This podcast is brought to you by healthcareinfosecurity.com, the leading online publication for risk management and security professionals within the health care industry. This is how we're going to take the internet health care and security.com. Today we're talking about breach assessments with Harry Rhodes of the American Health Information Management Association. Thanks for joining us, Harry.
I'd be your hour. For starters, can you briefly describe the harm standard in an internal and final breach notification rule, so people have that baseline? The provisions of the breach notification and the internal file rule say that when you have a security incident, before you determine whether or not it is a recordable incident that requires a breach notification, you have to do a risk harm assessment. And so you have to use a forensic mechanism to determine whether or not the incident actually resulted in a financial, reputational, or other type of harm to the individual.
And if it does, then you proceed with the breach notification process to notify the individual and the secretary of HHS. Can you highlight for us just a few of the key steps health care organizations should take to make sure they're doing an adequate assessment of the risk harm after a breach incident and are complying with the rules requirements? What are some of the key things? One of the biggest key things is that the breach notification process in the risk harm assessment tool is part of a more complete security governance and compliance model for your organization.
So you already need to have a process in place that you're monitoring and auditing for the potential of the security breach. A lot of times what you find out is that people don't even realize that the breaches occur because they're not doing their forensic investigation and not doing the auditing. So that's the first thing you have to have in place. And then once you discover that a security incident has occurred, then you need to have some sort of a formal process that includes a formal documentation and the documentation has to be consistent because you're going to need to keep this documentation and you need to rely on it as you go forward in dealing with the breach and responding to it.
And also later on, should you ever get audited, you're going to need your quality information. And it could be years afterwards that the incident come up again. And also you need to use this documentation for educational purposes and developing your policies and procedures and refining your actions. So you need to have a formal mechanism tool and it's really important to have some sort of a risk assessment ranking so you can determine whether or not this was an accidental unintentional breach or whether it was curiosity or whether it was deliberate or whether it was motivated by a financial gain.
And each one of those things are worse than the next and you need to have some sort of a mechanism that, so when you're looking at this, you're not just going on your gut reaction. Because being involved in a security incident and responding to a breach and determining the risk of harm is a very emotional processing. And everybody's really upset about it. People don't want to talk about it.
They wish it would go away. And so there's a lot of emotion there and you need to have something that gives you a formal, grounded, repeatable process and a logical way to move through it. So you're not just responding to it because there's been lots of incidences where an emotional response or immediate response or a rushed response backfires on the organization and then you're in a bigger mess than you were before. I understand there's some tools available to help with all this that people can take advantage of that available for you.
Can you pick out a couple for us that might be helpful? There's quite a few of them out there, but two of them that I'm familiar with because I'm familiar with. The individuals that are involved in it are the Chica Tool. The Chica Tool is very much like that tool I was describing to you before.
There is a formal process. There's a formal form for documenting its standardized form and its objective as possible and it's repeatable. There's a lot of subjectivity in there. It's very straightforward.
There's a checklist. There's a flowchart. And also there's a metric. There's a metric.
There's usually a three-level metric. So you can determine what level the incident was involved. It wasn't an unintentional accident. It wasn't curiosity.
It wasn't intentional for gain. It's a really great tool and there's a lot of other resources there as well. And the other one that I'm familiar with because I know people working on it is the HIPAA collaborative of Wisconsin or the HIPAA cow. This one is even more detailed.
It has many of the same things you find at the Enchica site. There's documentation forms. There's a checklist. There's a flowchart in the process.
There's a ranking system. But in addition to that, what you find out at the HIPAA cow site is there's actually some model breaches. And the idea there is that you can learn for people a lot of people's mistakes. Before you, there's some model letters.
There's talking points when you're talking to the media, a model letter to the media, talking points when you're talking to the patients. So the HIPAA cow one has got the tools plus also a lot of other resources that are available. So both of those are really a great place to go to start if you're trying to refine your policies or procedures or if you're trying to develop them. Do you expect the final version of the breach notification rule, which is still pending, will wind up modifying, clarifying, or eliminating the harm standard?
It really helped not because we want to think of the AHIMAs. We looked at the 44 states that have say laws that you have to report a business record breach, electronic business record breach. And in the majority of those states, what happens is that you identify that you had a security incident at a security breach and then you immediately contact the attorney general's office or the state police or the state health department. And then they actually do the forensic investigation to determine what level of harm is.
And what concerns me about that is that you lose control of the assessment, you lose control of forensic things, and you're counting on somebody else who's an outsider looking at your organization to tell you whether or not you have a breach that you're going to do about it. Whereas what I like about the risk of harm assessment is that you're looking at yourself, you're looking at your own soul, you're looking at what your organization does. You know what your problems are, your weak areas are. And if you don't know, going through the assessment process helps you to find out and understand that and it actually helps you to improve.
And then you determine whether or not the breach harm the patient financially or reputationally or otherwise. And so I think that keeping anything organization, having you go through the assessment process is really healthy and it improves your security, governance, and safeguards and compliance process within your organization. Do you think the harm system needs to be clarified? I'll make it more clear.
When I go around the country and I talk to people who are trying to do this, they would like to have guidance. There's always, whenever there's some new legislation or new regulation, people always don't just tell me what to do. There are people out there that would like some guidance. They're very concerned because they may have a process in place and they may be going through and documenting the process.
They may have tools and assessments and rankings and flow charts, but are they documenting enough? Are they doing enough? Are they doing the right thing? Are they over-reporting the guy down the street?
So under-reporting, are they going to spend years and years doing these risk of harm assessments and documenting them all? And then one day they get audited for whatever reason by the state or the federal government and they find out that they've been doing it wrong all these years. They're leaving out a step that someone else thinks is important, but they may have thought it wasn't as important. I would like to see the OCR because they sent out some more guidance.
I mean, back when HIPAA privacy rule first came out, they had all of those guidance that were available on the OCR site where you could go out there and look at a lot of the provisions of the HIPAA privacy rule. And you get a better idea of what the expectation was. I would like to see OCR do that same thing on their website. Give you some expectations of what you should be doing with the risk of harm assessment.
Because there's uncertainty over potential changes in the final version of the regional notification rule, does that affect or should it affect your breach assessment strategy and interim? The interim final rule is still in effect. You still have to comply with it. You can't sit around and wait until the final.
I mean, your organization is having breaches right now and you need to deal with those breaches. You have state laws that you have to answer for breaches for. And right now there's only like three states that require reporting for help to help information. But if you look at what happened last time, California was the first state to come out with a breach of notification law and then the other 43 states followed them.
It won't be long before the rest of the state school also requiring you to report health information breaches as well. I think you can wait. I think that you need to get started now because if not, you're going to be behind the curve, trying to catch up. There are people out there that are just not going to do anything.
And they're just going to wait and see. I've spoken to some of them. I'm trying to see the light that they need to get started now. But there are people who think that the whole thing just might go away.
But my advice is there's an obligation that's in the HIPAA security rule right now that you investigate and mitigate breaches and document breaches and what your response is. So there already is a HIPAA requirement that you do something waiting for the breach of notification final rule is unnecessary. Very good. Well, thanks, Harry.
We've been talking today with Harry Rhodes of Edema. This is Howard Anderson. Thanks so much for listening. This podcast has been brought to you by healthcareinfosecurity.com.
For more interviews, breaking news, research and educational webinars, please visit www.healthcareinfosecurity.com.