Electronic Data Records Law | How to Win E-Discovery

Health-care Data Tracking | Electronic Health Record (EHR)

HIPAA Security Rule Expanded

Patient Data: Account for Access-Disclosure

IT Logs, Control, Meta-data, Audit Trails

Congress imposed a demanding new data security regime on all healthcare organizations.  Congress more or less expects the industry (hospitals, doctors’ offices, insurance companies and more) to track and account for each and every access of electronic patient information.  Each time someone accesses data, the organization needs a record (a log entry) of it. 

Although Congress did not express this expectation in a single, concise statement, it effectively said it in four steps.  The four steps are part of the American Recovery and Reinvestment Act, known as Health Information Technology for Economic and Clinical Health Act or HITECH. 

To comply with HITECH’s four steps, the maintenance and review of logs and audit trails will not be the only procedures “covered entities” should adopt.  Employee training will be important, too.  But as a practical matter application-layer logs and audit trails showing on a historical basis who accessed which information will be critical to compliance.

Data Sharing vs. Restraint of Data Sharing

Before I describe the four steps, we need to see the big picture.  Like other industries, the healthcare community today makes great use of information technology (computers).  Although many personal health records are still on paper, computer systems are already ubiquitous in clinics, hospitals, doctors’ offices and insurance companies.  Email and other electronic data collection and exchange are common.  Loads of patient information already get into e-mail today, whether intentionally or otherwise.

If there is one thing that information technology excels at, it the sharing information.  And the capacity for computers to promote information sharing is good because sharing is critical to the delivery and administration of healthcare.  The industry already engages in extensive sharing and collaboration by way of computer technology, and this sharing/collaboration is increasing rapidly, as it is in other industries.  Lots of doctors carry BlackBerries or iPhones, for example.

So here’s the big picture conflict:  computers are about sharing data; HITECH is about data restraint and accountability.  The essence of HITECH’s four steps is that health entities must install lots of fine-granular controls to monitor, regulate or prevent the sharing of data.  Technology is enabling easy sharing; HITECH says we need to throttle it.

HITECH’s Four Steps

So what are the four steps?

First, under Section 13402 of the Act, if a healthcare “covered entity” discovers that a patient’s unsecured data is accessed without authority, then the entity must notify the patient. How is this requirement to be satisfied in practice? Although the keeping and auditing of logs are not the only way, logs are very important tools. 

Second, under Section 13405(c) a patient will have the right to receive from a covered entity an accounting, dating back three years, of disclosures of her protected information to anyone outside the entity.  A disclosure could include the sharing of information among health care entities for treatment, payment or health operations.  In other words, it could cover the exchange of treatment information from one doctor to another doctor who is not employed by the same entity as the first doctor – a very common event!

This accounting requirement only applies to electronic information, not paper.  It applies to any “electronic health record,” which HITECH expansively defines as electronic information about a person’s health, used by health care clinicians.  (Section 13400(5))  This could include lots of day-to-day internal email in a clinic, a hospital or a doctor’s office – or external e-mail among multiple health care providers. It could also include lots of miscellaneous e-records in medical devices and equipment, which are not normally considered part of a records management program.  The scope of what HITECH covers here is breathtakingly broad!  [Update June 2011:  The Department of Health and Human Services' publication of a proposed rule to implement Section 13405(c) has generated controversy.]

As a practical matter of compliance, this step number two will require extensive logs and audit trails showing who accessed which information and when.

Third, under Section 13405(a) a patient can request that a covered entity not disclose certain information to a “health plan.”  The delivery and administration of healthcare can be a very complex undertaking.  Compliance with a patient request to allow X information to be disclosed but not Y information is difficult.  Compliance will involve real attention and review.  Again, healthcare players are going to need to implement information controls that include application-layer logs and audit trails so that this kind of patient request can be enforced and employee actions can be reviewed after the fact.

Fourth, under Section 13405(b) a covered entity that uses patient information or discloses it to another covered entity must (if the purpose is for something other than treatment) limit the information to what is necessary for the purpose.  Again, this is a very subtle requirement.  Effective compliance requires a lot of human attention, supervision and after-the-fact review.

Interpretation

These four steps are not separate ideas.  They need to be viewed in the aggregate.  In any organization, perfect compliance with the HITECH’s four steps will be really hard to achieve and sustain.

