Figure 8-1 Health Informatics Regulations

A list of health informatics regulations includes meaningful use 2010, MACRA 2015, Cures Act 2016, HIPAA 1996, and HITECH 2009.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules contain privacy, security, and breach notification requirements that apply to individually identifiable health information created, received, maintained, or transmitted by health care providers who engage in certain electronic transactions, health transactions, health plans, health care clearinghouses, and their business associates. The Office for Civil Rights (OCR) is the Departmental component responsible for implementing and enforcing the privacy regulation. (U.S. Department of Health and Human Services [HHS], 2022, para. 6-7)

The need and means to guarantee the security and privacy of health information were the focus of numerous debates. Comprehensive standards for the implementation of this portion of the act eventually were finalized, but the process to adopt final standards took years. In August 1998, HHS released a set of proposed rules addressing health information management. Proposed rules specific to health information privacy and security were released in November 1999. The purpose of the proposed rules was to balance patients' rights to privacy and providers' needs for access to information (Hellerstein, 2000).

Hellerstein (2000) summarized the proposed privacy rules as follows:

• Define protected health information (PHI) as “information relating to one's physical or mental health, the provision of one's health care, or the payment for that health care, that has been maintained or transmitted electronically and that can be reasonably identified with the individual it applies to” (p. 2). Figure 8-2 depicts the types of information protected under HIPAA.

  Figure 8-2 What Is Protected Health Information?

  

  An illustration of a funnel depicts the elements of protected health information, encompassing demographics, medical history, lab or test results, and insurance information.

• Propose that authorization by patients for release of information is not necessary when the release of information is directly related to treatment and payment for treatment. Specific patient authorization is not required for research, medical or police emergencies, legal proceedings, and collection of data for public health concerns. All other releases of health information require a form for each release that specifies which information pertinent to the issue at hand is to be released. All releases of information must be formally documented and accessible to the patient on request.
• Establish patient ownership of the healthcare record and allow for patient-initiated corrections and amendments.
• Mandate administrative requirements for the protection of healthcare information. All healthcare organizations are required to have a privacy official and an office to receive privacy violation complaints. A specific training program for employees that includes a certification of completion and a signed statement by all employees that they will uphold privacy procedures must be developed and implemented. Every 3 years, all employees must re-sign the agreement to uphold privacy. Sanctions for violations of policy must be clearly defined and applied.
• Mandate that all outside entities that conduct business with healthcare organizations (e.g., attorneys, consultants, and auditors) must meet the same standards as those of the organization for information protection and security.
• Allow PHI to be released without authorization for research studies. Patients may not access their information in blinded research studies because their access may affect the reliability of the study outcomes.
• Propose that PHI may be de-identified before release in such a manner that the identity of the patient is protected. The healthcare organization may code the de-identification so that the information can be re-identified once it has been returned.
• Applies only to health information maintained or transmitted by electronic means.

As concerns mounted and deadlines loomed, the healthcare arena prepared to comply with the requirements of the law. The administrative simplification portion of this law was intended to decrease the financial and administrative burdens by standardizing the electronic transmission of certain administrative and financial transactions. This section also addressed the security and privacy of healthcare data and information for the covered entities of healthcare providers that transmit any health information in electronic form in connection with a covered transaction, health plans, and healthcare clearinghouses (Centers for Medicare and Medicaid Services [CMS], n.d.-a).

The privacy requirements, which went into effect on April 14, 2003, limited the release of PHI without the patient's knowledge and consent. Covered entities must comply with the requirements. Notably, they must dedicate a privacy officer, adopt and implement privacy procedures, educate their personnel, and secure their electronic patient records. Most individuals are familiar with the need to notify patients of their privacy rights because of their having had to sign forms before interacting with their own healthcare providers.

The Privacy Rule provided certain rights to patients: the right to request restrictions to access of the health record, the right to request an alternative method of communication with a provider, the right to receive a paper copy of the notice of privacy practices, the right to file a complaint if the patient believes their privacy rights were violated, the right to inspect and copy one's health record, the right to request an amendment to the health record, and the right to see an account of disclosures of one's health record. These rights placed the burden of maintaining privacy and accuracy on the healthcare system rather than on the patient.

On October 16, 2003, the standards for electronic transactions and code sets became effective. At that time, the standards did not require electronic transmission but rather mandated that if transactions were conducted electronically, they must comply with the required federal standards for electronically filed healthcare claims. “The Secretary has made the Centers for Medicare & Medicaid Services (CMS) responsible for enforcing the electronic transactions and code sets provisions of the law” (Indian Health Service, 2003, para. 3).

