Post on 06-Jun-2020
transcript
Identity Theft FACTA &
HITECH Overview
Lisa Asbell, RN, CHP, CITRMS
727 502 7427
Lisa Asbell 2012 1
AGENDA
Identity Theft Session 1
Statistics
Types of Identity theft
oIdentity theft stories
Methods of Identity theft
Data Breaches and the Damage caused
Warning Signs
IDT Protection
Repairing Personal Identity Theft
Lisa Asbell 2012 2
Agenda Session 2
FACTA FACTA Overview
FACTA Disposal Rule 2005
o Guideline for compliance & training
FACTA Red Flags Rules 2008
o 26 Red flags
o Guideline for compliance & training
Information Protection in your facility
Information Verification in your facility
Fines for non-compliance
Lisa Asbell 2012 3
AGENDA Session 3
HITECH ACT Areas of Change to HIPAA
Business Associate Agreements
Who Are the new BA’s and CE’s
Contract suggestions and guidance
Disclosure Agreement Provision
Breach Notification
Contract suggestions and guidance
HIPPA UPDATES
Lisa Asbell 2012 4
•Expanded Accountings of Disclosures
•Access to PHI
•Marketing
•New Penalties
Lisa Asbell 2012 5
LEARNING OBJECTIVES
How to identify a potential identity theft issue, types of identity theft
and personal identity theft
How to avoid lawsuits in your practice
Learn how the Red Flag Rules affect your facility;
Obtain practical tools such as action plans, policies and procedures,
and implementation techniques to assist your office with compliance;
Discover how to develop an action plan to mitigate identity theft; and
Comply with these new federal regulations.
Identify which organizations and individuals are BAs
Explain the new HITECH privacy and security requirements
List practical steps to rework BA and third party vendor contracts
Identify additional changes necessary to comply with HIPAA
Learn the vital importance of ongoing education and staff training
Identity Theft America’s #1 crime
Over 50 million victims in the last five years
Every 3 seconds an Identity is stolen
Over 567 million records in over 3,500 separate data breach since 2005.
Medical Identity theft is the fastest growing type. Grown over 400% in 12 months.
FTC reports that over 11 million people were victims in 2009. Over 51% is never reported!
70% of identity theft issues in medical facilities come from a piece of paper not the computer.
FBI reports that revenue from ID theft has surpassed drug trafficking. Over 9 billion a year.
Lisa Asbell 2012 6
Lisa Asbell 2012 7
" Over 400,000 Dead People opened Bank
accounts last year" – AARP
" The revenue from trafficking financial data has
surpassed that of drug trafficking." – Secret
Service March 2012
" Every Three seconds (27,000 times per day)
someone becomes a victim of Identity Theft." –
USA TODAY
IDT Statistics
Lisa Asbell 2012 8
Identity Theft: #1 FTC complaint for tenth
year straight
By admin | Published: February 26, 2011`
Think the problem of identity theft is going
away anytime soon? Think again, this week the
FTC released the 2011 Top Consumer
Complaints report and yet again, millions of
American consumers have found themselves
falling victim to identity theft and fraud. For ten
years straight identity theft and fraud have
made it to the top of the list, so I believe a toast
is in order to the identity thieves across the
world.
Criminal- (someone commits a crime in your name)
Financial - (new accounts, bank accounts, cell phones)
Drivers License- (use your name and licenses)
Social Security- (illegal aliens use them EVERYDAY)
you pay the taxes
Medical **** - (getting your health insurance info)
How many of your current patients are already victims?
What if they think your facility caused it? Do you have something in place to prove
otherwise? It only takes one complaint to launch and investigation… What about HIPAA?
They will look at everything. You can’t afford to wait a minute to get this program in place.
Lisa Asbell 2012 9
TYPES OF IDENTITY THEFT
Medical Identity Theft
Medical identity theft is a specific type of identity theft which occurs
when a person uses someone else's personal health identifiable
information, such as insurance information, Social Security Number,
health care file, or medical records, without the individual's knowledge
or consent to obtain medical goods or services, or to submit false claims
for medical services. There is limited information available about the
scope, depth, and breadth of medical identity theft.
Lisa Asbell 2012 10
Medical identity theft is about 2.5 times more costly than other types of
ID frauds, said James Van Dyke, president of Javelin, in part because
criminals use stolen health data an average of four times longer than
other identity crimes before the theft is caught. The average fraud
involving health information was $12,100 compared with $4,841 for all
identity crimes last year and consumers spent an average of $2,228 to
resolve it, or six times more than other identity fraud, according to
Javelin.
Medical Identity Threat A Rising Threat
Lisa Asbell 2012 11
The Perpetrator versus the Victim
249,000 had their medical identities stolen in 2008
Gartner Research estimates there will be more than 1 million cases of medical identity theft in 2009 The Fastest growing type of identity theft
Two areas of vulnerability: Use of a person’s name or identifiers without knowledge or consent
Use of a person’s identity to obtain money by falsifying claims for medical services
Lisa Asbell 2012 12
Personal IDT Nightmare Stories
CHICAGO (MarketWatch.com) -- Identity theft and fraud
have ruined Dave Crouse's life. In fewer than six
months, some $900,000 in merchandise, gambling and
telephone-services charges were siphoned out of his
debit card. His attempts to salvage his finances have
cost him nearly $100,000 and have bled dry his savings
and retirement accounts. His credit score, once a strong
780, has been decimated. And his identity -- Social
Security number, address, phone numbers, even
historical information -- is still being used in attempts to
open credit cards and bank accounts.
Lisa Asbell 2012 13
Few people know more about identify theft than John Harrison.
In an ironic twist, when the president of Choice Point wrote a book on
identity theft, he went to Harrison.
The Connecticut salesman has spent over 2,000 hours trying to
reclaim his life after having his identity stolen, and his home office
has become a shrine to the suffering, reports CBS News
Correspondent Byron Pitts.
"I had to come up with a filing system,'' says Harrison of his efforts to
clear his name.
Harrison was a victim nearly four years ago, when a 20-year-old stole
his identity and literally went for a ride.
