WhitePaper- Archiving Supports HIPAA Compliance

ABOUT THIS
WHITE PAPER How Archiving Supports HIPAA Compliance
This white paper
Most companies and medical establishments do not archive their electronic content
discusses the various
in a coordinated or meaningful way. Research has found in numerous market
reasons to archive email research surveys that only about two in five organizations has a true archiving system
and other electronic – one that will index all content that should be retained for long periods, place this
content. However, it goes content into archival storage where it cannot be modified, and make it available via
beyond that to provide robust search tools when data must be extracted from the archive. To be sure,
some concrete reasons almost all businesses perform nightly backups of their content stores, many take
and justification for periodic snapshots of data for purposes of restoring data if necessary, and many use
continuous data protection (CDP) systems to protect their data. However, most
deploying and
companies and medical establishments do not truly archive their content.
maintaining an archiving
system, most of which Does Your Organization Need to Archive Electronic Content?
are based on the cost
savings that archiving can In a word – Yes! You must archive all of your patient records and business records
provide – both direct cost that are stored electronically. There are no exceptions.
savings and reduced costs
For virtually any company or medical establishment, there are five drivers for archiving,
arising from lowered risk.
although the importance of these drivers will vary by the size of the organization,
the industry in which it participates, the advice of internal and external legal counsel
and the locales in which it operates:

• Legal Drivers
Email and other electronic content stores contain a growing proportion of business and
patient records that must be preserved for long periods of time. Further, this content
is frequently requested during discovery proceedings, because of the Federal Rules of
Civil Procedure (FRCP) and state versions of the FRCP. As a result, it is critical that all
relevant electronic content be made available for e-discovery purposes.

Formally enacted in 1975, the FRCP governs court procedures for civil suits filed in
the US federal courts. As a result of new amendments to the FRCP that went into
effect in December 2006, the discovery of electronically stored information, including
email messages, instant messages, word processing files, spreadsheets,
presentations and other content, is now a mandatory point of discussion in civil
cases. When subpoenaed for information, the responding party has a maximum of
30 days to respond according to Rule 34 of the FRCP.

Contact us to learn re:
Succor Consulting Group, Inc. www.mysuccor.com (888) 803-9431 | (704) 215-4411

The current version (2007) of the Rules requires the responding party to “[…]
produce documents as they are kept in the ordinary course of business […]” Rule
34: 34(b)(2)(E)(i). This means that if the responding party uses data online and
searches it electronically, they cannot supply that data as hard copy. The
amendment also requires opposing parties to discuss e-discovery issues within 120
days of a lawsuit's filing.
THE GOAL OF
THIS WHITE When a hold on data is required, it is imperative that an organization immediately be
able to begin preserving all relevant data, such as all email sent from senior
PAPER managers to specific individuals or clients/patients, word processing documents that
may contain corporate policy statements, spreadsheets with auditors’ opinions, and
This white paper will not so on. An archiving system allows organizations to immediately place a hold on data
attempt to deal with the when requested by a court or on the advice of legal counsel.
first objection – the
decision of whether or If an organization is not able to adequately place a hold on data when it is obligated
not you should avoid to do so, it can suffer a variety of serious consequences, ranging from
archiving because of the embarrassment to major legal sanctions or heavy fines. Litigants that fail to
smoking guns in your preserve electronic content properly are subject to a wide variety of consequences,
organization – other than including brand damage, additional costs for third-parties to review or search for
to offer two points of data, court sanctions, directed verdicts or instructions to a jury that it can view a
advice: first, don’t do defendant’s failure to produce data as evidence of culpability.
things that will get your
company into trouble; Further, an archiving system allows an organization to perform either formal or
and second, eliminating informal early case assessment activities. For example, if a terminated employee
all of your incriminating has threatened to sue his or her former employer in a wrongful termination action,
content is futile – senior managers can search the archive for information that will help them
someone, somewhere determine the potential liability they face. If this assessment of the potential lawsuit
will have a copy of it and results in a determination that the establishment was indeed wrong in firing the
it will come back to bite employee (the aforementioned smoking gun), they can instruct legal counsel to
you. Instead, the goal of pursue a quick legal settlement. If, on the other hand, the assessment results in the
this document is to deal discovery of information that supports the appropriateness of the establishment’s
with the latter objection decision, that information can be used to convince the ex-employee to drop the case
to archiving. It will or it can help win the case if it goes to trial. In either case, the archiving system can
demonstrate that help the organization to understand its position early on, either avoiding
archiving can provide unnecessary legal fees or an adverse judgment, or reducing its costs by proving the
actual, hard cost savings sufficiency of its case.
for an organization,
meaning that instead of Regulatory Compliance
archiving representing a There are a large and growing number of regulatory obligations to preserve email.
cost of doing business, it Some of the higher profile requirements are:
will actually be a way of
reducing your overall Health Insurance Portability and Accountability Act of 1996 (HIPAA)
costs and pay for itself in All organizations operating in the healthcare field need to comply with HIPAA to
a relatively short time. ensure the safety of Protected Health Information. Organizations are required to
protect the data from unauthorized users, as well as to retain for six years a
broad range of documentation regarding their compliance.


