HIPAA Violation Alleged Against Texas Physician

We all know HIPAA, the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), because seemingly every visit to every doctor starts with an HIPAA authorization form that allows patients to designate persons with whom personal health information (PHI) can be shared. The statute is pretty bare-bones, but it authorizes HHS to issue rules, which it did from 2000 to 2013 (summarized at the bottom of this post*). 

The cardinal rule for health care professionals is pretty simple: Don't access or spread the PHI of patients unless there's a need to know (with respect to the person accessing the PHI and the person on the receiving end). There are a gazillion technical aspects to the rule, but my version will cover the vast majority of situations in which a person who is covered by the rule (including health care professionals) seeks access to PHI.

A violator of HIPAA faces civil and criminal prosecution that may result in fines or even jail time. A medical resident at Baylor College of Medicine has been indicted for alleged HIPAA violations and if convicted faces the possibility of a $250,000 penalty and up to ten years in prison. Here's DOJ's summary of the case:

A Houston doctor has been indicted for obtaining protected individual health information for patients that were not under his care and without authorization, announced Alamdar S. Hamdani.

The four-count indictment alleges [Ethan] Haim[, Dallas,] obtained personal information including patient names, treatment codes and the attending physician from Texas Children’s Hospital’s (TCH) electronic system without authorization. He allegedly obtained this information under false pretenses and with intent to cause malicious harm to TCH.

 According to the indictment, Haim was a resident at Baylor College of Medicine and had previous rotations at TCH as part of his residency.

In April 2023, Haim allegedly requested to re-activate his login access at TCH to access pediatric patients not under his care. The indictment alleges he obtained unauthorized access to personal information of pediatric patients under false pretenses and later disclosed it to a media contact.

According to Becker's Hospital Review (June 17),  

[Haim] is accused of violating HIPAA by leaking internal documents from Houston-based Texas Children's Hospital concerning gender-affirming services. . . . 

This unauthorized access allegedly allowed him to obtain patients' personal health information, including names, treatment codes and details of the attending physicians. . . . 

In May 2023, Dr. Haim shared these internal documents with Christopher Rufo, a senior fellow at the Manhattan Institute in New York City. . . .

Although a HIPAA violation is a violation, not all violations are created equal. Inadvertence, carelessness, a desire to be helpful -- none of these excuses a violation of HIPAA, but the key to this case is likely to be the apparently political nature of Dr. Haim's alleged breach and this sentence in the DOJ press releasee: "He allegedly obtained this information under false pretenses and with intent to cause malicious harm to TCH." If true, not a good way to start a career in medicine!
____________________________

*HHS's HIPAA rules (source):

• HHS published a final Privacy Rule in December 2000, which was later modified in August 2002. This Rule set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.  Compliance with the Privacy Rule was required as of April 14, 2003 (April 14, 2004, for small health plans).
• HHS published a final Security Rule in February 2003. This Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information. Compliance with the Security Rule was required as of April 20, 2005 (April 20, 2006 for small health plans).
• The Enforcement Rule provides standards for the enforcement of all the Administrative Simplification Rules.
• HHS enacted a final Omnibus rule that implements a number of provisions of the HITECH Act to strengthen the privacy and security protections for health information established under HIPAA, finalizing the Breach Notification Rule.
• View the Combined Regulation Text - PDF (as of March 2013). This is an unofficial version that presents all the HIPAA regulatory standards in one document. The official version of all federal regulations is published in the Code of Federal Regulations (CFR). View the official versions at 45 C.F.R. Part 160 - PDF, Part 162 - PDF, and Part 164 - PDF.

HHS's Office of Civil Rights Launches Investigation into Cyberattack on UnitedHealth's Subsidiary, Change Healthcare

On Feb. 12, Change Healthcare experienced a ransomware attack. Most of us had not heard of Change Healthcare before then, but the effect of the cyberattack was felt widely around the country. Associated Press states that "Change Healthcare provides technology used to submit and process insurance claims — and handles about 14 billion transactions a year."As reported by Becker's CFO Report (3/13/24), 

Change Healthcare . . . processes 1 in 3 healthcare claims in the U.S. . . .  The attack has crippled many operations for hospitals, insurers, physician practices and pharmacies across the country, with the American Hospital Association calling it the "most significant cyberattack" on healthcare in U.S. history.

The attackers (identified as the BlackCat Group) allegedly "stole 6 terabytes of data from Change, including medical records and Social Security numbers, and has since received $22 million in bitcoins, according to Reuters."

Getting back to business as usual is taking a lot of time:

As of March 7, Change Healthcare's pharmacy electronic prescribing is fully functional for claim submission and payment transmission. Change is expected to have its electronic payment platform available for connection March 15. Its medical claims network and software are expected to start testing for reconnection March 18, with the company working throughout that week to restore service. 

Meanwhile, AP reports that "[t]he Office for Civil Rights said Wednesday that it also will examine whether Change Healthcare followed laws protecting patient privacy." The HHS press release (3/13/24) is here. It states in part (emphasis added):

The cyberattack is disrupting health care and billing information operations nationwide and poses a direct threat to critically needed patient care and essential operations of the health care industry.

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information and the required notifications to HHS and affected individuals following a breach.

Ransomware and hacking are the primary cyber-threats in health care. Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware. In 2023, hacking accounted for 79% of the large breaches reported to OCR. The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.