For a copy of the following presentation, please visit our

1. This UBA Employer Webinar Series is brought to you by United Benefit Advisorsin conjunction with Jackson Lewis For a copy of the following presentation, please visit our website at www.UBAbenefits.com. Go to the Wisdom tab and then to the HR webinar series page.

2. Presented by: Kathleen Barrow, Esq. barrowk@jacksonlewis.com Joseph Lazzarotti, Esq., CIPP/US lazzarottij@jacksonlewis.com April 9, 2013 United Benefits Advisors:HIPAA Privacy and Security – New Obligations Are Coming

3. About the Firm Represents management exclusively in every aspect of employment, benefits, labor, and immigration law and related litigation Over 700 attorneys in 49 locations nationwide Current caseload of over 5,000 litigations and approximately 300 class actions Founding member of L&E Global

4. Disclaimer This presentation provides general information regarding its subject and explicitly may not be construed as providing any individualized advice concerning particular circumstances. Persons needing advice concerning particular circumstances must consult counsel concerning those circumstances.  Indeed, health care reform law is highly complicated and it supplements and amends an existing expansive and interconnected body of statutory and case law and regulations (e.g., ERISA, IRC, PHS, COBRA, HIPAA, etc.).  The solutions to any given business’s health care reform compliance and design issues depend on too many varied factors to list, including but not limited to, the size of the employer (which depends on complex business ownership and employee counting rules), whether the employer has a fully-insured or self-funded group health plan, whether its employees work full time or part time, the importance of group health coverage to the employer’s recruitment and retention goals,  whether the employer has a collectively-bargained workforce, whether the employer has leased employees, the cost of the current group health coverage and extent to which employees must pay that cost, where the employer/employees are located, whether the employer is a religious organization, what the current plan covers and whether that coverage meets minimum requirements, and many other factors.  IRS Circular 230 disclosure: Any tax advice contained in this communication (including any attachments or enclosures) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed in this communication. (The foregoing disclaimer has been affixed pursuant to U.S. Treasury regulations governing tax practitioners.)

5. Workplace Privacy Concerns • I.T. • - Passwords • - Data security • - Firewalls • - Technology • E-commerce • Vendors • Customers • COPPA • Data breach • Confidentiality • Trade secrets • Policies • Agreements • Whisleblowing • Smart phones • Social media • Email

6. HIPAA – A Brief Refresher • What is the Health Insurance Portability and Accountability Act (HIPAA)? • Nondiscrimination • Portability • Fraud and Abuse • Administrative Simplification • What are key aspects of “Administrative Simplification”? • Privacy and security standards • Transaction code sets

7. HIPAA – A Brief Refresher • How do the privacy and security standards interact with state law? • They provide a federal floor for health information protection that supersedes any contrary provision of state law • State laws are not preempted if they conflict with HIPAA and are more “stringent” – more protective • What is the basic principle under HIPAA? • Covered Entities that possess . . . • individually identifiable information related to an individual’s health care, or provision or payment for health care. . . • cannot be used or disclosed except under specified circumstances, and must be safeguarded.

8. HIPAA – A Brief Refresher • Who/what is a covered entity under HIPAA? • Most Healthcare Providers – those that transmit health information in electronic form in connection with certain covered transactions • Health Plans • Health Care Clearinghouses • No Jurisdiction Over “Employers” • What health plans are covered? • Medical, dental, vision, HRA, HFSA, EAP, many LTC plans • Remember on-site health clinics, even though not “plans”

9. HIPAA – A Brief Refresher • What plans are NOT covered? • Disability, workers compensation, fixed indemnity LTC, stop-loss/reinsurance policies • Self-administered health plans with fewer than 50 participants • What is protected health information? • Information created or received by covered entity or employer • Relating to individual’s past, present or future • Physical or mental health or condition or • Provision of health care or • Payment for health care • That does or reasonably could identify the individual

10. HIPAA – A Brief Refresher • What is NOT Protected Health Information? • Medical information collected or maintained in connection with employer obligations under law (wearing your “employer hat”) • FMLA, ADA , Sick Leave Requests • Occupational Injury • Disability Insurance Eligibility • Drug Screening Results • Workplace Medical Surveillance • Fitness-For-Duty Tests • Focus on WHY employer acquired the information

11. HIPAA – A Brief Refresher • What is a Use? • The sharing, employment, application, utilization, examination, or analysis of information within the entity maintaining the information. • What is a disclosure? • The release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information.