As part of the American Recovery and Reinvestment Act of 2009 (ARRA), the
provisions of HIPAA have been significantly expanded. A key component of
ARRA is the Health Information Technology for Economic and Clinical Health Act
(HITECH). Now, business partners of entities already covered by HIPAA, such as
pharmacies, healthcare providers and others, are required to comply with HIPAA
provisions. This includes attorneys, accounting firms, external billing companies
Does Your
THE GOAL OF and others that do business with covered entities. While these business
Organization
THIS WHITE associates were accountable to the covered entities with which they did business
Need to Archive
PAPER
under the old HIPAA, these associates are now liable for governmental penalties
under the new law.
Electronic
This white paper will not
Content? with the
attempt to deal
Related to the point above is that penalties for HIPAA violations have been
expanded dramatically. For example, if a covered entity or one of their business
first objection – the associates loses 500 or more patient records, they must notify HHS and a
decision of whether or “prominent media outlet” to let them know what has occurred. Fines for
not you should avoid a
YES! Why? Here’s just violations can now reach as high as $1.5 million per calendar year.
archiving because of the
few:
smoking guns in your Sarbanes-Oxley Act of 2002
 Legal Drivers
organization – other than The Sarbanes-Oxley Act of 2002 requires all public companies and their auditors
to offer two points of to retain such relevant records as audit workpapers, memoranda,
 Regulatory
advice: first, don’t do correspondence and electronic records – including email -- for a period of seven
things that will get your
Compliance years. Company officers are obliged to report internal controls and procedures
company into trouble; for financial reporting and auditors are required to test the internal control
and  Storage
second, eliminating structures. Establishments have to ensure employees preserve information --
all of your incriminating
Management whether paper- or electronic-based -- that would be relevant to the company’s
content is futile – financial reporting.
someone, somewhere
 End User Self-
will have a copy of it and
Service Securities and Exchange Commission Rules
it will come back to bite Members of national securities exchanges, brokers and dealers are obliged to
you.Instead, the goal of
Knowledge preserve all records for a minimum of six years, the first two years in an easily
this document is to deal
Management accessible place (SEC Rule 17a-4). The affected records are broad and
with the latter objection encompass originals of communications generated and received by individuals
to archiving. It will
 Data Mining within financial institutions, including inter-office memoranda and internal audit
demonstrate that working papers. Also included are automated messages sent to all customers,
archiving can provide
 Reduction of which could include email blasts. The records may be "immediately produced or
actual, hard cost savings
Costs reproduced on 'micrographic media' [microfilm, microfiche or similar] or by
for an organization, means of 'electronic storage media'.
meaning that instead of
archiving representing a Financial Industry Regulatory Authority (FINRA)
cost of doing business, it FINRA is a non-governmental regulator formed in 2007 by the merger of various
will actually be a way of functions of the New York Stock Exchange and the National Association of
reducing your overall Securities Dealers. FINRA manages a wide variety of rules that are imposed
costs and pay for itself in upon the more than 5,000 brokerage firms and nearly 675,000 registered
a relatively short time. representatives it oversees.

Model Requirements for the Management of Electronic Records (MoReq)
MoReq is a specification, originally developed in 2001, that defines the functional
requirements for the manner in which electronic records are managed in an


Electronic Records Management System. MoReq has been used widely in
Europe and has been updated with MoReq2.

A small sampling of the many other requirements for data retention are FINRA
3010, the Investment Advisors Act of 1940 (hedge funds), the Gramm-Leach-
Bliley Act, IDA 29.7, FDA 21 CFR Part 11, OCC Advisory, the Financial
WHY DON’T MORE Modernization Act 1999, Medicare Conditions of Participation, the Fair Labor
BUSINESSES Standards Act, the Americans with Disabilities Act, the Toxic Substances Control
Act, the UK Companies Act, the UK Company Law Reform Bill - Electronic
ARCHIVE THEIR
Communications, the UK Combined Code on Corporate Governance 2003, the UK
CONTENT? Human Rights Act, Basel II, and the Markets in Financial Instruments Directive.

