Legal Risks and Ethical Problems
for Lawyers under the
HITECH Business Associate Rules
Washington State Bar Association Health Law Section
Critical Issues in Heatlhcare
June 13, 2013
© 2013 Christiansen IT Law
Presenter CV
John R. Christiansen, J.D. - Christiansen IT Law
•
Special Assistant Attorney General to Washington State Health Care Authority, health care information issues
related to HIPAA, HITECH, and related issues
•
Privacy and Security Expert, ONC/OCR Comprehensive Campaign for Communication and Education About
the HITECH Act (2010 – pres.); Consultant, ONC State Health Policy Consortium (2010 – pres.); Technical
Advisor, ONC Health Information Security and Privacy Collaboration (2005 – 2009)
•
Chair, ABA HITECH Megarule/Business Associates Task Force (2009 – pres.); Committees on Healthcare
Privacy, Security and Information Technology (2004 – 06); on Healthcare Informatics (2000 – 04); and PKI
Assessment Guidelines Health Information Protection and Security Task Group (2000 – 2003)
•
Executive Committee/Secretary, Washington State Bar Association Health Law Section (2012 – pres.)
•
Adjunct Faculty, University of Washington Information School (2008 – 2012); Oregon Health and Sciences
University Division of Medical Informatics and Outcomes Research (2000 – 2003)
•
Publications include State and Federal Consent Laws Affecting Health Information Exchange (Nat’l
Governors Association 2011); Policy Solutions for Advancing Interstate Health Information Exchange (Nat’l
Governors Association 2009); An Integrated Standard of Care for Healthcare Information Security (2005);
Electronic Health Information: Security and Privacy Compliance under HIPAA (2000); etc.
© 2013
Christiansen IT Law Privacy/Security/Compliance
2
Our Agenda
•
•
•
•
Review of HIPAA Business Associate Concepts
HITECH Changes to Business Associate Concepts
Business Associate Compliance for Attorneys
Business Associate Contracting for Attorneys
© 2013
Christiansen IT Law Privacy/Security/Compliance
3
Your Obligation
RPC 1.1: “A lawyer shall provide competent representation to a client.
Competent representation requires the legal knowledge, skill,
thoroughness and preparation reasonably necessary for the
representation.”
• If you work in health law you need to know at least enough about
HIPAA and HITECH to spot potential issues and possible traps, to
avoid compliance failures for both you and your clients
© 2013
Christiansen IT Law Privacy/Security/Compliance
4
HIPAA BA Review
HIPAA Jurisdictional Limitations and the Business Associate
Workaround
•
•
HIPAA Administrative Simplification intent: Require implementation of
electronic health claims transactions
– Privacy and Security Rules: Ancillary trust builders which grew beyond
expectation
Covered Entities (CE):
– Organizations directly involved in health claims transactions
• Any health care provider which gets paid electronically, health
plans, health care clearinghouses
• Directly regulated under HIPAA – subject to regulatory obligations
and penalties
© 2013
Christiansen IT Law Privacy/Security/Compliance
5
HIPAA BA Review
The Business Associate Workaround
•
•
CEs don’t/can’t perform all functions and activities involving use or
disclosure of PHI by themselves
How to protect PHI when non-CEs must access or control it?
© 2013
Christiansen IT Law Privacy/Security/Compliance
6
HIPAA BA Review
Business Associate (BA): A “person” who is not a CE workforce
member and:
•
© 2013
“Performs or assists in the performance of” a function or activity
involving the use or disclosure of PHI on behalf of a CE
•
Official examples: Claims processing or administration; data
analysis, processing or administration; utilization review; billing;
quality assurance; benefit management; practice management,
repricing
•
Any other “function or activity “ regulated under HIPAA
•
My examples: PHI disclosure to other CEs, individuals, public
health, research, marketing, etc.; security management and
administration; etc.
•
Provides legal, actuarial, accounting, consulting, etc. services to
or for CE involving disclosure of PHI to BA.
• 45 CFR § 160.103
Christiansen IT Law Privacy/Security/Compliance
7
HIPAA BA Review
BA status is “definitional,” does not depend on existence of BAC
•
•
•
If it does what a BA does, it’s a BA
Knowledge or intent of CE or BA are irrelevant
Presence or absence of a contract is irrelevant
© 2013
Christiansen IT Law Privacy/Security/Compliance
8
HIPAA BA Review
Business Associate Contracts (BACs)
•
CE may disclose PHI to/allow BA to create or receive PHI on CE’s behalf
upon “satisfactory assurance” BA will “appropriately safeguard” PHI
•
•
45 CFR § 164.502
“Satisfactory assurance” is BAC including required provisions (or equivalent
memorandum of understanding if governmental entities, plan document
provisions if group health plan)
•
© 2013
45 CFR § 164.504(e)
Christiansen IT Law Privacy/Security/Compliance
9
HIPAA BA Review
If you provide legal services as a BA to a CE, you must have a BAC
•
“A complaint alleged that a law firm working on behalf of a pharmacy chain
in an administrative proceeding impermissibly disclosed the PHI of a
customer of the pharmacy chain. OCR investigated the allegation and
found no evidence that the law firm had impermissibly disclosed the
customer’s PHI. However, the investigation revealed that the pharmacy
chain and the law firm had not entered into a Business Associate
Agreement, as required by the Privacy Rule to ensure that PHI is
appropriately safeguarded. Without a properly executed agreement, a
covered entity may not disclose PHI to its law firm. To resolve the matter,
OCR required the pharmacy chain and the law firm to enter into a business
associate agreement.”
