The Importance in Healthcare of a Disaster Recovery Plan (DRP) and how to Organize your Risk Analysis into an actionable DRP.

Creating Your Healthcare Disaster Recovery Plan and Best Practices

When a covered entity performs a Security Risk Analysis, this is not the end but a begging to your HIPAA Security procedures and business continuity plan.

Information gained from the risk analysis then needs to further be organized into a tangible, well documented and actionable Disaster Recovery Plan (DRP).

All health care organizations (particularly hospitals and emergency care centers), must maintain a high degree of system and network availability. Patient's lives may depend on systems being up and running, and a patient's health could be jeopardized or negatively impacted by lack of access to health care data in the event of system downtime. 

The disaster recovery plan is a required implementation, defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. The Rule calls for HIPAA-compliant organizations to anticipate how natural or other disasters could damage systems that contain electronic health information and to develop policies and procedures for responding to such situations.

A HIPAA-compliant disaster recovery plan must state how operations will be conducted in an emergency situation and which workforce members are responsible for carrying out those operations. The plan must also explain how data will be safeguarded or moved without violating HIPAA standards for Privacy and Security.  It must also explain how confidential data and safeguards for that data will be restored.  Although HIPAA doesn't specify exactly how to do this, it does note that failure to adequately recover from a disaster could lead to noncompliance. Failure to comply exposes officers of the organization to repercussions, such as fines or possible jail time.

Unfortunately, when establishing IT budgets, many health care practices and organizations overlook the importance of developing a meaningful, functional and standardized disaster recovery plan. It's important for health care practice Administrators, Compliance Officers and CIOs to make the necessary business case model and receive a useful budget for disaster recovery planning. Making use of the, pay $10 now or $10,000 later, theorem comes to mind.

Formulating a detailed disaster recovery plan should be a primary objective of the entire practice and IT disaster recovery planning project. It is in these plans that you will set out the detailed steps needed to recover your IT EMR systems to a state in which they can support the practice (during, if necessary) and after a disaster.

But before you can create a detailed recovery plan, you will need to perform a Risk Analysis/Assessment (RA) to identify the IT services that support the organization’s critical business activities.

The next step is to establish recovery time objectives (RTOs)* and recovery point objectives (RPOs)**.

*The recovery time objective (RTO) is the targeted duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity. It can include the time for trying to fix the problem without a recovery, the recovery itself, testing, and the communication to the users.

**A recovery point objective (RPO) is defined by business continuity planning. It is the maximum targeted period in which data might be lost from an IT service due to a major incident.

Now that you have that basic information gathering stage compiled, you can move on to the next stage.

Developing Disaster Recovery Strategies

ISO/IEC 27031, which is the global standard for IT disaster recovery, states, “Strategies should define the approaches to implement the required resilience so that the principles of incident prevention, detection, response, recovery and restoration are put in place.” Strategies define what you plan to do when responding to an incident, while plans describe how you will do it.

Once you have identified your critical systems, RTOs, RPOs, etc, create a table, similar to what is shown below, to help you formulate the disaster recovery strategies you will use to protect them.

Critical System(s)	RTO/RPO	Threat	Prevention Strategy	Response Strategy	Recovery Strategy
EMR System	6 hours/ 3 hours	Server Failure/Loss of ePHI	Secure server room; UPS; Regularly backup server	Verify UPS running time, use backup server	Restore/replace primary sever; restore backup date  and input interim records
Accounts Payable/ Billing	8 hours/ 4 hours	Server Failure/Loss of Billing records	Secure equipment room; UPS; Regularly backup server	Maintain paper records for later recovery	Restore/replace primary sever; restore backup date  and input interim records
Building Security	4 hours/ 2 hours	Security System Destroyed	Place system in secure location; UPS; Use protective enclosures for sensors and cameras	Deploy security is available, secure and/or relocate vital system/ records	Repair/Replace security unit and devices

Table 1: Determining disaster recovery Strategies.

Remember to consider issues such as billing, budgets, management’s position with regard to risks, the availability of resources, costs versus benefits, human constraints, technological constraints and regulatory obligations.

Now let’s examine some additional factors in strategy definition:

People

This involves availability of staff/contractors, training needs of staff/contractors, duplication of critical skills so there can be a primary and at least one backup person, available documentation to be used by staff, and follow-up (ongoing training) to ensure staff and contractor retention of knowledge.

Physical facilities

Areas to look at are availability of alternate work areas within the same site, at a different company location, at a third-party-provided location, at employees’ homes or at a transportable work facility. Then consider site security, staff access procedures, ID badges and the location of the alternate space relative to the primary site.

