Lava Lamps, Gag Gifts, and HIPAA – Ep 567 

What do lava lamps, whoopee cushions, and HIPAA have in common? More than you’d think! This week, a familiar mall retailer famous for gag gifts and lava lamps finds itself at the center of an OCR enforcement action that highlights a common misconception about employer-sponsored health plans. Along the way, you’ll learn why “we’ve never had a problem before” isn’t a cybersecurity strategy, how self-funded health plans fit into HIPAA, and why ignoring compliance can quickly become a very expensive joke.

In this episode:

Lava Lamps, Gag Gifts, and HIPAA – Ep 567

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Lava Lamps, Gag Gifts, and HIPAA

Employer Health Plans are often the Covered Entity nobody thinks about. In fact, I even recall sessions titled something like that in the HIPAA Summit.

Most people don’t understand what is actually behind their health insurance card.

If I ask what insurance you have, you’ll probably tell me the name on the card. UnitedHealthcare. Cigna. Aetna. Blue Cross.

That’s the logo you recognize.

But when you arrive at a doctor’s office, they don’t just ask, “Do you have Cigna?” They want to see the card because there is much more information on it.

You’ll find:

• The insurance company
• Your member ID
• A group or policy number
• The health plan
• Claim filing instructions

The member ID identifies you within the administrator’s system. (Side bar: Years ago, Medicare even used Social Security numbers for that purpose! That took forever to clean up.)

The health plan tells providers much more than just who your insurance company is. It helps determine what benefits apply, how claims are processed, where claims are sent, and other details needed to get paid.

That’s already a lot more information than most people think about when they simply say, “I have Cigna.”

But the health plan itself is even more important than most people realize.

For many employees, the assumption is simple: My employer buys insurance from a large insurance company and gives it to me as a benefit.

Sometimes that’s exactly what happens.

The employer purchases a health insurance product from the insurance company, pays part of the premium, and connects employees to the insurer.

But sometimes the arrangement works very differently.

Instead of buying insurance, the employer creates and operates its own health plan for employees.

The employer becomes responsible for paying the claims.

To make that possible, the employer hires an insurance company to provide access to provider networks, negotiate rates with doctors and hospitals, and perform administrative functions that would be impossible for most employers to do themselves.

The insurance company’s logo may still appear on the card.

Employees may still call the insurance company with questions.

Doctors may still submit claims through the insurance company’s systems.

But behind the scenes, the employer’s health plan is often the entity ultimately responsible for paying those claims.

And because processing healthcare claims is complicated, another player often enters the picture.

Third Party Administrators (TPAs) may be hired to process claims, manage paperwork, coordinate benefits, and perform other administrative services. The employer is responsible for making sure that gets done, not the insurance company in these deals.

The goal is usually cost savings.

The employer hopes that by funding claims directly, while using insurance companies and TPAs for administration, it can provide benefits at a lower overall cost.

Great.

But now something important has changed.

The employer is no longer simply providing a benefit connecting employees with the insurance company and they are out of the loop.

The employer is operating their own health plan and outsourcing the work.

And for HIPAA purposes, that health plan is usually considered a Covered Entity with its own compliance obligations set up inside the employer systems.

Most employees still think a health plan is simply a menu of benefits no matter which version they actually get through their employer.

On the flip side, though, OCR sees a health plan is an organization that must:

• Protect PHI
• Conduct risk analyses
• Implement security controls
• Maintain policies and procedures
• Train workforce members
• Comply with HIPAA

That’s why OCR’s settlement with the Spencer Gifts employee health plan gives us something more to discuss than just the fact that this is the 20th ransomware enforcement action and 14th Risk Analysis Initiative enforcement action.

OCR wasn’t concerned with copays, deductibles, or provider networks.

OCR wanted to know whether the health plan had conducted a risk analysis and implemented HIPAA-compliant policies and procedures before a ransomware attack occurred.

According to OCR, the answer was no.

Effective cybersecurity starts with Security Rule compliance, ensuring that Security Rule provisions are implemented before a cyberattack occurs. Regulated entities — including covered group health plans — should ensure these protections are firmly in place well before a cyberattack occurs, so the privacy and security of individuals’ health information remain safeguarded.

• OCR Director Paula M. Stannard

HHS’ Office for Civil Rights Settles Ransomware Investigation with Health Plan

OCR Spencer Settlement Agreement

Case Facts

• Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans was the employer-sponsored health plan involved in the settlement. This is the employee health plan, not the retail stores themselves.
• OCR opened the investigation after a breach report was filed in January 2022 following a ransomware attack discovered in November 2021.
• The attack affected 10,023 individuals. Exposed information included names, addresses, phone numbers, email addresses, and Social Security numbers.

What OCR Found

• OCR found that the health plan had not conducted an accurate and thorough risk analysis before the incident.
• OCR also found that compliant HIPAA Privacy, Security, and Breach Notification Rule policies and procedures were not implemented until after the breach occurred.
• Interesting note: OCR did not describe outdated policies, incomplete policies, or inadequate policies. OCR specifically stated compliant policies and procedures were not implemented until after the breach. That suggests a much more fundamental compliance problem than simply needing updates or additions.

The Settlement

• $450,000 settlement payment.
• Two-year corrective action plan.

What OCR Is Making Them Do In The CAP

• Conduct a complete enterprise-wide risk analysis.
• Create an inventory of all systems and locations containing ePHI.
• Review and revise HIPAA policies and procedures.
• Distribute those policies to workforce members and obtain certifications that they have read and understand them.
• Develop and deliver HIPAA training.
• Report compliance activities to OCR for monitoring.

Reading Between the Lines

• This does not read like an organization that simply missed a few security controls.
• The corrective action plan reads more like OCR is requiring the creation of a compliance program than the repair of an existing one.
• The biggest lesson may not be ransomware. The biggest lesson may be that many employer health plans fail to realize they are operating a HIPAA covered entity.
• Hiring a TPA, benefits administrator, or insurance company does not transfer HIPAA accountability.

Key Takeaways

• Employer health plans are covered entities under HIPAA.
• The logo on the insurance card does not tell the whole story.
• Self-funded plans often involve multiple parties, but OCR still expects the health plan itself to meet HIPAA obligations.
• Risk analyses continue to be one of OCR’s favorite enforcement targets.
• Cybersecurity failures are often compliance failures that existed long before the ransomware attack occurred.

The ransomware attack may have been what got OCR’s attention, but the settlement was really about what wasn’t done before the attack. Note to self: if your organization operates a health plan, you need to treat it like the HIPAA covered entity it is before a cybercriminal reminds you.

Who would have guessed that a trip down memory lane to Spencer’s Gifts would end with a lesson in HIPAA enforcement? This case is a reminder that compliance doesn’t care what your business sells — it cares whether you’re responsible for protecting health information. If your organization sponsors a self-funded health plan, now is the time to make sure your risk analysis, policies, and training are in place. Because when it comes to ransomware, “we’ve never had a problem” has never been a compliance strategy.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.