Managing HIPAA Data Breaches

Size: px

Start display at page:

Download "Managing HIPAA Data Breaches"

Primrose Wood
5 years ago
Views:

Managing HIPAA Data Breaches William J. Roberts, Esq.

2 Agenda What are the Risks of a Breach? IdenPfying Internal Threats IdenPfying External Threats Responding to a Data Breach 2

3 Data Breaches by the Nmbers $6.5 million average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 average cost per lost or stolen record 112 million nmber of individals (U.S. only) affected by a health care data breach in million nmber of hacked acconts (U.S. only) in 2014 Sorces: (1) 2015 Cost of Data Breach Stdy: United States, Ponemon InsPtte Research; (2) Data Breaches In Healthcare Totaled Over 112 Million Records In 2015, Forbes, 12/31/2015 3

4 Data Breaches Breaches are increasing in sophispcapon, freqency and severity Health care is a primary target of breach acpvity and is sbject to heightened government scrpny and enforcement Threats can be categorized in two ways: External Internal 4

5 IdenPfying Internal Threats Insider threats are twofold: Malicios Insider Wish to do harm to company Ø Can be employee theg for personal or bsiness gain Ø Terminated employees taking data Ø Accessing data otside scope of employment Ø Employees prposely missing data 5

6 IdenPfying Internal Threats Insider threats are twofold: Careless or Negligent Insider Ø No ill will, bt throgh carelessness, negligence or lack of training, creates openings for data loss Ø Stdy: The Hman Factor in Data ProtecPon ( hhp:// The_Hman_Factor_in_data_ProtecPon_WP_FINAL.pd f) Ø Employees are likely greatest threat to PHI Ø Incldes lost files, laptops, mobile devices 6

7 IdenPfying External Threats External threats take two forms An ahack on yor informapon systems or theg of physical files, or An ahempt to trick an employee to divlge sensipve informapon 7

8 Cybersecrity The Stats Average annal nmber of cybersecrity incidents: 80 to 90 million Increase in cybersecrity incidents from : 38% Projected global cost of cyberahacks in 2019: 2.1 trillion US dollars Sorce: hhp://expandedramblings.com/index.php/cybersecrity-stapspcs/ 8

9 It s Phishing Season! Phishing is an ahempt to se to trick a recipient into disclosing personal informapon, sch as financial accont informapon We are seeing increased sophispcapon and volme of ahempts hhps://blog.cyveillance.com/cyveillance-phishing-report-top-targetsjne / 9

10 Masqerading is a scam in which the perpetrator assmes the idenpty of a known, trsted colleage to trick the colleage into taking some acpon, ogen sending employee or financial data or wiring fnds Masqerading 10

11 A Ransom for Yor Data A ransomware ahack is one in which a perpetrator assmes control of yor data and will not release it npl payment is made (or threatens to frther disclose it nless payment is made) Payment is ogen reqested in bitcoin 11

Yo ve Been Hacked Hacking ahempts are increasingly common in all indstry sectors Healthcare, edcapon, government, retail and finance are the most

12 Yo ve Been Hacked Hacking ahempts are increasingly common in all indstry sectors Healthcare, edcapon, government, retail and finance are the most poplar targets Small enppes are jst as likely (if not more likely) to be targets as large, well-known corporapons Sorce: Indianapolis Star, 12/15/14 12

13 Responding to a Data Breach Discovery Damage Control InvesPgaPon MiPgaPon NoPficaPon(s) 13

14 ReporPng Strctre: Discovery Incident nopficapon policy Employee/staff training Cltre of transparency, not fear Consider mock breaches Need to have a breach response plan in place to gide response. Consider: The Right Team: IT, compliance, HR, papent/pblic relapons, legal consel Back-ps for each key, responsible individal (e.g. leave, vacapon) 14

15 InvesPgaPon The covered enpty mst invespgate the report of the breach withot delay Ahorney-client privilege is vital to protect yor interests Have external resorces lined-p ahead of Pme: PR, forensic IT, law enforcement contacts, external consel Only involve the necessary parpes confidenpality is important 15

16 NoPficaPon to Individals Rle: Covered enppes mst nopfy affected individals following the discovery of a breach of nsecred protected health informapon NoPce mst be wrihen and sent by first-class mail, or alternapvely, by if the affected individal has agreed to receive sch nopces electronically NoPce mst be provided withot nreasonable delay and in no case later than 60 days following discovery NoPce mst inclde, to the extent possible, a brief descrippon of the breach, a descrippon of the types of informapon that were involved in the breach, the steps affected individals shold take to protect themselves from potenpal harm, a brief descrippon of what the covered enpty is doing to invespgate the breach, mipgate the harm, and prevent frther breaches, as well as contact informapon 16

17 Consider: NoPficaPon to Individals Develop commnicapon lines toll free nmber, , postal address Who will respond to inqiries? Internal resorces sfficient or call center needed? FAQs Langage and disability concerns? Minors? Decedents? Can yo handle the commnicapons in-hose? 17

18 SbsPtte NoPce Rle: Insfficient or ot-of-date contact informapon for: 10 or more individals - the covered enpty mst provide sbsptte nopce by either pospng the nopce on the home page of its web site for at least 90 days or by providing the nopce in major print or broadcast media where the affected individals likely reside Ø mst inclde a toll-free phone nmber that remains acpve for at least 90 days where individals can learn if their informapon was involved in the breach Fewer than 10 individals - the covered enpty may provide sbsptte nopce by an alternapve form of wrihen nopce, by telephone, or other means 18

