This past December, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) announced proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. These proposed modifications to the rule would help support patient engagement and remove barriers to coordinated care as well as reduce regulatory burdens on the health care industry.

This news from HHS set the stage for a timely webinar co-sponsored by eFax Corporate and the Electronic Healthcare Network Accreditation Commission (EHNAC) titled HIPAA in 2021: HHS Proposed Changes to Modify Privacy Rule and its Impact on Covered Entities.

Hosted by ANSWERS Media, the virtual discussion was led by two leading privacy and security experts in the healthcare sphere – Brad Spannbauer, Consensus’s VP of software implementation, and professional services and Lee Barrett, executive director and CEO of EHNAC. Both participants each brought diverse knowledge and opinions on the proposed changes to the HIPAA Privacy Rule, the potential effects it might have on providers and the patients they care for, along with any provisions that may need to be implemented once the rule is finalized.

Experts discuss overview and ramifications of key provisions outlined in the rule

The current timeline of the Proposed Rule and the release of Final Rule. The Proposed Rule was officially issued on December 10, 2020 and was published by NPRM in the Federal Register on January 22, 2021. Comments are open until March 22, 2021, and Spannbauer encouraged listeners to take part and leave their thoughts. He went on to inform attendees that it takes approximately 90 days after comments close for a rule to catch, and covered entities will have 180 days to implement the results.

The impact of COVID-19. According to Barrett, some of what has happened with the Privacy Rule goes back to the beginning of the pandemic. The Office for Civil Rights established bulletins and guidance in February of 2020, the focus is trying to minimize the impact on fines and penalties that could be levied throughout by the OCR. Overall, Barrett believes the objective was to increase information sharing amongst a variety of entities while also focusing on good faith efforts of covered entities and business associates regarding how patient information would be shared.  

Telehealth. We saw an astounding rise in telehealth practice during the pandemic. Telehealth was a key component in healthcare because patients were not making appointments or visiting their primary care physicians. Smartphone applications became a link between various organizations, trying to make it easy for both patients and providers no matter the diagnosis or treatment plan. The OCR will not be imposing HIPAA penalties against healthcare providers for noncompliance in connection with the good faith provision of telehealth using these remote communication technologies. It has been outlined that covered providers can utilize apps such as FaceTime or Skype, but are unable to use Facebook Live, TikTok, or Twitch when providing telehealth.

Guidance on disclosures to law enforcement, first responders, public health authorities. This will identify existing HIPAA Privacy Rule permissions and provide examples for when a covered entity may disclose PHI about individuals without their HIPAA authorization. If an individual was in an emergency situation where treatment was needed, a first responder was potentially at risk for infection, or any information would prevent or lessen a serious threat then the absolute minimum bit of information would be necessary to disclose.

Modifications to the rules. These modifications protect covered entities from being subject to the minimum necessary requirement for uses by, disclosures to, or requests by a health plan or covered healthcare provider for care coordination and case management activities. Covered entities can disclose PHI to social services agencies, community-based organizations, or home and service providers. The modifications were proposed to encourage covered entities to use and disclose PHI more broadly in a variety of circumstances, which allows for the broad sharing of information in the midst of emergencies.

A new administration brings change

Each administration brings about new changes, and the Biden Administration will be no different. Barrett discussed the vast background in healthcare technology that the newly designated head of ONC Micky Tripathi, will bring to his post – including serving on The Sequoia Board of Directors and furthering FHIR initiatives in support of interoperability. He went on to note how there will also be changes to the CMS administration as many candidates are currently going through the nomination process. A select few industry experts are also going through the nomination process for the position of HHS Secretary. As leaders are selected and continue to drive efforts in the right direction, Barrett expressed how it has been stated that interoperability initiatives started under the Obama Administration will continue under the Biden Administration.

HIPAA Safe Harbor Law

The webinar also touched on the Safe Harbor Law, which amends the HIPAA HITECH Act and requires HHS to focus on incentivizing organizations to promulgate best practice security. According to Barrett, the goal of this law is to “not penalize those organizations that may have been impacted by a cyberattack, ransomware or other.” He went on to say how choosing not to seek third-party accreditation leaves the impacted organizations subject to an audit by OCR as well as certain fines and penalties due to their lack of proper cyber hygiene.

Now you know, but what should you do to prepare for the Final Rule?

