HIPAA Trends and Emerging Challenges: What to Expect in 2020

HIPAA is now over two decades old. In that time, much has changed. When it was written, the Internet was in its infancy, and most healthcare data was still on paper only. The objective of HIPAA was to modernize the flow of healthcare information and protect patients from fraud and theft. HIPAA compliance is critical to every healthcare organization, but that doesn’t mean it’s easy to keep up with HIPAA trends and emerging challenges. 

To help you prepare for any changes in 2020, we’re breaking down what to expect in the next year regarding HIPAA regulations. 

National Patient Identifier

As part of HIPAA’s passage in 1996, a National Patient Identifier was to be established. However, Congress overruled the legislation and restricted funding to develop it. In June of 2019, the House voted in favor of lifting this ban. There are two sides to the argument.

Most health IT leaders believe that creating an identifier is vital to solving challenges with patient matching and has the potential to minimize medical errors and misidentification. The American Health Information Management Association (AHIMA) supports the lift of the ban and development of the identifier. 

The identifier could help reduce interoperability issues, as well. The fierce objections to the identifiers are still coming from politicians, namely Sen. Rand Paul, R-Ky. He introduced a repeal act of the identifier in Congress recently. Paul argues that the national identifier would threaten patient privacy. Critics say his arguments are without merit and don’t align with the current reality of healthcare data needs.

A healthcare identifier for Medicare beneficiaries has been approved and goes into effect on January 1, 2020. This is a HIPAA trend that will continue to be a hot topic in the next year.

Compliance and Enforcement HIPAA Trends

Enforcement of HIPAA by HHS OCR has been picking up speed in 2019. After a record-breaking year of recovery of over $28 million, the OCR started 2019 with a $3 million settlement related to two breach incidents. 

Later in the year, the OCR announced its first settlement under the Right of Access Initiative. The case involved a healthcare organization that failed to respond to a patient’s request for medical records in a timely manner. With this settlement, it sends a clear sign that entities will be held accountable for not providing access to patients per HIPAA requirements. 

The largest settlement in 2019 will reportedly be a fine of $145 million paid by Allscripts Healthcare Solutions. The settlement is in reference to Practice Fusion, an entity purchased by Allscripts in 2018 that was under investigation regarding HIPAA’s anti-kickback statutes. 

Data breaches continue to be an Achilles heel for healthcare. Healthcare again leads all industries in cybersecurity attacks and data breaches. What’s interesting and provides context to this statement is that most incidents originated inside the organization.

Healthcare organizations must begin to evolve and modernize their infrastructure to combat this. They should also think of HIPAA compliance as a baseline and exceed requirements for better protection.

More Risk Assessments Will Occur

Healthcare organizations often think, incorrectly, that general insurance will cover a data breach. This is rarely the case. To ensure companies have insurance, they’ll likely need to perform risk assessments, which are already part of HIPAA audits. While you can undergo a risk assessment internally, it’s often a good idea to work with an experienced third-party expert.

Social Media Continues to be a Compliance Miss

There have been many tales associated with social media and HIPAA noncompliance. Social media is another channel for communication and must be treated with the same perspective. Under HIPAA, violations on social media networks include:

• Gossip or hearsay posted to unauthorized individuals even if no name is disclosed
• Sharing any patient photos without express permission
• Posting pictures from your office that contain any visible patient files
• Directly publishing any PHI

Much of this noncompliance challenges comes to appropriate employee training. Organizations need to have a clear and accessible policy on social media, so there is no room for misinterpretation.

State AGs Ramping Up General HIPAA Enforcement

While the healthcare industry generally thinks about the OCR as the agency to be concerned about the most, they can’t overlook state attorney generals. State AGs are becoming more active and have begun to band together to initiate multi-state suits. 

In addition to OCR, states are bringing their own actions on entities found to be in violation of HIPAA. The OCR is profoundly encouraging state AGs to take a stand. They were once not really a party. That all changed in 2010 when the Connecticut AG took aim at a company responsible for the breach of 446,000 patient records in the state.

Since then, multiple state AGs have sued noncompliant businesses and recouped monies on behalf of their impacted residents. That isn’t expected to decline. Research has shown that of the enforcement actions taken by state AGs, much of the time ePHI is the risk. Yet another reason to strengthen cybersecurity programs.

As technology advances and new innovative tools like AI and blockchain become part of the healthcare infrastructure, there will be new HIPAA trends to consider. Healthcare organizations must be proactive, rather than reactive, in sustaining HIPAA compliance and data security. We’ll keep you updated. Stay in touch by subscribing to the blog.