Technology

You’ll need to consider access to equipment space that is properly configured for IT systems, with raised floors, for example; suitable heating, ventilation and air conditioning (HVAC) for IT systems; sufficient primary electrical power; suitable voice and data infrastructure; the distance of the alternate technology area from the primary site; provision for staffing at an alternate technology site; availability of failover (to a secondary server of backup system for example) and failback (returning to normal operations) technologies to facilitate recovery; support for legacy systems; and physical and information security capabilities at the alternate site.

Data

Areas to look at include timely backup of critical data to a secure storage area in accordance with RTO/RPO requirements, method(s) of data storage (cloud, disk, tape, optical, etc), connectivity and bandwidth requirements to ensure all critical data can be backed up in accordance with RTO/RPO time scales, data protection capabilities at the alternate storage site, and availability of technical support from qualified third-party service providers.

Suppliers

You’ll need to identify and contract with primary and alternate suppliers, (including all Business Associates), for all critical systems, PHI data and processes, and even the sourcing of specific crucial people. Key areas where alternate suppliers will be important include hardware (such as servers, racks, etc), power (such as batteries, universal power supplies, power protection, etc), networks (voice and data network services), repair and replacement of components, and multiple delivery firms (FedEx, UPS, etc.).

Policies and procedures

Define policies and procedures describing your Disaster Recovery Plan and have them approved by senior management and Compliance Officer(s). Then define the step-by-step procedures to (for example) initiate data backup to secure alternate locations, relocate operations to an alternate space, recover systems and data at the alternate sites, and resume operations at either the original site or at a new location.

Be sure to obtain management sign-off for your strategies and be prepared to demonstrate that your strategies support the practices’ business and compliance goals.

Translating disaster recovery strategies into DR plans

Once your disaster recovery strategies have been developed, you’re ready to translate them into disaster recovery plans. Let’s take Table 1 and recast it into Table 2, seen below. Here we can see the critical system and associated threat, the response strategy and (new) response action steps, as well as the recovery strategy and (new) recovery action steps. This approach can help you quickly drill down and define high-level action steps.

Critical System(s)	Threat	Response Strategy	Response Action Steps	Recovery Strategy	Recovery Action Steps
EMR System	Server Failure/ Loss of ePHI	Switch over to backup server; create paper records	Confirm status of Server; Verify Data has been backed up including testing and restoring; Switch over to alternate server	Restore/replace primary sever; restore backup date  and input interim records	Verify primary system integrity and repair/replace if necessary; restore backups; incorporate offline records; fall back from secondary servers
Accounts Payable/ Billing	Server Failure/Loss of Billing info	Switch over to backup server; create paper records	Confirm status of Server; Verify Data has been backed up including testing and restoring; Switch over to alternate server	Restore/replace primary sever; restore backup date  and input interim records	Verify primary system integrity and repair/replace if necessary; restore backups; incorporate offline billing or accounting information; fall back from secondary servers
Building Security	Security System Destroyed	Deploy guards and/or secure server records room.	Verify status of security system and video storage; Organize guards and define duties;  have available alternative communication methods (2-way radio)	Obtain or re-install new system/sensors, etc.	Contact vendor to identify system failure issues and repair/replace any faulty components.

Table 2: Using strategies to create disaster recovery Plan.

From Table 2 (above) you can expand the high-level steps into more detailed step-by-step procedures, as you deem necessary. Be sure they are organized and linked in the proper sequence.

Developing DR plans

DR plans provide a step-by-step process for responding to a disruptive event. Procedures should ensure an easy-to-use and repeatable process for recovering damaged IT and ePHI assets then returning these hardware items and critical data back to normal operation as quickly as possible. If staff relocation to a third-party “hot site” or other alternate space is necessary, procedures must be developed for those possible scenarios.

Incident response

In addition, IT disaster recovery plans should be an inclusive part of an incident or emergency response plan that addresses the initial stages of the situation and the steps to be taken.

Note: Emergency management activities that may be needed to address situations where humans are injured or situations such as fires may be a concern must be addressed by local fire departments and/or other first responders.

The DR plan structure

The following section details the elements in a DR plan in the sequence defined by ISO 27031 and ISO 24762.

Important note: Best practice DR plans should begin with a few pages that summarize key action steps (such as where to assemble employees if forced to evacuate the building) and lists of key contacts and their contact information for ease of coordinating, authorizing and launching the plan.