Barrett first advised that all covered entities take time to review their current policies and procedures to determine what revisions need to be made ahead of the Final Rule approval. Covered entities shouldn’t wait to start making provisions on what those revisions might be. Second, all covered entities should begin to look at their organizations’ training processes. Should the Final Rule be approved, where do training tactics need to be amended to meet the new changes? For example, front office staff members should be aware of all forms that patients might have completed and submitted previously as patients could come in and ask to review their PHI on the spot. They might even ask for their records to be sent to another entity. If this Rule is implemented, the timing of these events will go from 30 to 15 days.

Spannbauer concluded the webinar by telling attendees how a majority of these changes will eliminate burdens for covered entities and should be embraced as they will not only make life a little easier for those they impact but, most importantly, because they support patient care.

Watch the complete webinar: HIPAA in 2021: HHS Proposed Changes to Modify Privacy Rule and its Impact on Covered Entities

In a recent HITRUST virtual panel co-sponsored by eFax Corporate, “Effectively Managing Cybersecurity Vulnerabilities in a Turbulent Healthcare Ecosystem,” HITRUST’s Michael Parisi shared an insightful anecdote.

A friend of Michael’s, working from home during the lockdown, had a phone call with a customer to discuss highly sensitive information—while his patio door was wide open. Afterward, the man’s wife came in from outside and told him she heard everything he’d said to the customer. Oh, and so did the couple’s next-door neighbor.

What makes Michael’s point relevant to this conversation about healthcare cybersecurity during COVID is that we’re all running our businesses and performing our jobs under new circumstances, which means we’re all facing new risks and threats.

Now, imagine that call was between a physician and a patient—and think of the neighbor as an Alexa or Siri in the doctor’s home, with a cybercriminal hacking the device to listen in for sensitive data. As Michael pointed out, “The devices are always listening.”

A panel with diverse healthcare-industry expertise

That was just one of many lockdown-era cybersecurity threats discussed by the expert panel, which included:

• The legal perspective:
  Matthew Fisher, who heads the healthcare regulatory team for the New England law firm Mirick O’Connell
• The third-party certification perspective:
  Michael Parisi, VP of Assurance Strategy and Community Development for HITRUST
• The accreditation perspective:
  Lee Barrett, CEO of the Electronic Healthcare Network Accreditation Commission (EHNAC)
• The healthcare cloud-service provider perspective:
  Jeffrey Sullivan, CTO of eFax Corporate’s parent company j2 Cloud Services

COVID challenges for healthcare security professionals

Among the other quarantine-era risks the panel discussed included:

Too much change, too quickly.

Healthcare organizations have had to adjust so much of their operations to address work-from-home arrangements—policies, controls, assessments, tools, technologies—that many IT teams have had to shift their focus away from security, privacy, and regulatory compliance.

Newly generated data is attracting hackers.

With the medical industry working to develop both a COVID vaccine and new treatments, hackers see increased value in going after these companies’ networks and systems to steal this intellectual property. This is why cyberattacks against biopharma companies have skyrocketed since the early days of the pandemic.

Stressful times lead to poor cybersecurity judgment.

Many healthcare-industry professionals are working from home, often for the first time, while also dealing with the stress of the pandemic. These disruptions in our professional and personal lives can leave us more distracted and vulnerable to poor decisions—such as falling for phishing attacks.

EHNAC’s Lee Barrett cited one incredible example. The HHS issued a warning that hospitals’ security and privacy officers were receiving postcards, supposedly from the “Secretary of HIPAA Compliance,” asking them to visit a URL for a risk assessment. The problem: There is so such position as Secretary of HIPAA Compliance. This is a new phishing attack, designed to take advantage of everyone’s confusion during COVID. And many of these healthcare security professionals are falling for it.

Understandably, healthcare orgs’ priority is always on saving lives and is even more important now

Another challenge the panel discussed was that the healthcare industry has only finite resources and budget—and right now, the priority for these organizations is protecting people’s health during COVID. In other words, many organizations are having to weigh competing objectives and de-emphasize everything other than the challenges of treating COVID patients and saving lives. Unfortunately, “everything” can also include cybersecurity and data-privacy initiatives.

What healthcare IT teams should do now

The panelists offered a number of suggestions for health organizations to better protect their sensitive data. j2’s Jeffrey Sullivan, for example, suggested a couple of best practices for healthcare IT teams during what he described as our current “once-in-a-lifetime level of distraction.”