"Lowes, Home Depot, Sears, JC Penny, two cars from Ford, a Harley,
a Kawasaki motorcycle," says Harrison, listing off the purchases
made in his name. "About $265,000 in four months."
Lisa Asbell 2012 14
ORANGE COUNTY, Fla. -- An Orange County woman is living an
identity theft victim's nightmare. She's been to jail and court
several times just to clear her name and she's still facing check
fraud charges in two counties.
"I was stuck. There was nothing I could do," victim Rose Jackson
told Eyewitness News.
Rose said she had little choice but to wait for months in jail for the
first of four trials on forgery and grand theft charges. Her name
started showing up on bogus checks after her purse was stolen
two years ago. She wishes she had filed a police report
immediately, because now she says no one believes the mother of
two was a victim of identity theft.
"You know, they don't care, because everybody in jail says, 'It wasn't
me. I didn't do it,'" she said.
Lisa Asbell 2012 15
Spot a Phishing Email
Protect Your Computer from Spyware
Spear Phishing: Identity Theft's New
Black
Web Page Spoofing
Email Spoofing
Nigerian Letter Scams Getting More
Elaborate
Computer Scams
Common IDT METHODS
Lisa Asbell 2012 16
Dumpster Diving
Your Risky Mailbox
Credit Card Protection Basics
Data Breaches
Vishing
Social Engineering
Vacation Time: Protect Yourself from
Identity Theft
Natural Disasters: Protect Yourself
From Identity Theft
Is Your Bank Really Merging?
Old Scams, Made New
Real World Scams
Risky Situations
Lisa Asbell 2012 17
Spear Phishing: Identity Theft’s New Black
Most people have heard about phishing – the practice of using fraudulent
emails to gain access to personal information for the purpose of identity theft.
But like any activity, an occasional update in the process is needed. Spear
phishing is the new black in identity theft.
The term phishing was coined because of the way that criminals try to gain
access to personal information – basically, they cast out a bunch of bait in
the form of fraudulent emails, and wait to see who bites. Spear phishing,
however, is more targeted.
Just a fisherman would use a spear to target a single fish, spear phishing
targets individuals. Whereas criminals might send a single, mass e-mail to a
couple hundred thousand people in a phishing attack, spear phishing attacks
are customized and sent to a single person at a time.
The spear phishing email usually contains personal information such as a
name or some tidbit about employment. They are also unique emails, rather
than being the mass “your bank account has been compromised,” type
emails that are more common in phishing.
For example, one instance of spear phishing targeted corporate executives
with personalized emails about a legal case in which the recipient of the
message was allegedly being sued. It was a new scam, so it was easy for
executives to assume that it was legitimate and click the link provided in the
message. And that’s the point at which the spear pierces the target.
Lisa Asbell 2012 18
Identity Theft Methods You May
Not Have Considered
Identity theft is often thought of as an electronic crime. In truth, however,
it’s your every day habits that could lead to identity theft. Little things that
you don’t think about it can create the opportunities that an identity thief
needs to grab enough information to damage your credit, or worse, your
whole life. Here’s a quick list of four common ways that identity thieves
gather your information…ity theft is often thought of as an electronic
crime. In truth, however, it’s your every day habits that could lead to
identity theft. Little things that you don’t think about it can create the
opportunities that an identity thief needs to grab enough information to
damage your credit, or worse, your whole life. Here’s a quick list of four
common ways that identity thieves gain access to your personal
information and steal your identity.
Lisa Asbell 2012 19
1. Wayward Receipts
Before 2006, merchants printed credit card numbers on receipts. Today,
that practice that is supposed to be illegal, but there are times when it still
happens. Especially if the merchant you’re shopping with uses one of the
old carbon credit card machines to make a copy of your credit card. Even
new cash registers print the last four digits of the card number and an
expiration date on the receipt. This information can be gold to identity
thieves.
Keep track of your receipts until you can shred them. Don’t leave them in
the bag with your purchases. And don’t throw them away in public trash
receptacles or even in your own trash. Treat your receipts just as you
would any other personal information and shred them using a cross-cut
shredder.
Lisa Asbell 2012 20
2. ATM Lurkers
Cash can’t be duplicated, so it must be safer to shop with cash than with a check or
credit card, right? Well, that depends. Cash can be safer, but only if you’re safe in
getting and managing it.
Have you ever stopped by the ATM machine just to have someone standing a little
closer than you’re comfortable with? Be careful of those people. In this day and
age of camera and video-enabled cell phones, that ATM lurker could be recording
your ATM pin number. Then it’s just a matter of grabbing your card and they have
access to your bank account and everything that’s in it.
Whenever possible use a drive up ATM machine. And if you must use an ATM
machine where people can stand behind you, try to block others’ view with your
body.
3. Secure Your Domain
Your personal space—your home and your car—feel safe to you. This is where you
spend the most time, and it’s where you keep everything that matters most in your
world. It’s that feeling of comfort that puts you most at risk for identity theft in your
own home. If someone took all of the information that you have laying around your
home, how much could they gain?
Be aware of the risks that you take with your personal information in your own
home. Mail stacked on a desk, personal files in closets, and purses sitting out in
the open are vulnerable to opportunistic criminals. Keep your personal information
and mail locked away in a fire-proof safe, and put your purse or wallet away in a
place that can’t be seen.
Lisa Asbell 2012 21
4. Credit Card Follies
Most people rely on their credit and debit cards to make everyday
purchases at stores and restaurants. Unfortunately, it’s very easy
for someone to steal your credit card information.
A common scheme used to steal credit card numbers is called
skimming. You give your credit to a server or cashier to pay for
something, and they either swipe it twice—once for authorization
and once to collect the information encoded on the card.
The best way to protect yourself from skimming is to use a
disposable credit card that you load with a preset spending
amount. They’re good until that money is gone, and then they’re
useless. This stops criminals from gaining access to your credit
or banking accounts and helps prevent identity theft.
