Healthcare Information Security and Privacy

by Jack Barkstrom - Attorney, CPA

Just where do you work? The Justice Department or the Office for Civil Rights?

I happened to meet someone at an after-hours event and asked them where they worked. "At the Office for Civil Rights," they said. "You work for the Justice Department?" I asked. You must get a lot of questions about the Civil Rights Act. "Well no," they replied. "Sometimes people call about that, but I work for the Office for Civil Rights in the Department of Health and Human Services." I almost asked, then what are you doing in Denver? HHS has an Office for Civil Rights in Denver? I thought they only had one in Washington.

One of the first, and most confusing questions, about the HIPAA/HITECH Acts is how Civil Rights enforcement went from the Justice Department to the Department of Health and Human Services. Put another way, how did discussions about civil rights, which had been largely dominated by the legal focus on voting rights and racial discrimination, come to be displaced by the medical field when it came to discussion of civil rights? Civil rights in the U.S. had started out as an area of law, primarily focused on racial discrimination and voting rights. It may be helpful to look back at a history of civil rights legislation to understand the transition.

The Office for Civil Rights (OCR)

I usually get confused about the official name. Is it the "Office of Civil Rights" or the "Office for Civil Rights?" I usually think it's the "Office of Civil Rights," although it appears to be somewhat interchangeable. Sometimes it gets referred to as the "office for civil rights." At other times it has been cited as the "office of civil rights."

The Civil Rights Act of 1957

The Civil Rights Act of 1957 was signed by President Dwight Eisenhower in September 1957. It was a response to the growing civil rights movement, which followed the 1954 Brown v. Board of Education, which outlawed segregated schooling. It was primarily aimed at Southern resistance to desegregation. It fell short of its main goal which was the protection of Black voting rights, since it was significantly weakened by oppostion from members of Congress. It did create a U.S. Commission on Civil Rights, which was to investigate violations of civil rights and recommend solutions. It also created the Civil Rights Division within the Department of Justice to handle civil rights cases.(1)

The Health and Human Services (HHS) Office for Civil Rights, almost had a separate history. It had its origins in 1953, when the Cabinet-level Department of Health, Education, and Welfare (HEW) was created, also under President Eisenhower, officially coming into existence on April 11, 1953. In 1979, the Department of Education Organization Act was signed into law, providing for a separate Department of Education, essentially splitting civil rights jurisdiction between the Department of Health, Education, and Welfare and the Department of Education. (This 1979 milestone, years in the future, may seem unrelated, except that the Department of Education would have its own Office for Civil Rights, which would largely focus on gender descriminition. Education-related oversight was now the responsibility of the Education Department. In 1980, the Department of Health, Education, and Welfare was renamed the Department of Health and Human Services (HHS). (Possibly the reason for the change was that the term "Human Services" had a more positive connotation than the term "Welfare.")(2)

The Civil Rights Act of 1964 focused primarily on what might be called the "traditional" (non-medical) areas of civil rights, prohibiting discrimination in public accomodations, employment (Title VII) and education. Title VI of the Civil Rights Act prohibits discrimination on the basis of race, color, or national origin in federally funded programs. The perception of civil rights as more of a medical rights issue than an issue of traditional civil rights, had its beginnings with the creation of the Medicare and Medicaid programs in 1965. Medicare and Medicaid were enacted as Title XVIII and Title XIX of the Social Security Act, providing hospital, post-hospital extended care, and home health coverage to almost all Americans aged 65 or older. The last major piece of legislation in this area was the Voting Rights Act of 1965, signed by President Johnson in August 1965. Enthusiasm or pressure for new legislation and enforcement began to decline after that, along with the meaning of "civil rights." When it was resurrected, it would be associated more with the medical field.(3)

In 1977, the Health Care Financing Administration (HCFA) was established to administer the Medicare and Medicaid programs. In 1995 the Social Security Administration (SSA) became independent of the Department of Health and Human Services (HHS). Following this action, HCFA itself consolidated into its own headquarters in Baltimore, down the road from the SSA. It was in the following year that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was passed. While one of HIPAA's goals was to provide "portability" of insurance coverage when employees changed employers, it perhaps marked the real transition point for control of the meaning of civil rights. In 2001 the Health Care Financing Administration (HCFA) was renamed the Centers for Medicare and Medicaid Services (CMS).(4)

The HIPAA/HITECH Acts - Historical Overview

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), on a timeline, was something of a late comer to the health insurance field, since it came some thirty years after the creation of the Medicare program in 1965. Events moved relatively quickly after that. The HIPPA Privacy Rule was promulgated in December 2000. The HIPAA Security Rule would be published (originally) in February 2003. The HIPAA Enforcement Rule (Interim Final Rule) intended to enforce the other rules, was initially published in April 2003. In July 2009, administration and enforcement of the HIPAA Security Rule was transferred from the Centers for Medicare and Medicaid Services (CMS) to the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS). The Final Rule would be issued in January 2013.(5)

The Health Insurance Portability and Accountability Act (HIPAA) was an amendment to the Social Security Act. It added Part C -Administrative Simplification to Title XI of the Act. These Administrative Simplification provisions were intended to improve the Medicare program (Title XVIII of the Act) and the Medicaid program (Title XIX of the Act). HIPAA's primary stated purpose was focused on insurance, with the goal of permitting employees to change jobs without having their new health plans excluding preexisting conditions. At the same time, Congress was beginning to deal with efficiency and problems becoming apparent with the increasing use of computer technology. It did mandate a uniform of transaction codes to process insurance claims more easily, which was the reason for the name of Part C, "administrative simplification."(6)