– Pharmacy Chain Enters into Business Associate Agreement with
Law Firm, hhs.gov Health Information Privacy website
© 2013
Christiansen IT Law Privacy/Security/Compliance
10
HIPAA BA Review
BAC Penalties
•
CE may be penalized if CE “knew of a pattern of activity or practice” of the
BA “that constituted a material breach or violation” of the BAC, unless:
• The CE took “reasonable steps to cure the breach or end the violation”
and, “if such steps were unsuccessful:”
• Terminated the BAC, if “feasible,” or if not “feasible” reported the
problem to DHHS
• 45 CFR §.504(e)(1)(ii)
•
No jurisdiction to penalize BAs for BAC violation, or any HIPAA regulatory
violation
© 2013
Christiansen IT Law Privacy/Security/Compliance
11
HIPAA BA Review
BA Subcontractor/Agent Workaround
•
•
•
BAs don’t/can’t perform all functions and activities for/on behalf of CEs
involving use or disclosure of PHI by themselves
BAs may also need to permit other parties to have access to, use, disclose
PHI for BA’s own functions and activities
How to protect PHI when non-BAs must access and/or control it?
© 2013
Christiansen IT Law Privacy/Security/Compliance
12
HIPAA BA Review
BA Subcontractor Workaround
•
Mandatory provision: BA may disclose PHI to “any agent, including a
subcontractor” which agrees to:
– “Implement reasonable and appropriate safeguards” for the PHI, and
– “The same restrictions and conditions which apply to” the BA with
respect to the PHI
• 45 CFR §§ 164.314(a)(2)(i)(B), .502(e)(2)(ii)(D)
© 2013
Christiansen IT Law Privacy/Security/Compliance
13
HIPAA BA Review
BA Subcontractor Workaround
•
•
•
•
•
Vaguely articulated concept: BA delegates “subcontractor” performance of
function, activity or service for ultimate benefit or use of CE
No “subcontractor” definition
“Subcontract” is kinda/sorta like BAC, maybe
BA penalty for noncompliance: Potential BAC termination, if CE finds out
and cares enough
No jurisdiction to penalize BA or subcontractor – or CE
© 2013
Christiansen IT Law Privacy/Security/Compliance
14
HIPAA BA Review
HIPAA
BA/Subcontractor Chain
© 2013
Christiansen IT Law Privacy/Security/Compliance
15
HIPAA BA Review
BA Services Provider Workaround
•
Optional provision: BA may disclose PHI for purposes of the BA’s “proper
management and administration” and to “carry out legal responsibilities,” if
recipient provides “reasonable assurances” that:
– It will hold the PHI “confidentially,”
– The PHI will be used or further disclosed only as required by law or for
purposes for which it was disclosed, and
– The recipient will notify BA of any “breach of confidentiality”
• 45 CFR § 164.504(e)(4)
© 2013
Christiansen IT Law Privacy/Security/Compliance
16
HIPAA BA Review
BA Services Provider Workaround
•
•
•
•
•
Even more vaguely articulated concept: BA can use third parties to perform
limited functions, activities or services for benefit or use of BA
No associated definitions
No meaningful detail re “assurances”
BA penalty for noncompliance: Potential BAC termination, if CE finds out
and cares enough
No jurisdiction to penalize BA, services provider – or CE
© 2013
Christiansen IT Law Privacy/Security/Compliance
17
HIPAA BA Review
HIPAA BA/Services
Provider Relationship
© 2013
Christiansen IT Law Privacy/Security/Compliance
18
HIPAA BA Review
When do lawyers “obtain PHI on behalf of a CE?”
•
•
•
•
•
•
•
Privacy/security compliance support for CEs: Probably yes
Some other kinds of compliance support: Sometimes yes
Fraud and abuse/false claims: Probably yes
Healthcare professional discipline: Probably yes
Risk management for CEs: Probably yes
Due diligence for some types of CE transactions
Representing CE in any case involving individual patient diagnosis or
treatment, individual health benefits: Yes
•
Even if PHI is already public record
•
Even if subject individual is plaintiff
•
Even if subject individual has authorized disclosure by CE
•
Not an exhaustive list
© 2013
Christiansen IT Law Privacy/Security/Compliance
19
HIPAA BA Review
When lawyers don’t “obtain PHI on behalf of a CE.”
•
•
•
•
•
Representing any party which is not a CE
•
Including individual plaintiffs
Workers compensation cases
Social Security cases
Employment law matters
•
Except for representation of group health plans
Not an exhaustive list
© 2013
Christiansen IT Law Privacy/Security/Compliance
20
HITECH BA Expansion
Health Information for Clinical and Economic Health Act (HITECH)
•
•
•
HITECH § 13401(a) mandates application of HIPAA Security Rule to BAs
“in the same manner” as to CEs, requires that HITECH security
requirements applicable to CEs apply to BAs, and requires that all such
provisions “shall be incorporated” into the BAC
HITECH § 13404(a) mandates application of HIPAA BAC regulations (45
CFR § 164.504(e)) to BAs as regulatory requirements, requires that
HITECH privacy requirements applicable to CEs apply to BAs, and
requires that all such provisions “shall be incorporated” into the BAC.
