Achieving Safe Harbor: What the HITECH Act Means for U.S. Healthcare Organizations’ Communications and Business Processes

Executive Summary:
This white paper sets out to explain the importance of data security within your healthcare organization and focuses on the following subjects:

  • The move from paper to electronic records
  • HITECH and what its means to you
  • How you can comply with HITECH and new regulations
  • Why complying with HIPAA is not enough
  • An introduction to complete health information security from infrastructure to people.

Download PDF of this Whitepaper

Security and Privacy Driving Improvements
The security and privacy of personal health records (PHR) has long been a hot button within the healthcare industry. The movement from paper to electronic records was first addressed with HIPAA (The Health Insurance Portability and Accountability Act) in 1996 and continues to be updated with new documents and implementations over time, most recently with the 5010 update. While HIPAA encouraged the use of electronic medical records (EMR), little was done in the way of enforcing these recommendations or to encourage the investment in improving processes and securing patient information.

Paper records are still common within healthcare organizations (HCOs), insurers, clearinghouses and related business associates (BAs), leaving these organizations susceptible to data breaches and lost patient data. Personal health information (PHI) is sent via fax, mail and other unsecure methods of transfer on a daily basis. Paper breaches year-to-date 2009 jumped to more than 25% of the total reported breaches tracked by the Identity Theft Resource Center (ITRC). This is up from compares to 17.7% reported for the year 2008.

Not All Automation is Created Equal
Organizations have invested in standardized claims and automated processes with insurance companies, HCOs and care providers, but there are still opportunities to reduce cost and improve business processes. Examples of outdated processes are the use of fax, courier and other insecure processes methods for communicating information and managing exceptions to patients and, outsourced service providers and for managing the exceptions in otherwise automated processes. With clear business gains, the ability to improve the quality of care and deliver value-added services to patients, many organizations have been deploying solutions for electronic records.

While this is clearly a step forward, HCOs and related entities that have implemented electronic methods within their infrastructure face interoperability issues between systems. No standards have been set in place so that providers of service (POS) can effectively transfer records electronically, leaving HCOs and other entities to their own devices. However, the days of recommendations and best practices are gone. Enforcement of the privacy and security of EHRs (electronic health records) is here and its name is ARRA.

In February of 2009, The American Recovery and Reinvestment Act (ARRA) was signed into law by the federal government. A portion of this bill, The Health Information Technology for Economic and Clinical Health Act (HITECH), allocates billions of dollars as incentives for HCOs and physicians who can provide “meaningful use” of EHR systems. Additionally, The HITECH breach notification rules require covered entities (CEs) and business associates to send out notifications to affected individuals upon a breach of unsecured protected health information (PHI). The breach notification rules will be enforced beginning February 2010.

For information to be protected according to HITECH regulations, provides that PHI will behas to be deemed unusable, unreadable or indecipherable if it has been encrypted. In this regard, the U.S. Department of Health and Human Services (HHS) has followed the lead of more than 45 state breach notification laws that likewise provide “safe harbors” for encrypted information. The guidance is clear that its recitation of information safeguards, though a proposal pending public comment, is intended to be exhaustive.  HCOs and other covered entities are will be required to comply with the safe harbor laws by October 2010. .

Compliance and Stimulus Money
The primary market driver pushing HITECH compliance is proving “meaningful use” of a qualified EMR system. Each Physicians PSO will receive $44,400 per physician over three years if they can prove they have completed an electronic data exchange to another entity. Early adopters (those that comply by Oct. 2010) of “meaningful use” of EHR systems will be the first to benefit from the government stimulus money. Conversely, non-adopters will be subject to penalties and fines up to $1.5 million if not compliant by 2015.they fail to meet compliance requirements.

HITECH mandates the healthcare industry to adopt technology, standardization and collaboration of PHI through the use of EHR systems. Additionally, HITECH specifies that encryption must comply with the HIPAA Security Rule, which states covered entities must implement three types of safeguards:

1. Administrative
2. Physical
3. Technical

The HIPAA security rule also states that organizations must provide a documented process. HITECH provides two specific examples of encryption that have been deemed to meet this standard: (1) for data at rest, encryption consistent with the National Institute of Standards and Technology (NIST) Special Publication 800-111 and; (2) for data in transit, encryption that complies with Federal Information Processing Standard 140-2.