If the focus of HIPAA was insurance and portability, on its surface, Congress was not ignoring questions about the privacy and security of medical data. It just could not agree on what measures should be included as part of HIPAA legislation. Instead, it established a deadline for itself of August 21, 1999 to return to the topic and enact comprehensive legislation. If it failed to act by then, the Department of Health and Human Services (HHS) was to promulgate regulations with regard to health privacy. On November 3, 1999 HHS published proposed regulations, (subject to revision) on the Privacy Rule. The regulations for the Security Rule would be published later, in 2003.(7)

The HITECH Act

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act. It was part (Title XIII) of the American Recovery and Reinvestment Act (ARRA). The purpose of the HITECH Act was to facilitate the move to electronic health records. It mandated much higher penalties for violations and expanded the entities or organizations directly subject to its jurisdiction. So-called "Covered Entities," (CEs) which had formerly been limited to health care providers, such as hospitals or physicians, now included "business associates" (BAs) - entities providing services, such as claims processing, to health care providers. It also made anyone dealing with "protected health information" (PHI) - information identifying an individual patient - subject to HIPAA. This meant that almost anyone, such as employers or life insurers, who sent or received patient information, fell under HIPAA's reach. In addition, HHS was required to conduct audits of HIPAA compliance. Finally, the HITECH Act contained the first federal data breach notification requirement. It required notification of affected individuals "without unreasonable delay" and not later than 60 days after discovery of the breach.(8)

In spite of the HITECH requirements of 2009, HHS would not release the final regulations for another four years. The Omnibus Final Rule or "Omnibus Rule" was released on January 25, 2013. The HITECH Act, in its goal to move to electronic health records, had attempted to cover electronic protected health informaton (ePHI), which is a subset of protected health information (PHI). When the Omnibus Rule was finally released, it covered a broad range of activities, from physical security safeguards, including facility access, workstation, control of devices and storage media, to disposal, protection of ePHI during transmission, to greater enforcement powers by HHS.(9)

The Omnibus Rule was specific enough to cover then-known problems, yet broad enough to allow for unforeseen problems. Whether technological advances, such as artificial intelligence, move so quickly as to make current regulation "outdated," it is likely to change. It remains to be seen whether that change will come in the form of an update and modification, or a complete replacement. It will definitely change. One other cautionary note should be added. The HIPAA and HITECH acts started out focused on the healthcare industry, which seemed to be limited to doctors and hospitals. It has expanded into non-medical areas. HIPAA and HITECH have not forgotten about hospitals and doctors. Hospitals and physicians have their own special sections with their own set of regulations. In terms of computer technology, it should also be kept in mind that, future legislation in the medical field will be influenced by technological developments. It is somewhat of a two-way street. Vulnerabilities and breaches at one hospital are likely to make news and alert other industries of problems, prompting a search for a response. Similarly, incidents in other areas are likely to influence health industry regulation or legislation. The response, in either case, is likely to be immediate.

• 1) Eisenhower Presidential Library website, at https://www.eisenhowerlibrary.gov - online-documents.
• 2) Department of Health & Human Services website, at https://www.hhs.gov/about/historical-highlights/index.html, accessed May 24, 2021.
• 3) Barry R. Furrow et al, Health Law Cases Materials and Problems, 628, Eighth Edition (St. Paul, MN: West Publishing Company, 2018); See also Department of Health & Human Services Centers for Medicare & Medicaid Services, Medicare & Medicaid Milestones 1937-2015, July 2015.
• 4) Department of Health & Human Services website, see also HHS website.
• 5) Patricia D. King, ed., HIPAA/HITECH Resource Guide, 1, 2, 77, First Edition (Washington, DC: American Health Lawyers Association, 2014); see also Stephen S. Wu, A Guide to HIPAA Security and the Law, 2-4, 7, 17-18, 21-23, Second Edition (Chicago, IL: American Bar Association, 2016); see also Daniel J. Solove and Paul M. Schwartz, Information Privacy Law, 39, 531-539, Seventh Edition, (New York: Walters Kluwer, 2021); see also Department of Health & Human Services website; see also Federal Register/Vol. 74, No. 148, August 4, 2009, 38630; see also Annual Report to Congress on HIPAA Privacy Rule and Security Rule Compliance For Calendar Years 2009 and 2010, 1-4, U.S. Department of Health and Human Services Office for Civil Rights.
• 6) King, HIPAA/HITECH Resource Guide, 1-3; see also Solove, Information Privacy Law, 531; see also Wu, A Guide to HIPAA Security and the Law, 7-11 .
• 7) King, HIPAA/HITECH Resource Guide, 1-3; see also Solove, Information Privacy Law, 531-532; see also Wu, A Guide to HIPAA Security and the Law, 1-3.
• 8) Pub. L. No. 111-5, 123 Stat. 115 (2009); see also King, HIPAA/HITECH Resource Guide, 1, 77-78; see also Solove, Information Privacy Law, 532-535; see also Wu, A Guide to HIPAA Security and the Law, 3, 9-11, 21-24.
• 9) King, HIPAA/HITECH Resource Guide, 1, 21-49, 83-103; see also Solove, Information Privacy Law, 533; see also Wu, A Guide to HIPAA Security and the Law, 9, 13, 23.