Lisa Asbell 2012 22
Warning: Identity Thieves Want Your Home
Identity thieves are interested in your identity for what they can gain
from it. When they can access your mortgage or the deed to your home,
that can be literally the roof over your head. Your learn what the top
mortgage scams are so that you can protect yourself from criminals that
would use your information to steal your home.
Identity Thieves Love Your Gadgets, Too!
Your cell phone, iPod, and GPS system might be putting you at risk for
identity theft. These gadgets can be used by identity thieves to gain
access to your personal information. Learn how to protect your identity
by securing your personal gadgets.
How to Protect Your Identity from Employment Scams
Unemployment rates keep rising. But identity thieves don't care if you're
out of work. They'll take advantage of you anyway with employment
scams designed to steal your personal information. Learn how to
protect yourself from identity theft employment scams.
Breaches are Rampant!
www.privacyrights.org
Check out this website and you will see that over 567 million records
including personal information has been breached since 2005.
The FTC reports that the problem will 20 times worse over the next
20 months.
The FTC says that by the end of 2013 every person in America will be
affected by ID THEFT
Our goal is that NO one becomes a victim of identity theft because of
carelessness within your organization
Lisa Asbell 2012 23
Recent Known Breaches
Lisa Asbell 2012 24
• Harris County Hospital, Texas – Administrator lost medical/financial records of 1,200 patients with HIV/AIDS – Information was on a portable flash drive – Data was not password protected nor encrypted
• Staten Island University Hospital, NY – Computer with Medical Records Stolen - Patients informed 4 months later
• UCSF Medical Center – Information on patients was accessible on the Internet - Patients informed 6 months later
• New York-Presbyterian Hospital/Weill Cornell Medical Center – 2000 patient records sold; 50,000 improperly accessed
• University of Utah Health Care – Password protected but unencrypted laptop with data on 4,800 people was stolen after hours from a locked room
• University of Minnesota Reproductive Medicine Center – Doctor lost an unencrypted portable storage device with information on 3,100 patients
Lisa Asbell 2012 25
1. If you receive a credit card statement in the mail from a creditor where you do
not have an account, contact them immediately. Someone may have opened that
account in your name without you knowing about it.
2. If you feel you have good to excellent credit but you are turned down for a loan
or a new credit card, find out why. It could be that your credit is not as good as you
thought it was, or it could also be that someone has opened one or more accounts
in your name and they are all past due.
3. As mentioned above, you get a phone call from the collections department of a
creditor where you didn't know you had an account.
4. Withdrawals on your credit card account as a "cash advance" withdrawal or
having charges that you cannot identify on your debit card or credit card statement.
It is your right to know what each and every one of those transactions represents,
and if you can't identify it, it is your task to find out what it was.
5. If you don't receive your credit card statements around the same time of the
month, or perhaps don't receive one at all in a given month. Be aware of when you
should be receiving those, and if you don't receive one, contact the creditor to find
out why. It could be that an identity thief has stolen your identity and changed your
address.
Warning Signs that you may be a victim
Lisa Asbell 2012 26
Benefits of having IDT protection
•Less headache for you
•Continuous monitoring
•Loss time and wage reimbursement
•A fraud specialist to actually help
restore your name
•Peace of mind
Lisa Asbell 2012 27
A. Free Reports
Consumer advocates have long encouraged individuals to monitor their credit
reports as a way to detect identity theft. The standard advice was to request a
copy of your credit report once a year from each of the three national credit
bureaus: Experian, TransUnion, and Equifax. Until now, you usually had to pay
up to $9.50 to get a copy of your report from each of these credit bureaus.
Congress recognized the benefits of self-monitoring. It adopted a new rule that
allows you a free copy of your credit report annually from each of the "big
three." (Read more about the rulemaking on this provision.)
Should I contact each credit bureau for my free report?
No. The only way to get your free reports is through a centralized source, a
combined effort by the three national bureaus. Free reports are available
through a dedicated web site, www.annualcreditreport.com. You may order by
telephone at ( 877) 322-8228 or by mail. For a copy of the mail-in form, go to
https://www.annualcreditreport.com/cra/requestformfinal.pdf.
What is the best way to order my free reports?
We recommend you order free reports by telephone or mail. A World Privacy
Forum report released in July 2005 exposed hundreds of imposter web sites.
To read the full report and tips for ordering free reports, see
www.worldprivacyforum.org/pdf/wpfcalldontclickpt2_7142005.pdf
Lisa Asbell 2012 28
Equifax: P.O. Box
740250, Atlanta, GA
30374- 0241.
Report fraud: Call (888)
766-0008 and write to
address above.
TDD: (800) 255-0056
Web: www.equifax.com
Experian: PO Box 9532
Allen TX, 75013
Report fraud: Call (888)
EXPERIAN (888-397-3742)
and write to address above.
TDD: Use relay to fraud
number above.
Web: www.experian.com/fraud
TransUnion: P.O. Box 6790,
Fullerton, CA 92834-6790.
Report fraud: (800) 680-7289
and write to address above.
TDD: (877) 553-7803
E-mail (fraud victims only):
fvad@transunion.com
Web: www.transunion.com
1. Notify credit bureaus and establish fraud alerts. Immediately report
the situation to the fraud department of the three credit reporting
companies -- Experian, Equifax, and Trans Union. When you notify one
bureau that you are at risk of being a victim of identity theft, it will notify the
other two for you. Placing the fraud alert means that your file will be
flagged and that creditors are required to call you before extending credit.
Consider using a cell phone number if you have one.
We recommend that you do not choose to call Experian. You will be
subject to a marketing pitch for their "free" credit management tools. If you
fail to cancel the service within 30 days, your credit card will automatically
be charged for the service.
Lisa Asbell 2012 29
2. Law enforcement. Report the crime to your local police or
sheriff's department right away. You might also need to report it to
police department(s) where the crime occurred if it's somewhere
other than where you live. Give them as much documented
evidence as possible. Make sure the police report lists the
fraudulent accounts . Get a copy of the report, which is called an
"identity theft report" under the FCRA. Keep the phone number of
your investigator handy and give it to creditors and others who
require verification of your case. Credit card companies and
banks may require you to show the report in order to verify the
crime.