19 NoPficaPon to the Media Rle: Covered enppes that experience a breach affecpng more than 500 residents of a state or jrisdicpon are, in addipon to nopfying the affected individals, reqired to provide nopce to prominent media otlets Consider: Ogen in the form of a press release Withot nreasonable delay and in no case later than 60 days following discovery Mst inclde the same informapon reqired for the individal nopce PR professional assistance Media talking points Media point person who speaks for yor organizapon (and who does not) Controlling the message/coordinapng with employees Be cognizant of media leaks/stealth inqiries 19

20 NoPficaPon to HHS Rle: Covered enppes mst nopfy HHS by sbmisng a breach report form online 500 or more individals, covered enppes mst nopfy HHS withot nreasonable delay and in no case later than 60 days following a breach Fewer than 500 individals, the covered enpty may nopfy HHS of sch breaches on an annal basis, de to HHS no later than 60 days ager the end of the calendar year in which the breaches are discovered Consider: Accracy is vital Smmary statement may have significant conseqences 20

21 Other NoPficaPon ObligaPons? Depending pon yor sector, contractal arrangements or locapon, consider the following addiponal nopficapons that may be necessary: State Ahorney General(s) State reglatory agencies (e.g. Departments of Health, Insrance or Consmer ProtecPon) Bsiness partners (e.g. HIEs, affiliates) Departments of EdcaPon (state and federal) PoliPcal stakeholders (esp. if governmental enpty) Fnders (look to grants, donors) Employees (e.g. , Intranet pospng) 21

22 Thoghts on BA Breaches At Pmes, a breach is cased by or occrs at yor bsiness associate. When planning for and responding to sch a breach, consider: BAA reporpng, cooperapon, mipgapon and liability isses is the BAA yor friend or foe? Who shold nopfy? Control of messaging 22

23 MiPgaPon Rle: A covered enpty mst take reasonable steps to mipgate harm to individals cased by the breach HIPAA is light on specifics bt state laws are now mandapng certain measres Consider: What informapon can yo provide to affected parpes? Credit monitoring when? Reqired by law? Credit conseling, idenpty theg recovery services IdenPty theg insrance 23

24 Damage Control A data breach may inflict significant financial, operaponal and reptaponal costs on a company. Employee morale and confidence may also sffer. Develop a plan for: Responding to qespons and concerns from crrent and former employees, papents or cstomers Handling inqiries from relevant bsiness partners Managing the company s reptapon in the bsiness and consmer commnipes 24

25 Legal Risks Lawsits Can and Will Come from Six Sorces: Consmers Insrers Financial InsPtPons Shareholders Employees Government 25

26 Government Enforcement A HIPAA breach may reslt in enforcement acpons from state ahorney generals and the HHS Office for Civil Rights (OCR) In some instances, other enforcement agencies, inclding consmer protecpon, health, edcapon or insrance departments, may have jrisdicpon Key a HIPAA breach ogen violates other state and federal laws, meaning more opportnipes for enforcement 26

27 Legal Risks and Government Enforcement Need to prepare for the following from Day One : OCR invespgapon and enforcement acpon Ahorney General invespgapon and enforcement acpon Lawsits from papents, cstomers, bsiness partners Everything yo do from preparing for the breach to yor response to it is in prepara7on for these enforcement ac7ons and lawsits 27

28 PenalPes Recent changes to the law have significantly increased the penalpes for violapng HIPAA: For Pers of civil monetary penalpes ranging from $100/ per violapon to $1.5 million/per violapon Criminal penalpes: p to $250,000 in fines and p to 10 years in prison Both the covered enpty and individal employees can be penalized for violapng HIPAA Breaches may also reslt in costly consent orders or correcpve acpon plans, lawsits and addiponal penalpes state enforcement acpons 28

29 Learn from Others In 2014, New York-Presbyterian Hospital and Colmbia University entered into sehlement for $4.8M for failing to secre papent info Gov t conclded companies: Ø Lacked technical safegards Ø Failed to condct accrate risk analyses Ø Failed to develop adeqate risk management plans to address potenpal secrity threats 29

Qes8ons + Contact Informa8on William J. Roberts, Chair Privacy + Data ProtecPon Tel: 860-251-5051 wroberts@goodwin.

30 Qes8ons + Contact Informa8on William J. Roberts, Chair Privacy + Data ProtecPon Tel: wroberts@goodwin.com Sorce : The New Yorker, Sept. 8, 2015 Bad news, captain. The ship s compter has been sharing all or personal data with the Romlans. 30

31 Need Help With HIPAA Compliance? The Gard Total Compliance Soltion Simple Cost-effective Compliance with Confidence Adits SRA (Secrity Risk Assessment), Administrative, Privacy Spport - We work with yo Compliance Coaching Incident Management Remediation Plans HIPAA Hotline Edcation Cltre of Compliance Contact Us HIPAA ( ) Bsiness Associate Management Docment Version Employee Attestation & Tracking Policies, Procedres & Training HIPAA

Drafting Legal Opinions for Article 9 Security Interests: Navigating the Complexities and Avoiding Liability

Drafting Legal Opinions for Article 9 Secrity Interests: Navigating the Complexities and Avoiding Liability Erik W. Hepler, Kirkland & Ellis James C. Schlwolf, Shipman & Goodwin Overview Opinions are typical