Implications:

1.  Healthcare organizations need to be archiving email (and other e-messages such as text) for generous periods of time.  Archival allows later review of which patient information was delivered to which person (not to mention other operational functions, such as review of who was consulted on a particular matter, at which time, and so on).

2.  Any healthcare e-mail archive application needs to support audit trails that show who accessed which particular e-mail archive record at which time.

3.  For other collaboration systems (non-email), healthcare firms will similarly need access logs and audit trails.

The concept of health-care covered entities maintaining audit logs is not new.  The existing HIPAA Security Rule already requires that covered entities, “Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” (See Footnote.)  But as written that rule does not require the implementation of logs.  HITECH adds urgency to such implementation.

Comments invited!

Update April 2011: A healthcare group has pointed out that healthcare providers store eletronic patient information in many places other than just qualified electronic health records.  (See step number 2 in the blog post above, which I originally wrote in August 2009.)  A requirement that a provider account to patients for every access made to their data, in the past three years, wherever it may be stored in electronic form will be very burdensome, according to Medical Group Management Association.

–-Benjamin Wright, Senior Instructor on cyber defense law at the SANS Institute.
 

Footnote:  Data access audit trails are already part of other medical privacy law. New Mexico's Electronic Medical Records Act, SB 278, for instance, requires a "record locator service" (a kind of clearinghouse for health records) to maintain detailed audit logs on the access of patient information.

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Medical Technology Regulation

Telemedicine Licensure and Data Security

Technology perennially introduces problems for compliance with law and regulation.  But often technology can help alleviate those problems by fostering transparency and accountability.

Take for instance telemedicine, a promising family of technologies for making healthcare more affordable and accessible. Telemedicine allows, for example, a geographically remote physician to examine and treat a patient.  It can do wonders for a patient in a rural clinic who needs attention from a specialist in a distant city.  But telemedicine raises medical license issues for a physician in, say, Illinois who is treating a patient in Wyoming.  If the Illinois specialist must become licensed in each state where her patients happen to be at the time she delivers care, then red tape will impede her practice of telemedicine.

Telemedicine also raises data security issues.  On the Internet, data security law is bewilderingly confusing because authorities have recently issued a cacophony of new and very demanding laws, regulations and standards.  Often these rules are poorly written and reflect expectations that are unrealistic in our networked society.  Assorted guidance like HIPAA, state privacy regulations, breach notification laws, "20 Critical Security Controls", PCI-DSS and others purport to tell us how to protect data that might be involved in a telemedicine transaction.  But full, strict compliance with all these requirements is sparse if not impossible in the real world, as demonstrated by the daily parade of stories about how private data has leaked out of hospitals, corporations, universities, government agencies (federal, state, local and foreign) and every other organization under the sun.

So do these legal problems mean telemedicine is doomed?  No.  Just as Internet technology looks like a dark cloud to anyone seeking literal compliance with all applicable laws, information technology itself provides a silver lining.  Technology engenders the transparency and accountability that are favored in law.

The Internet allows a practitioner of telemedicine to explain to regulators – and to prospective patients – what she is doing, the value of it and the risks associated with it.  It enables the specialist doctor in Illinois to publicize, via web postings, how she is helping patients

in numerous other states, how she is taking rational steps (such as involving local doctors) to avoid or limit any medical injury in target states, and how she is endeavoring (albeit imperfectly) to protect private data.  Through the Internet, she can invite any regulators or members of the public who have reservations or constructive suggestions about her activities to contact her and discuss.

IT further allows the specialist's telemedicine system to store copious, detailed records of what care was provided, when and how, including the good faith methods used to minimize any unlicensed practice of medicine and to safeguard the patient’s private data.  Good records could even include full recordings of interactive videoconferences between patient and doctor.  Good records are the basis for third-party review and accountability to the public.

Together, electronic transparency and accountability avoid a core evil that regulations abhor: a cover-up.  So often, it is deception or cover-up that transforms a legally ambiguous situation into a violation of law.  Here are four examples:

1. When computer crime experts differentiate good “white hat” computer security research from bad “black hat” hacking, a decisive factor is whether the suspect engaged in any trickery or concealment.

2. Martha Stewart did not go to jail for insider trading, though she did have inside information at the time of making a stock trade. She went to jail for attempting a cover-up of that trade, that is, obstructing an investigation into whether she had traded on insider information.

