The State of HIPAA Privacy and Security Compliance, 2006

April 2006

Print version

Contents

Executive Summary
Survey Results and Analysis
Conclusion

Contributors: Jill Callahan Dennis, JD, RHIA, Meg Featheringham, Susan Fenton, MBA, RHIA, Sue Fiorio, Kevin Gould, Scott Mackenzie, Cindy Nichols, RHIA, CHP, Mark Piszczor, Dan Rode, MBA, FHFMA, Anne Zender, MA

Executive Summary

About the 2006 Survey

For the past three years, the American Health Information Management Association (AHIMA) has surveyed healthcare privacy officers and others whose jobs relate to the HIPAA privacy function to gain an understanding of where healthcare organizations stand with regard to implementing the privacy and security rules of the Health Insurance Portability and Accountability Act (HIPAA). The first survey results were released in April 2004, one year after the implementation of the final privacy rule. In 2005, the second annual survey looked at compliance with the privacy rule and the security rule, which went into effect on April 21, 2005.

This third annual survey revisits these areas to assess how well the industry is maintaining HIPAA privacy and security compliance as a part of the normal course of business as it moves further away from the implementation deadlines.

AHIMA intends the results of the survey will reinforce the importance of protecting the privacy, confidentiality, and security of personal health information. It also intends to help the industry understand the most difficult areas of privacy and security implementation that may need more study.

Sixty-four percent of respondents to the 2006 survey work in a hospital setting and the remaining 36 percent in integrated healthcare delivery systems. Of the 1,117 survey respondents, 40 percent are designated privacy or security officers, with another 9 percent functioning as the privacy or security officer without the official title. Thirty-two percent indicated they serve on HIPAA privacy or security teams or committees.

Findings

The majority of facilities continue to be essentially compliant with HIPAA privacy and security regulations. Nearly 39 percent of hospitals and health systems report full privacy compliance, holding steady with last year’s 40 percent and a considerable increase over 2004’s 23 percent. Unfortunately, the number of those who believe that they are more than 85 percent compliant with the privacy regulations has dropped in the last year. The percentage of respondents who believed their institution was more than 85 percent compliant dropped to 85 percent in 2006, down from 91 percent in 2005. As a result, the percent of respondents who believed they were less than 85 percent compliant increased from 9 percent in 2005 to 15 percent in 2006.

Responses to other questions give insight into this slight decrease and show that while it is not a significant change, it is enough to raise concern. For example, fifty-five percent of respondents indicated that resources are their most significant barrier to full privacy compliance. Privacy officers particularly need support for education and training of new staff, while a lack of resources and competing priorities have led some hospital and health system staff to slack off regarding all aspects of the privacy rule. The issue of budget also appears to impact the level of privacy training and monitoring that a privacy officer or staff are capable of providing. Finally, privacy officers report sensing a loss of support from senior management, both in ensuring the facility staff is aware of the need for privacy as well as ensuring sufficient budgeting for education.

After three years, most providers are growing accustomed to the various provisions of the privacy rule, but there are still reports of difficulties with a select few requirements, notably accounting for disclosures. Not surprisingly, many respondents would like to see changes in the accounting for disclosures provision of the privacy rule. This is especially true where the demand for such accounting is extremely low. Most commonly, respondents had received only a few requests for an accounting or none at all (64 percent of all respondents reported receiving no requests). For many, this provision is not only burdensome but also significantly inefficient.

One year into the HIPAA security regulations, a quarter of the surveyed facilities indicate compliance at the top level with another 50 percent indicating that they are close to full compliance. This represents an increase over 2005, when 17 percent of all respondents described themselves as “completely compliant,” and 43 percent described themselves as 85 to 95 percent compliant. It appears that the security regulations were much easier to achieve than the privacy rules.

Some consumers are becoming more aware of the importance of the privacy of health information, as evidenced by the increased number of questions providers report being asked by patients. More disturbingly, 22 percent reported encountering consumers who refused to sign release of information forms. More research is needed to understand how deep those fears are or what consumers are most worried about. Clearly the industry now has an opportunity to educate consumers on how their personal health information will (or should be) protected. This is an important step. Without consumer confidence the national health information network will never succeed.

