Many health care businesses assume that HIPAA compliance guarantees protection from data breaches. Unfortunately, this is not a correct assumption.
The health insurance company Premera Blue Cross recently announced that it was the target of a sophisticated cyber attack. It is estimated that the personal information of eleven million individuals may have been accessed by hackers.
In the days following the breach, the Seattle Times ran an article about an audit conducted by the federal Office of Personnel Management (OPM) and Office of Inspector General (OIG) on Premera’s operations prior to the breach.
Due to the health insurance coverage that Premera provides to federal employees, OPM and OIG had the right to audit Premera’s systems to ensure the security of the employees’ personal information. According to the Seattle Times article, the federal agencies warned Premera of potential vulnerabilities with its information technology security prior to the breach.
What Did OPM and OIG Actually Find?
After reading the article, I assumed that the federal agencies found massive problems with Premera’s HIPAA security compliance. Clearly, Premera would not have suffered the breach if it had complied with the HIPAA Security Rule, right?
Nope.
Page ii of the audit states the following:
Health Insurance Portability and Accountability Act (HIPAA)
Nothing came to our attention that caused us to believe that Premera is not in compliance with the HIPAA security, privacy, and national provider identifier regulations.
Instead, the security issues that the OPM and OIG found with Premera’s system appear to have involved more advanced features, including:
- Lack of Piggybacking Prevention; and
- Although Premera had a “thorough incident response and network security program,” it needed a better methodology for applying software patches, updates, and server configurations. Note, that failing to appropriately patch software can lead to serious HIPAA violations, including OCR investigations and Settlements. For more information about patching and HIPAA please read: “Failure To Patch Software Leads to $150,000 Settlement“.
Upon review of the audit report, it appears that Premera did have fairly robust security safeguards. For example, although it did not have the physical access control of piggybacking prevention, it had installed a multi-factor authentication key pad for each staff member.
The OPM and OIG certainly found issues with Premera’s security procedures, but the report repeatedly makes it clear that Premera:
- Had adequate HIPAA privacy and security policy and procedures;
- Updated its HIPAA policies annually and when necessary; and
- Required employees to complete HIPAA compliance training each year.
HIPAA Compliance May Not Be Enough
The unfortunate takeaway from Premera’s data breach is that HIPAA compliance may not be enough to ensure security from attacks carried out by sophisticated hackers.
Although a covered entity’s security policies and procedures may technically comply with the HIPAA Security Rule, it is still critical to go further and address any known vulnerabilities that HIPAA may not even require to be addressed.
Contact Casey Moriarty for more information about HIPAA compliance.
