Health data will be locked down

HIPAA isn't just for healthcare providers anymore. The federal law that requires your doctor to protect your privacy soon will apply to other organizations that come in contact with patient data.

Changes to the Health Insurance Portability and Accountability Act are forcing businesses that provide all sorts of services to the healthcare industry to start documenting what they've done to protect that data.

That's because, starting Sept. 23, they could be audited by the federal government.

To make sure that data is locked down tight enough to meet HIPAA standards, some businesses will need to do more than they're doing now, according to Michael Stovsky, an attorney at Benesch in Cleveland.

None of the affected businesses that spoke with Crain's Cleveland Business said they plan to overhaul their security practices because of the pending rule changes; however, other companies probably don't even know they meet HIPAA's definition of a “business associate” and therefore must comply with its regulations, Mr. Stovsky said.

“The business associates who don't think they're in the healthcare business, those are the ones who are going to be thunderstruck by this,” said Mr. Stovsky, chairman of Benesch's Innovations, Information Technology and Intellectual Property Practice Group.

Net Activity Inc. is one of many local businesses that soon will need to comply with HIPAA.

The small Valley View company's core business has nothing to do with healthcare: Net Activity helps other businesses manage their computer systems. But among those businesses are physician practices, so the company has had to sign agreements stating it will comply with HIPAA.

Not that the company is totally unprepared. Each quarter, Net Activity assesses the security of its processes and computer systems, which already should be up to HIPAA's standards, said president and founder Harry Bhatia.

But the company wouldn't be prepared for an audit if one were to occur today, Mr. Bhatia said.

“I'm sure we'll be lacking on some documentation,” he said.

A lot of companies will need to do more to document their security procedures, according to attorney Kim Wilcoxon, partner in the executive compensation group at Thompson Hine's Cincinnati office.

The documentation process could be easy for a small company run by a single person who knows what's going on throughout the entire business, Ms. Wilcoxon said. For a larger company, however, getting several different departments to produce the proper documentation can take months, she said.

“HIPAA is 90% documentation,” she said.

But documentation isn't everything. Even companies that think they meet HIPAA's security standards — which touch on the security of facilities, computers and administrative processes — could be wrong, Ms. Wilcoxon said.

For years, hospitals and other healthcare companies liable under HIPAA have forced vendors to sign agreements stating that they'll protect patient data and notify them of any security breaches. However, some companies that signed those forms might have installed security measures that no longer suffice because of changes in technology or the way they do business, Ms. Wilcoxon said. Companies qualifying as business associates need to conduct risk assessments regularly, she said.

Joe Dickinson, privacy and security officer for the MetroHealth Systems, said business associates will face “significantly increased liability” once they're directly accountable to the federal government. If one of the thousand-plus business associates that works with MetroHealth causes a data breach, the hospital system could terminate the contract and seek damages in court. Soon, however, a company in that situation could face additional federal penalties, Mr. Dickinson said.

Plus, the federal government is starting to do more HIPAA-related audits, Mr. Dickinson said.

“They are in a much more serious condition when it comes to the federal government,” he said.

Like Net Activity, AtNetPlus Inc. of Stow provides information technology services to some physician practices. Partner Jay Mellon said he's unsure if the company would qualify as a business associate, but if it does he worries that it could affect the company's insurance rates.

“My biggest concern would be, I hope my policy fees don't go up,” Mr. Mellon said, adding that the company already should meet HIPAA standards.

Security has been part of Iron Mountain Inc.'s core business since founder Herman Knaust converted a depleted iron mine in New York state into a shelter for corporate data. However, the Boston-based records management company — which has local facilities serving University Hospitals and possibly other undisclosed customers — now must make sure its many subcontractors sign amended business associate agreements and understand HIPAA soon will apply directly to them, said Web Hull, senior privacy and compliance specialist.

Iron Mountain is telling those subcontractors, including some in Northeast Ohio, to do the same for their own subcontractors, if they have access to patient data.

With its security team refocusing on HIPAA compliance, Iron Mountain sees this moment as an opportunity to educate its subcontractors, Mr. Hull said.

“For lots of other people who are business associates, this is going to be a major change,” he said.

"Health data will be locked down" originally appeared in Crain's Cleveland Business.