IT Employment

Ask something
Discussion Locked

HIPPA / personnel question.

0 helpful
11 replies

by graeme 3 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Bear with me - the question is at the end!

Scenario:

1. We have installed a brand new network to help a small not for profit in the medical sector get HIPPA compliant - as well as HQ there are some remote sites that VPN back to base. For email - travelling staff have OWA to an Exchange Server fromn where ever they are.

2. As part of the contract we offered initial training for their whole staff and enhanced training for their "in-house" tech. We also provided a boilerplate "Acceptable Computer Use Policy" which is a rather large document that can be edited to suit the particular organization's modus operandi.

3. We are retained to assist the in house tech with maintenance and as an oversight to their in-house actions.

It is a nice on-going maintenance contract.

This weekend it is was pretty obvious from our security measures that someone had made a casual attempt to try obvious username/passwords to access the server. The IIS log trapped the IP address of the attempt(s) and we have been able to demonstrate that the attempt was from an employee's home address and that they used the first part of their OWA to at least get themselves in the ballpark as to the IP address to try and get to the server from.

We turned the matter over to the "in-house" tech and the organization's HR department with the appropriate parts of the server logs.

This incident demonstrated that the organization HAD completed and communicated the Acceptable Computer Use Policy and DID include the recommended clause regarding attempting to access areas outside a user's credentials could lead to disciplinary action. But we discovered that the organization had NOT obtained a signature to acknowledge communication of the policy.

Now at one level - the state the organization operates in is a "hire and fire at will" state. So they can just let the non-contracted employee go with no reason given - if they choose to.

But it has also become apparent that it is a general policy of the organization's HR department to NOT have employees sign ANYTHING in the way of a training or policy documents - whether it it an IT matter - or anything else!

Now we come to the question!

I have communicated to the "in-house" tech (our principal point of contact) that we consider this to be a gross oversight on their part - because it makes it hard for the organization to prove they are attempting to be compliant with ANYTHING - let alone HIPPA.

Their tech agrees but feels their hands are tied.

We feel we are covered because we have communicated the concern.

Does anyone have experience with this situation and possibly examples of HIPPA problems with an approach like this so we can give their tech some ammunition with their HR department?

TIA

11 replies

by graeme

Thanks Dafe2 - this is exactly the sort of third party opinion I was hoping to find.

by bfilmfan

You may want to inform your technical contact and his HR handlers that they ALL can be found guilty of violating HIPAA.

HR can be especially damned if someone can prove they never signed a piece of paper acknowledging having been trained. I believe the prosecutor would be using terms, such as, "willful malfeasance and flagrant disregard for the law."

The U.S. Department of Health and Human Services (HHS), through its Office of Civil Rights (OCR), investigates claims of HIPAA violations and can impose civil penalties against individuals and companies. These range from $100 for each violation up to $25,000 for multiple violations of the same standard in a calendar year. These can quickly add up if a company repeats the same violation with respect to multiple employees and multiple incidents.

Individuals who knowingly violate the HIPAA Privacy Rule and willfully misuse employee medical information can be fined up to $250,000 and be imprisoned for up to 10 years.

Personally, I am not that fond of Martha's recipes.

http://www.hipaadvisory.com/action/awareness/privacytraining.htm

http://www.benefitnews.com/law/detail.cfm?id=4440

by doug_dame

Two thoughts:

(1) Your day-to-day contact is likely not the signatory on your contract, nor at a "policy-making" level in the org. You need to direct your concerns to that level of the client organization. I would suggest something of a "incident report," describing the attemepted suspicious log-in by a remote user, and ask for written guidence on how they would like you to handle such events on their behalf in the future. (If you phrase this carefully, you can make it clear that helping them put in place effective HIPAA policies is a value-enhancing part of your service, not just a cranky whine.)

(2) In all healthcare orgs I'm familiar with, "compliance" is a sub-department within the Legal section, not HR, and those people are generally exceedinly aware of the "risks to mgmt" of failure to have / enforce policies etc relating to compliance. In memo to (1), cc: the top legal person at the client.

HTH

Douglas Dame
Gainesville FL USA

by jdpond

You're giving IT a bad name you arrogant, self serving, unethical consultant (who obviously has a vested interest in getting this organization to spend more money). From the Federal Register Vol. 68, No. 34 / Thursday, February 20, 2003 / Rules and Regulations,

"2. Enforcement
The proposed rule did not contain
specific enforcement provisions. This
final rule likewise does not contain
specific enforcement provisions;"

This rule was specifically enacted without enforcement provisions because doing so would be inherently unfair; it is not the fault of a homeowner who left his door unlocked that the house is burlarized, but the criminal intent of the burglar.