“Omnibus Rule” published January 25, 2013
•
Compliance mandatory as of September 23, 2013
© 2013
Christiansen IT Law Privacy/Security/Compliance
21
HITECH BA Expansion
Revised BA Definition (45 CFR § 160.103)
•
A “person” who is not a CE workforce member and (inter alia):
•
Provides legal, actuarial, accounting, consulting, data aggregation,
management, administrative, accreditation, or financial services on
behalf of a CE, involving disclosure of PHI for purposes of the services
to the BA by the CE or another BA; and
•
A subcontractor that creates, receives, maintains, or transmits PHI on
behalf of a BA
© 2013
Christiansen IT Law Privacy/Security/Compliance
22
HITECH BA Expansion
New Subcontractor Definition (45 CFR § 160.103)
•
Subcontractor means a person to whom a BA delegates a function, activity,
or service, other than in the capacity of a member of the workforce of such
BA
– If a BA delegates a function involving PHI to a subcontractor, that
subcontractor becomes a BA
– If the subcontractor/BA in turn delegates a function involving PHI to
another subcontractor, that other subcontractor becomes a BA
– And so on, as far as activities, functions and services involving PHI are
delegated
•
A “chain of trust” for PHI
© 2013
Christiansen IT Law Privacy/Security/Compliance
23
HITECH BA Expansion
•
•
•
•
•
© 2013
“Upstream:” CE, or BA delegating
function
“Downstream:” BA to which
function is delegated
“First tier” BA: BA with direct
delegation from CE
“Second tier” BA: BA with direct
delegation from first tier BA (and
third, fourth tier, etc.)
“Lower tier” BAs: BAs below first
tier
Christiansen IT Law Privacy/Security/Compliance
24
HITECH BA Expansion
Subcontractor/BAs do not include recipients of PHI for BA purposes
•
“We also provide the following in response to specific comments.
Disclosures by a business associate pursuant to § 164.504(e)(4) and its
business associate contract for its own management and administration or
legal responsibilities do not create a business associate relationship with
the recipient of the [PHI] because such disclosures are made outside of the
entity’s role as a business associate.”
– Preamble to Omnibus Rule at 5574
– Not limited to “agents” of BA
– Not a regulation, but an interpretation
• BA Services Provider is not a Subcontractor, so is not a BA
© 2013
Christiansen IT Law Privacy/Security/Compliance
25
HITECH BA Expansion
•
•
•
© 2013
BA retains law firm to perform
legal services involving PHI for
purposes of BA
BA Services Provider may use,
disclose PHI for BA purposes
BA Services Provider may use
other parties to provide
support/related services for BA
purposes
– These parties are also not
BAs
Christiansen IT Law Privacy/Security/Compliance
26
HITECH BA Expansion
© 2013
•
Can a law firm be a
Subcontractor?
•
Yes to another law firm
Christiansen IT Law Privacy/Security/Compliance
27
HITECH BA Expansion
© 2013
•
Can a law firm be a
Subcontractor?
•
No to any non-lawyer entity if
providing legal services
Christiansen IT Law Privacy/Security/Compliance
28
HITECH BA Expansion
Analysis:
•
Covered Entity can delegate legal services functions to law firm Business
Associate
– Non-lawyer cannot provide legal services (unauthorized practice of law).
RCW 2.48.140
– Therefore non-law firm Business Associate cannot be delegated legal
services functions
– And, non-lawyer cannot direct legal services of lawyer. RPC 1.8(f);
5.4(b), (d)
© 2013
Christiansen IT Law Privacy/Security/Compliance
29
HITECH BA Expansion
Can lawyers escape regulated status?
•
•
•
•
GLBA litigation: American Bar Association v. Federal Trade
Commission (2005): Gramm-Leach-Bliley Act (GLBA) did not give Federal
Trade Commission (FTC) jurisdiction to regulate licensed attorneys in
“practice of law by GLBA privacy regulations, based on interpretation of key
GLBA term “financial institutions”
FACTA litigation: American Bar Association v. Federal Trade
Commission (2011: Licensed attorneys in “practice of law” are not
“creditors” required to comply with identity theft protection “Red Flags
Rules” issued by FTC under Fair and Accurate Credit Transactions Act of
2003 (FACTA)
No known HIPAA challenge to lawyers included as BAs
Legal theories behind GLBA and FACTA litigation do not apply under
HIPAA or HITECH
© 2013
Christiansen IT Law Privacy/Security/Compliance
30
HITECH BA Compliance Obligations
Direct regulatory obligations
•
•
•
•
•
•
•
•
•
Full compliance with the Security Rule for ePHI
Use and disclose PHI only as permitted by the upstream BAC
Comply with the Minimum Necessary rule
Notify the CE in case of a security breach
Provide access to a copy of PHI they maintain to the CE or individual, as
specified in their upstream BAC
Provide the information needed for an accounting of disclosures
Maintain and provide access to their records to OCR to investigate the BA’s
compliance
Requirement for implementing BACs with any downstream BA
Terminate BAC for breach by CE
© 2013
Christiansen IT Law Privacy/Security/Compliance
31
HITECH BA Compliance Obligations
Key BAC obligations
•
•
•
•
•
•
•
•
•
Full compliance with the Security Rule for ePHI
Use and disclose PHI only as permitted in the BAC, including Minimum
Necessary policies of CE
Notify the CE in case of a security incidents, breaches, unauthorized
use/disclosure
Provide access to a copy of PHI in their possession to the CE or individual
Provide the information needed for an accounting of disclosures
Maintain and provide access to their records to OCR to investigate the CE’s
compliance
Implementing BACs with any downstream BA
Authorize termination of BAC for breach by CE
Require return/destruction/escrow of PHI upon termination of BAC
© 2013
Christiansen IT Law Privacy/Security/Compliance
32
HITECH BA Compliance Obligations
Many BAC requirements are
redundant to direct
regulatory requirements
• Some are not, and not
well coordinated
© 2013
Christiansen IT Law Privacy/Security/Compliance
33
HITECH BA Compliance Obligations
BAs are:
•
•
•
•
•
Exposed to potential federal criminal penalties for violation of HIPAA
Subject to regulatory jurisdiction of OCR and state attorneys general
Required to cooperate with OCR investigations of CE and BAs
Exposed to potential civil monetary penalties for violation of HIPAA
Exposed to private tort actions by individuals harmed by BA failure to
comply with HIPAA
© 2013
Christiansen IT Law Privacy/Security/Compliance
34
HITECH BA Compliance Obligations
Hold on a minute . . . What about that last one???