The security requirements went into effect on April 21, 2005, and required the covered entities to put safeguards into place that protect the confidentiality, integrity, and availability of PHI when stored and transmitted electronically.

The safeguards that were addressed were administrative, physical, and technical. The administrative safeguards refer to the documented formal policies and procedures that are used to manage and execute the security measures. They govern the protection of healthcare data and information and the conduct of the personnel. The physical safeguards refer to the policies and procedures that must be in place to limit physical access to electronic information systems. Technical safeguards are the policies and procedures used to control access to healthcare data and information. Safeguards need to be in place to control access, whether the data and information are at rest; residing on a machine or storage medium; being processed; or in transmission, such as being backed up to storage or disseminated across a network.

Definitions

The HITECH Act included some important definitions that anyone involved in NI should know:

• Certified EHR technology: The term certified EHR technology means that an EHR meets specific governmental standards for the type of record involved, whether it be an ambulatory EHR used by office-based healthcare practitioners or an inpatient EHR used by hospitals. The specific standards that are to be met for any such EHRs are set forth in federal regulations.
• Enterprise integration: The term enterprise integration means the electronic linkage of healthcare providers, health plans, the government, and other interested parties to enable the electronic exchange and use of health information among all the components in the healthcare infrastructure.
• Healthcare provider: The term healthcare provider includes hospitals, skilled nursing facilities, nursing homes, long-term care facilities, home health agencies, hemodialysis centers, clinics, community mental health centers, ambulatory surgery centers, group practices, pharmacies and pharmacists, laboratories, physicians, and therapists.
• Health information technology: The term health information technology means “hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by healthcare entities or patients for the electronic creation, maintenance, access, or exchange of health information.”
• Qualified electronic health record: The term qualified electronic health record means “an electronic record of health-related information on an individual.” A “qualified” EHR contains a patient's demographic and clinical health information, including the medical history and a list of health problems, and is capable of providing support for clinical decisions and entry of physician orders. It must also have the capacity “to capture and query information relevant to health care quality” and “exchange electronic health information with, and integrate such information from other sources.” (ONC, 2009, pp. 8-9)

HIPAA Privacy and Security Rules

Nurses have been complying with HIPAA for years. HIPAA was enacted by the federal government for several purposes, including better portability of health insurance as a worker moved from one job to another; deterrence of fraud, abuse, and waste within the healthcare delivery system; and simplification of the administrative functions associated with the delivery of health care, such as reimbursement claims sent to Medicare and Medicaid. Simplification of administrative functions entailed the adoption of electronic transactions that included sensitive healthcare information. To protect the privacy and security of health information, two sets of federal regulations were implemented: The Privacy Rule became effective in 2003, and the Security Rule became effective in 2005. Many practitioners who refer to HIPAA are not referring to the comprehensive federal statute enacted in 1996 but rather to the Privacy Rule and the Security Rule, the federal regulations that were adopted years after HIPAA became law.

Under the Privacy Rule, patients have a right to expect privacy protections that limit the use and disclosure of their health information. Under the Security Rule, providers are obligated to safeguard their patients' health information from improper use or disclosure and to maintain the integrity of the information and ensure its availability. Both rules apply to PHI, defined as any physical or mental health information created, received, or stored by a covered entity that can be used to identify an individual patient, regardless of the form of the health information (i.e., it can be electronic, handwritten, or verbal) (Legal Information Institute, 2013). Covered entities include hospitals and other healthcare providers that transmit any health information electronically as well as health insurance companies and healthcare clearinghouses (Legal Information Institute, 2013).

Clinicians have become very knowledgeable about the requirements of the Privacy and Security Rules. They are familiar with their obligations to protect patient information and the rights afforded to their patients under these regulations:

• Patients are entitled to a notice of privacy practices from their healthcare provider.
• Inpatients are entitled to opt out of the facility's directory, thereby protecting disclosure of information that they are even a patient in the facility.
• Under certain circumstances, patients must authorize disclosure of their PHI before it can be released by the provider.
• Patients can request and obtain access to their own healthcare records and may request that corrections and additions be made to their records. Providers must consider a patient's request to amend a healthcare record, but they are not required to make such an amendment if the request is unwarranted.
• Unauthorized access or use or any loss of healthcare information must be disclosed to any patient affected by the breach.
• Patients may request an accounting of anyone who accessed their healthcare information, and the provider is required to provide that information in a timely manner.
• Patients have a right to complain if they perceive that the privacy or security of their healthcare information has been compromised in some way. Such complaints can be made directly to the provider or to the Office for Civil Rights (OCR).

