Lance's Corner

OCR Launches HIPAA Investigation of Change Healthcare

Apr 16, 2024
Per the notice below, the United States Office for Civil Rights (OCR) has launched an investigation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) into Change Healthcare and the cyberattack it suffered.

HHS Office for Civil Rights Issues Letter and Opens Investigation of Change Healthcare Cyberattack

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued a “Dear Colleague” letter addressing the cybersecurity incident impacting Change Healthcare, a unit of UnitedHealthcare Group (UHG), and many other health care entities.  The cyberattack is disrupting health care and billing information operations nationwide and poses a direct threat to critically needed patient care and essential operations of the health care industry.  OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information and the required notifications to HHS and affected individuals following a breach.  Ransomware and hacking are the primary cyber-threats in health care.  Over the past five years, there has been a 256% increase in large breaches reported to OCR involving hacking and a 264% increase in ransomware.  In 2023, hacking accounted for 79% of the large breaches reported to OCR.  The large breaches reported in 2023 affected over 134 million individuals, a 141% increase from 2022.  The full text of OCR’s letter is below:

March 13, 2024

Re: Cyberattack on Change Healthcare

Dear Colleagues:

The Office for Civil Rights (OCR) is aware that Change Healthcare, a unit of UnitedHealth Group (UHG), was impacted by a cybersecurity incident in late February that is disrupting health care and billing information systems nationwide.  The incident poses a direct threat to critically needed patient care and essential operations of the health care industry.  OCR administers and enforces the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules, which establish the minimum privacy and security requirements for protected health information and breach notification requirements that covered entities (health care providers, health plans, and clearinghouses) and their business associates must follow.  We are committed to ensuring access to care while enforcing laws that bolster patient privacy and security.  Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident.  OCR’s investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare’s and UHG’s compliance with the HIPAA Rules.  OCR’s interest in other entities that have partnered with Change Healthcare and UHG is secondary.  While OCR is not prioritizing investigations of health care providers, health plans, and business associates that were tied to or impacted by this attack, we are reminding entities that have partnered with Change Healthcare and UHG of their regulatory obligations and responsibilities, including ensuring that business associate agreements are in place and that timely breach notification to HHS and affected individuals occurs as required by the HIPAA Rules.  Safeguarding protected health information is a top priority.  OCR would also like to share the following resources to assist you in protecting your records systems and patients from cyberattacks:

  • OCR HIPAA Security Rule Guidance Material – This webpage provides educational materials to learn more about the HIPAA Security Rule and other sources of standards for safeguarding electronic protected health information.  Materials include a Recognized Security Practices Video, Security Rule Education Paper Series, HIPAA Security Rule Guidance, OCR Cybersecurity Newsletters, and more.
  • OCR Video on How the HIPAA Security Rule Protects Against Cyberattacks – This video discusses how the HIPAA Security Rule can help covered entities and business associates defend against cyberattacks.  Topics include breach trends, common attack vectors, and findings from OCR investigations.
  • OCR Webinar on HIPAA Security Rule Risk Analysis Requirement – This webinar discusses the HIPAA Security Rule requirements for conducting an accurate and thorough assessment of potential risks and vulnerabilities to electronic protect health information and reviews common risk analysis deficiencies OCR has identified in its investigations.
  • HHS Security Risk Assessment Tool – This tool is designed to assist small- to medium-sized entities in conducting an internal security risk assessment to aid in meeting the security risk analysis requirements of the HIPAA Security Rule.
  • Factsheet: Ransomware and HIPAA – This resource provides information on what is ransomware, what covered entities and business associates should do if their information systems are infected, and HIPAA breach reporting requirements.
  • Healthcare and Public Health (HPH) Cybersecurity Performance Goals – These voluntary, health care specific cybersecurity performance goals can help health care organizations strengthen cyber preparedness, improve cyber resiliency, and protect patient health information and safety.

OCR is committed to helping health care entities understand health information regulations and to collaboratively working with entities to navigate the serious challenges we face together.  OCR encourages all entities to review the cybersecurity measures they have in place with urgency to ensure that critically needed patient care can continue to be provided and that health information is protected.

Sincerely,

Melanie Fontes Rainer
Director, Office for Civil Rights

Read the Letter – PDF

The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.  OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information.  Guidance about the Privacy Rule, Security Rule, and Breach Notification Rules can also be found on OCR’s website.  If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.

USDOL Issues Comprehensive Employer Guidance on Long COVID

The United States Department of Labor (USDOL) has issued a comprehensive set of resources that can be accessed below for employers on dealing with Long COVID.

Supporting Employees with Long COVID: A Guide for Employers

The “Supporting Employees with Long COVID” guide from the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) and Job Accommodation Network (JAN) addresses the basics of Long COVID, including its intersection with mental health, and common workplace supports for different symptoms.  It also explores employers’ responsibilities to provide reasonable accommodations and answers frequently asked questions about Long COVID and employment, including inquiries related to telework and leave.