•
HIPAA doesn’t provide an individual cause of action?
•
True, but see R.K. v. St. Mary’s Medical Center, 735 S.E.2d 715, 723
(2012) cert. den. __ U.S. __ (April 1, 2013) (reviewing multistate caselaw
holding HIPAA provides standard of care supporting negligence per se and
related types of tort action to hold same for West Virginia)
See RCW 5.40.050: A “breach of duty imposed by statute… or
administrative rule… may be considered by the trier of fact as evidence of
negligence[.]”
•
•
So a law firm BA owes a duty of care to and can be sued by any individual
whose PHI it has in its capacity as a BA, if harmed by the law firm’s failure
to comply with HIPAA requirements applicable to BAs
© 2013
Christiansen IT Law Privacy/Security/Compliance
35
Structuring Law Firm Compliance
Can law firms segregate compliance obligations?
•
HIPAA concept: “Hybrid entity”
• “A single legal entity that is a [CE] . . . whose business activities include
both covered and non-covered functions . . . and that designates health
care components[.]”
• 45 CFR § 164.103
• “If a [CE] is a hybrid entity, the requirements of [the Security and Privacy
Rules] apply only to the health care component(s) of the [CE.]”
• 45 CFR § 164.105(a)(1)
• “Health care components” may include organizational “components” to
the extent that they perform “covered [CE] functions” or “activities that
would make the component” a BA of a component which performs
covered functions
• 45 CFR § 164.105(a)(2)(iii)(C)(2)
© 2013
Christiansen IT Law Privacy/Security/Compliance
36
Structuring Law Firm Compliance
Can law firms segregate compliance obligations?
•
Hybrid entity CE “must ensure that a health care component” complies with
the Privacy and Security Rules; in particular • No disclosure of PHI to other components unless such disclosure would
be permitted to separate entity
• Protect PHI with respect to other components “to the same extent” as
required under the Security Rule if they were separate entities
• Comply with the Privacy Rule as if the component were CE or BA, as
applicable
• Workforce members serving both health care and other components
may not use or disclose PHI obtained “in the course of or incident to”
work in the former while providing services to the latter, except as would
be permitted by the Privacy Rule for separate entity
• 45 CFR § 164.105(a)(2)(ii)
© 2013
Christiansen IT Law Privacy/Security/Compliance
37
Structuring Law Firm Compliance
Can law firms segregate compliance obligations?
•
Hybrid entity CE (not the component) is responsible for compliance; in
particular • Documented designation of components, including all performing CE
and BA functions
• Maintenance of all Security and Privacy Rule policies and procedures
documentation
• CE as a whole is subject to compliance, enforcement obligations and
penalties
• 45 CFR § 164.105(a)(2)(iii)
© 2013
Christiansen IT Law Privacy/Security/Compliance
38
Structuring Law Firm Compliance
Can law firms segregate compliance obligations?
•
Can hybrid entity concepts be applied to BAs?
• No specific reference in HITECH
• No guidance on point
• Functional equivalents can be established by policies and procedures,
where appropriate backed by technical architecture
• Example:
• Firm designates “health law component” – lawyers, paralegals,
support staff – using policy documentation
• Possibly include “BAs” in other “components,” where
appropriate
• Firm establishes policies and procedures for “health law (and BA?)
component,” and for interaction with “other components” of firm
• Possibly including physical, technical separation; certainly at
least physical, technical identification and distinction
© 2013
Christiansen IT Law Privacy/Security/Compliance
39
Attorney BA Security Compliance
Security Rule compliance is (not in-) consistent with ethical obligations
to protect confidential information
•
•
RPC 1.6(a): “A lawyer shall not reveal information relating to the
representation of a client unless the client gives informed consent, the
disclosure is impliedly authorized in order to carry out the representation or
the disclosure is permitted by paragraph (b).”