Just under a third (31 percent) of respondents indicated that they were currently involved in a local or regional health information exchange project. For those involved in health information exchanges, it appears that HIM professionals are addressing release of information, privacy, and security areas, with authentication being one of the main security issues being investigated.

Conclusion

Three years after the implementation of the HIPAA privacy rule, the AHIMA survey concludes the following:

HIPAA implementation has been a challenge for organizations, and it appears that for the majority the challenge has been met. However, the need for privacy, confidentiality, and security remain, especially as organizations tighten staffing and budgets. A slight drop in the number of facilities reporting themselves to be fully or mostly compliant with HIPAA should serve as a warning to the industry that compliance should not be taken for granted.

If the support for privacy and security and the need for ongoing training are not maintained (and, in a few areas, increased), all the work that has been put into the HIPAA compliance efforts of the last few years may be undone over time.

The need for support of privacy and security must also reach beyond facilities. The federal government’s approach to HIPAA enforcement has been to educate rather than fine or prosecute offenders. While we applaud this approach, a concerted effort to educate and remind the healthcare industry and others of the need to maintain and continually improve privacy efforts is equally needed.

The healthcare industry has much to learn from the lessons of HIPAA as it moves toward electronic health records and a nationwide health information network. There is considerable disagreement on whether electronic health records will improve privacy or security and there are many concerns on how information networks will protect data. Consumers will be watching the healthcare industry to see how well it complies with the HIPAA rules before they put their trust in a national health information exchange. Communicating with consumers, answering their questions and addressing their concerns, may be a key to advancing health information exchange activities. Privacy officers and HIM professionals will be important partners in this process. AHIMA believes that the time is right for an open dialogue about the value of privacy and security at both the national and organizational levels.

Survey Results and Analysis

About the 2006 Survey

For the past three years, the American Health Information Management Association (AHIMA) has surveyed healthcare privacy officers and others whose jobs relate to the HIPAA privacy function to gain an understanding of where healthcare organizations stand with regard to implementing the privacy and security rules of the Health Insurance Portability and Accountability Act (HIPAA). The first survey results were released in April 2004, one year after the implementation of the final privacy rule. In 2005, the second annual survey looked at compliance with the privacy rule and the security rule, which went into effect on April 21, 2005.

This third annual survey revisits these areas to assess how well the industry is maintaining HIPAA privacy and security compliance as a part of the normal course of business as it moves further away from the implementation deadlines.

AHIMA intends the results of the survey will reinforce the importance of protecting the privacy, confidentiality, and security of personal health information. It also intends to help the industry understand the most areas of privacy and security implementation that may need more study. The findings are particularly significant in light of the research currently being conducted by the Health Information Security and Privacy Collaboration (HISPC) at the behest of the Office of the National Coordinator for Health Information Technology (ONC). HISPC is working with state governments to assess and develop plans to address variations in policies and business practices that affect privacy and security. The goal is to address barriers to interoperable health information exchange.

AHIMA conducted the survey in January 2006, with the assistance of an impartial third-party market research firm. E-mail invitations were sent to AHIMA members who were considered most likely to have participated significantly in the HIPAA implementation process and others who had participated in various HIPAA-related educational opportunities provided by AHIMA. The survey received 1,117 qualified responses.

AHIMA has a long history of protecting health records and information that dates back to the founding of the association in the 1920s. For more than 75 years, AHIMA has taken on this charge in a number of different healthcare settings. In many cases, AHIMA members have been charged with the HIPAA privacy and security mandates.

With this survey AHIMA seeks to educate the public and the industry on issues related to HIPAA privacy and security that have been and will need to be addressed. The goal is to maintain and increase public trust in a healthcare system that needs to maintain and protect personal health information to provide maximum benefits to its patients.

