Electronic Data Records Law | How to Win E-Discovery

Health-care Data Tracking | Electronic Health Record (EHR)

HIPAA Security Rule Expanded

Patient Data: Account for Access-Disclosure

IT Logs, Control, Meta-data, Audit Trails

Congress imposed a demanding new data security regime on all healthcare organizations.  Congress more or less expects the industry (hospitals, doctors’ offices, insurance companies and more) to track and account for each and every access of electronic patient information.  Each time someone accesses data, the organization needs a record (a log entry) of it. 

Although Congress did not express this expectation in a single, concise statement, it effectively said it in four steps.  The four steps are part of the American Recovery and Reinvestment Act, known as Health Information Technology for Economic and Clinical Health Act or HITECH. 

To comply with HITECH’s four steps, the maintenance and review of logs and audit trails will not be the only procedures “covered entities” should adopt.  Employee training will be important, too.  But as a practical matter application-layer logs and audit trails showing on a historical basis who accessed which information will be critical to compliance.

Data Sharing vs. Restraint of Data Sharing

Before I describe the four steps, we need to see the big picture.  Like other industries, the healthcare community today makes great use of information technology (computers).  Although many personal health records are still on paper, computer systems are already ubiquitous in clinics, hospitals, doctors’ offices and insurance companies.  Email and other electronic data collection and exchange are common.  Loads of patient information already get into e-mail today, whether intentionally or otherwise.

If there is one thing that information technology excels at, it the sharing information.  And the capacity for computers to promote information sharing is good because sharing is critical to the delivery and administration of healthcare.  The industry already engages in extensive sharing and collaboration by way of computer technology, and this sharing/collaboration is increasing rapidly, as it is in other industries.  Lots of doctors carry BlackBerries or iPhones, for example.

So here’s the big picture conflict:  computers are about sharing data; HITECH is about data restraint and accountability.  The essence of HITECH’s four steps is that health entities must install lots of fine-granular controls to monitor, regulate or prevent the sharing of data.  Technology is enabling easy sharing; HITECH says we need to throttle it.

HITECH’s Four Steps

So what are the four steps?

First, under Section 13402 of the Act, if a healthcare “covered entity” discovers that a patient’s unsecured data is accessed without authority, then the entity must notify the patient. How is this requirement to be satisfied in practice? Although the keeping and auditing of logs are not the only way, logs are very important tools. 

Second, under Section 13405(c) a patient will have the right to receive from a covered entity an accounting, dating back three years, of disclosures of her protected information to anyone outside the entity.  A disclosure could include the sharing of information among health care entities for treatment, payment or health operations.  In other words, it could cover the exchange of treatment information from one doctor to another doctor who is not employed by the same entity as the first doctor – a very common event!

This accounting requirement only applies to electronic information, not paper.  It applies to any “electronic health record,” which HITECH expansively defines as electronic information about a person’s health, used by health care clinicians.  (Section 13400(5))  This could include lots of day-to-day internal email in a clinic, a hospital or a doctor’s office – or external e-mail among multiple health care providers. It could also include lots of miscellaneous e-records in medical devices and equipment, which are not normally considered part of a records management program.  The scope of what HITECH covers here is breathtakingly broad!  [Update June 2011:  The Department of Health and Human Services' publication of a proposed rule to implement Section 13405(c) has generated controversy.]

As a practical matter of compliance, this step number two will require extensive logs and audit trails showing who accessed which information and when.

Third, under Section 13405(a) a patient can request that a covered entity not disclose certain information to a “health plan.”  The delivery and administration of healthcare can be a very complex undertaking.  Compliance with a patient request to allow X information to be disclosed but not Y information is difficult.  Compliance will involve real attention and review.  Again, healthcare players are going to need to implement information controls that include application-layer logs and audit trails so that this kind of patient request can be enforced and employee actions can be reviewed after the fact.

Fourth, under Section 13405(b) a covered entity that uses patient information or discloses it to another covered entity must (if the purpose is for something other than treatment) limit the information to what is necessary for the purpose.  Again, this is a very subtle requirement.  Effective compliance requires a lot of human attention, supervision and after-the-fact review.

Interpretation

These four steps are not separate ideas.  They need to be viewed in the aggregate.  In any organization, perfect compliance with the HITECH’s four steps will be really hard to achieve and sustain.

Implications:

1.  Healthcare organizations need to be archiving email (and other e-messages such as text) for generous periods of time.  Archival allows later review of which patient information was delivered to which person (not to mention other operational functions, such as review of who was consulted on a particular matter, at which time, and so on).