The OCR, which is part of HHS, is responsible for enforcing HIPAA. It provides significant information and guidance to clinicians who must comply with the Privacy and Security Rules. It has been tracking complaints and investigating violations since 2003. Guidance and information about the complaint process and the violations that the OCR has handled are available on its website at www.hhs.gov/hipaa/filing-a-complaint/index.html. As an example, snooping of healthcare records of friends and neighbors is a common HIPAA violation. Even if the information is not disclosed to anyone else, it is still a violation to access records of persons whom one is not assigned to care for. Disciplinary actions may include termination (HIPAA Journal, 2023a).

Many businesses are moving to enact a “bring your own device” (BYOD) policy for employees. This policy, which helps to streamline the lives of employees by maintaining personal and business information on one device, can also result in cost savings for the organization overall. BYOD is an issue, however, when dealing with PHI. Healthcare organizations typically do not encourage the use of personal devices for professional matters, and in many instances, they have policies in place forbidding employees from using personal devices in the workplace. According to Pennic (2013), approximately 50% of healthcare organizations reported that personal mobile devices can be used to access the internet within their facilities but these devices were not given access to the organization's network. For a long time, only devices that were issued by the organization, secured, and routinely audited were able to access the secure network; however, workers were not happy carrying more than one device. Kleyman (2018) pointed out that “[i]f we want to keep an effective and productive healthcare workforce, we need to find a balance between connection and control” (para. 7). He suggested several strategies to support workflow and provide appropriate security:

1. Detail and document your users, their mobile interactions, and their use-case
2. Design a mobility and BYOD workflow that works and is secure
3. Leverage EMM/MDM [enterprise mobility management/mobile device management] and mobility control technologies to improve user experience while still locking things down
4. Enable network-level visibility, DLP [data loss prevention], and data scanning (para. 22-25)

As more healthcare workers used personal devices in the workplace, policies began to change to ensure HIPAA compliance. Wani et al. (2020) suggested several technologies to address BYOD security risks. These include a mobile device management platform to provide central management of devices, including registration/deregistration, encryption, log off, device tracking and data wiping; containerization to separate personal and organization data; virtual desktop infrastructure that eliminates organizational data storage on personal devices; identity and access management; and secure clinical communication platforms. See this website for a list of ways to handle personal devices and maintain the security of PHI: www.healthit.gov/topic/privacy-security-and-hipaa/how-can-you-protect-and-secure-health-information-when-using-mobile-device.

Compliance with the Privacy and Security Rules is mandatory for all covered entities, and the HITECH Act extends compliance with these requirements directly to other entities that are business associates of a covered entity. Requirements include designation of privacy and information security officials to protect health information and appropriate handling of any complaints. Sanctions must be imposed if a violation of HIPAA occurs. The Privacy and Security Rules also mandated that certain physical and technical safeguards be implemented for PHI and that entities conduct periodic training of all staff to ensure compliance with these safeguards. Most entities adhere to industry standards and provide their personnel with yearly training. In addition, entities are to conduct regular audits to ensure compliance, and any breaches in the privacy or security of PHI must be remedied immediately. It is important to avoid a security incident because such incidents trigger certain notification requirements and may be associated with monetary penalties.

The HITECH Act Enhanced HIPAA Protections

The HITECH Act has had a significant effect on HIPAA's Privacy and Security Rules in the following ways:

• HHS is to provide annual guidance about how to secure health information.
• Notification requirements in the event of a breach in the security of health information were enhanced.
• HIPAA requirements now also apply directly to any business associates of a covered entity.
• The rules that pertain to providing an accounting to patients who want to know who accessed their health information were changed.
• Enforcement of HIPAA was strengthened.

These measures were implemented to provide further assurance that health information would be protected as the country transitioned to a nationwide health IT infrastructure. Privacy and data regulations are also being established around the world. See a map of the world depicting the laws of various countries at this website: https://iapp.org/resources/article/dla-piper-data-protection-laws-of-the-world. It is quite evident that privacy and security are global concerns.

Several standards-setting organizations are also involved in the privacy and security aspects of the health IT infrastructure development (Box 8-1).