1. Make sure your automated solutions are in place

First, Jeffrey suggested, review your cybersecurity infrastructure across your newly distributed organization. Make sure all of the automated tools and processes are doing their jobs, meaning:

• All of employees’ company-issued devices are encrypted
• Your team has remote monitoring in place for these devices
• You’ve implemented fraud protection, malware detection, and intrusion detection

2. Make sure your cloud service providers are prepared as well

Jeffrey also recommended contacting the third parties whose apps, platforms, and other cloud tools your employees use. Ask them what specific steps they’ve taken to protect their systems—and your company’s sensitive data—during this period of heightened risk from cybercriminals.

Lee Barrett of EHNAC—who called j2’s level of cybersecurity preparedness “a model for the industry”—offered another valuable recommendation:

3. Get a third-party risk assessment

Lee noted that the best way to make sure your organization is meeting all of its cybersecurity and regulatory standards is to have your infrastructure and processes audited and tested by a third-party expert.

Now more than ever, your internal IT security teams have too much on their plate to make sure you’re addressing—or even seeing—all of the new potential threats to your organization’s data security.

For HIPAA-compliant, HITRUST-certified, and COVID-secure cloud faxing, learn what eFax Corporate can do for your organization.

As COVID-19 pushes our nation’s healthcare system to the brink, stories continue making headlines of how public health officials in many cities throughout the country are weeding through stacks of paper test results as they look to trace cases and quarantine patients. In other instances, people are waiting longer to find out if they have coronavirus because nasal swab test results are being paper faxed, which cause latency getting results into systems. To think we are relying on paper processes as the virus surges in many areas of our country is problematic. Add to the fact that 9 billion healthcare-related faxes were sent in 2018 (Nebergall, “Fax Technology is the Cornerstone of Interoperability. Here’s Why,” Open Health News, Feb. 6, 2019) and it is clear that now is the time for us to address healthcare’s Achilles’ heel – legacy paper communication systems.

Use of traditional paper fax, specifically the fax machine, is around because it is an established familiar technology that most people would agree works. After all, you can reliably send information from one person to another. However, when you are in the business of healthcare, your focus is on the quality and safety of patients and the thought of using new technologies can be a distraction which takes away from familiar workflows. Simply stated, the fax machine has proven itself year after year to be an easy way of sending and receiving information. But that doesn’t mean using paper fax the way many have been using it for decades is still the most efficient, convenient and secure way of sharing patient information between providers. If providers and public health officials are expected to stop using the fax machine as we know it, there needs to be an easy to use, reliable, affordable, secure technology that allows interoperability of all data for electronic health information to be shared.

An effective, secure and convenient alternative

The issue with paper faxes is the workflow and lack of system integration, which means added time for data to be actionable. Manual workflows needed to process paper documents are slow, laborious, error-prone and at times, incomplete. Paper faxing can be inexpensively replaced immediately with Digital Cloud Fax Technology (DCFT) which improves the digital transmission of information by eliminating paper, optimizing workflows and providing the ability for secure foundational interoperability. 

For those unfamiliar with this technology, digital cloud fax is a secure, paperless, cost effective, and proven way for medical professionals to share documents and records. When professionally installed, it is HIPAA-compliant and falls into the Health Information Management Systems Society’s (HIMSS) category of “foundational interoperability.” Due to its simplicity and universal acceptance within healthcare, digital cloud fax technology is widely used in every setting with particular importance in communities that struggle to afford sophisticated electronic health-record systems, including public health, rural healthcare organizations and financially challenged urban clinics.

Compared to physical faxing, cloud faxing works like this: An employee creates an email, types in the recipient address, types a cover letter and hits “send.” The fax is sent securely into a determined workflow for an easy queue to manage documents, with a confirmation arriving a few minutes later. There is no printing, no scanning, no dialing, no waiting and no paper to file.

If a higher level of security is required, cloud faxing can transmit documents using TLS 1.2 and store them in a secure server with 256-bit encryption. Users log in to the server to view faxes.

Interoperability: the way forward

If interoperability of systems was easy and commonplace, faxing as we know it would be eliminated. Instead, data from disparate systems within a healthcare facility doesn’t always flow into the EHR, which means that same patient data stays behind as a patient move from provider to provider. Instead, connecting a provider’s EHR to its ambulatory physician EHRs, along with imaging, labs, pharmacy and more, requires specific connections between each system and the treating provider’s core EHR. Bringing data to a common platform multiplies the number of required connections exponentially.