Additionally, HIPAA Security Rule states that HCO business associates must comply with these standards. In “An Introductory Resource Guide for Implementing the HIPAA Security Rule,” published by NIST, it clearly mandates that HCOs must contractually enforce security standards: “Contracts between covered entities and business associates must provide that business associates will implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the EPHI that the business associate creates, receives, maintains, or transmits on behalf of the covered entity.”

The pressure is on to automate clinical processes and exchange information electronically, and to do so in a secure environment. The negative impact of a data breach potentially outweighs government early adopter incentives and non-compliance fines. With data breaches making headlines at an increasing rate, HCOs face intense media scrutiny, customer churn and a tarnished reputation.

According to the Ponemon Institute’s report, “The 2008 Annual Study: Cost of a Data Breach,”, breaches are costly events for an organization; the average total cost per reporting company was more than $6.6 million per breach (up from $6.3 million in 2007 and $4.7 million in 2006) and ranged from $613,000 to almost $32 million. Cost of lost business continues to have the highest financial impact with 69 percent of total data breach costs attributed to customer churn.

The Current State of Electronic Health Records
While most HCOs and other covered entities are aware of the impending regulations and promised stimulus money, there are many questions that remain open:

  • How do I become compliant?
  • How do I exchange the information with patients?
  • What is required for our business associates?

The need to share PHR information and collaborate with other organizations is increasingly complex as HCOs are responsible for the privacy of data through the full cycle of data transmission whether it is to patients, payors or outside partners. With the creation of HITECH, most experts say that covered entities and business associates must immediately finalize their breach notification policies and procedures.

However, most SMB healthcare organizations don’t have a system in place and many HCOs and their partners are unclear on what the law dictates. Additionally, most HCOs face the task of finding the available resources to comply with the HITECH security guidelines. The HITECH Act focuses on the establishment of a national health infrastructure and on providing incentives for the adoption of electronic health records.

HIPAA and Outdated Technology
When HIPAA was introduced in 1996, the requirements of the bill were generic in regards to security of information and thus, left up to POS interpretation. The law essentially encouraged the widespread use of electronic data interchange in the U.S. healthcare system without fully addressing how to accomplish successful electronic file transfer. This led to disparate EHR systems within HCOs, the rise of clearinghouses and ongoing complexity for their partners.

While standards and adoption of standards-based communications grew with the roll out of HIPAA, many processes still required standardization. However, many software vendors created proprietary solutions which weren’t interoperable outside of a healthcare system or that would only work with a specific EHR system.

Many EHR systems utilize custom TCP/IP socket protocols. While these are custom implementations that can be made secure while the information is in transit across a network, they only work when both ends of the connection have the same software. Moreover, data is not necessarily encrypted once it is saved and when it arrives at its destination.

In the past, many HCOs have used similarly insecure methods to deliver PHI information to outside business partners:

  • FTP - File Transfer Protocol - is a standard network protocol used to exchange and manipulate files over a TCP/IP based network, such as the Internet. While free, FTP requires some IT knowledge and is a cumbersome process. Additionally, it’s not secure. According to Gartner, Inc.: “Numerous factors cause companies to re-examine how they manage the movement of information from system to system, partner to partner, and person to person. FTP [File Transfer Protocol] alone isn’t a viable option to give the insight, security, performance, and, ultimately, the risk mitigation necessary to responsibly conduct business.” (For more information, see Kenney, LF et al.: “Magic Quadrant for Managed File Transfer,” page 2, Gartner Research Publication ID Number G00157614, 23 June, 2008.)
  • SFTP - Secure File Transfer Protocol - Many vendors promote SFTP solutions. The data is transferred through SSL/TLS, a network protocol that allows data to be exchanged using a secure channel. While SFTP offers a minimal amount of security, it still compromises both your data’s confidentiality and integrity. SFTP is both a cumbersome solution and difficult to secure, making this seemingly secure method of transfer as obsolete as FTP.
  • VPN – Virtual Private Network – is a computer network with an additional software lawyer on top of your existing network to create a private scope. While a VPN protects information over the Internet, it doesn’t issue the security of that data in a corporate network or at rest.

All of these methodologies have been proven to lack the proper security to ensure your PHI is secure. Additionally, these disparate data transfer protocols and solutions introduce islands of manual manageability, thus creating operational complications and multiple tiers of supportability that increase cost and risk. So what are your options? As discussed earlier in this paper, the answer is encryption.