Respondents

Of the total 1,117 respondents, 40 percent were designated as either the privacy or security officer for their organization. Another 9 percent indicated that they were functioning as the privacy or security officer but without the formal title–most likely because they held the position part time or in combination with other duties. Thirty-two percent indicated that they served on a HIPAA privacy or security team or committee while 18 percent answered “other.” AHIMA is aware that a number of HIM department directors or assistants often take on the privacy officer role because they have expertise in the area. It appears, therefore, that 49 percent of all respondents were directly involved in the privacy or security functions of their organization.

Types of Facilities

In 2006, 64 percent of survey respondents said they work in a hospital setting; the remaining 36 percent work in integrated healthcare delivery systems. For the purposes of this survey, respondents are categorized by numbers of admissions/discharges (A/D) during the last calendar year (as reported by the respondents). The categories are:

• More than 50,000 A/D (5 percent of respondents)
• 20,000-49,999 A/D (10 percent)
• 10,000-19,999 A/D (13 percent)
• 5,000-9,999 A/D (21 percent)
• 2,000-4,999 A/D (22 percent)
• Fewer than 2,000 A/D (28 percent)

Privacy: Who’s in Charge?

When asked whether their facility has a privacy officer, 27 percent of all respondents had a full-time officer, while 61 percent had a part-time officer. Consistent with other years, this survey finds that a breakdown by admissions and discharges shows that the larger a facility is, the more likely it is to have a full-time privacy officer.

Even then, however, the largest reporting group indicates only 52 percent have a full-time officer, while in the smallest group almost 30 percent have a full-time privacy officer. Privacy officer employment levels seem to be stable. A large majority of total respondents (85 percent) indicate that the part-time or full-time status of their privacy officer has not changed in the last year.

A small number of facilities (2 percent) still report having no privacy officer at all. Nine percent say they do not know-a cause for concern, as the privacy rule requires that a covered entity designate a privacy official.

How busy a part-time privacy officer might be apparently depends on facility size. Facilities with fewer than 5,000 admissions/discharges a year indicated that about 61 percent of their part-time privacy officers spend less than 25 percent of their total time dealing with privacy issues, while very large facilities indicate that more than 26 percent of their part-time officers spend more than 50 percent of their time engaged in privacy matters.

Another question asked whether the respondents’ facility had a committee or task force related to privacy. Sixty-four percent of respondents said that they did, a 17 percent drop since 2005, and a 25 percent drop since 2004. Eighty-eight percent of facilities with the highest number of admissions/discharges reported having such a committee.

In written comments, many respondents noted a lack of resources (time, education budget, and in some cases staff) to complete what they now view as additional duties associated with the privacy rule. Respondents reported that employment shortages resulting in a busier work force and higher staff turnover add a burden to educate new employees and keep up education and reminders for existing staff. Similarly, for a second year, many felt that their lack of time and to some extent resources could mean that their institution’s commitment to the privacy compliance process has diminished.

Privacy: How Compliant Are We?

Respondents were asked: “In your opinion, how compliant is your facility with the HIPAA privacy requirements?”

In 2006, 39 percent of respondents reported that they were fully compliant, compared to 40 percent in 2005 and 23 percent in 2004. While the difference between 2005 and 2006 is not statistically significant, a larger drop is seen in the number of respondents reporting that they were 85 percent compliant. Overall, 85 percent of all respondents reported being 85 percent or more compliant this year, compared to 91 percent in 2005. As a result, the percent of respondents who believed they were less than 85 percent compliant increased from 9 percent in 2005 to 15 percent in 2006. This drop in perceived levels of compliance is spread across organizations of all sizes and appears to correspond with many comments indicating that some organizations’ emphasis on and support for HIPAA privacy programs has diminished. Respondents report needing more staff, time, ongoing education programs, and support from organization administrators and medical staff leadership.

Two years after the compliance deadline for hospitals and health plans, only 1 percent of respondents indicate that they are less than 50 percent compliant. In 2005, 4 percent of respondents indicated they were less than 50 percent compliant, compared to 7 percent in 2004.

Difficulties with HIPAA Privacy Requirements

The survey asked whether respondents were having difficulties implementing and enforcing specific provisions of the privacy rule. As in 2005, most respondents reported no or only slight difficulties with most of the requirements. However, in some areas respondents reported moderate or extreme difficulties.