To help eliminate the continued burden paper holds on the healthcare industry, while at the same time helping make provider systems more interoperable, earlier this year, we introduced a platform that connects healthcare organizations through the continuum-of-care. Called Consensus, the platform offers one comprehensive connection with a simple, inbox-like dashboard to manage all incoming and outgoing patient documents including digital cloud faxes, Direct Secure Messaging, patient query and API integration into health exchange networks. With Consensus, providers can access leading EMR/EHR systems through CommonWell and Carequality, plus connections to ACOs and HIE data, allowing for the digital exchange of electronic health information between physicians, public health departments and labs.

Conclusion

Moving beyond paper eases operational and technological burdens that cause bottlenecks which impact patient care and threaten to cripple a public health system that has classically been underfunded by our nation’s healthcare system. What is happening with the lack of effective data sharing at several public health departments and what will undoubtedly happen elsewhere as the virus continues to surge in other areas of our county – including rural populations – can be avoided with a comprehensive interoperability system at our fingertips. One that integrates traditional faxing technology with efficient document management so that providers can exchange patient information electronically. And do so both safely and efficiently.

Despite attempts to eliminate the fax machine in healthcare, it continues to be relied upon by many providers. Not only is faxing commonplace in many healthcare organizations throughout the country, but the use of traditional fax for data exchange continues to rise, according to the Office of the National Coordinator for Health Information Technology’s (ONC) State of Interoperability among U.S. Non-federal Acute Care Hospitals in 2018 Report, released in March 2020.

In a recent article published in Healthcare IT Today, Consensus’s John Nebergall discusses how, although many healthcare organizations still rely on fax machines as their primary way to send patient information to other providers external to their network, cloud fax technology is also on the rise:

According to the ONC, from 2017 to 2018, the use of eFax to send and receive care records increased 3% and 7%, respectively.

“eFax, or cloud faxing as it’s more commonly called, is one of the best protocols for rapid, reliable and scalable data transfer,” stated John Nebergall, Senior Vice President and General Manager of Cloud Faxing at Consensus. “Cloud faxing means having a fully electronic workflow. There is no paper, no physical fax machine, yet it uses tried-and-true fax protocols.”

With a traditional fax machine, patient information would need to be printed from the EHR, walked over to the fax machine and sent through, page by agonizing page. Once confirmation the fax was received properly, the paper record would need to be shredded in order to protect patient privacy. Babysitting this entire process is a tremendous waste of precious healthcare resources.

Cloud faxing eliminates all of this. With the click of a button, information from an EHR (and most other hospital systems) can be turned into a fax transmission and sent to the recipient via the Internet. “It’s quick, convenient and secure” said Nebergall.Read the full article in Healthcare IT Today.

In part 1, we described the debate on the role of APIs and FHIR that took place during the 4^th Annual Current and Future State of Interoperability, a panel discussion sponsored by eFax Corporate and hosted by HealthcareNOW Radio.

The panel included moderator Matt Fisher, attorney with Mirick O’Connell; John Nebergall, vice president of Consensus; Chris Muir, director in the Standards Division of ONC; Dave Cassel, executive director of Carequality; and Jeff Coughlin, senior director of federal and state affairs for HIMSS.

In this post, we’ll focus on the panel’s discussion of proposed information blocking rules and how healthcare organizations can prepare for the broader information sharing inevitably coming to healthcare.

Not surprisingly, ONC’s Muir couldn’t speak to some information blocking questions, as the rule is currently under review. He did say that when meeting with patients and caregivers, he frequently hears complaints about getting access to information and expects the 21^st Century Cures Act to mitigate some of those challenges.

He went on to say that although his agency seeks to address things like the security of APIs and potential problems stemming from deliberate information blocking, what he and his colleagues are really trying to do is create the preconditions for truly transforming healthcare—in which patients play a larger role in their healthcare and there is more competition in the healthcare technology field.

Meanwhile, there was a lively debate over the seven exceptions to information blocking penalties proposed by ONC, which include protecting patient safety, promoting the privacy of EHI, promoting the security of EHI, allowing recovery costs, excusing an actor from responding to infeasible requests, permitting the licensing of some interoperability elements, and allowing temporary exceptions for maintenance or improvements.

HIMSS’s Coughlin says his organization is mainly concerned with ensuring that the seven exceptions are focused in the right direction and had asked ONC for more information about what “broad sharing” would look like.

Carequality’s Cassel said he believes the information blocking rule will have some benefit in expanding on some of the progress already made, especially with regard to provider-to-provider interoperability and potentially opening up the interoperability to patients and others.

