes in technology and there has been a lot of change since the rule was published in 2005.
OCR phase 2 audit results and plans for enforcement.
Mr. Severino shared that OCR was finalizing phase 2 audits and results will be published soon. As far as the audit program goes, he indicated that there would likely be no more formal audits. Instead, the audits would become part of OCR’s enforcement activity. He believes this promotes an enforcement mindset with a higher-level rigor, similar to enforcement activity conducted by the US Department of Justice.
An audience member asked if enforcement would continue unabated or would be curtailed under this administration. The answer: OCR is still on track with enforcement. Mr. Severino would like to see enforcement go down as a reflection of the expansion of a culture of compliance, which OCR has been pushing since 2011. He did add that the industry was far from there today.
Adam Greene asked Mr. Severino to provide three takeaways for the audience. The Director said:
- You need to treat PHI as if it was a bar of gold. That includes conducting periodic risk analyses, encrypting PHI and securing mobile devices.
- “We’re from the governments and we’re here to help” – tap into OCR resources through its website, the most popular website for the US Department of Health & Human Services.
- “Help us help you” – review NPRMs, RFIs, and other information OCR would like input from the industry about and provide feedback. Periodically check regulations.gov to check on opportunities to provide OCR feedback.
All in all it was a great conference and good to get information from the proverbial horse’s mouth. Julia will be sharing information about some of the sessions she attended. Look for more in the weeks to come!