Under HIPAA, individuals have the right to ask for an accounting of all disclosures of protected health information for purposes other than treatment, payment, or healthcare operations. As found in previous surveys, this requirement was the most significant issue for respondents, with 15 percent indicating that it was moderately to extremely difficult. Although AHIMA, the American Hospital Association, and others have asked for changes to this requirement, none are expected in the near future. In 2006, larger organizations most frequently report difficulty with this requirement.

Ten percent of respondents identified confusion by individuals/patients in understanding the notice of privacy practices as a problem. Such recognition of patient confusion might also be the reason more than 55 percent of respondents say they have changed their notice (see below).

In 2006, 10 percent of respondents reported difficulty obtaining protected health information from other providers. Anecdotes indicate that the problem may be particularly acute for schools (because of conflicting state and federal Department of Education laws and regulations) and for individual practices that do not understand their options under HIPAA. This is an area where the Office of the National Coordinator on Health Information Technology’s study on privacy may be able to shed additional light.

Access and release of information to patients’ relatives or significant others is a problem for 9 percent of the respondents. The reasons why are numerous. Respondents note that identifying a patient’s personal representative can be complex, as can various laws associated with durable power of attorney. Others note that getting patients, relatives or significant others, institutions, and laws to all agree is often difficult.

It appears that even after three years, business associate agreements continue to cause difficulty for healthcare providers. Nine percent of respondents indicated moderate to extreme difficulty with this requirement. As noted in previous surveys, larger providers likely have more potential business associate agreements, leading to problems of volume as well as complexity. Smaller facilities may have fewer business associate agreements but have also fewer staff and less time to manage and monitor these agreements.

Access and release of information to law enforcement was identified as a problem by 8 percent of respondents. We know from a variety of discussions that multiple jurisdictions, including state and federal, remain problems along with the need to educate law enforcement about HIPAA and state and local restrictions. This area could benefit from HISPC’s study.

Seven percent of respondents indicated moderate to extreme difficulty with access and release of information for subpoenas versus court orders. We noted in 2005 that many problems with subpoenas and court orders occur because attorneys and courts continue to be unaware of HIPAA regulations or rely on state rules inappropriately. This may indicate that other professions, such as law enforcement, appear to be paying less attention to HIPAA, especially in locations where HIPAA education for non-healthcare entities was not available.

Confusion related to information being released for research protocols continues. It is clear this issue has not been resolved at a federal level between human subject protection regulations and HIPAA. While overall 5 percent of respondents indicated moderate to extreme difficulty with the requirement, most of the difficulties exist in larger institutions where more research occurs. However, respondents from the largest organizations may report fewer difficulties than the next largest group because most large teaching-tertiary facilities and systems have specific staff managing research protocols.

The survey asked, “Which areas of the HIPAA privacy rule do you believe need to be modified by the federal government?” Responses to this question vary according to the size of the facility. The following were identified by 15 percent or more of respondents as problems needing modification:

• Accounting for disclosures (29 percent)
• Access and release of information to relatives or significant others (20 percent)
• Post-care disclosure to patients (16 percent)
• Release of information to law enforcement (16 percent)
• Subpoenas and court orders (15 percent)

As in previous years, accounting for disclosures remains a top issue for all organizations. It must again be noted that the data show that the number of requests for an accounting is very small (see Privacy Provisions: Handling Consents and Requests), but responding to any requests requires a considerable amount of administrative work.

Other Privacy Concerns

The survey asked respondents to identify the number one barrier to their facility’s ability to be in full compliance with the HIPAA privacy requirements. Resources topped the list from 55 percent of respondents, with 24 percent citing administrative support and 6 percent citing state preemption situations. The remaining 10 percent appeared to have responses that could be easily categorized into the resource and support categories. Only 3 percent of respondents indicated that there were no barriers at present.

As AHIMA noted in its 2005 report, the need for resources and support is increasingly mentioned. Resources are often translated into more staff or more time for privacy activities, including monitoring and correcting problems. Education remains a top priority, and many report the challenge of expanding education of new employees and retraining existing employees with limited resources.