1. Introduction.  Following the initial emergency pages, DR plans have an introduction that includes the purpose and scope of the plan. This section should specify who has approved the plan, those who are authorized to activate it and a list of linkages to other relevant plans and documents.
2. Roles and responsibilities. The next section should define roles and responsibilities of DR recovery team members, their contact details, spending limits (for example, if equipment has to be purchased) and the limits of their authority in a disaster situation.
3. Incident response. During the incident response process, we typically become aware of an out-of-normal situation (such as being alerted by various system-level alarms), quickly assess the situation (and any damage) to make an early determination of its severity, attempt to contain the incident and bring it under control, and notify management and other key stakeholders.
4. Plan activation. Based on the findings from incident response activities, the next step is to determine if disaster recovery plans should be launched, and which ones in particular should be invoked. If DR plans are to be invoked, incident response activities can be scaled back or terminated, depending on the incident, allowing for launch of the DR plans. This section defines the criteria for launching the plan, what data is needed and who makes the determination. Included within this part of the plan should be assembly areas for staff (primary and alternates), procedures for notifying and activating DR team members, and procedures for standing down the plan if management determines the DR plan response is not needed.
5. Document history. A section on plan document dates and revisions is essential, and should include dates of revisions, what was revised and who approved the revisions. This can be located at the front of the plan document.
6. Procedures. Once the plan has been launched, DR teams take the materials assigned to them and proceed with response and recovery activities as specified in the plans. The more detailed the plan is, the more likely the affected IT asset will be recovered and returned to normal operation. Technology DR plans can be enhanced with relevant recovery information and procedures obtained from system vendors. Check with your vendors while developing your DR plans to see what they have in terms of emergency recovery documentation.
7. Appendixes. Located at the end of the plan, these can include systems inventories, hardware logs, software license keys, Insurance policies and/or agent contacts, application inventories, network asset inventories, contracts and service-level agreements, supplier contact data, and any additional documentation that will facilitate recovery.

Additional follow up activities:

Once your DR plans have been completed, they are ready to be exercised and most importantly, TESTED.

Don't neglect DRP testing, modification and critical system updates.

This Identifies most of the critical components of any DRP needed to respond to HIPAA disaster recovery requirements. Although not discussed above, addressable policies could be dealt with inside or outside the DRP. Nonetheless, as ePHI applications can be added to, deleted or modified, periodic planed tests and resultant corrections are vital to the continuing success of any HIPAA disaster recovery plan while supporting regulatory requirements. 

This process, along with controlled testing, will serve to verify and determine whether recovery, fail-over and restoration processes with records and IT assets function as planned.

In parallel to these activities are these additional and necessary supplementary requirements:

Create and implement employee awareness training, documented policies and records management procedures. These are essential in that they ensure employees are fully aware of DR plans and their responsibilities in a disaster, and DR team members have been trained in their roles and responsibilities as defined in the plans. And since DR planning generates a significant amount of documentation, records management (and change management) activities should also be initiated. If your organization already has records management or process management implementation and change management programs, incorporate them in your DR planning.

With natural disasters, security breaches (external and internal) along with cyber attacks occurring more and more frequently, the need for a practicable DRP is more essential than ever. In fact, having a viable DRP is something all covered entities and supporting Business Associates should have in place for their own business integrity and survival along with patient record and health data integrity, regardless of HIPAA or other governmental regulatory disaster recovery requirements.

Note: When developing your IT/EMR DR plans, be sure to review the global standards ISO/IEC 24762 for disaster recovery and ISO/IEC 27035 (formerly ISO 18044) for incident response activities.

Source(s):http://www.hcsiinc.com, https://www.iso.org/, http://searchhealthit.techtarget.com, 

https://www.ready.gov, http://www.computerweekly.com, https://www.iso.org/, https://en.wikipedia.org

To subscribe to this blog, enter your email address:

Delivered by FeedBurner

HHS Launches New Video Training Module for HIPAA Patient Right to Access

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced that it has a new video training module for health care providers.

According to HHS, the new training module provides an “in-depth review of the components of the HIPAA right of access and ways in which it enables individuals to be more involved in their own care.” The training module provides helpful suggestions about how health care providers can integrate aspects of the HIPAA access right into medical practice. This activity is intended for primary care physicians, obstetricians and gynecologists, pediatricians, and nurses.

The goal of this activity is to review components of the Health Insurance Portability and Accountability Act (HIPAA) right of access and ways in which it enables individuals to be more involved in their own care.