If IT had a professional ethics board, I would be reporting you.

by srogler

I don't think is is arrogance here but a little CYA. As for the enforcement I think you need to look at the Fed Reg again. Try strating with
[Federal Register: April 17, 2003 (Volume 68, Number 74)]
[Rules and Regulations]
[Page 18895-18906]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr17ap03-15]
...
"We intend that this be the first installment of a rule
that we term the ``Enforcement Rule.'' The Enforcement Rule, when
issued in complete form, will set forth procedural and substantive
requirements for imposition of civil money penalties. In the interim,
we are issuing these rules of procedure to inform regulated entities of
our approach to enforcement and to advise regulated entities of certain
procedures that will be followed as we enforce the Administrative
Simplification provisions of HIPAA. "

by jnoble9

Reading the Legislation is all well and good, if you are an insomniac, a lawyer with nothing to do, or simply wanting to commit suicide by eye-strain.

Bear in mind, that WHATEVER the law says, it doesn't matter one bit, until there is someone to enforce it.

If you go back and read what BFilmFan wrote, you will see the following:
"The U.S. Department of Health and Human Services (HHS), through its Office of Civil Rights (OCR), investigates claims of HIPAA violations and can impose civil penalties against individuals and companies. These range from $100 for each violation up to $25,000 for multiple violations of the same standard in a calendar year. These can quickly add up if a company repeats the same violation with respect to multiple employees and multiple incidents.

Individuals who knowingly violate the HIPAA Privacy Rule and willfully misuse employee medical information can be fined up to $250,000 and be imprisoned for up to 10 years."

These are the Teeth to the Legislation.

You can argue all you like about how the law is written, IF YOU ARE A LAWYER, and wish to argue with the HHS lawyers.

Until then, I would suggest, as others have, to provide the HR department, Legal Council for the Company in question, and Board of Directors the information that BFilmFan has provided here.

Then, and only then, can you as a security practitioner say that you have done your due diligence.

Just my opinion... ymmv.

by doug_dame

WOW ... what ... something. Hard to believe this is a serious post from the real person it purports to be.

IMO the concerns expressed in the original post are very valid and very appropriate. Conveying those concerns to the client is exactly what I would hope the consultants/contractors would do if they were working for me. None of this smacks of money-grubbing unethical behavior at all, to my mind.

There are a number of aspects of HIPAA, which have been "rolled out" over time, and therefore have varying effective dates. To pull a section out of context that says "no SPECIFIC [emphasis added] enforcement provisions" are in this section of the rule, and imply from that there are NO [general] enforcement provisions whatsoever relating to HIPAA violations is either (a) woefully uninformed or (b) a grotesque intentional distortion of reality.

Specific HIPAA violations can certainly bring down institutional and personal sanctions. (Big fines, jail time.) The Office of Civil Rights (OCR)has jurisdiction over privacy related issues. The clear impression from reading the rules is that investigations of specific violations could results in finding of what in NCAA-football terms would be "a failure of institutional control", which could lead to bigger and more pervasive sanctions.

And your analogy is exceedingly poor. A more apt one would be a bank. It is not socially acceptable for the bank's managers to go home for the night and leave the front door open, and the vault unlocked, that is deemed an unacceptable level of protection for assets (money) that people have entrusted to the bank.

In health care, people entrust aspects of their medical and life histories to the providers, insurers, etc.

The privacy and security aspects of HIPAA are the govt's way (attempt) to implement a growing societal consensus that the health care industry must be held to a higher standard of diligence in safe-guarding and using people's personal health information than it has generally practiced in the past. We can all quibble about the details of the HIPAA Rules, but the over-arching intent is clear. And most, I venture, would say over-due.

My $0.02

Douglas Dame
Gainesville FL USA

by drmemory

What you have appears to be an anecdotal case that may indicate a policy deficiency. I stress may because this would not be the first time that an existing policy was not properly implemented. I would recommend that you start with that assumption and escalate your concerns upward from there, provided that you can obtain verification of the lack of policy or an inappropriate policy. There is real danger here as your statement of work may be limited to 'technically' compliance, i.e. not process and policy. If you feel compelled/justified in pursuing this:
1. Your are responsible to your contracting authority, not your contact person. The contracting authority should be notified of your concerns in an overt and factual manner.
2. The employee's concerns should be directed to an ombudsman or other independent reporting channel, particularly if they feel that their position could be viewed as 'out-of-policy'.

by graeme

I asked for appropriate guidance and thank you to the two who gave me a couple of pointers.

To those who want to spin off into a debate about the rights and wrongs of what we did - we are under NO DOUBT that that we did the correct thing (if only to show OUR liability insurers we take things seriously).

I really don't want to say too much more about the persons at the client's place of work - I need to guard THEIR privacy - but let's just say it is a small enough shop that the IT point of contact is also the HIPPA compliance officer for the whole organization and that they are on the Board of the company. I think we have communicated quite far enough up the chain!

"Arrogant" - sorry poster - I don't think so - as someone else said - they would be glad to pay a consultant to help them out with deficiencies. That is the role we are hired for and that is the role we play.

If someone else has some useful links of the nature of the first two (which is what I asked for) then please feel free to post here.

For those who want to carry on debating consulting ethics - please go start your own post and don't muddy this one which was an information request!

Thank you :-)

This discussion is closed to new replies.