Download the guide

Accommodation and Compliance: Long COVID

The Long COVID Accommodation and Compliance webpage from the USDOL-funded Job Accommodation Network (JAN) helps employers and employees understand strategies for supporting workers with Long COVID.  Topics include Long COVID in the context of disability under the Americans with Disabilities Act (ADA), specific accommodation ideas based on limitations or work-related functions, common situations and solutions, and questions to consider when identifying effective accommodations for employees with Long COVID.  Find this and other Long COVID resources from JAN, below:

Long COVID, Disability and Underserved Communities: Recommendations for Employers

The research-to-practice brief “Long COVID, Disability and Underserved Communities” synthesizes an extensive review of documents, literature and data sources, conducted by the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) on the impact of Long COVID on employment, with a focus on demographic differences.  It also outlines recommended actions organizations can take to create a supportive and inclusive workplace culture for people with Long COVID, especially those with disabilities who belong to other historically underserved groups.

Read the brief

Long COVID and Disability Accommodations in the Workplace

The policy brief “Long COVID and Disability Accommodations in the Workplace” explores Long COVID’s impact on the workforce and provides examples of policy actions different states are taking to help affected people remain at work or return when ready.  It was developed by the National Conference of State Legislatures (NCSL) as part of its involvement in USDOL’s State Exchange on Employment and Disability (SEED) initiative.

Download the policy brief

Understanding and Addressing the Workplace Challenges Related to Long COVID

The report “Understanding and Addressing the Workplace Challenges Related to Long COVID” summarizes key themes and takeaways from an ePolicyWorks national online dialogue through which members of the public were invited to share their experiences and insights regarding workplace challenges posed by Long COVID.  The dialogue took place during summer 2022 and was hosted by USDOL and its agencies in collaboration with the Centers for Disease Control and Prevention and the U.S. Surgeon General.

Download the report

Working with Long COVID

The USDOL-published “Working with Long COVID” fact sheet shares strategies for supporting workers with Long COVID, including accommodations for common symptoms and resources for further guidance and assistance with specific situations.

Download the fact sheet

COVID-19: Long-Term Symptoms

This USDOL motion graphic informs workers with Long COVID that they may be entitled to temporary or long-term supports to help them stay on the job or return to work when ready, and shares where they can find related assistance.

Watch the motion graphic

A Personal Story of Long COVID and Disability Disclosure

In the podcast “A Personal Story of Long COVID and Disability Disclosure,” Pam Bingham, senior program manager for Intuit’s Diversity, Equity and Inclusion in Tech team, shares her personal experience of navigating Long COVID symptoms at work.  The segment was produced by the USDOL-funded Partnership on Employment and Accessible Technology (PEAT) as part of its ongoing “Future of Work” podcast series.

Listen to the podcast

HHS OIG Issues Annual Report on State MFCUs

Per the notice below, the Office of the Inspector General (OIG) of the United States Department of Health and Human Services (HHS) has issued its annual report on the performance of state Medicaid Fraud Control Units (MFCUs).

Medicaid Fraud Control Units Fiscal Year 2023 Annual Report (OEI-09-24-00200) 

Medicaid Fraud Control Units (MFCUs) investigate and prosecute Medicaid provider fraud and patient abuse or neglect. OIG is the Federal agency that oversees and annually approves federal funding for MFCUs through a recertification process. This new report analyzed the statistical data on annual case outcomes—such as convictions, civil settlements and judgments, and recoveries—that the 53 MFCUs submitted for Fiscal Year 2023.  New York data is as follows:

Outcomes

  • Investigations1 - 556
  • Indicted/Charged - 9
  • Convictions - 8
  • Civil Settlements/Judgments - 28
  • Recoveries2 - $73,204,518

Resources

  • MFCU Expenditures3 - $55,964,293
  • Staff on Board4 - 257

1Investigations are defined as the total number of open investigations at the end of the fiscal year.

2Recoveries are defined as the amount of money that defendants are required to pay as a result of a settlement, judgment, or prefiling settlement in criminal and civil cases and may not reflect actual collections.  Recoveries may involve cases that include participation by other Federal and State agencies.

3MFCU and Medicaid Expenditures include both State and Federal expenditures.

4Staff on Board is defined as the total number of staff employed by the Unit at the end of the fiscal year.

Read the Full Report

View the Statistical Chart

Engage with the Interactive Map

GAO Issues Report on Medicaid Managed Care Service Denials and Appeal Outcomes

The United States Government Accountability Office (GAO) has issued a report on federal use of state data on Medicaid managed care service denials and appeal outcomes.  GAO found that federal oversight is limited because it doesn't require states to report on Medicaid managed care service denials or appeal outcomes and there has not been much progress on plans to analyze and make the data publicly available.  To read the GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the first link below.  To read GAO highlights of the report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the second link below.
https://www.gao.gov/assets/d24106627.pdf  (GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes)
https://www.gao.gov/assets/d24106627_high.pdf  (GAO highlights on federal use of state data on Medicaid managed care service denials and appeal outcomes)

CMS Issues Latest Medicare Regulatory Activities Update

The Centers for Medicare and Medicaid Services (CMS) has issued its latest update on its regulatory activities in the Medicare program.  While dentistry is only minimally connected to the Medicare program, Medicare drives the majority of health care policies and insurance reimbursement policies throughout the country.  Therefore, it always pays to keep a close eye on what CMS is doing in Medicare.  To read the latest CMS update on its regulatory activities in Medicare, use the link below.
https://www.cms.gov/training-education/medicare-learning-network/newsletter/2024-03-14-mlnc