Upon completion of this activity, participants will have increased knowledge regarding:

• The components of the HIPAA access right, including an individual's ability to direct a copy of their health information to a third party, including a researcher 
• How the HIPAA right of access enables individuals to become more involved in their care

Information about training materials can be found on the HHS website here: https://www.hhs.gov/hipaa/for-professionals/training/index.html.

The video module can be found here: http://www.medscape.org/viewarticle/876110.

The module contains a video (approximately 37 minutes) titled “An Individuals’ Right to Access and Obtain Their Health Information Under HIPAA” and features Devan McGraw, the Deputy Director for Health Information Privacy at the US Department of Health and Humans Services. The video talks about why privacy protections are important, but mainly focuses on the patient’s right of access, including:

• what fees that can be charged
• whether records may be sent unsecured at the patient’s request
• how quickly the records need to be provided to the patient upon request
• which records can be excluded from a patient’s right to access
• an individual’s ability to have a copy of his/her health information sent directly to a third party.

Upon completion of this activity, participants will receive free Continuing Medical Education (CME) credit for physicians and Continuing Education (CE) credit for health care professionals. In order to receive credit, it is required to have a Medscape user ID and password, which is free to sign up. There are no fees for participating in or receiving credit for this CME.

Additional Training Materials and Resources

Helping Entities Implement Privacy and Security Protections

The HIPAA Rules are flexible and scalable to accommodate the enormous range in types and sizes of entities that must comply with them. This means that there is no single standardized program that could appropriately train employees of all entities. 

HealthIT.gov’s Guide to Privacy and Security of Electronic Health Information provides a beginners overview of what the HIPAA Rules require, and the page has links to security training games, risk assessment tools, and other aids.

Patient Privacy: A Guide for Providers (login required), is an educational program for health care providers on compliance with various aspects of the HIPAA Privacy and Security Rules. Physicians can earn free Continuing Medical Education (CME) credits and health care professionals will receive Continuing Education (CE) credits.

State Attorneys General Training materials provide a more comprehensive overview of HIPAA compliance:

Video & Slides from 2011 State Attorneys General Training (link to non-government website)

Computer-Based State Attorneys General Training Modules (download zip file)

Want to learn more about the HIPAA Privacy & Security Rules? Sign Up for the OCR Privacy & Security Listserv

OCR has established two listservs to inform the public about health information privacy and security FAQs, guidance, and technical assistance materials. We encourage you to sign up and stay informed!

For additional information about HIPAA Privacy and HIPAA Security training for your self and your staff, please contact Healthcare Compliance Solutions Inc. (HCSI). (801)-947-0183

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

When Doctors Resist Compliance Training

"No doctor, compliance training is not optional"

We often receive calls from clients asking for creative ways or guidance to get the doctors in their practice to do compliance training along with the rest of the office staff. The doctor doesn't have time or just wants to "review" the policies and procedures, which they won't. This seems to be a fairly common thread with compliance training and doctors.

Many offices have similar issues with doctors resisting training and as a medical office manager or compliance training administrator you may need to be less coddling or creative and more firm and direct. 

The bottom line is that HIPAA, OSHA and Medicare do not simply suggest training. It is REQUIRED that ALL EMPLOYEES receive compliance training annually (including management and particularly doctors). They don’t simply recommend this or say if it is convenient but that it is REQUIRED for compliance.

It may be necessary to send a message reminding ALL staff members of this fact and the importance of being in compliance for the safety of patients and staff, privacy issues, the legal requirements and financial/reputation ramifications for the practice as a whole due to violation or non-compliance.

Including the information on specific regulations may be useful to get the message across. For example:

The HIPAA Privacy CFR discussing administrative requirements for training can be located in 45 CFR § 164.530(b)(1) and for HIPAA Security 45 CFR § 164.308(a)(5).

Similar resources for OSHA can be found on the Guide to Compliance with OSHA Standards for Medical and Dental offices website. Note that each standard requires training.

Medicare and most insurance companies also require attestation (to affirm to be correct, true, or under oath) that ALL staff receives Fraud, Waste and Abuse training to maintain receipt of payment.

As for HR and Employment Law, we were recently contacted by a client about an unemployment claim issue. Because of the Doctor making a poor decision they will likely end up paying that unemployment claim when normally they would have been able to contest it. Due to that doctors lack of HR training, his bad decision will now cost the practice unnecessarily. Please see this previous article that spawned from this incident:
The greatest risk to any organization comes from within.


