Straight from the Source: OCR and NIST Provide Guidance on Safeguarding Health Information at Annual Conference

Designed to explore the current health information technology security landscape, particularly as it pertains to the HIPAA Security Rule, this conference gave the approximately 200 attendees and other interested individuals watching the live webcast a unique opportunity to hear directly from senior leadership at OCR and other government agencies charged with enforcing health information privacy and security laws, in addition to hearing from industry participants.

As part of the opening keynote address, Jocelyn Samuels, the OCR Director, provided attendees with some particularly valuable insights into OCR’s current priorities.  In addition to announcing the settlement agreement with Cancer Care Group, P.C. (analyzed by Arent Fox in the post, “Don’t Lose Your Laptop!  New HIPAA Settlement Emphasizes Importance of Risk Analysis and Device and Media Controls”) and emphasizing the importance OCR places on the completion of a thorough risk analysis, Director Samuels also noted a number of additional upcoming initiatives, including:

• A new HIPAA audit protocol;
• Guidance on an individual’s right to access (including information on how the right to access connects to the President’s Precision Medicine Initiative);
• Guidance for cloud storage providers;
• An on-line portal to answer HIPAA-related questions from technology developers and others; and
• A new, more user-friendly OCR website.

Other OCR speakers at the conference were Deven McGraw, Deputy Director of the Health Information Privacy Division, and Iliana Peters, OCR’s senior advisor for compliance and enforcement.  Notably, as part of her speech on OCR’s current compliance and enforcement work, Ms. Peters identified OCR’s current HIPAA enforcement priorities as (i) ensuring that covered entities and business associates have completed a risk analysis and risk assessment that considers all of the electronic protected health information (often referred to as “e-PHI”) in an enterprise, (ii) protecting the individual rights granted by HIPAA, and (iii) business associate activities.  With respect to business associates, Ms. Peters specifically noted that many breaches involve business associates and that business associates often have data for multiple covered entities, so these breaches can involve information pertaining to very large numbers of individuals.

Attendees also heard speeches from representatives of the Food and Drug Administration, Office of the National Coordinator for Health IT, the Federal Trade Commission, and NIST, as well as from industry participants.  The speakers provided valuable insights in sessions dedicated to topics such as security management (threat intelligence, security plans, security best practices, etc.), medical device and electronic health record security, interoperability, business associate liability issues, and the areas of overlapping jurisdiction between OCR and the Federal Trade Commission.

Arent Fox’s Health Care Counsel Blog has published posts and articles about the health information technology security landscape, including “The Internal Threat: Cyber Security and Medical Devices,” and “eHealth – FTC Study Weighs in on Privacy and Security Concerns with its ‘Internet of Things’ Report.”  We also discussed these issues in our October 2014 Importance of Protecting Your Health Care Organization Against a Cybercrime Attack webinar. 

Arent Fox attorneys regularly monitor speeches and appearances by government officials for valuable insights into compliance with the HIPAA regulations.  Arent Fox attorneys also assist clients with conducting risk analyses, strengthening their HIPAA compliance programs, investigating and reporting breaches of unsecured protected health information, and responding to OCR investigations.