12. HIPAA – A Brief Refresher • When can a plan use and disclose PHI? • General rule – not unless permitted under HIPAA • Key exceptions • Individual, and pursuant to his/her authorization • Plan sponsor and business associates • Inadvertence • Treatment, payment, health care operations • Judicial and administrative proceedings • Workers compensation • HHS • Whistleblowers

13. HIPAA – A Brief Refresher • What if a situation does not fall into an exception? • Authorization is needed • What are the required elements for an authorization? • Specific and meaningful description of information • Identify person or class of persons authorized to make the disclosure, and that will use or receive it • Purpose of the disclosure, and no compound authorizations • Expiration date or specified event to terminate the authorization • Notice of right to revoke and how to do so • Notice of the potential for subsequent disclosure and loss of protection • Date and signature of the individual

14. HIPAAFully insured v. Self funded • What do plans (plan sponsors) need to consider when addressing compliance with HIPAA privacy and security? • Fully insured plan exception v. self-funded plans • Privacy rules • Security rules

15. HIPAAFully insured v. Self funded • Do fully insured plans have the same requirements as self funded plans? • It depends. Fully insured plans are exempt from many of HIPAA’s administrative requirements if plan does not create or receive PHI, except for: • Performing administrative enrollment functions • Receiving summary health information for limited purposes • Bid submissions • Plan amendment or termination • Administering payroll deductions • 2004 JCEB informal guidance suggests fully insured plans may avoid triggering full application of rules by obtaining an authorization when dealing with employees

16. HIPAAFully insured v. Self funded • We have a fully insured plan and only receive PHI as plan sponsor for obtaining premium bids, modifying or terminating the plan, and enrollment and disenrollment. Do we need to amend our plan? • No, virtually all of the compliance burden will fall on the insurer • Privacy Notice • Administrative Safeguards • Required policies, actions: • Anti-intimidation\retaliation • Limitation on waiver of HIPAA rights • Possible Business Associate Agreement – e.g., Insurance brokers who handle claims questions

17. HIPAAFully insured v. Self funded • Same question as the previous slide, but we also have a health flexible spending arrangement (HFSA)? • While compliance would be the same for the fully insured plan, the HFSA is considered a self-funded health plan to which the administrative exception would not apply. • Compliance would be similar to what is described for fully insured plans that do not qualify for the administrative exception (the plan has access to PHI beyond what is permitted for exception to apply) and self-funded plans • The answer is the same for health reimbursement arrangements.

18. HIPAAFully insured v. Self funded • We have a fully insured plan which has a wellness program component that we administer and also provides a participant advocate service for covered employees and dependents? • The administrative exception described above likely does not apply, which means that the plan is subject to all of the administrative requirements under the privacy rule and the security rule. • This is the case for self funded plans as well.

19. HIPAAPrivacy Rule Compliance • What are the key requirements under the HIPAA privacy rule? • Appoint Privacy Officer • Amend the health plan for plan sponsor access, and obtain plan sponsor certification • Adopt written policies including: • Safeguards to protect PHI • Accommodating individuals’ rights including access, amendments, accounting for disclosures, restrictions, etc. • Record retention and documentation • Complaints and sanctions

20. HIPAAPrivacy Rule Compliance • What are the key requirements under the HIPAA privacy rule? (ctd.) • Identify and contract with business associates (and their sub-contractors—discussion ahead!) • Distribute notice of privacy practices • Train employees as reasonably necessary to ensure compliance • Maintain plan for responding to breaches of unsecured PHI • Periodically review and document compliance efforts

21. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? • Security rule applies to electronic PHI only • PHI that is computer based, e.g., created, received, stored or maintained, processed and/or transmitted in electronic media • Electronic media includes computers, laptops, disks, memory stick, PDAs, servers, networks, dial-modems, e-mail, web-sites, etc. • Security - means to ensure the confidentiality, integrity, and availability of PHI that the covered entity creates, receives, maintains, or transmits through applicable administrative, physical and technical standards.

22. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) Administrative Safeguards • Security Management Process • Risk analysis (R) • Risk management (R) • Sanction policy (R) • Information system activity review (R) • Assign Security Responsibility

23. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) • Workforce Security • Authorization or supervision of workforce (A) • Workforce clearance procedure (A) • Termination procedures (A) • Information Access Management • Access authorization (A) • Access establishment and modification (A)

24. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) • Security Awareness and Training • Security reminders (A) • Protection from malicious software (A) • Log-in management (A) • Password protection (A) • Security Incident Procedures • Response and reporting (R)

25. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) • Contingency Plan • Data backup plan (R) • Disaster recovery plan (R) • Emergency mode operation plan (R) • Testing and revision procedures (A) • Application and data critically analysis (A) • Evaluation • Business Associates • Written agreement (R)

26. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) Physical Safeguards • Facility Access Controls • Contingency operations (A) • Facility security plan (A) • Access control and validation procedures (A) • Maintenance records (A) • Workstation Use • Workstation Security

27. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) • Device and Medical Controls • Disposal (R) • Media re-use (R) • Accountability (A) • Data back-up and storage (A)

28. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) Technical Safeguards • Access Control • Unique user identification (R) • Emergency access procedure (R) • Automatic log-off (A) • Encryption and decryption (A) • Audit Controls • Integrity • Authenticate ePHI (A)

29. HIPAASecurity Rule Compliance • What are the key requirements under the HIPAA security rule? (ctd.) • Person or Entity Authentication • Transmission Security • Integrity controls (A) • Encryption (A)

30. HIPAA HITECH, GINA • What changes were made by HITECH? • Modifications to breach notification rule • Application of HIPAA to business associates, subcontractors • Attorney general enforcement • Increased penalties and enforcement • Updates to Notice of Privacy Practices • Expanded right of electronic access to PHI • What changes were made by GINA? • Confirmed PHI includes “genetic information”

31. HIPAA HITECH, GINA • What are the key features of the breach notification rule under HIPAA? • Applies to covered entities and business associates • Final regulations confirm covered entities still have obligation to provide notification • Covered entities may delegate that responsibility to business associates by contract • Triggered for unsecured PHI

32. HIPAA HITECH, GINA • What are the key features of the breach notification rule under HIPAA? • No risk of harm standard, CEs and BAs must consider following factors to determine if there is a breach • nature and extent PHI involved, including the types of identifiers and the likelihood of re-identification; • the unauthorized person who used the PHI or to whom the disclosure was made; • whether the PHI was actually acquired or viewed; and • the extent to which the risk to the PHI has been mitigated.

33. HIPAA HITECH, GINA • What are the key features of the breach notification rule under HIPAA? • Generally follows the format of 46 state laws with some key distinctions: • Absent law enforcement delay, must provide notice without unreasonable delay but not later than 60 days following discovery • Notify Secretary of HHS via website • Immediately for breaches affecting 500 or more individuals • Within 60 days of end of calendar year in which breach occurred for breaches affecting fewer than 500 individuals • Conspicuously post notice on CE’s website or place notice in major print or broadcast media for breaches involving 10 or more individuals for whom there is insufficient contact information

34. HIPAA HITECH, GINA • How do the new changes affect business associate relationships? • BAs are subject to most of the privacy rules, and virtually all of the security rules, directly • Subcontractors of BAs are considered BAs • An entity is a BA if it meets the regulatory definition, regardless of whether a BAA is in place • Final regulations make clear that entities that maintain PHI for CEs (even if they do not access it) are likely BAs – e.g., cloud service providers, records storage companies.