Encrypting your EHRs
In the HHS Breach Notification Interim Final Rule, the definitions for acceptable encryption is based on the HIPAA privacy rule discussed earlier. You must encrypt your EHR information at rest and in motion. But what does this mean? An EHR must be encrypted while being transferred and when the intended recipient has received the information. For example, a POS sends medical necessity documentation to an insurer to validate the need for additional tests he ruan on a patient. When Once the recipient receives the file, it must be encrypted at the state of rest, whether it’s in their email, saved on their desktop, etc.

As an HCO, you are responsible for the encryption of EHR information through the whole life cycle. That includes outside the four walls of your organization, whether it’s:

  • An insurance company
  • A referring physician
  • Directly to your patient

Regardless of where that data breach occurs, If there is a data breach on your or the partner side, it is your responsibility unless you can contractually prove the encryption mandates of your partners. You are responsible for:

  • The level of encryption (AES)
  • Message integrity (SHA)
  • Strong authentication (RSA)

The U.S. government and the National Security Agency (NSA) have adopted AES, or Advanced Encryption Standard. The SHA hash functions are a set of cryptographic hash functions algorithms designed by the National Security Agency (NSA) and published by the NIST as a U.S. Federal Information Processing Standard.

RSA (Rivest, Shamir and Adleman) is the strongest form of public key cryptography and is widely used in electronic commerce protocols.

Another characteristic of any proven EHR solution is the ability for integration. Can the solution you choose integrate with your current applications: clinical solutions, back-end office applications, revenue cycle solutions, etc? An EHR solution should work within your existing workflow and minimize complexity caused by increased automation, various Web services and governance requirements.

The single most important aspect to successfully implementing a secure EHR system is ease of use. If the solution is too difficult for end users from any and every department within your HCO, it will not be utilized. End users will look for a way to circumvent your secure solution if it is too complex and takes them away from completing their daily tasks.

With end users in mind, you should be cognizant of what departments within your organization will need to use your secure communications solutions and how. Like HIPAA, the HITECH Act includes PHI as well as name, social security number, address and insurance account numbers. This affects almost every department within and outside your organization, including:

  • Partnering healthcare networks
  • Physician services
  • Health information management
  • Patient financial services
  • Patient access/registration
  • Radiology
  • Ancillary departments

We’ve covered what HITECH, HIPAA and the safe harbor rules dictate and characteristics of a successful and secure EHR solution and implementation within your HCO. Now how can you comply with an easy-to-use solution that meets all of these requirements?

Ensuring Data Security within Your Organization – The Stonebranch Solution
Stonebranch provides integrated solutions that provide end-to-end support of your internal and external integration, automation and secure data transfer needs from infrastructure to people. With the growing number of healthcare regulations, HCOs and related covered entities can no longer afford not to have a strategy for file transfer, whether it is internally between applications, for external exchange with business partners or through Web-based applications such as Software as a Service (SaaS) for ad hoc file transfers. When attempting to improve data security while reducing cost and complexity, many HCOs may discover they are using a wide variety of file transfer products for seemingly similar purposes.

Many of their existing products are architected toward internal transfers only. Others act as standalone solutions with no integration to your entire workload management infrastructure. More than 70 percent of batch processing jobs are related to file transfer. How do you ensure that these data transfers are secure as well? Many of these products end up causing various problems and issues, such as:

  • Limited platform support
  • Lack of data security
  • Lack of compliance
  • No audit capabilities

Stonebranch’s solutions work as an integrated platform that eliminates these issues while providing fast deployment and R.O.I. With secure data exchange within your IT infrastructure, you gain:

  • Flexible visibility tools and capabilities to meet your organization’s needs
  • Integration of file transfers, avoiding delays
  • Intelligent data supports your ability to analyze and plan
  • Enforcement and governance of policies

Through an integrated platform, you can securely send:

  • EMR (Electronic Medical Record) information
  • EHR (Electronic Health Record) information
  • PHR (Personal Health Record) information
  • Billing information
  • Insurance claims
  • Medical necessity documentation
  • X-rays and medical imaging files
  • Documents and photos

Are you ready to claim your stimulus money?

Getting Started with Stonebranch and Scribbos
For more information on our solutions, Infitran™, our Intelligent File Transfer solution, Scribbos™, our secure business communications solution and Indesca™, our Independent Scheduling Agents solution, please visit our corporate Web site at: www.stonebranch.com or visit Scribbos at: www.scribbos.com. To speak with a Stonebranch Solutions Consultant, please call: 678-366-7887.

Additional Resources:
“Securing Your Business with Managed File Transfer: Why FTP/SFTP solutions are no longer a viable option” – a Stonebranch Business Benefits White Paper

Download PDF of this Whitepaper