2.  Any healthcare e-mail archive application needs to support audit trails that show who accessed which particular e-mail archive record at which time.

3.  For other collaboration systems (non-email), healthcare firms will similarly need access logs and audit trails.

The concept of health-care covered entities maintaining audit logs is not new.  The existing HIPAA Security Rule already requires that covered entities, “Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” (See Footnote.)  But as written that rule does not require the implementation of logs.  HITECH adds urgency to such implementation.

Comments invited!

Update April 2011: A healthcare group has pointed out that healthcare providers store eletronic patient information in many places other than just qualified electronic health records.  (See step number 2 in the blog post above, which I originally wrote in August 2009.)  A requirement that a provider account to patients for every access made to their data, in the past three years, wherever it may be stored in electronic form will be very burdensome, according to Medical Group Management Association.

–-Benjamin Wright, Senior Instructor on cyber defense law at the SANS Institute.
 

Footnote:  Data access audit trails are already part of other medical privacy law. New Mexico's Electronic Medical Records Act, SB 278, for instance, requires a "record locator service" (a kind of clearinghouse for health records) to maintain detailed audit logs on the access of patient information.

Financial E-Recordkeeping Law

National Instrument 31-101: E-mail, Collaboration, Online Chat, Instant Message, and Social Networking Records?

Canada is in the process of adopting new rules on the retention of electronic records by securities firms such as stock brokerages. The rules will impose rigorous requirements for preservation and availability of records for e-mail, text and other communications between firms and their clients.

The rules are part of proposed National Instrument (NI) 31-103, which will install a new nationwide regime for regulation of securities firms. Although authorities hoped to have made NI 31-103 effective as of March 31, 2009, they are still refining it. They anticipate publishing the next draft around April 1, 2009, with implementation beginning sometime after that.

Even though the rules are not yet final, firms can see that the new retention requirements are coming. They are wise to begin e-record retention now.  NI 31-103's new requirements are consonant with the larger trend in society to expect that enterprises keep plentiful electronic records.

Proposed NI 31-103 Section 5.15(1)(a) provides: “A registered firm must maintain records to accurately record its business activities, financial affairs, and client transactions.”

Proposed Section 5.5: “In most circumstances, registered firms should maintain the following records to satisfy subsection 5.15(1)(a) . . . all e-mail, regular mail, fax and other written communications with clients.”

What are the standards for record retention? Seven years is an important time period. Proposed Section 5.16:

"(1) A registered [securities] firm must keep its records safe and in a durable form.
(2) For a period of two years after the creation of a record, a registered firm must keep the record in a manner that permits it to be provided promptly to the regulator, and thereafter the record may be kept in a manner that permits it to be provided to the regulator in a reasonable period of time.
(3) A record provided under subsection (2) must be in a form that is capable of being read by the regulator.
(4) A registered firm must keep
  (a) an activity record for seven years from the date of the act, and
  (b) a relationship record for seven years from the date the person or company ceases to be a client of
the registered firm."

So 5.16 generally provides for shorter retention for “activity records” (seven years from the date of the act) than for “relationship records” (seven years after the client ceases its engagement of the firm).

5.16 goes on to define "relationship records" (which relate for example to the ongoing relationship between a firm and its customer) and “activity records” (which relate for example to specific purchase and sale transactions). In particular instances, however, the difference between an activity record and a relationship record could be indistinct and unclear. An e-mail can contain both activity information and relationship information.  Under a conservative interpretation, this lack of clarity could militate toward keeping even presumably “activity” records longer than seven years.

US securities firms have been dealing with similar record retention rules for a decade, and the US experience is a useful guide for Canadian firms. In 1997 the US Securities and Exchange Commission expressly required securities firms to store certain client communications such as e-mail under SEC Rule 17a-4. As new technologies have emerged, the requirements have been read to include them. For example, NASD Rule 03-33 specifically interpreted 17a-4 to include instant messages.

On several occasions US regulatory authorities have penalized firms for poor electronic records retention practices. For example the New York Stock Exchange fined J.P. Morgan $2.1 million.

As a matter of practice, compliance with rules like Rule 17a-4 and NI 31-103 can be easier if electronic messages are stored in a dedicated message archive server rather than in a production e-mail server or in network backup.

There is no reason in principle why such rules would not be read to include records of new forms of communications as they arise – such as postings on a message “wall” in a social networking environment like Facebook or Ning or txt or video communications via Skype.

–Benjamin Wright