35. HIPAA HITECH, GINA • Are CEs responsible for BAs? • CEs are responsible for their BAs when the BAs are their agents under federal common law • Look to terms of BAA and nature of relationship to determine agency status • Key factor – does CE have right to control conduct of BA?

36. HIPAA HITECH, GINA • When are BAs directly liable under HIPAA? • Final regulations make clear that BAs are directly liable for: • uses and disclosures of PHI not permitted under HIPAA; • a failure to provide breach notification to the CE; • a failure to provide access to a copy of electronic PHI to the CE, the individual, or the individual’s designee; • a failure to disclose PHI to the Secretary of Health and Human Services to investigate or determine the BA’s compliance with the HIPAA privacy and security rules; • a failure to provide an accounting of disclosures; and • a failure to comply with the HIPAA security rules. • But not other portions of privacy rule, such as notice requirement

37. HIPAA HITECH, GINA • What key issues need to be addressed in our BAAs? • OCR provides sample provisions: • http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html • Caution: • Address agency issue to minimize liability for acts/omissions of BA • Give attention to state law protections for personal information as BAs often also have access to this kind of information. See, e.g., CA, TX, MD, MA, and others • Outline process for investigating/handling security incidents/breaches • Consider indemnification provisions

38. HIPAA HITECH, GINA • What should we know about State AG enforcement? • Actions brought in federal court • Actions may seek damages on behalf of State residents • Attorneys’ fees can be recovered • Damages are determined by • Multiplying number of violations by $100, • Subject to a calendar year cap for violations of identical requirements or prohibitions equal to $25,000 • States like CT and MN have already invoked this authority

39. HIPAA HITECH, GINA • What are the new penalties under HITECH? • “Did not know” penalty – amount not less than $100 or more than $50,000 per violation when it is established the CE or BA did not know and, by exercising reasonable diligence, would not have known of a violation; • “Reasonable cause” penalty – amount not less than $1,000 or more than $50,000 per violation when it is established the violation was due to reasonable cause and not to willful neglect; • “Willful neglect-corrected” penalty – amount not less than $10,000 or more than $50,000 per violation when it is established the violation was due to willful neglect and was timely corrected; • “Willful neglect-not corrected” penalty – amount not less than $50,000 per violation when it is established the violation was due to willful neglect and was not timely corrected. • A penalty for violations of the same requirement or prohibition under any of these categories may not exceed $1,500,000 in a calendar year.

40. HIPAA HITECH, GINA • Are there new rules for HHS investigations, compliance reviews? • Yes, investigations of complaints (beyond preliminary review) and compliance reviews are mandatory when willful neglect is possible. • Willful neglect means the “conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.” Examples: • CE disposes of several hard drives containing ePHI in an unsecured dumpster, in violation of § 164.530(c) and 310(d)(2)(i). HHS’s investigation reveals CE failed to implement any policies and procedures to reasonably and appropriately safeguard PHI during the disposal process. • CE’s employee loses unencrypted laptop containing unsecured PHI. HHS’ investigation reveals CE feared its reputation would be harmed if information about the incident became public and, therefore, decided not to provide notification as required by § 164.400 et seq.

41. HIPAA HITECH, GINA • What changes do we have to make to our Notices of Privacy Practices (NPPs)? • Describe certain uses and disclosure that require authorization, including: • psychotherapy notes (where appropriate), • marketing purposes, • disclosures that constitute a sale of protected health information, and • mention that other uses and disclosures may require an authorization • Inform individuals of the right of affected individuals to be notified following a breach of unsecured PHI; simple statement sufficient • Include a statement that PHI includes genetic information

42. HIPAA HITECH, GINA • Are these changes to the NPP “material”, and how do we provide notice of the changes? • Yes, these changes are material. • If NPP is posted on website: • prominently post material changes or revised NPP on its website by the effective date of the material change – Sept. 23, 2013, and • provide the revised NPP, or information about the changes and how to obtain a revised NPP, in its next annual mailing to individuals then covered by the plan, such as during the open enrollment period. • If NPP is not posted on website: • Provide a revised NPP (or information about the changes and how to get a revised NPP) to individuals covered by the plan within 60 days of the material revision to the NPP. • Be sure to address ADA, other discrimination issues

43. HIPAA HITECH, GINA • What if we already updated our NPP? • If the NPP has already been updated to reflect the HITECH Act requirements and individuals have been informed of all material revisions made to the NPP, no additional action is needed because of the final rule. • If you made the changes to the NPP consistent with the HITECH Act, but did not inform individuals of the material changes, you should do so within the time and manner described above. • Can we provide the NPP by email? • Yes, so long as the individual has agreed (“opt-in” rule) to receive an electronic copy. The agreement to receive electronic notice can be obtained electronically.