– “A lawyer must act competently to safeguard information relating to the
representation of a client against inadvertent or unauthorized disclosure
by the lawyer or other persons who are participating in the
representation of the client or who are subject to the lawyer’s
supervision.” ABA Ethics 2000, Comment 16 to Model Rules of
Professional Conduct 1.6.
Also implicates obligation to provide competent representation. See RPC
1.1
© 2013
Christiansen IT Law Privacy/Security/Compliance
40
Attorney BA Security Compliance
Anticipated Model Rule updates
•
•
•
“To maintain the requisite knowledge and skill, a lawyer should keep
abreast of changes in the law and its practice, including the benefits and
risks associated with technology.” Comment 6 to Model Rule 1.1
Unauthorized access to/inadvertent or unauthorized disclosure of,
confidential information does not violate Model Rule 1.6 if the lawyer has
made reasonable efforts to prevent the access or disclosure, including
security risk analysis and selection of appropriate safeguards. Comment 16
to Model Rule 1.6.
Client may give informed consent to forego security measures that would
otherwise be required by Model Rule. Id.
© 2013
Christiansen IT Law Privacy/Security/Compliance
41
Attorney BA Security Compliance
•
Attorney required to take “competent and reasonable steps to assure that
the client’s confidences are not disclosed to third parties through theft or
inadvertence” and “competent and reasonable measures to assure that the
client’s electronic information is not lost or destroyed,” and “must either
have the competence to evaluate the nature of the potential threat to the
client’s electronic files and to evaluate and deploy appropriate computer
hardware and software to accomplish that end, or if the attorney lacks or
cannot reasonably obtain that competence, to retain an expert consultant
who does have such competence.”
– State Bar of Arizona, Opinion No. 05-04
© 2013
Christiansen IT Law Privacy/Security/Compliance
42
Attorney BA Security Compliance
•
“Whether an attorney violates his or her duties of confidentiality and
competence when using technology to transmit or store confidential client
information will depend on the particular technology being used and the
circumstances surrounding such use. Before using a particular technology
in the course of representing a client, an attorney must take appropriate
steps to evaluate: 1) the level of security attendant to the use of that
technology, including whether reasonable precautions may be taken when
using the technology to increase the level of security; 2) the legal
ramifications to a third party who intercepts, accesses or exceeds
authorized use of the electronic information; 3) the degree of sensitivity of
the information; 4) the possible impact on the client of an inadvertent
disclosure of privileged or confidential information or work product; 5) the
urgency of the situation; and 6) the client’s instructions and circumstances,
such as access by others to the client’s devices and communications.”
– State Bar of California, Formal Opinion No. 2010-179
© 2013
Christiansen IT Law Privacy/Security/Compliance
43
Attorney BA Use and Disclosure of PHI
Basic Principles
•
•
•
•
•
Scope of PHI which BA may obtain is determined by underlying agreement
between CE and first tier BA
Authorized uses and disclosure of PHI are determined by underlying
agreement
CE may not authorize BA to use or disclose PHI in any way not permitted to
CE
BA must comply with CE minimum necessary policies
BA must pass along restrictions on PHI use or disclosure which no less
stringent than those in its BAC, to downstream BAs and Services Providers
© 2013
Christiansen IT Law Privacy/Security/Compliance
44
Attorney BA Use and Disclosure of PHI
Scope of authorization
•
•
•
CE must ensure that its own policies, notices, PHI use and disclosure
restrictions do not preclude appropriate obtaining, use, disclosure of PHI
First tier and other upstream BACs must allow for full scope of PHI to be
obtained, used, disclosed for purposes of engagement
Upstream BACs must not prohibit obtaining, use, disclosure of PHI for
purposes of engagement
• Attorney BA may want to confirm in some cases, with some clients
• Red flag for downstream attorney BAs, Services Providers: Upstream
BACs must include optional provision allowing Services Providers
to obtain, use, disclose PHI for BA legal services purposes
© 2013
Christiansen IT Law Privacy/Security/Compliance
45
Attorney BA Use and Disclosure of PHI
•
•
•
© 2013
Assume BAC between CE and BA
Health IT Vendor does not include
optional BA services provider
provisions
BA may not authorize law firm to
obtain, use or disclose PHI to
provide legal services to BA
Examples: Dispute with CE
alleging BA misuse of PHI, breach
of BAC, breach response and
notification analysis, etc.
Christiansen IT Law Privacy/Security/Compliance
46
Attorney BA Use and Disclosure of PHI
Minimum necessary rule
•
•
•
•
CE or BA must make reasonable efforts to limit PHI requested, used or
disclosed to the minimum necessary to accomplish the intended purpose of
the use, disclosure, or request.
– 45 CFR § 164.502(b)(1)
Minimum necessary policy requirements include functional workforce
classifications relative to PHI needed for routine functions, criteria for nonroutine disclosures
– 45 CFR § 164.514(d)
CE (or upstream BA?) may rely on documented representations that PHI
requested in minimum necessary for professional services purposes, from
professional providing services
– 45 CFR § 164.514(d)(3)(iii)(C)
Attorney BA should have:
– Minimum necessary policies
– Standard form for representations to clients
© 2013
Christiansen IT Law Privacy/Security/Compliance
47
Attorney BA Breach Notification
CE Has the Obligation to Notify Individuals and OCR
•
•
“A CE shall, following the discovery of a breach of unsecured PHI, notify
each individual whose unsecured PHI has been, or is reasonably believed
by the CE to have been, accessed, acquired, used, or disclosed as a result
of such breach.”