Box 8-1 Standards-Setting Organizations
The following organizations are recognized by the Secretary of Health of HHS as standards-setting organizations and groups that support the administrative simplification aspects of HIPAA. Each organization is followed by a link to its web page. This information is used with permission from www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/StandardsSettingandRelatedOrganizations.
Advisory Groups
National Committee on Vital and Health Statistics (NCVHS) https://ncvhs.hhs.gov Workgroup for Electronic Data Interchange (WEDI) www.wedi.org
Designated Authoring Entity for Operating Rules
Committee on Operating Rules for Information Exchange (CAQH CORE) www.caqh.org/CORE
Designated Standard Maintenance Organizations (DSMOs)
Dental Content Committee of the American Dental Association (ADA DeCC) www.ada.org/en/science-research/dental-standards/dental-content-committee-decc Accredited Standards Committee (ASC X12) www.x12.org Health Level Seven (HL7) www.hl7.org National Council for Prescription Drug Programs (NCPDP) www.ncpdp.org/home National Uniform Billing Committee (NUBC) www.nubc.org National Uniform Claim Committee (NUCC) www.nucc.org
Non-Designated Standard Maintenance Organizations
American National Standards Institute (ANSI) www.ansi.org Electronic Healthcare Network Accreditation Commission (EHNAC) www.ehnac.org Health Industry Business Communications Council (HIBCC) www.hibcc.org Electronic Payments Association (Nacha) www.nacha.org National Association of Insurance Commissioners (NAIC) https://content.naic.org National Information Standards Organization (NISO) www.niso.org

Avoiding security incidents has become a paramount concern for healthcare organizations and providers. Providers must protect their information and prevent unauthorized persons from accessing, using, disclosing, changing, or destroying a patient's health information or otherwise interfering with the operations of a health information system, such as an EHR. PHI can be secured through encryption, shredding and other forms of complete destruction, or electronic media sanitation. For an overview of two methods for de-identifying PHI, visit www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html.

Figure 8-3 depicts some common causes of PHI vulnerabilities.

Figure 8-3 Vulnerability of Private Health Information

A box divided into four equal sections depicts the vulnerability of private health information.

The P H I vulnerabilities are as follows. Unintentional breaches: Unsecured terminals; Loss of devices; Unsecured passwords. Outside attacks: Hackers; Worms, viruses, spam; Theft. Intentional breaches: Malicious insiders; Social media use; Unauthorized access. Network issues: Unencrypted transmissions; Firewall failure.

The distinction between secured and unsecured PHI is important because providers that experience a breach in the privacy or security of their PHI must adhere to certain notification requirements depending on the type of PHI affected by the breach. The HITECH Act enhanced the breach notification requirements of HIPAA. If the PHI is unsecured, the provider must take certain steps to notify those individuals who have been affected. Providers can avoid these onerous breach notification requirements if the PHI is secured in accordance with the specifications of HHS.

A breach is considered discovered as soon as an employee other than the individual who committed the breach knows or should have known of the breach, such as unauthorized access or even an unsuccessful attempt to access information. For example, if a nurse knows that a colleague has accessed or attempted to access the record of a patient for whom the colleague is not providing care, the nurse's employer is deemed to have discovered the breach as soon as the nurse learned of it. The discovery of a breach triggers the beginning of the time frame during which the provider must fulfill the notification requirements. A provider must fulfill these requirements within a reasonable period; under no circumstances may a provider take more than 60 days from discovery of the breach. It is easy to understand why providers require their employees to report knowledge of such breaches immediately to the privacy or information security officer. A provider's failure to adhere to the breach notification requirements could result in OCR sanctions, including monetary penalties.

Whenever a breach involves unsecured PHI, covered entities are responsible for alerting each affected individual by mail or email, based on the individual's preference. If there is insufficient contact information for 10 or more patients, the provider is required to place conspicuous postings on the home page of its website or in major print or broadcast media (without identifying patients). A toll-free number must be provided so that affected individuals can call for information about the breach. For breaches involving unsecured PHI of more than 500 individuals, a prominent media outlet must also be notified. Notice of a breach must be given to HHS within 60 calendar days of the discovery (HHS, 2015). It is easy to see why providers would want to avoid these requirements by making sure that their PHI is secured. Having to post such notices undermines the trust that exists between healthcare providers and the patients and communities they serve.

The HITECH Act has improved the privacy and security of PHI by applying the requirements of HIPAA directly to the business associates of covered entities. In the past, it was up to the covered entity to enter into contracts with its business associates to ensure compliance with HIPAA. Now business associates are responsible for their own compliance. An example of such a business associate is a health IT company hired by a hospital to implement or upgrade an EHR system. The technology company has access to the hospital's EHR system and must comply with the HIPAA Privacy and Security Rules, just as covered entities must comply with these rules, which includes being subject to enforcement by the OCR for any violations.