The regulations above are but a very small sample of the regulations focused on
The objections to data retention that impact archiving requirements and practices. Additional
archiving tend to revolve regulations are shown in a table later in this report.
around two major
themes:

• Archiving preserves
“smoking guns” – that
content that might reveal
poor judgment on the
part of decision makers
or rogue employees that
could harm a company or
practice at trial or during
a regulatory audit.

• There’s a misconception
that archiving may be too
expensive.


PHYSICIANS,MORE
WHY DON’T
THEIR STAFF AND
COMPANIES
PATIENTS
ARCHIVE THEIR
CONTENT?
Today, we live in the
electronic era. More and
more we are seeing a
The objections to
shift in the way
archiving tend to revolve
physicians and their staff
around two major
communicate with their
themes:
patients.

We now have patient
portals where patients
• Archiving preserves
can send messages to
“smoking guns” – that
their physicians andreveal
content that might staff.
poor judgment on the
Patients are more likely
now,of corporate decision
part than ever, to send
requests to their
makers or rogue
physicians and office
employees that could
personnel, via emailtrial
harm a company at and
other electronic means.
or during a regulatory
audit.
Even if a patient sends a
request just for a change
of appointment; this
informationis simply too
• Archiving MUST be
expensive, particularly
kept, as it is now
considered a patient
when there are higher
record. for scarce IT
priorities
dollars or when economic
conditions mean that
some things just cannot
be funded.


• Storage Management
A business does not have to have billions of documents to experience significant
email storage growth. The dual drivers of cheaper disk storage and the increased
size of email messages, thanks to attachments such as images and videos, is fueling
the electronic content storage explosion. Messaging storage is growing at roughly
30% annually, which means that a terabyte of storage today will swell to nearly 2.5
HIPAA terabytes in just three years.
VIOLATIONS AND
The implications of rapid storage growth can be significant. For example, the total
ENFORCEMENT cost of storage – including its acquisition, deployment, configuration, maintenance
and power consumption – is anywhere from five to eight times the cost of the
Failure to comply with storage hardware itself.
HIPAA can result in civil
and criminal penalties (42 Archiving is a very useful tool in reducing the volume of storage on email servers
USC § 1320d-5).Civil and in other electronic repositories, such as SharePoint or Quickr. One way to
Penalties . use archiving as a storage management tool is through the use of stubbing, in
which email messages are replaced with “stubs” – roughly 10Kb links that point to
The “American Recovery content that has been migrated from users’ mailboxes to the archive. When a user
and Reinvestment Act of clicks on a stub, the message and attachment are retrieved from the archive and
2009”(ARRA) that was presented to the user as though the message were still in their mailbox. An
signed into law on alternative is to stub only attachments, leaving the message itself intact and
February 17, 2009, replacing the attachment with a link. As with email stubbing, when a user clicks on
established a tiered civil the link, the attachment is retrieved from the archive. Another alternative is to
penalty structure for migrate emails and attachments to the archive without the use of stubbing, allowing
HIPAA violations (see users to search for content directly from the archive.
below). The Secretary of
the Department of Health Regardless of the particular method used, the advantages of using archiving to
and Human Services control storage growth include removing large amounts of content from “live” content
(HHS) still has discretion stores like email servers or SharePoint servers and placing it on less expensive archival
in determining the storage, as well as reducing the time required for both backups and restores.
amount of the penalty
based on the nature and • End-User Self Service
extent of the violation Most IT staff members would wholeheartedly agree with the notion that users asking
and the nature and them to recover missing or deleted emails, files and other content is among the less
extent of the harm pleasant aspects of their jobs. Aside from the difficulty associated with recovering
resulting from the this content, the time it requires takes away from other tasks that would allow IT to
violation. The Secretary is be more productive and contribute more to the company.
still prohibited from
imposing civil penalties An appropriately designed archiving capability allows IT staff to put users in charge
(except in cases of willful of recovering their own missing or deleted content, freeing IT from the burden of
neglect) if the violation is doing this for them. This can result in significant cost savings, as discussed later in
corrected within 30 days this white paper, as well as recovery of IT time that otherwise would be spent on
(this time period may be this important, but unproductive, task.
extended).
• Knowledge Management / Data Mining
As employees rely on email, collaboration tools and other content repositories as the
primary tools they use to do work, it is important for companies to be able to extract
business intelligence from the content that employees generate. Some archiving