“A CE shall, following the discovery of a breach of unsecured PHI . . . notify
[OCR].”
– 45 CFR §§ 164.404(a), .408(a)
© 2013
Christiansen IT Law Privacy/Security/Compliance
48
Attorney BA Breach Notification
Each BA in a Chain Has an Obligation to Notify the CE
•
•
•
“A BA shall, following the discovery of a breach of unsecured PHI notify the
CE of such breach.”
– 45 CFR § 164.410(a)(1)
Required BAC provision that BA must “report to the CE any security incident
of which it becomes aware, including breaches of unsecured PHI as
required by § 164.410.”
– 45 CFR § 164.314(a)(2)(i)(C)
CE may delegate notification to BA
– Omnibus Rule at 5651.
© 2013
Christiansen IT Law Privacy/Security/Compliance
49
Attorney BA Breach Notification
Each BA in a Chain Has an Obligation to Notify the CE
•
•
No regulatory obligation for lower tier BAs to notify upstream BAs
– Only applicable if provided for in non-required BAC provision
– Does notification of upstream BA count as CE notification?
No regulatory obligation for BA Services Providers to notify CE
– BA “assurances” from Services Providers must include notification of
“breach of confidentiality”
– Is that the same as a “breach” under the Breach Notification Rule?
© 2013
Christiansen IT Law Privacy/Security/Compliance
50
Attorney BA Breach Notification
Each BA in a Chain Has an Obligation to Notify the CE
•
Timing of BA notification to CE
– 60 days if BA is not agent of CE
– ASAP if BA is agent of CE, as breach is deemed “discovered” by CE
upon “discovery” by BA, even if BA has not notified CE
• Either avoid making BA an agent, or hold BA to rapid notification to
allow timely CE notification
• Can a lower tier BA be considered CE’s agent?
© 2013
Christiansen IT Law Privacy/Security/Compliance
51
Attorney BA Breach Notification
When is an attorney an “agent?”
•
Agency determined by federal common law. Preamble to Interim Final Rule
• “Agency is the fiduciary relationship that arises when one person (a
"principal") manifests assent to another person (an "agent") that the
agent shall act on the principal's behalf and subject to the principal's
control, and the agent manifests assent or otherwise consents so to
act.” §1.01 Restatement (Third) of Agency
• “An agent has actual authority to take action designated or implied in
the principal's manifestations to the agent and acts necessary or
incidental to achieving the principal's objectives, as the agent
reasonably understands the principal's manifestations and objectives
when the agent determines how to act.” § 2.02(1) Restatement (Third)
of Agency
© 2013
Christiansen IT Law Privacy/Security/Compliance
52
Attorney BA Breach Notification
Limiting attorney “agency”
• RPC 1.2
• “Subject to paragraph[] (c) . . . a lawyer shall abide by a client's
decisions concerning the objectives of representation and . . . shall
consult with the client as to the means by which they are to be pursued.”
• “(c) A lawyer may limit the scope of the representation if the limitation is
reasonable under the circumstances and the client gives informed
consent.”
• Comment 6: “The scope of services to be provided by a lawyer may be
limited by agreement with the client or by the terms under which the
lawyer's services are made available to the client. . . . In addition, the
terms upon which representation is undertaken may exclude specific
means that might otherwise be used to accomplish the client's
objectives. Such limitations may exclude actions that the client thinks
are too costly or that the lawyer regards as repugnant or imprudent.”
© 2013
Christiansen IT Law Privacy/Security/Compliance
53
Access to PHI Maintained by Attorney BAs
Individual rights to access, get copies, request amendment
•
•
Do not apply to “information compiled in reasonable anticipation of, or for
use in, a civil or administrative action or proceeding.”
• 45 CFR § 164.524(a)(1)(ii), .526(a)(2)(iii)
Apply only to “designated record sets”
– A “group of records maintained by or for” a CE, including (i) medical,
billing, payment, claims, case or medical management, or (ii) “used, in
whole or in part, by or for the [CE] to make decisions about individuals.”
• 45 CFR § 164.501
© 2013
Christiansen IT Law Privacy/Security/Compliance
54
Access to PHI Maintained by Attorney BAs
Individual rights to access, get copies, request amendment
•
•
•
RPC 1.6: Attorney may not disclose confidential information of client
without client’s informed consent
When would legal services include or require development of records “used
by or for a CE to make decisions about individuals,” which were not
compiled in “reasonable anticipation of or for use in a civil or administrative
action or proceeding?”
– Consider issues at start of engagement; if potentially problematic get
client’s informed consent
Does inclusion of required access provisions in BAC waive confidentiality
and privilege?
– Consider specifying that access/amendment are not permitted (if
applicable)
– Require CE approval of any access (should probably be done anyway)
© 2013
Christiansen IT Law Privacy/Security/Compliance
55
Accounting of Disclosures by Attorney BAs
Individual right to accounting of disclosures of PHI
•
•
•
•
Specific exceptions: Disclosures for treatment, payment, health care
operations; to, or as authorized by, individuals themselves; facility directory;
national security, correctional facility or law enforcement; limited data set
No exception for information compiled for use in civil or administrative
proceedings
Not restricted to designated record sets
Must include date of disclosure, name of recipient, description of PHI and
statement of the purpose of the disclosure
© 2013
Christiansen IT Law Privacy/Security/Compliance
56
Accounting of Disclosures by Attorney BAs
Accounting of disclosures may include confidential information
•
•
•
RPC 1.6: Attorney may not disclose confidential information of client
without client’s informed consent
This could include information such as identity of experts consulted,
services obtained, which might be embarrassing or detrimental to client. Cf.