Administrative support goes hand in hand with this issue. Without significant support, privacy officers or committees have difficulties securing budget or resources to achieve full compliance. Administrative support either from executives or clinical leadership is also directly tied to the attitude employees take toward promoting and incorporating privacy practices in their daily functions. Without this support, reports of slippage in daily practices may grow more prevalent.

Since the implementation of the privacy rule in 2003, the number of external or nationwide educational programs on privacy has reduced significantly. Emphasis on the need for good privacy practices has also decreased, so it is possible that administrators or clinical leaders believe maintaining and improving privacy practices is less of a priority. From comments made by the respondents, it appears that many privacy officers are doing their best, but their calls for more support and resources are going unheard. This may be why organizations report feeling that they are less compliant than they were.

The Impact of State Pre-emption

The 2006 data show a small decrease in the number of respondents who say that the impact of the HIPAA allowance for state pre-emption has caused difficulties, as indicated by 22 percent of the respondents, compared to 25 percent in 2005. The categories representing larger groups may be more likely to experience problems as they include systems that are in more than one state. Some pre-emption issues relate more to where a facility is located and where its patients live than to size. In either case, developers of regional or national health networks that cross state borders should be aware of this statistic, and it will certainly be of interest to HISPC.

As a follow-up to this question, the survey asked respondents to identify the areas causing them the most problems. The top five answers from respondents were:

• Release of information to relatives or significant others (28 percent)
• Release of information to law enforcement (27 percent)
• Release pursuant to subpoena/court order (26 percent)
• Release related to state requirements for consents (25 percent)
• Release of information to patients (22 percent)

As time goes by, it may be that providers are reporting fewer problems because they are more comfortable with the rules. Consent requirements have changed in some states, so differences with HIPAA may have been reduced. However, more than a quarter of respondents continue to experience difficulty in this area, and it continues to be a concern to many privacy groups seeking to remove the treatment, payment, and healthcare operations requirement from HIPAA. As noted in the 2005 survey results, about 50 percent of the states have a requirement for consent and many organizations have included consents even though they are optional under HIPAA. Issues with release of information to courts and law enforcement are no surprise since the conflicts in the state preemption often occur in these areas. Many state laws are written without considering exceptions for healthcare. Until conflicts in legal areas are examined and resolved (a subject for HISPC), problems will continue.

Pre-emption issues can also complicate release of information to patients and relatives. In 2005, providers in several states began to have problems charging for the cost of release of records. Part of this problem concerned states that have established rules with regard to who and what can be billed for this service. In several cases persons with a questionable relationship to the patient under HIPAA claimed they should not be charged because they were acting on behalf of the patients. This matter was recently resolved by the Office for Civil Rights, but it is too early to tell if there will be fewer problems associated with such releases. As mentioned in 2005, the identification of patient representatives also continues to create conflict between states and the HIPAA rules, and this may not be resolved until differences can be clearly defined.

Reactions to HIPAA Privacy

How are patients reacting to HIPAA privacy efforts? The survey asked some new questions designed to gauge patient reaction.

Consumer groups and healthcare policy makers have devoted considerable attention to this question. This year the survey referred to a recent report that noted that a high percentage of patients were concerned about privacy of their health records and asked, “How has that manifested itself in your facility?” Forty-seven percent of respondents said it was “not a problem.” Another 30 percent said they had encountered more questions from consumers. More disturbingly, 22 percent reported encountering more consumers who refused to sign release of information forms.

While HIM professionals are pleased that patients are asking more questions, it is not clear why they are asking them. Questions may be resulting from concerns related to the notice of privacy practices or other forms or from misunderstanding privacy issues. The survey does not shed light on why some individuals refuse to sign forms. Larger facilities seem to report more questions from consumers, while those at smaller facilities seem more likely to say that privacy concerns are not a problem.

