HHS is proposing major changes to HIPAA for the first time in more than a decade, aiming to strengthen cybersecurity protocols for electronic health data. Healthcare cybersecurity leaders are mainly in favor of the proposal \u2014 though there are some concerns that smaller providers will struggle with the financial and operational burdens of compliance.
\nThe post HHS\u2019 Proposed HIPAA Changes Are A Step In The Right Direction, But Some Providers May Struggle To Comply appeared first on Above the Law.<\/p>\n
Among myriad acronyms in the healthcare industry, HIPAA<\/a> is one of the most referenced.\u00a0<\/p>\n At the end of last year, the Department of Health and Human Services proposed<\/a> major updates to this law \u2014 named the Health Insurance Portability and Accountability Act \u2014 for the first time in more than a decade.\u00a0<\/p>\n HHS said its proposal is designed to \u201cbetter protect the U.S. healthcare system from a growing number of cyberattacks.\u201d The announcement was made at the end of a year in which several high-profile cybersecurity incidents occurred in healthcare, such as the ransomware attacks Change Healthcare<\/a> and Ascension<\/a> \u2014 the former exposed more than 100 million patient records, and the latter exposed more than 5 million.<\/p>\n These proposed changes seek to strengthen cybersecurity protocols for electronic health data by standardizing certain security processes among providers. HHS is accepting comments on its proposal until March 7.<\/p>\n Healthcare cybersecurity leaders are mainly in favor of the proposed changes, as the regulation will force providers to address longstanding gaps in their data infrastructure and security preparedness. However, the experts interviewed for this article noted that smaller providers may struggle with the financial and operational burdens of compliance.<\/p>\n HHS\u2019 proposal seeks to make several changes to the way providers manage health data under HIPAA, with a key change being the elimination of the distinction between \u201crequired\u201d and \u201caddressable\u201d implementation specifications.<\/p>\n Currently, HIPAA has two types of security rules for protecting sensitive health information \u2014 \u201crequired\u201d rules that must be followed and \u201caddressable\u201d rules that providers can choose not to obey.<\/p>\n By getting rid of these two categories, HHS is aiming to make all cybersecurity rules mandatory for healthcare organizations, as well as emphasizing the need for comprehensive security measures across all health data. This means several cybersecurity protocols will be required for all providers, such as two-factor authentication, data encryption and network segmentation.<\/p>\n If instated, these changes would help providers get on the same page and follow shared cybersecurity standards, pointed out Aaron Neiderhiser, CEO of open-source healthcare data platform Tuva Health<\/a>.<\/p>\n This standardization will be beneficial for the healthcare industry \u2014 because any provider that isn\u2019t using protocols like multi-factor authentication and data encryption is \u201cnot protecting data to the extent that they should be,\u201d Neiderhiser said.<\/p>\n But other changes are \u201cmore esoteric\u201d and will be more difficult for some providers to implement, he noted.<\/p>\n For instance, the proposed changes to HIPAA would also require providers to maintain detailed written documentation for all of their cybersecurity policies and procedures. HHS wants providers to continually maintain documents for asset inventory, network mapping and risk analyses.<\/p>\n The main goal behind these new documentation requirements is to ensure providers can effectively map out the way their data is being stored and transferred, noted Mitesh Rao, CEO of OMNY Health<\/a>, a national data ecosystem that facilitates medical research.<\/p>\n \u201cThat goes beyond cybersecurity \u2014 that\u2019s almost into the infrastructure space,\u201d he said. \u201c[HHS] is saying, \u2018Look, you guys are sitting on a lot of data, you need to really have your hands wrapped around it. You need to know where it is, know how it\u2019s moving, know how everything is set up.\u2019\u201d<\/p>\n The changes reflect the fact that data \u201cis now driving everything\u201d in healthcare, but many organizations lack a comprehensive understanding of where all their data sits and how it can best be leveraged, Rao explained.<\/p>\n Gaining this understanding is no easy task, he pointed out. Health systems house massive amounts of data that sprawls across various systems and divisions, such as inpatient services, surgery, pharmacy, imaging and clinical trials.<\/p>\n Still, having a strong grasp on data mapping is crucial, Rao declared.<\/p>\n Once a provider knows exactly where all of its information sits and how that data can best be leveraged, data \u201cbecomes more of an asset and less of a liability,\u201d he said.\u00a0<\/p>\n Last year was the sector\u2019s worst year in history<\/a> in terms of breached healthcare records, with more than 200 million patient records exposed. Healthcare providers are well aware of what a problem data breaches have become in the past few years, and most organizations realize that they need to work on shoring up their defenses, Rao noted.<\/p>\n In order to do this, providers have to partner with tech companies, he said.<\/p>\n \u201cThe infrastructure that exists right now across the provider world isn\u2019t really designed to meet a lot of these capabilities \u2014 but there are a lot of great platforms that are designed to do this. So it\u2019s a question of who to partner with,\u201d Rao remarked.<\/p>\n Neiderhiser of Tuva Health also highlighted the fact that providers aren\u2019t tech-savvy enough to meet new cybersecurity regulations on their own.These responsibilities sit outside providers\u2019 core competency.<\/p>\n \u201cSome organizations that we work with will say things like, \u2018We don\u2019t know how to log into AWS.\u2019 They\u2019re provider organizations \u2014 their business is not technology, it\u2019s care delivery,\u201d Neiderhiser stated.<\/p>\n Larger organizations can easily strike partnerships with tech companies that have expertise in data management and security. For smaller healthcare organizations that may not have deeply established relationships with tech partners, there could be a longer adjustment period, Neiderhiser said.<\/p>\n A large health system may have already had its IT personnel preparing for a potential change in HIPAA for months \u2014 but a small rural hospital probably didn\u2019t have the resources or staff to account for this, he noted. In his view, smaller providers will certainly face a bigger burden when it comes to complying with these new regulations.<\/p>\n The smaller provider organizations that Neiderhiser mentioned often operate on tight margins<\/a> \u2014 meaning it might be a struggle to come up with the cash to pay a tech company to manage their cybersecurity compliance functions.<\/p>\n Another cybersecurity expert \u2014 Sean Kelly, chief medical officer at health IT security company Imprivata<\/a> \u2014 noted that he is worried about the cost of compliance.<\/p>\n \u201cIt\u2019s difficult just to put forth unfunded mandates \u2014 and it\u2019s really difficult, without any kind of funding or incentivization, to just put penalties in front of hospital systems that already have limited budgets, particularly when you look at critical care access hospitals and rural practices,\u201d Kelly declared.<\/p>\n If the proposed changes to HIPAA are instated, Kelly said he hopes the federal government establishes a system in which hospitals with fewer resources can qualify for grant money or \u201csome sort of incentivization\u201d for compliance. For instance, perhaps these hospitals could obtain Medicare payments more quickly as an incentive, he stated.<\/p>\n He also pointed out that if Congress conducted an analysis of the cost of cybersecurity breaches versus the cost of a pool of money going toward preventive cybersecurity measures at hospitals, it would find that the breaches are much more expensive.<\/p>\n \u201cThe cost of these breaches is enormous \u2014 not just for the hospitals and the patients that go through it, but even for the local hospitals around it. When a hospital shuts down, then the ambulances go elsewhere, and patients get seen elsewhere. There\u2019s unnecessary tests, there\u2019s morbidity, mortality, lawsuits, and costs associated with the local area around a hospital that goes down,\u201d Kelly explained.<\/p>\n