Washington State Bar Association Formal Opinion 183, Disclosure of
Information Relating to the Representation of a Client by a Legal Service
Office to the Legal Service Corporation or Other Third Party
– Consider issues at start of engagement; if potentially problematic get
client’s informed consent
Does inclusion of required access provisions in BAC waive confidentiality
and privilege?
– CE should provide the accounting (should probably be done by CE
anyway)
© 2013
Christiansen IT Law Privacy/Security/Compliance
57
Governmental Access to Attorney BA Records
Access to BA records for compliance investigations
•
•
•
•
Access to investigate BA compliance required by rule
Access to investigate CE compliance required by mandatory BAC provision
Production of records for government agency audit may waive both
attorney-client privilege and work product doctrine protection
• U.S. v. Massachusetts Institute of Technology, 129 F.3d 681 (1st Cir.
1997)(waived for purposes of other governmental agency access),
Westinghouse Electric Corp. v. Republic of Philippines, 951 F.2d 1414
(3d Cir. 1991)(waived for purposes of private litigant access)
Waiver is at time of entry into contract with standard access provision
• U.S. v. Massachusetts Institute of Technology, supra
© 2013
Christiansen IT Law Privacy/Security/Compliance
58
Governmental Access to Attorney BA Records
Suggestions for dealing with potential waiver issues
•
•
•
•
Raise potential issues with CE client (informed consent)
Draft BAC provisions carefully
• Limit, condition OCR access rights to records for investigation of CE
client to minimize risk of waiver
• Limit, condition OCR access rights to investigate BA law firm
BA may disclose records, etc. with respect to its own compliance in general,
without reference to particular clients or matters – may be workable
negotiating position with OCR for informal resolution (or at least show good
faith)
Design practice scope, processes and systems to “firewall” matters
potentially subject to investigation from other matters
© 2013
Christiansen IT Law Privacy/Security/Compliance
59
Governmental Access to Attorney BA Records
Investigation of BA compliance - potential for conflict of interest
•
•
•
RPC 1.7(a): “Except as provided in paragraph (b), a lawyer shall not
represent a client if the representation involves a concurrent conflict of
interest. A concurrent conflict of interest exists if . . . there is a significant
risk that the representation of one or more clients will be materially limited
by . . . a personal interest of the lawyer.”
RPC 1.7(b): “Notwithstanding the existence of a concurrent conflict of
interest . . . a lawyer may represent a client if: (1) the lawyer reasonably
believes that the lawyer will be able to provide competent and diligent
representation . . . and (4) each affected client gives informed consent,
confirmed in writing[.]”
When would a conflict present? When should you get consent?
© 2013
Christiansen IT Law Privacy/Security/Compliance
60
BAC Termination Due to Violation
Mandatory BAC provision allowing either party to terminate BAC (and
therefore engagement if other party violates BAC
•
•
•
•
Omnibus Rule removed specific provision for reporting violator to OCR if
termination not feasible
• Still permissible to report, of course
Failure to terminate if violation or breach is uncured may be grounds for
penalizing non-terminating party
Draft termination provisions carefully
• Allow for cure periods, etc.
• Do not apply to provisions not required in a BAC – e.g. breach
notification specifics
Ensure termination provision allows for “escrow” of PHI instead of requiring
return or destruction
• PHI may be retained under protection if return/destruction not “feasible”
• May need to be retained for risk management, related purposes
© 2013
Christiansen IT Law Privacy/Security/Compliance
61
BAC Termination Due to Violation
Ethical obligations upon discovery of BAC noncompliance by client
•
RPC 1.2(d): “A lawyer shall not counsel a client to engage, or assist a
client, in conduct that the lawyer knows is criminal or fraudulent, but a
lawyer may discuss the legal consequences of any proposed course of
conduct with a client and may counsel or assist a client to make a good faith
effort to determine the validity, scope, meaning or application of the law.”
© 2013
Christiansen IT Law Privacy/Security/Compliance
62
BAC Termination Due to Violation
Ethical obligations upon discovery of BAC noncompliance by client
•
RPC 1.16(b): “If a lawyer for an organization knows that an officer,
employee or other person associated with the organization is engaged in
action, intends to act or refuses to act in a matter related to the
representation that is a violation of a legal obligation to the organization, or
a violation of law that reasonably might be imputed to the organization, and
that is likely to result in substantial injury to the organization, then the lawyer
shall proceed as is reasonably necessary in the best interest of the
organization. Unless the lawyer reasonably believes that it is not necessary
in the best interest of the organization to do so, the lawyer shall refer the
matter to higher authority in the organization, including, if warranted by the
circumstances, to the highest authority that can act on behalf of the
organization as determined by applicable law.”
