WHO GETS THE CHANGE BLAME? Hundreds of providers are lobbying HHS to be exempted from reporting data breaches in the Change Healthcare cyberattack — though one cybersecurity expert says letting them “off the hook” could set a precedent. Provider groups — including the American Medical Association, the College of Healthcare Information Management Executives and the American Health Information Management Association — wrote to HHS and the Office for Civil Rights earlier this week to request clarity on who is responsible for reporting breaches of personal health information to federal officials and individuals whose data was breached. Federal law mandates that entities covered under HIPAA report breaches within 60 days of the breach’s discovery. According to the provider groups, this is Change’s responsibility, not theirs. Cybercriminals attacked Change Healthcare, a large medical bill clearing house, in February, disrupting provider payments. UnitedHealth Group, which owns Change, has offered to notify affected patients on behalf of providers. A spokesperson for UnitedHealth pointed Pulse to testimony by the company’s CEO, Andrew Witty, earlier this month when he told Congress that United is “working closely with HHS’s Office [for] Civil Rights to make sure our notice is effective, useful and complies with the law.” In April, OCR wrote in an FAQ after the attack that the covered entity — Change wasn't named — is “ultimately responsible for ensuring individuals are notified” but “may delegate the responsibility of providing individual notices” to their business associates, which could include providers. Providers are concerned OCR’s language is too ambiguous. “The worry is that this is going to fall to the providers to have to report the breach. … This would be incredibly burdensome to have to do,” Mari Savickis, vice president of public policy at CHIME, told Pulse. While Savickis said she hasn’t heard of providers being asked to provide notice, “we really need OCR to step in,” she said. “If there’s another big attack, we can point back to [OCR’s guidance],” she said. Toby Gouker, a chief security officer at First Health Advisory, which provides cybersecurity consulting to the industry, told Pulse that OCR’s guidance suggests that Change Healthcare and the providers affected by the attack are business associates — which creates a gray zone of responsibility. “If [Change] is a business associate of a hospital, then the hospital itself is responsible for everything,” Gouker said. Why it matters: Shifting the responsibility for breach notifications on one entity like Change — as providers want — “is a big deal in health care because there are going to be many more situations” like this, Gouker said, especially as federal authorities warn of foreign entities specifically targeting the health care sector. “This clears up a definition of who is responsible,” he said, setting a precedent that providers can refer back to after future attacks, which could keep them from taking on escalating fines if they fail to report a breach. “A lawyer [for a hospital] could say, ‘Hey, you let them off the hook,’” Gouker added. OCR referred Pulse to its earlier guidance on the Change attack when asked about the letter. WELCOME TO WEDNESDAY PULSE. Our health team has very different opinions on their favorite (and least favorite) places to work in the U.S. Capitol. For me, it’s wherever is closest to &pizza. Send your tips, scoops and feedback to ccirruzzo@politico.com and bleonard@politico.com and follow along @ChelseaCirruzzo and @_BenLeonard_.
| 
Comments
Post a Comment