Under new provisions of the Fair Credit Reporting Act (FCRA,
605A)
you can place an initial fraud alert for only 90 days. The credit bureaus
will each mail you a notice of your rights as an identity theft victim. Once
you receive them, contact each of the three bureaus immediately to
request two things:
a free copy of your credit report
an extension of the fraud alert to seven years
You may request that only the last four digits of your Social Security
number (SSN) appear on the credit report.
Lisa Asbell 2012 30
3. Federal Trade Commission. Report the crime to the
FTC. Include your police report number. Although the
FTC does not itself investigate identity theft cases, they
share such information with investigators nationwide who
are fighting identity theft.
Call the FTC's Identity Theft Hotline: (877) IDTHEFT
(877-438-4338)
Or use its online identity theft complaint form:
https://www.ftccomplaintassistant.gov/
Or write: FTC Identity Theft Clearinghouse, 600
Pennsylvania Ave. N.W., Washington, DC 20580.
The FTC's uniform fraud affidavit form is available at
http://www.ftc.gov/bcp/edu/resources/forms/affidavit.pdf
Visit the Web site for the President’s Identity Theft Task
Force for Identity Theft Victims’ Statement of Rights
under federal law: www.idtheft.gov/
Lisa Asbell 2012 31
Lisa Asbell 2012 32
IDENTITY THEFT RELATED LAWS
FACTA Disposal Rule
FACTA RED FLAGS RULE
http://www.ckfraud.org/idtheft.html
State Info
FACTA
Lisa Asbell 2012 33
Fair and Accurate Transaction Act of 2003
Signed into law by President Bush on 12/4/ 04
Requires every practice to have a Written Security
plan.
This law is NOT delayed!
Fines up to $3,500 per affected employee or patient.
Civil and Class Action lawsuits are a potential
threat. No statue of limitation on Class Action
Lisa Asbell 2012 34
Businesses must leave off all but the final five digits of a credit card
number on electrically printed store receipts as of December 1,
2006.
Employers must destroy all information obtained from a consumer
credit report before discarding it.
Consumers who suspect that they are the victims of identity theft
only need to notify one of the three credit reporting services
(Experian, Trans Union, or Equifax) to initiate a nationwide fraud
alert.
Mortgage lenders must provide the credit score they use to
determine a loan’s interest rate, regardless of whether the loan is
approved or denied.
FACTA is enforced by the Federal Trade Commission
Many Arms of FACTA Jan 1 2005 - Access to Credit Reports- This was the first part
of FACTA www.annualcreditreport.com
June 1, 2005 Disposal Rule and business or person that has
information derived from consumer reports must have a plan
and policy in place to properly DISPOSE of that information.
www.ftc.gov/opa/2005/06/disposal.shtm
December 1, 2006 Truncation – Only allows up to 5 digits
of a credit card to be on the receipt
www.ftc.gov/bcp/edu/pubs/business/alerts/alt007.shtm
January 1, 2008 Red Flags Rules
www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm
Lisa Asbell 2012 35
FACTA DISPOSAL RULE
The Disposal Rule applies to consumer reports or
information derived from consumer reports. The Fair Credit
Reporting Act defines the term consumer report to include
information obtained from a consumer reporting company
that is used – or expected to be used – in establishing a
consumer’s eligibility for credit, employment, or insurance,
among other purposes. Examples of consumer reports
include credit reports, credit scores, reports businesses or
individuals receive with information relating to employment
background, check writing history, insurance claims,
residential or tenant history, or medical history.
Lisa Asbell 2012 36
Lisa Asbell 2012 37
Existing FCRA preemption provisions are made permanent and other areas in
which state and local laws are preempted have been added, especially in
specific areas relating to identity theft. This should not be construed to mean that
all areas of identity theft are now preempted.
Consumers can place fraud alerts on their credit files and block information
caused by identity theft or fraud. The FTC and other federal agencies must
establish guidelines to protect against fraud and identity theft. The law provides
for “active duty alerts” for active duty military personnel.
When a consumer is granted credit, but, because of a credit rating, the credit
granted is at a less advantageous rate, the consumer must receive notice of that
fact.
Consumers have the right to one free credit report annually from the national
repositories and national specialty credit reporting agencies, a newly designated
group of credit reporting agencies. The FTC must prescribe regulations to
provide procedures and processes for consumers to obtain free reports.
The standard for furnisher accuracy is changed from “knows or consciously
avoids knowing” to the higher standard of “knows or has reasonable cause to
believe” information is inaccurate. Regulators must establish guidelines for
furnishers regarding the “accuracy and integrity” of information furnished to credit
reporting agencies. A study on the accuracy of consumer reports must also be
conducted.
FACTA Close UP
Lisa Asbell 2012 38
Consumers may dispute information and initiate an investigation directly with
furnisher. Furnishers cannot forward information to credit reporting agencies when a
consumer submits an identity theft report to the furnisher relating to that information.
A requirement that credit and debit card numbers be truncated on consumer
receipts will be implemented over an extended period.
Consumers can request that their social security number be truncated from their
credit report.
Credit scores and how they are determined must be disclosed to consumers for a
reasonable fee, as determined by the FTC. Consumers must be notified of this right.
A study on the potential disparate impact of credit scores is required.
Consumers can prohibit the sharing of information by affiliates that will be used for
marketing purposes.
Communications to employers from third party investigators are no longer
considered consumer reports under the FCRA. However employees must be
notified if adverse action is taken based such communications and employees have
the right to a summary of the nature and substance of the communication.
Additional limits are placed on the sharing of medical information.
A financial literacy and education commission is created.
FACTA Requirements (Disposal Rules)
Lisa Asbell 2012 39
Have a Written Security policy for how you physically secure
information
Mandatory Staff training on Identity theft and the Security
Policy
Appointed an Information Security Officer
Have a mitigation plan for how you would repair the
problem.
Have Senior Management approve the policies and
procedures
Bad People can get the info if your not careful!