Existing accounting rules are enhanced under the HITECH Act, giving patients the right to access their EHR and receive an accounting of all disclosures. Before the HITECH Act, HIPAA regulations provided an exception to the accounting requirements. Providers and other covered entities were not required to include in the accounting any disclosures that were made to facilitate treatment/payment/operations (TPO)-treatment of patients, the payment for services, or the operations of the entity-a provision commonly known as the TPO exception. This exception ended in January 2011 for providers that recently implemented new EHR systems. For those providers with EHR systems that were implemented before the HITECH Act, the TPO exception ended in January 2014. It is easy to understand why this exception has ended. As all providers implement comprehensive EHR systems, it will be very easy to generate an electronic record with an accounting of anyone who accessed a patient's record.

Finally, the HITECH Act strengthened the enforcement of HIPAA. HHS can conduct audits, which will be even easier to accomplish once a nationwide health IT infrastructure is in place. In addition, stiffer civil monetary penalties (CMPs) for violations of HIPAA became effective as soon as the HITECH Act became law in February 2009. They were revised in 2019 to reduce the maximum penalty for Tiers 1 through 3. CMPs are divided into four tiers. A Tier 1 CMP, in which the covered entity had no reason to know of a violation, is $100 per incident, up to a cap of $25,000 per year. A Tier 2 CMP, in which the covered entity had reasonable cause to know of a violation, is $1,000 per incident, up to a cap of $100,000 per year. A Tier 3 CMP, in which the covered entity engaged in willful neglect that resulted in a breach, is $10,000 per incident, up to a cap of $250,000 per year. In addition, the HITECH Act gives authority to impose an additional Tier 4 CMP of $50,000 to $1.5 million if the covered entity does not properly correct a violation. Criminal penalties also can be imposed when warranted. It is imperative that providers avoid these penalties (HHS, 2019). The HIPAA Journal (2023b) notes that the OCR has discretion when applying penalties and that the actual dollar amounts change yearly with inflation.

Before enactment of the HITECH Act, the federal government alone enforced HIPAA. Now state attorneys general can play a significant role in the enforcement and prosecution of HIPAA violations. Once the HITECH Act became law, state attorneys general were authorized to pursue civil claims for HIPAA violations and collect up to $25,000 plus attorneys' fees. As of 2012, individuals who are damaged by such violations became eligible to share in any monetary awards obtained by these state officials. For very specific and current HIPAA information, see www.hhs.gov/hipaa/index.html.

Interestingly, during the COVID-19 pandemic, the Secretary of Health and Human Services issued a limited waiver of HIPAA sanctions and penalties in response to the declaration of a national emergency. Read here the bulletin detailing HIPAA requirements and limited sanctions during a national emergency: www.hhs.gov/sites/default/files/hipaa-and-covid-19-limited-hipaa-waiver-bulletin-508.pdf.

Being Involved and Staying Informed

The development and implementation of a nationwide EHR system holds great promise for nursing practice and NI. The profession of nursing will benefit from the many enhancements such an infrastructure has to offer, including the ability to improve the delivery and quality of nursing care, making more efficient and timely nursing care decisions for patients, avoiding errors that may harm patients, and promoting health and wellness for the patients whom nurses serve. On a broader scale, nurse researchers will have the ability to more readily access data that can be used to continue to foster evidence-based practice. For those who devote their professional careers to NI or plan to do so, the opportunities abound. Much work remains to be done as this country transitions to a nationwide health IT infrastructure.

All nurses need to be engaged in this process, whether they treat patients, are managers within healthcare organizations, teach, develop computer programs, or help create institutional or governmental policies. Nurses, as the end users of developing technologies, cannot afford to be left behind in these exciting times. Their voices must be heard, whether within the facility in which they work as changes to the EHR system are contemplated or in the public policy arena. How often are nurses the last to know that a new EHR system has been adopted by their hospital? How many times have nurses been trained to use a system that would have benefited from their input before it was implemented or even purchased? Often, nurses are not invited to the table when entities make decisions about informatics. They should not be afraid to ask to be included, whether to be heard within the workplace or within the governmental agencies that are overseeing the changes that are taking place.

Even nurses who do not get involved in this process need to stay current with the rapid changes that are taking place. Information about federal initiatives is available from the ONC and the OCR. Both offices are housed within HHS and are excellent resources for additional information about the HITECH Act and HIPAA. Regulations to implement the HITECH Act and enhance the HIPAA protections required by it are being proposed and adopted at a rapid pace.