But Consensus’s Nebergall disagreed. “It’s a fragmented environment, with organizations in various stages of moving to value-based reimbursement. Laying out a clear and enforceable rule for what constitutes purposeful withholding of patient data would be nearly impossible,” he said.

Nebergall went on to point out that in addition to federal rules, healthcare leaders must consider state laws, sometimes for multiple states, making compliance even more complex. “Short timelines like compliance in 2020 could prove very costly for providers,” he said.

Proper preparation

The panelists differed in their advice for healthcare executives preparing for broader information sharing and information blocking penalties. Cassel said he encourages providers to begin work on the documentation to qualify for exceptions, should they be needed. He also said healthcare organizations should look at how information blocking fits within their overall compliance framework. “Have a compliance plan in place so that you can prioritize your technology-based efforts on the greatest risk or the greatest opportunity,” he said.

Coughlin said the organizations he regularly speaks with are preparing based on the proposed rule. “I think people are primed and ready and just waiting to see the final rule,” he said. He also noted the connection between  interoperability and other policy issues, such as value-based care.

“You can’t deliver value-based care without broad information exchange, and the burdens on providers are such that it’s important to minimize the amount of time clinicians spend trying to share information with other health systems.”

Nebergall had a different view, encouraging those involved with rulemaking to consider encouraging small steps that will lead to more participation at the provider level. “The reality of our healthcare system is that we have a very large middle-of-the-pack that is still dealing with highly manual paper processes,” he said.

“I think there is a ton of work left to do to adopt electronic workflows into the real world of how care is delivered, not only in hospitals, but also post-acute care and home healthcare. The idea of being able to share information like this is light years away from the reality of what these caregivers deal with every day.”Fax is the fiber of who work gets done at the clinical level—electronic transactions of any kind are dwarfed by fax, he said. “And if we keep focusing on the edge of the spear, we’re not going to provide what the “middle” needs, which is getting the information into electronic form so they can think about transmitting it.”

Bring technologists together to discuss interoperability, and you’re going to hear a lot of acronyms, some words of wisdom, and a considerable amount of dissent.

That was the case at the 4^th Annual Current and Future State of Interoperability, a panel discussion sponsored by eFax Corporate and hosted by HealthcareNOW Radio.

Indeed, there was little consensus on the first question asked by moderator Matt Fisher, an attorney with Mirick O’Connell. Fisher asked where APIs fit into current and future healthcare interoperability. “Connectivity is a big plus for APIs, giving healthcare organization the opportunity to expand their ecosystems,” said John Nebergall, vice president of Consensus. “But APIs are not going to solve your integration problems.”

Chris Muir, director in the Standards Division of ONC, agreed. “It’s not a full solution, but it’s helpful when patients need to access data from an ERHs or providers are using more than one EHR,” he said.

Dave Cassel, executive director of Carequality, saw things differently. “APIs are useful across the board,” he said. “There are challenges on the patient-access side, but they’re solvable. And giving patients more control over data access has benefits, including fewer HIPAA problems.”

Shifting the discussion slightly, Nebergall said the real issue is creating a way for patients to gather and exchange information in a way that’s useful to them. This is where technology other than APIs can be useful, providing a way to deliver information directly to patients rather than making them go from place to place to find it, he said.

FHIR’s semantic side

Asked about the Fast Healthcare Interoperability Resources (FHIR) standard, Cassel said while there are always arguments about any given standard, there’s a lot of support in the industry for it. ONC’s Muir concurred, saying that people are supporting it and talking about trying to use it. “We’re seeing a lot of adoption of open APIs based on FHIR,” he said.

But Nebergall said there are serious issues on what he called the semantic side of FHIR. “FHIR holds great promise, but there’s not full consensus,” he said. “We see the use of different coding systems with prior data normalization.”

Jeff Coughlin, senior director of federal and state affairs for HIMSS noted that ONC is asking what version of FHIR should be used and that he expects to see version specification in ONC’s Final Rule.

Cassel pointed out that version specification is not sufficient, that users must take a further step. “FHIR is, more or less, a transport standard, telling you how to get information from point A to point B. It doesn’t say how to define the payload in terms of the data set,” he said. “FHIR can do semantic, but the user has to specify. He or she has to go into Resources and say ‘Thou shalt use Terminology X.’ You can’t leave it unspecified, for example just saying ‘Send medication.’”

In part 2 of this post, we’ll report on the status of information blocking regulations and how organizations can prepare for broader information sharing, including state and federal regulations and moving away from traditional fax.