In January 2005, for example, Trailblazer Health, a Medicare
intermediary/carrier, posted a notice warning health care providers
about an identity theft scam involving a caller posing as a Medicare
Fraud Investigator or Medicare employee. The scam artists ask the
provider to fax copies of the provider’s driver’s license, Social
Security Number, Provider Identification Number, medical license,
medical charts or other sensitive information, claiming to need it to
update the provider's record, replace information lost in a
computer malfunction, or certain other plausible business reasons.
Instead, the identity thieves use the information to file fraudulent
claims under the provider’s identifying information with a different
payment address created by the identity thieves.
Lisa Asbell 2012 40
What is required to be FACTA-compliant?
FACTA requires financial institutions and creditor organizations
to develop, document and implement a comprehensive
identity theft program that includes information
security policies, procedures and incident response
plans covering personal (e.g., consumer, customer,
patient) information. The objective of this program
is to mitigate identity theft risks through the
effective prevention, detection and management of
“Red Flag” incidents (ref. below).
The program must be administered by a board of directors or
senior management and be periodically (min. annual)
reviewed, updated and confirmed. The program must also
ensure that relevant vendors are compliant.
Lisa Asbell 2012 41
FACTA The Value of Health information
Lisa Asbell 2012 42
A Patient Chart is valued at $100,000 to a Identity Thief!
The USA today reports that average damages to an individual who
is a victim of identity theft is over $90,000
How many are in your facility? In a chart, there is a copy of
driver’s license, health insurance cards, social security numbers,
birthdates…. EVERYTHING!
The health insurance CRISIS is real… Medical identity theft is
going to get worse.
It only takes one compliant to ruin your year or your career.
LAWSUITS with FACTA
To date over 3,000 lawsuits have been filed
because of merchants not complying with
FACTA.
Radio Shack According to the complaint, which
was posted on the state attorney general's Web
site, "thousands" of records containing customer
names, addresses, telephone numbers and other
data were found in a trash can in an alley behind a
RadioShack store located in Portland, Texas, in
March 2007. Fined $630,000 Lisa Asbell 2012 43
FACTA Red Flag Rules What you must do
Lisa Asbell 2012 44
In simple terms Red Flag Rules was passed as a Federal Law because
Identity Theft is so rampant. It is a huge problem facing the medical industry
today. It can apply to your facility because you extend credit because you bill
patients. If you any type of financing or put credit reports
Your facility is required to adopt a WRITTEN IDENTITY PREVENTION
PROGRAM. This plan is put in place to help prevent identity theft at your
practice.
While HIPAA is a law about privacy, physically securing a patients information
in your facility. Red Flag Rules says stop a thief who may come into your
facility to receive services that has already stolen an identity!
VERIFICATION….. And Authentication are the two main
components. You must train your employees the steps to take
to limit the possibility of identity theft in your organization.
Red Flag Rules Overview Are you impacted?
Lisa Asbell 2012 45
It applies to all types of businesses….
The law applies to two types of organizations
1. Financial Institutions
2. Creditors– Defined by DELAYED billing.
It is position of the FTC that a Provider will be
deemed a “creditor” under the Red Flag Rules
with respect to at least some, if not all the
payment arrangements with patients. Accordingly,
a Provider should plan to comply with the Red
Flag Rules.
Red Flag Rules Overview Action Steps
Lisa Asbell 2012 46
Your Written Identity Theft PREVENTION Program
includes:
Identifying the Red Flags that apply to your
practice
Employee Training on those Red Flags(Detect
and Defend)
Oversight of Service Providers
Adoption of plan by Board Members or Senior
Management.
Updating the plan on a yearly basis.
Three Parts of Red Flags
Identify – Look at your organizations business practices
and how you collect information. What type of information
are you collecting and how do you identify that person, client
or patient is who they really say they are. Identify which of
the 26 red flags applies to your facility.
Detect – Employee training is KEY to detecting red flags are
they appear. This training should be conducted by someone outside
your facility who has real knowledge of identity theft and the laws.
Defend – When multiple Red Flags have been detected
what are you going to do, How will you respond, Call the
police? Ask for more information?
Lisa Asbell 2012 47
What are the 26 Red Flags?
Suspicious activities, documents, etc.
Personal identification information that does not
match other sources
Altered or forged documents – description not
matching the patient
Inconsistent information with other records
Notices from victims of ID theft, law enforcement
officers, insurers, or anyone suggesting possible
identity theft
Lisa Asbell 2012 48
Lisa Asbell 2012 49
Lisa Asbell 2012 50
The following ‘Red Flags’ are potential indicators of fraud and any time when a Red Flag, or a situation closely resembling a Red Flag, is apparent, it should be investigated for verification.
1.Alerts, Notifications or Warnings from a Consumer Reporting Agency
1.A fraud or active duty alert is included with a consumer report. 2.A consumer reporting agency provides a notice of credit freeze in response to a request for a consumer report. 3.A consumer reporting agency provides a notice of address discrepancy, as defined in
334.82(b) of this part.
4.A consumer report indicates a pattern of activity that is inconsistent with the history and usual pattern of activity of an applicant or customer, such as:
•A recent and significant increase in the volume of inquiries
•An unusual number of recently established credit relationships
•A material change in the use of credit, especially with respect to recently established credit relationships •An account that was closed for cause or identified for abuse of account privileges by a financial institution or creditor
Lisa Asbell 2012 51
1.Suspicious Documents
1.Documents provided for identification appear to have been altered or forged. 2.The photograph or physical description on the identification is not consistent with the appearance of the applicant or customer presenting the identification. 3.Other information on the identification is not consistent with information provided by the person opening a new covered account or customer presenting the identification. 4.Other information on the identification is not consistent with readily accessible information that is on file with the financial institution or creditor, such as a signature card or a recent check. 5.An application appears to have been altered or forged, or gives the appearance of having been destroyed and reassembled.
