OC board torpedos HIPAA compliance software

On a 11-6 vote this month, the Oneida County board of supervisors shot down a request by three county agencies to purchase software they billed as a tool to help keep them compliant with federal HIPAA laws, or medical privacy regulations.

The request came in for heavy questioning, and supervisor Billy Fried said he thought it was the department head’s and staff’s responsibility to keep up-to-date with federal standards, rather than rely on software that would become an ongoing cost for taxpayers.

Representing her own department, as well as information technology and public health, social services director Mary Rideout said the county was in compliance but that its policies and procedures were outdated. She also explained how complicated HIPAA regulations are, and said the departments did not have adequate staff time to keep up to date with the ever-updating standards.

“So this is really a joint request from the ITS department, public health and social services for HIPAA compliance software,” Rideout explained to supervisors. “So as you all know, whenever you go to the doctor, you sign your HIPAA release. So our department, social services, and public health must follow the HIPAA law and regulations. The county as a whole has to have policies and procedures regarding HIPAA.”

And the county does have them, Rideout said, but they are outdated.

“They were last updated in 2014,” she said. “What the software does for us, it’s really a tool that helps guide us to updating those policies and procedures to make sure that we are in full compliance. I believe we are in compliance, but when regulators come in and want to see your compliance, they want to see your updated policies or procedures, they want to see your staff training. And what this tool does for us is that it brings that all in one place.”

On the information technology side, Rideout said, that department has to run security audits every year to make sure that all of the information being put into county computer systems is HIPAA compliant. 

“So there’s really the two components,” she said. “The privacy component that guarantees that we’re training our staff. We have policies and procedures to make sure we’re following HIPAA compliance, which really is just another layer of confidentiality for us, in addition to the IT side so that any of our protected health information that’s being put in a computer system is also secure. And so this software just is a tool that helps guides us through that process, keeps all the information in one place.”

Rideout said the funding purchases the software for three years with Covid relief dollars, and, after that, the cost of the software would come out of the three respective departmental budgets. 

Some inquiries

But the proposal came in for questions from supervisor Collette Sorgel, who first wanted to know if the departments were tracking compliance now, given the lack of software.

“Currently the health department and social services department do the training and we track that individually in our own departments,” Rideout said. “We do have our policies that are out there on our networks and saved, but what we don’t have formally going is if there’s a change in the law, we’re not getting those policies updated.”

If she happens to be at a meeting, Rideout said, and someone notes a change, then she catches that and updates the policy. But, she suggested, that’s catch is as catch can.

“But this software would be updating every year saying, ‘okay, here’s what you need to update, here’s the policies that need to change,’” she said. “And it helps guide us, like I said, and keeps that all in one place for the county instead of some of it in the social services department, some of it in public health. And then ITS, which is responsible of course for our whole network, they have their own basic tracking system. This brings it all together and we all have access to it.”

The cost, Rideout explained, would be $24,000–$8,000 a year after getting a discount for paying all three years upfront, as opposed to the normal $10,000 a year.

Sorgel wasn’t done asking questions: “Why can’t you be sharing data right now and getting updates as they come out for this without using a software to do it?”

They could, Rideout answered.

“It is just time consuming and that certainly would involve our corporation counsel to be reviewing any changes to the law to make sure that what we are implementing is following the compliance laws,” she said. 

Rideout reiterated just how complicated the federal regulations are and how many pages it involves.

“We had a full committee when the HIPAA law came into effect back in 2006,” she said. “I think there were eight staff members who worked, put this all together, and it was a good year or two project just to get the policies up for Oneida County. Unfortunately it’s just with everything else on our plate, it’s a lot to do for any individual department. This really is a tool that just makes that a lot easier for us.”

An issue of time

Essentially, Rideout said, the department just doesn’t have adequate time available to do the updates.

At the administration committee, which moved the resolution to the full county board, Rideout told supervisors she believed that updating the policies without the software would cost more in staff time than what the software would cost. 

The administration committee also determined that the project would meet Covid spending rules “as long as the terms are set by the end of 2024 and all funds are spent by 2026,” according to the minutes of that meeting.

Also at that committee meeting, the minutes state, corporation counsel Mike Fugle said he had concerns that any staff member could be fully knowledgeable of all the rules regarding HIPAA, and he “reminded the committee that in 2025 Oneida County will also be taking over the Human Service Center which has to have HIPAA policies that Oneida County doesn’t currently have.”

At the county board meeting, Rideout said the plan passed muster with the county’s capital improvement projects (CIP) committee after the departments worked on initial numbers.

“Anybody that’s on the CIP committee knows that we talked to consultants to help us get our policies and procedures up to date,” she said, adding that the departments investigated and came up with a plan they thought would be fiscally responsible.

Rideout said it would take staff time even with the software.

“There’s no doubt about that,” she said. “That’s going to take us time but a lot less time researching because they’re doing that for us. And then we’re making sure our information is updated.”

Fried spoke against the software purchase, and he said he spoke against it at CIP, though he acknowledged voting to send it to the full county board at the administration committee because, he said, CIP had supported it.

“It [his opposition] has nothing to do with the department heads or the departments that are bringing it to us,” Fried said. “I have very high respect for Mary. She certainly has a lot on her plate. I have high respect for the others as well.”

Fried said accountability was the reason he was voting no.

“I feel this is part of what the department head should be responsible for,” he said. “2014 was the last time they updated it. She stated some of this is for training — well, all people in these positions should be trained as part of their job. So I don’t think we should be spending money on it.”

In addition, Fried said, it’s not a one-time cost but something that would continue on.

And then there was this, Fried said: “When we did our budget we took a lot of grief for supporting the pay raises for the county employees and I justified that because we ask a lot of them, as well as wanting to be competitive. And I feel this should be a responsibility that they do within their job descriptions. And then certainly, if it is something they need in their departments, then it should have been in their budget.”

With that the board voted the proposal down 11-6.

Richard Moore is the author of “Dark State” and may be reached at richardd3d.substack.com.