3. Arthur Andersen was not criminally convicted for the audit work it performed for Enron.  Rather, a jury convicted Andersen for a cover-up, that is, destroying records that might be needed to review the audit work.

4. Law normally does not require a mere witness to crime to report it.  But if the witness takes any step to prevent others from uncovering the crime, then the witness is herself guilty of the crime known as “misprision of a felony.”

Let me say all this another way:  When literal compliance with complex law is difficult, parties are wise to talk candidly about the problem in public and about their good faith effort to comply.  Candid communication can diminish expectations for strict compliance and can soften the law’s interpretation and enforcement.

I’m not saying that public relations and record keeping are all that's necessary to comply with law on the Internet.  But when a person makes a sincere attempt to comply with otherwise conflicting, unrealistic or outdated regulations, transparency and accountability can weigh heavily in favor of a conclusion that the person effectively did comply.

Update 1:  The technologies to support telemedicine are advancing to include more than just microphones and video cameras.  Biomedical, Inc. has created a digestible computer chip, which will can transmit medical information from inside a patient.  Don Clark, "Take Two Digital Pills and Call Me in the Morning," Wall Street Journal,  Aug. 4, 2009.  Imagine a patient who ingests such a pill at home; the pill relays information to a device connected to the patient's home computer, which forwards it via the Internet to a remote physician.

Update 2: As cheap new technologies enable consumers at home to collect floods of data about their vital signs, issues will arise concerning the unauthorized practice of medicine.  A person (possibly a remote physician who is not licensed in the consumer's state) or a software program may help the consumer interpret the data.  Would this help constitute unauthorized practice of medicine, if the person or software explicitly disclaims giving medical advice or diagnosing disease and recommends that the consumer consult a licensed physician?  

A few years ago, Texas lawyers questioned whether self-help software was engaged in the unauthorized practice of law.  The legislature then enacted special legislation to declare that software is 
not engaged in unauthorized practice -- so long as the software conspicuously states it is not a substitute for the advice of an attorney.

Some worry that healthcare reform in the US will lead to a shortage of doctors.  Kirch, "How to Fix the Doctor Shortage," Wall St. J., Jan. 5, 2010.  If a shortage does materialize, state regulators may be less inclined to conclude that help from software or remote physicians constitutes the unauthorized practice of medicine.  Regulators may feel that software and remote physicians can help to reduce the wait times for people who really need an in-person visit with a doctor.

–-Benjamin Wright

Mr. Wright the law of data security and investigations at the SANS Institute.

Update:  Interview of Mr. Wright regarding telemedicine regulation.

Medical and Education Record Retention and Purge Policy

Tiered e-Archives for Patient Records and Electronic Mail

How long should an enterprise retain e-data? What's a smart policy on e-record destruction?  Hear how East Carolina University answered the questions for e-mail, medical records and security videos.

The institution retains those three classes of data in a dedicated archival system (more than just normal production records and backup).

East Carolina retains e-mail of top school administrators seven years, then purges it.  In my experience, seven years is the traditionally-recognized period for responsible retention of important financial records.

East Carolina elected to retain e-mail of faculty and staff for three years.

It archives security video (very voluminous) 30 days.  

The university saves patient records until 20 years after patient's death.

To reduce costs, the university retains archives in tiers. Newer or higher-priority archives are in higher-performance "primary" storage, whereas older archives are relegated to slower storage, outside the network backup program.

On the topic of tiers, I’ll go one step further than what I read about East Carolina U.  I envision another, even lower and less expensive tier, where archives are retained and organized but not accessible by fully-automated means.  

From the perspective of e-discovery theory, a rationale for tiered storage is this:  E-discovery law is most intolerant when records are destroyed too early.  In the e-records world, too-early destruction is the most common type of "spoliation" or "obstruction of justice".  E-discovery law is also intolerant (but maybe a bit less so) when a litigant possesses records, but she doesn’t know it and can’t find them.  

Finally, e-discovery law seems to be more tolerant when a litigant possesses records, knows she possesses them, knows more or less where they are, but just can't get to them very easily.  When this is the case in a lawsuit, a litigant is much less likely to be charged with spoliation.  Instead, the plaintiff and defendant are prone to go before the judge and argue about the extent to which the dusty old e-archives are important and about who should pay for how much of the cost of retrieving them.

-–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in e-record archival.