Lisa Asbell 2012 52
1.Personal Identifying Information
1.Personal identifying information provided is inconsistent when compared against external information sources used by the financial institution or creditor. For example: The address does not match any address in the consumer report. The Social Security Number (SSN) has not been issued, or is listed on the Social Security Administration’s Death Master File. 2.Personal identifying information provided by the customer is not consistent with other personal identifying information provided by the customer. For example, there is a lack of correlation between the SSN range and date of birth. 3.Personal identifying information provided is associated with known fraudulent activity as indicated by internal or third-party sources used by the financial institution or creditor. For example:
•The address on an application is the same as the address provided on a fraudulent application
1.Personal identifying information provided is of a type commonly associated with fraudulent activity as indicated by internal or third-party sources used by the financial institution or creditor. For example: The address on an application is fictitious, a mail drop, or prison. The phone number is invalid, or is associated with a pager or answering service
Lisa Asbell 2012 53
When potentially fraudulent activity is detected, it is essential to act quickly as a rapid appropriate response can protect customers and the company from damages and loss.
1.Once potentially fraudulent activity is detected, gather all related documentation and write a description of the situation. Take this information and present it to the designated authority for determination. 2.The designated program representative will complete additional authentication to determine whether the attempted transaction was fraudulent or authentic. 3.If a transaction is determined to be fraudulent, appropriate actions must be taken immediately. Actions may include:
•Cancel the transaction
•Notify and cooperate with appropriate law enforcement •Determine extent of liability to company
•Notify actual customer that fraud has been attempted
DEFEND
What happens when Red Flags are ignored?
I didn’t think to do harm to anyone; I only wanted the pain to
end,” murmured Mariana de la Torre, 28, nearly two years
after her cervical cancer pushed her, an illegal Mexican
immigrant, into secretly using another woman’s name and
Social Security number for Medicaid benefits and other aid.
She got $530,000 in medical treatments using another
person’s name!
Sierra Morgan was billed $12,000 on her health-care credit
card in November for liposuction, a procedure she never
requested or had. “It’s depressing to know that someone used
my name and knows so much about me,” said the 31-year-old
respiratory therapist from Modesto, California.
Lisa Asbell 2012 54
More Stories……
Brandon Sharp, 38, found more than $100,000 of unpaid
medical bills on his credit report when he went to buy a
home. The charges included $19,501 for a life-flight
helicopter trip and emergency room visits he never used, said
Sharp, a project manager for an oil company in Houston,
Texas. “I’m as healthy as they come,” he said.
Lisa Asbell 2012 55
Employees Careless or Corrupt?
The AMA reports that 70% of breaches in a medical facility comes
for either a careless or corrupt employee.
In a widely reported case in 2006, a clerk at a Cleveland Clinic
branch office in Weston, Fla., downloaded the records of more
than 1,100 Medicare patients and gave the information to her
cousin, who in turn, made $2.8 million in bogus claims.
Feb 19, 09 Summary: Records of more than 1,000 patient visits to
Northeast Orthopaedics, a large Albany surgical practice on
Everett Road, have been posted on the Internet, a violation of
patient privacy laws. Alan Okun, practice administrator, said the
North Carolina company that transcribes dictation for the doctors
had a security lapse. The problem was discovered earlier this week
and the company, removed the records...
Lisa Asbell 2012 56
Damages Recoverable Under FACTA Actual Damages– Under Section 1681o(a)(1), a plaintiff may
bring an action and recover actual damages for a negligent
violation of the Act
Statutory Damages– Under Section 1681n(a)(1)(A), a
plaintiff may bring an action and recover statutory damages
between $100 and $1,000 for a willful violation of the Act
Punitive Damages– Under Section 1681n(a)(2), a plaintiff
may also seek punitive damages
Attorneys’ Fees– Under Sections 1681n(a)(3) and
1681o(a)(2), a plaintiff may also seek costs, including
attorneys’ fees
• NOTE: There is no statutory limit on recoverable damages
Lisa Asbell 2012 57
Lisa Asbell 2012 58
HITECH
Lisa Asbell 2012 59
Health Information Technology and Clinical
Health Act
Part of the ARRA American Recovery and
Reinvestment Act. “Stimulus Package
Signed into the law in Feb 2009
Some are calling it HIPAA 2 Compliance
Areas of changes
WHAT IS HITECH?
The Health Information Technology for Economic and
Clinical Health Act (“HITECH”) is Title XIII of the
American Recovery And Reinvestment Act (“ARRA”) of
2009
HITECH was signed into law on February 17, 2009
In short, HITECH changes and significantly broadens the
scope and application of the Health Insurance Portability and
Accountability Act (“HIPAA”)
Both the Department of Health and Human Services
(“HHS”) and the Federal Trade Commission
Lisa Asbell 2012 60
HITECH Changes to HIPAA
Significantly expands the scope, penalties and compliance
challenges of HIPAA
Changes the application of the provisions of the HIPAA
Privacy Rule and the HIPAA Security Rule
Increases the penalties for HIPAA violations
Expands the definition of a Business Associate
Provides additional methods of enforcement
Requires proactive auditing of covered entities by HHS
Both HHS and FTC have issued proposed rules pursuant to
HITECH
Lisa Asbell 2012 61
Lisa Asbell 2012 62
Beginning on February 17, 2011, the Secretary of
HHS will be required:
– To investigate every complaint of a HIPAA
violation to determine if a violation is due to
willful neglect
– To impose a civil monetary penalty for any
HIPAA violation determined to be due to willful
neglect
Lisa Asbell 2012 63
New requirements for "Business Associates" –
Deadline: February 17, 2010
HIPAA rules were strengthened by extending the responsibility for protection of PHI to
"Business Associates." Under the new law, the "Business Associates" have the same
responsibilities for any breach of private health care information as do the provider of the
services. However, it is the medical practice's responsibility to create new "Business Associate
Agreements" or amend the agreements currently in place to add the additional language to
effectively communicate this added responsibility to any party or entity that might have access
to private healthcare information of the patients of the medical practice. Your agreements
should outline these responsibilities and the practice should make sure that all such associates
have read, signed, and returned the agreements for appropriate record-keeping requirements
of the practice. "Business Associates" would include Attorneys, Consultants, Accountants,
Third-Party Billing Companies, Computer Vendors or maintenance companies, etc.