Another key item of importance is that workforce member can't just read over some notes on policies or procedures and be considered "trained". There needs to be a formalized consistent method of training that includes Documentation of the training processes, dates, etc. As the saying goes, if it isn't documented it didn't happen.

Compliance and Compliance Training is not optional and is very crucial to the legitimacy and success of your practice or medical facility. Make these requirements clear to your Entire Workforce as a fundamental part of your organization's culture and a non-negotiable condition of employment at your practice. End of story!

Source(s): http://www.hcsiinc.com, https://www.law.cornell.edu, https://www.osha.gov, https://www.teachprivacy.com

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Policies and Procedures, Compliance Training and HR

Maintaining Compliance and also Keeping HR in the Loop

In your ongoing efforts to provide an office culture of compliance, it is important to remember that HIPAA requires covered entities to establish and implement written policies and procedures that are consistent with its Privacy and Security Rules.  It can also be important for your Human Resource officer(s) to be involved with HIPAA compliance related issues in the business.

The U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) has begun its Phase 2 HIPAA Audit Program.  The Program will focus on the policies and procedures adopted and employed by covered entities and their business associates to meet the requirements of the Privacy, Security, and Breach Notification Rules.  Furthermore, if a group health plan is selected for an audit, it would have a very short time to produce its policies and procedures (i.e., 10 business days).  If the group health plan does not comply (for example, because it does not have policies and procedures), the OCR will likely impose corrective measures which could include costly civil monetary penalties.

HIPAA policies and procedures have important functions, including but not limited to:

• Limiting uses and disclosures of Protected Health Information (“PHI”) to the minimum amount reasonably necessary to achieve the purpose of the use or disclosure;
• Identifying the workforce members who need access to PHI and electronic PHI (“e-PHI”) to carry out their duties, the categories of PHI that they need, and any conditions under which they need the PHI to do their jobs;
• Ensuring appropriate protection of e-PHI when it is transferred, removed, disposed and electronic media is re-used; and
• Ensuring that e-PHI is not improperly altered or destroyed.

However, it is not sufficient for a covered entity to merely adopt its HIPAA policies and procedures.  The health practice office must also:

• Designate a privacy and security official to develop and implement policies and procedures; 
• Train applicable workforce members on its policies and procedures as necessary for them to carry out their functions, and apply appropriate sanctions against workforce members who violate its policies and procedures;
• Periodically assess how well its policies and procedures meet the requirements of the Security Rule; and
• Designate a contact person responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices.

There is no template for HIPAA policies and procedures.  Instead employers have the flexibility to design policies and procedures that are appropriate for their size, organizational structure, and risks to PHI and e-PHI.  Furthermore, as employers evolve, so should their policies and procedures.  For example, if an employer adopts a telework policy, it may wish to review whether its policies and procedures appropriately address issues involving remote access.

Summarizing, although not a new requirement, due to new technologies, evolving business and regulatory practices, along with impending HHS audits, employers may want to review their HIPAA policies and procedures to make sure that they are compliant and up-to-date. Many HIPAA policies inherently overlap with Human Resource's duties: training, disciplinary actions and employee health information for examples.

The increase in audits — combined with everything from changes in technology, the addition of a health and wellness program and concerns about hacking — serve as a good reminder why employers should revisit HIPAA training often and collaborate with HR to ensure compliance.

Many of the employers facing fines are healthcare providers, health plans or healthcare clearinghouses (organizations considered as covered entities under HIPAA). But most HR professionals also handle protected health information (PHI) to some extent, which puts them in danger of violating the HIPAA Privacy Rule.

Employers should have a written policy in place about how they handle PHI and designate PHI handlers and a HIPAA privacy officer. The policy should outline what types of information are considered PHI and how employers may and may not use it. It should also include a procedure for handling complaints and a process for employees to file them if they think their privacy rights are being violated.

Employees who may handle PHI should be trained on the dos and don’ts of handling protected health information, especially as it relates to electronic information. It’s vital for the HR team to understand the implications of handling PHI in emails, storing it on the cloud, or communicating about it over other electronic formats. And when discussing matters containing PHI with an employee, it’s important to have a signed HIPAA authorization form for the release of employee health information.

Lastly, the HIPAA privacy officer should review compliance documents and ensure that agreements with vendors who handle PHI, called “business associate agreements,” are up to date. The federal government considers vendors and subcontractors to be business associates if they handle PHI on behalf of the covered entity.

Source(s): http://www.hhs.com, http://www.jdsupra.com, https://www.benefitnews.com, http://www.hcsiinc.com

To subscribe to this blog, enter your email address:


Delivered by FeedBurner