Some consumers are becoming more aware of the importance of the privacy of health information. Certainly the increased discussion of electronic health records, a nationwide health information network, local networks, stolen or misplaced laptops, and identity theft are getting more attention and raising fears among some. It is not clear how deep those fears are or what consumers are most worried about. But clearly the industry now has an opportunity to educate consumers on how their personal health information will (or should) be protected as the health information environment changes. This is an important step. Without consumer confidence, the national health information network will never succeed.

More than 55 percent of all respondents indicate that their facilities have changed their privacy notices since April 2004, a considerable increase from 19 percent in 2005. This relatively high percentage is a sign that organizations are listening to the needs of their patients and making a good faith effort to maintain an accurate notice of privacy practices.

Most of the changes were made to clarify language and make the notice easier to understand. Often changes were caused by state law changes, telephone numbers, title changes, and so forth. Facilities could eliminate some of these changes by providing titles rather than names on their privacy notices.

14 HIPAA requires facilities have a process for handling complaints regarding its privacy practices. But some complaints are the result of misunderstandings rather than a violation of the rule. The survey asked if facilities had received any complaints regarding the HIPAA rule or their rights. A number of facilities reported complaints (57 percent). A breakdown shows:

The survey asked whether respondents believed the difference between federal HIPAA requirements and state laws caused any complaints. Responses varied by size.

In general, 42 percent of respondents reported that their facility’s staff was generally very supportive of initiatives related to patient privacy, with another 41 percent reporting staff were somewhat supportive. In 2006, 16 percent said that staff were indifferent or not supportive, compared to 18 percent in 2005.

Privacy Provisions: Handling Consents and Requests

As in previous years, the accounting for disclosures requirement is reported to be a difficult one and is most often mentioned as needing modification. AHIMA and other groups have sought a recommendation for such an amendment from the National Committee on Vital and Health Statistics and the Office for Civil Rights, but at this time no amendment is expected in the near future. The survey asked facilities to indicate how many requests for an accounting they have received in 2005 from all patients seen.

Most commonly, respondents had received only a few requests for an accounting or none at all (64 percent of all respondents reported receiving no requests). Of those reporting in total, only 2 percent of facilities report receiving a volume of more than 15, and when this is broken down by size only facilities with between 10,000 and 20,000

15 admissions reported a percentage higher (3 percent). Volume of requests varies widely among the range of respondents. AHIMA recommends that the disclosure requirement be replaced in part by amending the notice of privacy practices to alert patients to disclosures required by law. If such disclosures did not have to be included in an accounting (e.g., if patients were informed in the notice of the laws concerning such a release) it is likely the number of accountings for other purposes would go down.

The HIPAA regulation highlighted an individual’s right to request an amendment or correction to his or her healthcare record. The 2006 survey asked whether requests for amendment to the content of an individual’s record had changed since April 14, 2003. Thirty-three percent indicated that requests had stayed the same, while 22 percent indicated that they had received no requests. Only 18 percent reported an increase while 15 percent reported a decrease. A look at the breakdown by admissions gives no clear indication of any trend by size.

The survey also asked respondents to indicate the percentage of patients who requested information for amendments or corrections. Of all respondents 87 percent reported that 2 percent or fewer patients requested amendments, with 33 percent showing no requests for such information.

The HIPAA regulations let individuals know that they have the right to request a copy of their health information from covered entities. The 2006 survey asked: “Of the patients treated in your facility in the last year, what percentage of patients requested copies of their health information?” Eighteen percent reported that they had received no requests from patients in the last year. Twenty-three percent reported less than 5 percent had

16 requested copies, and 15 percent reported from 5 to 10 percent of their patients requested copies. At the other end of the spectrum, 11 percent of all respondents indicated that 25 percent or more patients requested copies.

Sixty-three percent of total respondents say they charge patients for copies of health information. Of these, 43 percent charge between $0 and $5 per page; few charge more, although a number of respondents answered “other” indicating that they may have a different charging scheme. As noted in previous years, charges vary considerably, as a number of states have regulations related to how much an institution can charge for such services and in some states hospitals can only charge for the actual copying, not for any clerical activities. Fifty-three percent report that their fee is governed by state regulation; 29 percent indicate there is a separate fee for non-patient representatives. This process is likely to change as electronic health records and personal health records evolve.