Every requirement under the HIPAA Privacy
Rule or HIPAA Security Rule will now apply
to business associates and not just to covered
entities
Lisa Asbell 2012 64
Business associates will be required to:
– Adopt all of the technical safeguards, including:
• Encryption
• Password protection
– Adopt administrative safeguards, including:
• Training
• Policy adoption
– Adopt physical safeguards, including:
• Locks
• Building security measures
• Persons whose PHI is stored, may obtain
accounting disclosures
Lisa Asbell 2012 65
Disclosure Agreement Provision –
Effective: February 18, 2010
Patients have the right to pay in full for out of pocket
expenses for health care services and request that
your practice not disclose his or her medical
information to a health plan or other entity. Your
practice must comply with this request. Make sure
that all your employees are informed about this
provision and modify notification or follow-up
procedures where applicable. This is information
that will have to be shared with all employees in the
medical practice that is involved in health
information and insurance processing.
Lisa Asbell 2012 66
Information Breach Notification
Effective February 22, 2010
New provision requiring that HIPAA covered entities such
as physicians, hospitals, and health plans notify patients
(and Business Associates notify the partnering entity) of
any breach of health care information. If a breach
involves 500 people or less, the responsible party must
notify each affected individual by written notice. This
notice must contain the details of the breach, the
information disclosed, and the steps being taken by the
practice or entity to avoid any future breaches, as well as
explaining the rights of the patient(s) in protecting their
private healthcare information. If the breach involves
more than 500 persons, the Act requires that the
Department of Health and Human Services be notified as
well as the local media outlets
Lisa Asbell 2012 67
Breach = “the unauthorized acquisition,
access, use, or disclosure of protected health
information [“PHI”]which compromises the
security or privacy of such information, except
where an unauthorized person to whom such
information is disclosed would not reasonably
have been able to retain such information.”
• A discovery of a breach occurs when:
– Entity has actual knowledge of a breach,
and
– Entity should reasonably have known of the
breach
Lisa Asbell 2012 68
As drafted, no harm is necessary for a breach to
occur
• Definition of breach does not include:
– Unintentional access by employees of covered
entities or business associates if occurring within
the scope of their duties and if the information is not
the subject of a further breach
– Inadvertent disclosures within a covered entity by
and to people otherwise authorized to access the
Information
• This would cover a wide range of inadvertent
disclosures in the treatment context
Lisa Asbell 2012 69
Breach only applies to “unsecured protected health
information”
• Strong incentive to utilize technologies and
methodologies approved by HHS, because if there is
a breach, but PHI is secure, then entity avoids the
costly breach notification requirements
• Secure PHI = HHS guidance provides that PHI
must be rendered unusable, unreadable, or
indecipherable to unauthorized individuals
• HHS provides specific encryption and destruction
guidance (74 Federal Register19006, 19009-19010)
Lisa Asbell 2012 70
Indeed, the first reported criminal conviction for violation of the Health Insurance
Portability and Accountability Act (“HIPAA”) privacy rules involved a theft of
protected health information by a former Seattle Cancer Care Alliance employee,
Richard Gibson. Mr. Gibson used a patient's name, date of birth and Social
Security number to obtain credit cards; he subsequently charged
$9,100 for personal items and expenses. While Mr. Gibson’s theft of protected
health information resulted in his conviction under HIPAA, his actions also might
have been prosecuted under various other Federal criminal statutes targeting
identity theft or other cybercrimes such as 18 U.S.C.
1028, which makes
personal identity theft a felony under Federal law punishable with
fines, up to 15 years imprisonment, or both. Health care entities may face vicarious
liability for crimes committed by their employees and agents. Accordingly, payers
and providers should take appropriate steps to prevent and detect identity theft and
other cybercrime by their employees and business partners. Documenting such
preventative measures will be useful in defending against such security breaches.
HIPAA VIOLATIONS
Breach Notification Requirements
Lisa Asbell 2012 71
Made “without unreasonable delay”
• Notice must be provided within 60 days (outer limit) of
the date the unauthorized disclosure, access, or
acquisition of unsecured PHI is discovered and must be
given to each individual whose unsecured PHI is
affected
• If there are more than 500 residents affected in a
single state, a notice must be published in the media
and given to the Secretary of HHS
• If there are less than 500 residents affected in a single
state, a log of such disclosures must be maintained and
forwarded to the Secretary of HHS each year
BN Requirements continued
Lisa Asbell 2012 72
Notice requirements apply to all PHI
• Notice requirements will take effect for breaches occurring 30 days
after the promulgation of regulations by the Secretary of HHS, which
must occur on or before August 17, 2009
• Notices must contain at least
– A brief description of what occurred
– A description of the types of unsecured PHI that were involved in the
breach
• Name
• SSN
– The steps individuals should take to protect themselves from
potential harm
– A brief description of what the covered entity is doing to investigate
the breach, mitigate damage and protect against further breaches
– Covered entity’s contact information for questions by patients
HITECH and FTC Concerns
Lisa Asbell 2012 73
• For purposes of HITECH, the FTC notes that the reach
of the FTC is beyond its traditional jurisdiction under
Section 5 of the FTC Act because the ARRA does not
limit the FTC’s enforcement authority to the provisions of
Section 5
• FTC broadly defines “identifiable health information”
– Many entities will be unexpectedly subject to FTC’s
jurisdiction
• FTC requires notification within five (5) days of discovery
of breach involving more than 500 individuals (HHS says
within 60 days)
Lisa Asbell 2012 74
HITECH and the FTC – Concerns • Terms with respect to penalties are unclear:
– Reasonable cause
– Reasonable diligence
– Willful neglect
• Currently, there is not a clear understanding of the
terms; “reasonable cause” and “reasonable diligence”
often turn on “business care and diligence,” however
“business care and diligence” is not defined in HITECH
• In case law, the definitions of all of these terms occur in
tax fraud and tax avoidance cases, and courts have not
been traditionally favorable to business entities under
these standards
Accounting For Disclosures
Lisa Asbell 2012 75
• HITECH adds a new burden of accounting for entities that
maintain PHI in electronic health records
• The accounting requirement applies only to releases of PHI
outside the covered entity
• HITECH now requires covered entities and business associates
to account for all electronic discloses of PHI
• The accounting must produce disclosures made for three (3)
years prior to the date of the request for accounting
• A covered entity may choose to either
– Produce an accounting of all disclosures made by itself and all
of its business associates, or
– Produce an accounting of all disclosures made by itself and a
list of all business associates receiving electronic PHI
Accounting For Disclosures
Lisa Asbell 2012 76
There are two separate effective dates for this
expanded accounting obligation:
– For covered entities and business associates
currently using an electronic health record system, the
effective date is January 1, 2014
– For covered entities and business associates who
acquire an electronic health record system after
January 1, 2009, the effective date is the later of
January 1, 2011 or the date that the electronic health
system is acquired
• Late adopters have less time to comply (why?)