© 2013
Christiansen IT Law Privacy/Security/Compliance
63
Attorney BA Contracting
Potential points of conflicts in BA contracting
•
•
Does entry into a BAC constitute or create a “business transaction” or
pecuniary interest” potentially adverse to a client? See RPC 1.8 (Conflict of
Interest: Current Clients).
– RPC 1.8 “does not apply to ordinary fee arrangements between client
and lawyer, which are governed by Rule 1.5[.]” Comment 1 on RPC 1.8
• RPC 1.5 deals only with reasonableness of fees – not helpful here
Note that even if there is no conflict at time of entry into BAC, subsequent
events could create conflict
– Compliance failure where both parties may be at fault
– Security breach with attendant costs of notification
– Civil damages action where plaintiffs make both CE and BA defendants
© 2013
Christiansen IT Law Privacy/Security/Compliance
64
Attorney BA Contracting
Potential points of conflicts in BA contracting
•
•
Do mandatory BAC provisions set up potential for conflict in case of BAC
violation or security breach?
– Provisions which do not allocate, limit or shift liability perhaps do not
create a conflict?
Non-mandatory provisions allocating, limiting, shifting liability might?
– “Agreements prospectively limiting a lawyer's liability for malpractice are
prohibited unless permitted by law and the client is independently
represented in making the agreement because they are likely to
undermine competent and diligent representation. Also, many clients
are unable to evaluate the desirability of making such an agreement
before a dispute has arisen . . . “
• Comment 14 on RPC 1.8
• Is failure to comply with a BAC “malpractice?”
– Is attorney indemnification of client defense costs limited by RPC
1.8(e)(1) (attorney may not advance or guarantee litigation costs)?
© 2013
Christiansen IT Law Privacy/Security/Compliance
65
Attorney Services Provider Contracting
Remember: Not a BA if providing services to a BA, for the BA’s own
purposes
•
•
•
How do you identify services for BA purposes?
Is it permitted under the upstream BACs?
Services Provider contract minimum mandatory content:
– “Assurance” that PHI will be held confidentially
– “Assurance” that PHI will only be used or further disclosed by Services
Provider as required by law, or for purpose for which it was disclosed to
the Services Provider
– Services Provider will notify BA of any “security incident” or “instance of
which it is aware in which the confidentiality of the PHI has been
breached”
– Services Provider will “agree to implement reasonable and appropriate
safeguards to protect” PHI
© 2013
Christiansen IT Law Privacy/Security/Compliance
66
Attorney Services Provider Contracting
A few questions about Services Provider contract content
•
•
•
•
•
Is “confidentiality” equivalent to legal ethics definition? Does it matter?
Does full Security Rule compliance apply by contract?
How do “security incident” and “breach of confidentiality” reporting link to
Breach Notification Rule?
Can Services Providers ever use or disclose PHI for their own
management, administration, legal responsibilities (compare to BAC
provision)?
– If not prohibited by law, must it be explicitly authorized in upstream
BACs?
Can Services Providers retain PHI upon termination of engagement (like
BAC “escrow” provision)?
© 2013
Christiansen IT Law Privacy/Security/Compliance
67
Attorney Contracting: Special Problem
Outsourcing to data storage/cloud services
•
•
•
OCR has stated that data storage vendors are BAs, even if:
– The vendor does not have a contractual right or authority to access
stored PHI
– The vendor does not need to and never does access stored PHI
– The vendor cannot access stored PHI because it is encrypted and the
vendor does not have access to the key
I think OCR is wrong, but I’m not the regulatory authority
Some cloud services vendors take the position they are not BAs
– Use of such a vendor as a BA would entail violation of both regulations
and upstream BAC
– Could attorney Services Provider to BA use non-BA data storage
vendor? Should it?
© 2013
Christiansen IT Law Privacy/Security/Compliance
68
Attorney Contracting
Summary: Provisions and perspectives on attorney BACs
•
•
•
•
•
•
•
•
Know your client: CE? First tier BA? Lower tier BA?
Know your engagement: Are you a first tier BA? Lower tier BA? BA Services
Provider?
Know your engagement: Does it involve PHI? Is it an activity not covered by
HIPAA/HITECH?
Know your PHI constraints: Upstream BACs and minimum necessary
policies
Define engagement scope to minimize risk of “agent” status for breach
notification
Draft PHI access, accounting of disclosure and governmental access
provisions carefully to minimize risks of confidentiality, privilege waiver
Avoid risk shifting provisions to minimize conflict potential
Consider if any circumstances or conditions make informed consent to any
provision prudent
© 2013
Christiansen IT Law Privacy/Security/Compliance
69
Attorney Contracting
Compliance timing and BACs
•
•
No “grandfathered” contracts as proposed
Some BACs “deemed compliant” until September 22, 2014
– To be “deemed compliant” a BAC must be:
• In compliance with pre-HITECH HIPAA BAC requirements
• In effect before January 25, 2013,
• Not apply to agreements or arrangements which are renewed (for
evergreen contracts) or amended before September 23, 2013
– In other words, if the underlying agreement of a BAC is
renewed or amended, the BAC is no longer deemed compliant,
even if the BAC is not amended
– “Deemed compliant” status terminates on the earlier of:
• Renewal or amendment of the underlying agreement, or
• September 22, 2014
© 2013
Christiansen IT Law Privacy/Security/Compliance
70
Questions? Thanks!
© 2013
Christiansen IT Law Privacy/Security/Compliance
71