Security: The Next Challenge

The HIPAA security rule was in place for almost one year when the 2006 survey was taken. As in 2005, the survey asked if the facility had designated a security officer. This year, 100 percent of respondents indicated that their organization has a security officer, compared to 89 percent in 2005.

Why do so many more facilities have security officers than privacy officers? It may be that many organizations consider security an information technology function, so the role may have already existed in some form before HIPAA. Respondents were next asked to designate whether the security officer is full or part time. About two-thirds (65 percent) of respondents say the security officer role is a full-time one, compared to 57 percent in 2005.

A look at responses by facility size indicates larger facilities are slightly more likely to have a full-time position.

For those reporting a part-time director, 57 percent again indicated that the role was filled by an IT or information services employee. Only 4 percent reported that the privacy officer was also serving as the security officer. Ten percent of respondents indicated that an HIM professional held the part-time security officer role. The relatively high number of “other” responses continues to reflect small institutions’ need to share the load among administrators and individuals with skills in organization, auditing, and so forth.

The number of facilities that have a committee or task force related to security has decreased since 2005. In 2005 the figure for committees stood at 78 percent, but in 2006 the figure is 59 percent. The reasons why are not clear, but it may be that some of these duties have been assigned to a privacy committee or to the information technology department if the organization has completed its initial security review and adopted a security plan.

The number of respondents who believe their facilities are compliant with HIPAA security has increased. In 2006, 25 percent of respondents described themselves as completely compliant, and 50 percent described themselves as 85 to 95 percent compliant. This represents an increase over 2005, when 17 percent of all respondents described themselves as completely compliant, and 43 percent described themselves as 85 to 95 percent compliant. Clearly there is a high level of confidence in the industry that the security requirements have been met. This corresponds with the popular belief that the HIPAA security rule’s formula for compliance was easier to meet than that of the privacy rule, which has more external factors.

The results are also roughly consistent with facility size. More research is warranted to better understand trends among facilities by size.

The survey asked if people had recently upgraded their electronic software/application systems to comply with HIPAA security requirements. The results find that 54 percent have upgraded recently, while 46 percent have not. We have noted below the type of software involved for those that did upgrade. Interestingly, the largest and smallest facilities were more likely to have upgraded.

Firewalls, anti-virus software, and data back-up technologies were the most frequently updated.

Privacy, Security, and RHIOs

In light of the growth of health information exchange projects, health information networks, or regional health information organizations (RHIOs), the survey asked for the first time if respondents were involved in these efforts from a privacy and security standpoint. Thirty-one percent of respondents indicated they were involved in such a project. At this early stage, this statistic is not surprising; however, as individual organizations become more involved in RHIOs, we fully expect this number to increase.

Most of those respondents who are involved in RHIOs indicated that their role is related to privacy and/or security. Future research will attempt to get a better picture of RHIO involvement.

Privacy and Security Training: A Key Factor

Training and education have been important concerns for privacy officers and once again AHIMA asked respondents how they are training organization employees and volunteers.

The survey asked how facilities are handling privacy training for new employees. Sixty-four percent indicated that new employees are trained in-house by either the privacy officer or an education officer. It is clear from responses, however, that many facilities are using multiple forms of education depending on the situation and the size of the facility.

For ongoing training for current employees, training methods varied considerably. Department staff meetings, newsletter articles, and reminders topped the list.

Information on the Go: Outsourcing

Outsourcing continues to be an HIM issue in some areas of the country. Of those responding, 43 percent indicated that their organization is outsourcing in the area of health information management functions.

20 (The response is very similar to the 42 percent reported in 2005.) The practice of outsourcing appears to have a direct relationship to the size of the organization.

According to responses from those who outsource, transcription is most frequently outsourced, followed by release of information and coding. The survey did not ask if the functions were outsourced to companies out of state, out of the country, or just out of the facility. Again, results vary with facility size.

