On October 27, 2015, the Senate passed S. 754, the Cybersecurity Information Sharing Act (“CISA”), with bi-partisan support. Although some raised privacy concerns, CISA received backing from the Administration and support from many industry participants. The Senate bill must be reconciled with similar bills in the House (H.R. 1560 and H.R. 1731) before a conference version is produced. This process may be contentious as privacy advocates seek to strengthen protections for personal information, and Senator Richard Burr, Chairman of the Senate Intelligence Committee and co-sponsor of CISA, indicated that the conferencing process is unlikely to produce a resolution before January 2016.
On Monday, October 5, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released an online platform for mobile health developers and others interested in the intersection of information technology and health information privacy and security. Interested parties can submit questions and comments on issues related to compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The Practising Legal Institute has published “Cybersecurity: A Practical Guide to the Law of Cyber Risk,” a treatise edited by Ed McNicholas and Vivek Mohan of Sidley Austin LLP. This “Sidley on Cybersecurity” treatise sets out in a clear and readable manner the complex legal framework for cybersecurity in the United States. We hope that it will be a practical legal guide for in-house attorneys, IT leaders, senior executives, and corporate directors concerned about cybersecurity risk.
The White House is soliciting public comments on its Proposed Privacy and Trust Principles (the Proposed Principles) for the Precision Medicine Initiative (PMI). PMI is a federal initiative to support research, technology and policies that enable the development of individualized treatments, and is backed by a $215 million investment under President Obama’s 2016 Budget.
New legislation out of Hartford means that Connecticut joins Massachusetts in imposing strict state requirements for data protection. S.B. 949. Additionally, the new law amends Connecticut’s data breach notification law, making Connecticut the first in the nation to affirmatively require entities that experience a reportable data breach to offer free credit monitoring to residents affected by the breach. The legislation further imposes significant new requirements on health insurers, as well as contractors that receive confidential information from state agencies, to maintain minimum data security protections. While health insurers have until 2017 to come into full compliance, the requirements for state contractors are effective as of July 1, 2015.
In May, the Department of Health and Human Services published its Spring 2015 regulatory agenda, which outlines its upcoming rulemaking initiatives. The agenda describes a number of Office of Civil Rights (OCR) rulemakings that are forthcoming, including OCR’s plan to release an advanced notice of proposed rulemaking that would solicit public comments on establishing a methodology under which an individual who is harmed by a Health Insurance Portability and Accountability Act (HIPAA) offense may receive a percentage of any Civil Money Penalty or monetary settlement collected by the government with respect to the offense. This is a significant rulemaking, which was required under the Health Information Technology for Economic and Clinical Health Act (HITECH) and is expected to be released in December 2015. The full regulatory agenda may be accessed here: http://www.reginfo.gov/public/do/eAgendaMain.
Recently, the Office of the National Coordinator for Health Information Technology (ONC) and the Office for Civil Rights (OCR) published new guidance on the privacy and security of electronic health information (the “Guide”). Although the Guide was drafted primarily for the benefit of smaller healthcare providers, it provides useful information on privacy and security issues that is potentially valuable to providers of all sizes. The Guide, last published in 2011, provides updated information about compliance with Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs (“Meaningful Use Programs”) and the HIPAA Privacy, Security and Breach Notification Rules.
On December 3, 2014, the Federal Trade Commission (FTC) announced that it reached a settlement with PaymentsMD, an Atlanta-based medical billing company, and its former CEO, Michael C. Hughes, for alleged violations of Section 5(a) of the Federal Trade Commission Act for using deceptive tactics to collect sensitive health information. Public comments on the FTC’s proposed Consent Orders are due January 2, 2015.
On November 11, 2014, the Connecticut Supreme Court held in Emily Byrne v. Avery Center for Obstetrics and Gynecology, P.C. (“Avery Center”) (SC 18904) that the federal Health Insurance Portability and Accountability Act (“HIPAA”) does not preempt state common law negligence and emotional distress claims against medical providers who improperly breach the confidentiality of a patient’s medical records and that “HIPAA may inform the applicable standard of care in certain circumstances.” In reaching its decision, the high court reversed the trial court’s dismissal of plaintiff Emily Byrne’s state common law causes of action for negligence and negligent infliction of emotion distress against Avery Center for releasing information about her pregnancy without her authorization in complying with a subpoena in a paternity action. Although other states have reached similar holdings, the Connecticut ruling is notable in light of the passage of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, which expanded HIPAA liability to business associates. As such, covered entities as well as their business associates risk increased exposure under HIPAA and state laws, including negligence, invasion of privacy and state privacy claims.
On Tuesday, April 22, 2014, the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) announced that Concentra Health Services Inc. (“CHS”) and QCA Health Plan Inc. (“QCA”) have agreed to pay a total of $1,975,220, collectively, to resolve potential violations of the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy and Security Rules stemming from the theft of unencrypted laptops. Specifically, CHS has agreed to pay $1,725,220, and QCA has agreed to pay $250,000, to OCR to settle potential HIPAA violations and will adopt corrective action plans to evidence their remediation of the potential violations. The clear message from both settlements is that OCR expects covered entities to encrypt mobile devices that store electronic Protected Health Information (“ePHI”).