• The Secretary of HHS can extend both of these
deadlines up to a maximum of two (2) years by
regulation
Restrictions On Disclosure Of PHI
Lisa Asbell 2012 77
• Will apply six (6) months after the Secretary of HHS
promulgates regulations, which must occur on or
before August 17, 2009
• HITECH does not prohibit the sale of properly de-
identified information
• HITECH requires covered entities and business
associates to agree to requested restrictions if:
– The disclosure is to be made to a health plan for
purposes other than treatment
– If the patient or someone else pays in full for the
care that is the subject of the PHI
Restrictions On Disclosure Of PHI
Lisa Asbell 2012 78
Patients will be able to prevent third-party payers from
having access to records of care for which the payer is
not financially responsible
– This restriction would not apply if the payer is also a
provider of health care treatment, such as HMOs
• Covered entities should consider whether their current
technology will enable them to keep track of such
requests and ensure that such information is not
disclosed in violation of a patient’s request
• For providers participating in a RHIO, the tracking may
be particularly difficult to accomplish without
sophisticated technology and training
Restrictions On Disclosure Of PHI
Lisa Asbell 2012 79
HITECH makes it clear that the sale of PHI
by covered entities or business associates is
not permitted, except in very limited
circumstances, without a specific advance
patient authorization
• The authorization must include “a
specification of whether the [PHI] can be
further exchanged for remuneration by the
entity receiving [PHI]”
• De-identified data can still be sold
Marketing and Fundraising
Lisa Asbell 2012 80
These restrictions apply on and after February 17, 2010
and severely limit marketing communications
• HITECH clearly states that:
– All patients must have the opportunity to opt out of
communications regarding fundraising
– Fundraising communications may no longer be
considered “health care operations”
• Covered entities will be severely limited in their ability to
receive payment from third parties in exchange for
communicating with their patients in a way that would
have been considered marketing under the HIPAA
Privacy Rule
Lisa Asbell 2012 81
Government Oversight – Audits
• The Secretary of HHS is required to conduct periodic audits to
ensure that covered entities and business associates are in
compliance with HIPAA
• The Secretary of HHS could begin conducting audits as soon as
February 17, 2010
• If audits are dependent upon the enactment of implementing
regulations, then the audits of those obligations could begin by
February 17, 2011
• Covered entities and business associates should prepare for audits
to begin no later than February 17, 2010 for all HIPAA requirements
in effect at the time of HITECH’s adoption and all provisions of
HITECH that are implemented by that date
NEW HIPAA FINES
Lisa Asbell 2012 82
Tier A – If the offender did not know
$100 for each violation, total for all violations of an identical
requirement during a calendar year cannot exceed $25,000.
Tier B – Violation due to reasonable cause, not willful neglect
$1,000 for each violation, total for all violations of an identical requirement
during a calendar year cannot exceed $100,000.
Tier C – Violation due to willful neglect, but was corrected.
$10,000 for each violation, total for all violations of an identical requirement
during a calendar year cannot exceed $250,000.
Tier D – Violation due to willful neglect, but was NOT corrected.
$50,000 for each violation, total for all violations of an identical requirement
during a calendar year cannot exceed $1,500,000.
Importance of Staff Training
Lisa Asbell 2012 83
A recent study from the AMA says that over 70% of identity thefts in a medical facility/practice is an INSIDE job.
You must train every employee specifically on Identity Theft, FACTA, HITECH all policies and the “Red Flags” that apply to your facility.
Training should be conducted by some one with extensive knowledge of identity theft and the laws.
Lisa Asbell 2012 84
Lisa Asbell 2012 85
Lisa Asbell 2012 86
1. Everything we have covered today has to do with
information protection. True or False?
2. You can truly protect yourself from identity theft.
True or False?
3. The scariest type of identity theft is medical. T or F?
4. Every company/medical facility regardless of size has at
least one law to comply with when it comes to protecting
information?
T or F?
5. FACTA is enforceable by FEDERAL law and there are
fines attached. T or F?
Lisa Asbell 2012 87
6. Red Flags Rules is about information protection?
T or F?
7. All 26 flags apply to every organization
in America. T or F?
8. A data breach as defined by HIPAA applies only to
encrypted information. T or F?
9. Under HITECH the areas to update are HIPAA Security
Policy, Breach Notification Policy and BA Agreement.
T or F?
10.Business Associates are Covered entities under the
new changes. T or F?
DM Solutions
Lisa Asbell 2012 88
FACTA/ Red Flag Rules /HITECH $899.00
Includes a template of the program that you can personalize for your organization. For
Red Flags and HITECH
Updated BA agreement
Data Breach Notification Policy
Red Flag Policy
Security Policy
Step by Step guide to implement In only 1-2 hours
All forms for training employees and a employee training recorded call for your
convenience
A 30 minute consultation to ask questions and so you can jump start getting your program
in place
Includes live employee audio training
Order both today for only $499.00
As a special offer. I have included FULL OSHA and HIPAA
manuals on the CDs!
Thank You!
Lisa Asbell 2012 89
Lisa Asbell, RN, CHP, CITRMS 727.502.7427