Outsourcing of protected health information requires a business associate contract, according to HIPAA. However, some outsourcing vendors in turn outsource their business, so it is possible that work might be given to firms overseas. This has been a concern to some state legislators, so the survey asked whether facilities’ business associate contracts address the use of subcontractors to offshore affiliates or companies. Forty-nine percent responded yes, while 30 percent indicated that their business associate agreements did not address this issue and 21 percent were not sure. In text responses, several respondents commented that they would be reexamining their agreements as a result of considering this question.

Conclusion

Three years after the implementation of the HIPAA privacy rule, the AHIMA survey concluded the following conclusions:

• The majority of facilities continue to be essentially compliant with HIPAA privacy and security regulations. Unfortunately, the number of those who believe that they are 85 percent or more compliant with privacy has dropped in the last year. Responses to other questions give insight into this slight decrease and show that while it is not a significant change, it is enough to raise concern.
• Barriers to full compliance such as a lack of resources and diminished administrative support should be addressed. For the second year in a row, respondents indicate they need more staff, time, ongoing education programs, and support from organization and medical staff leaders. Responses to questions and comments indicate that there is not enough time available to do the education that privacy officers feel is needed, and as a consequence they are noticing that some old habits are creeping back. This concern does not appear to be reflected in patient complaints, but it is clear that staff at all levels need to be continually reminded of the need to maintain privacy. The issue of budget also appears to impact the level of privacy training and monitoring that a privacy officer or staff are capable of providing. Finally, privacy officers report sensing a loss of support from senior management, both in ensuring the facility staff is aware of the need for privacy as well as ensuring sufficient budgeting for education.
• After three years, most providers are growing accustomed to the various provisions of the privacy rule, but there are still reports of difficulties with a select few requirements.
• Not surprisingly, many respondents would like to see changes in the accounting for disclosures provision of the privacy rule. Most commonly, respondents had received only a few requests for an accounting or none at all. For many, this provision is not only burdensome but also significantly inefficient. This problem could be easily addressed while ensuring that individuals would have an accounting for all releases not covered by authorization or law.
• It appears that the security regulations were much easier to achieve than the privacy rule. One year into the HIPAA security regulations, a quarter of the surveyed facilities reporting indicate compliance at the top level with another 50 percent indicating that they are close to full compliance.
• Some consumers are becoming more aware of the importance of the privacy of health information, as evidenced by the increased number of questions providers report being asked by patients. More disturbingly, nearly a quarter reported encountering consumers who refused to sign release of information forms. More research is needed to understand how deep those fears are or what consumers are most worried about. Clearly the industry now has an opportunity to educate consumers on how their personal health information will (or should) be protected. This is an important step. Without consumer confidence the national health information network will never succeed.

HIPAA implementation has been a challenge for organizations, and it appears that for the majority the challenge has been met. However, the need for privacy, confidentiality, and security remain, especially as organizations tighten staffing and budgets. A slight drop in the number of facilities reporting themselves to be fully or mostly compliant with HIPAA should serve as a warning to the industry that compliance should not be taken for granted.

If the support for privacy and security and the need for ongoing training are not maintained (and, in a few areas, increased), all the work that has been put into the HIPAA compliance efforts of the last few years may be undone over time.

The need for support of privacy and security must also reach beyond facilities. The federal government’s approach to HIPAA enforcement has been to educate rather than fine or prosecute offenders. While we applaud this approach, a concerted effort to educate and remind the healthcare industry and others of the need to maintain and continually improve privacy efforts is equally needed.

The healthcare industry has much to learn from the lessons of HIPAA as it moves toward electronic health records and a nationwide health information network. There is considerable disagreement on whether electronic health records will improve privacy or security and there are many concerns on how information networks will protect data. Consumers will be watching the healthcare industry to see how well it complies with the HIPAA rules before they put their trust in a national health information exchange. Communicating with consumers, answering their questions and addressing their concerns, may be a key to advancing health information exchange activities. Privacy officers and HIM professionals will be important partners in this process. AHIMA believes that the time is right for an open dialogue about the value of privacy and security at both the national and organizational levels.