Data Security in the “New Normal” of Teleworking

By Margaret Young Levi and Kathie McDonald-McClure

The 2020 worldwide pandemic will go down in the history books much like the 1918 Spanish Flu.  One big difference between then and now: the technology that has enabled millions of us to remain moderately productive “at work” from the comfort of our homes.  Welcome to the “new normal” of telework.  Being comfy at work in yoga pants – saving time by not having to dress for “the office” as we once knew it.  Shorter commutes, with coffee refills only steps away in the “breakroom” – our kitchens.  Staying connected to our co-workers, clients and work associates in Brady Bunch style, creating a little mystique with virtual backgrounds on Zoom, Microsoft Teams or WebEx video conferencing platforms.

As relaxed as we may be in the new normal of teleworking, it’s not a time to relax when it comes to being vigilant in securing the confidences of our employers, employees, clients or customers.  Teleworking brings new technology challenges:  learning new software and conferencing programs, managing confidential paper documents, and protecting electronic data.  And since our homes are now an extension of our offices, these challenges may create additional exposure for employers. As office workers and healthcare providers switched to telework and telehealth under state stay-at-home orders, malicious cyber actors were ramping up to take advantage of the security gaps that would inevitably accompany such a sudden transition. Wyatt data privacy counsel offer practical tips to protect employer and client data, as well as personal information, in the new normal of telework.

Continue reading

Audio-Video Conferencing Risks and Tips for Healthcare Providers

by Margaret Young Levi and Kathie McDonald-McClure

Federal and state governments have relaxed restrictions on telehealth to encourage and empower medical providers to serve patients at home during the novel coronavirus (COVID-19) national public health emergency (PHE). Both medical providers and patients have embraced this new way of connecting due to its convenience and, as a result, the expanded use of telehealth is likely here to stay.  The use of audio and video conferencing for patient care, while convenient, risks an unauthorized disclosure of sensitive information if it is used without due regard for whether the connections are secure. 

Following expansion by the U.S. Department of Human Health Services’ Office for Civil Rights (OCR) and the Centers for Medicare and Medicaid Services (CMS) of federal telehealth services and relaxation of certain requirements during the COVID-19 PHE, Kentucky Medicaid followed suit.  See our previous post about Kentucky Medicaid’s expansion of coverage for telehealth. 

OCR Relaxes HIPAA enforcement for telehealth during COVID-19 PHE.  OCR, the agency responsible for enforcement of HIPAA, issued guidance on its enforcement discretion with regard to certain telehealth practices under HIPAA.  This guidance makes it clear that OCR will not enforce penalties for the use of technology that is not HIPAA compliant, when used in the good faith provision of telehealth services.

Under this Notice, covered health care providers may use popular applications that allow for video chats, including Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, or Skype, to provide telehealth without risk that OCR might seek to impose a penalty for noncompliance with the HIPAA Rules related to the good faith provision of telehealth during the COVID-19 PHE. 

Continue reading