44. HIPAA HITECH, GINA • Does HITECH enhance an individual’s right to their electronic PHI? • For PHI maintained in electronic records systems, covered plans must provide the requested information: • in the electronic form and format requested by the individual, if it is readily producible, or • if not, in readable electronic form and format as agreed to by the plan and the requesting individual. • To the extent possible, the information must be provided as a “machine readable copy,” meaning in a standard digital format that can be processed and analyzed by a computer (for example, in Microsoft Word or Excel, text, HTML or text-based PDF). • Plans must use reasonable safeguards in providing the individual with the electronic copy of his or her PHI

45. HIPAA HITECH, GINA • Does HITECH enhance an individual’s right to their electronic PHI (ctd.)? • The timeline for providing access to requested PHI in a designated record set, whether in paper or electronic form, is shortened from 60 days to 30 days for records maintained at an off-site location. • A one-time 30-day extension (for a total of 60 days) is permitted if the individual is timely notified of the need for an extension.

46. HIPAA HITECH, GINA • When do we have to comply with final rule? • General rule: The final rule becomes effective on March 26, 2013, but covered plans and business associates have 180 days to comply - September 23, 2013. • Business associate agreements: For BAAs in place prior to January 25, 2013, that comply with the HIPAA and privacy and security rules: • the parties need not update the BAA during the one-year period following September 23, 2013, unless • the BAA is renewed or modified on or before September 23, 2014, and provided • the parties operate as required under the final rules in accordance with the applicable compliance dates.

47. GINA • What is the Genetic Information Nondiscrimination Act (“GINA”) and why is it important? • Applies to employers and group health plans • Protects “genetic information” of current/former employees and applicants • Prohibits employers from collecting (request, require or purchase), using and disclosing “genetic information,” subject to certain exceptions • Makes it illegal to fire, demote, harass, or otherwise “retaliate” against an applicant or employee for filing a charge of discrimination, participating in a discrimination proceeding (such as a discrimination investigation or lawsuit), or otherwise opposing discrimination • Genetic information may not be used for underwriting purposes even with the individual’s authorization

48. GINA • What does “genetic information” mean? • Genetic tests of the individual or his/ her family members; • Family medical history – manifestation of disease in a family member, including an employee’s spouse; • An individual’s request for, or receipt of, genetic services, or participation in clinical research that includes genetic services; or • GI of a fetus carried by an individual or by pregnant family member.

49. HIPAA, HITECH, GINA Recap • What do we do now? • Review basic HIPAA privacy and security rule compliance • Plans should revisit plan design issues, risk assessment, policies and procedures, plan document requirements, etc. • BAs should ensure they are up to speed with the new HITECH mandates (security rules, in particular) and the requirements in BAAs, as well as state law data security requirements • Modifications to breach notification rule • Both plans and BAs should revisit their internal protocols so they are prepared for an eventual breach. • State laws also need to be considered, and coordination with other parties

50. HIPAA, HITECH, GINA Recap • What do we do now? (ctd.) • Business associates, subcontractors • Plans should ensure BAAs are in place where needed and updated timely (remember state law and personal information) • BAs should ensure they have BAAs with their subcontractors and that their policies and procedure reflect the provisions in those agreements. • Watch for state law issues and additional protections – breach, indemnity, audit, etc. • Update to Notice of Privacy Practices • Plans need to ensure NPPs are timely updated and disseminated • BAs responsible for this function must update their NPPs accordingly • Be audit ready