systems enable customers to quickly locate emails up to 15 years old and extract
information, such as the identity of users’ email correspondents or reports they
generated. This could be useful, for example, when a new employee is required to
trace back correspondence and other content between his or her predecessor and a
customer or patient. There are also sophisticated tools that can perform automated,
large-scale retrieval and rigorous in-depth analysis of archived content, adding to the
FINES FOR HIPAA value of what archiving can offer a medical establishment.
NON-
Cost Justifying the Deployment of Archiving
COMPLIANCE
JUSTIFYING ARCHIVING TO YOUR BOSS(ES)
Fines apply to physicians
One of the most important considerations in the process of selecting an archiving
that willfully neglect to
solution is to first justify the need for archiving to senior decision makers, since not
comply with HIPAA and
everyone agrees that email and other content archiving is a sound business practice.
range from $10,000.00
For example, roughly one in eight IT decision makers believes that deleting all email
per violation to
content on a regular basis is the least risky option, since it reduces the likelihood that
$50,000.00 per violation,
incriminating evidence will be found during legal discovery, a regulatory audit, etc.
up to $1.5 million per
calendar year for one
If you’re trying to justify archiving, there are some hard cost savings that any
“identical violation,” if
organization can realize by deploying the right archiving capability, whether hosted or
corrective action is not
on-premise. Further, there are some additional savings and risk mitigation issues that
taken in the case of
archiving can also provide – these are discussed in the next section.
willful neglect to comply
with HIPAA. In other
In the following examples, we will use the following assumptions:
words, a specific violation
of an “identical
• Fully burdened IT staff member salary: $80,000
requirement or
• External legal counsel fees: $200 per hour (average of attorneys and paralegals)
prohibition” may not
exceed $1.5 million
SCENARIO 1: E-DISCOVERY OR REGULATORY AUDIT
during a calendar year.
• Without archiving
Just about every organization of any size will need to go through an e-discovery
exercise at some point, either directly as a litigant in a legal action or in support of
another organization that is directly involved in a lawsuit. Further, heavily regulated
organizations like broker-dealers will periodically need to respond to regulatory
requests for information. These types of requests, which today are a key
component of most legal or regulatory actions because of the large and growing
proportion of business records stored electronically, have become a fact of life for
most organizations.

Let’s say that a 500-seat organization must respond to an e-discovery or regulatory
audit request and all of its electronic content is stored on 500 backup tapes.
Further, let’s assume that IT will spend 30 minutes loading each tape into a recovery
server and copying the data to a central repository for processing by legal staff.
Another 24 hours of IT staff time will be required to address issues like corrupted
.PST files, tapes that cannot be read, etc. Let’s also assume that legal staff will
require 320 person-hours to search through this repository for relevant content (the
equivalent of one person working full time for eight weeks).


This figure can vary widely based on the type of data through which legal must
search, but this figure is based on a real-world example. Using the
assumptions above, an organization will spend 250 person-hours of IT staff
time at a total cost of $10,538 (250 hours x $38.46/hour) to recover the data
from the backup tapes. Further, the cost of legal staff will be $64,000 (320 hours x
EMAIL ARCHIVING $200 per hour), yielding a total labor cost of $74,538 for just a single e-discovery
exercise or a regulatory audit.
Your staff and patient
email contains a wealth • With archiving
of information that is Now, let’s assume that the organization has an archiving system that can be
crucial to your medical accessed by legal staff directly. Although archiving systems can vary widely in price
business. based on their feature set, licensing costs and other factors, let’s assume a three
year cost of $120 per seat (including acquisition, support and maintenance costs), or
Protect it with an
$60,000 for the entire organization. We’ll further assume that an organization will
Intuitive and fully
need to go through 10 e-discovery or regulatory audit requests over a three-year
integrated email
period. If we spread the cost of the archiving system over just these requests, that
archiving solution. results in a cost per request of $6,000 for the archiving system.
Email Archiving backs up
your folders, tasks, Using the same assumptions as in the example above, we can eliminate the IT cost,
calendars and much since the legal staff can access the archive directly without any involvement from IT.
more, right down to the Further, because the archived information has already been indexed before being
metadata. archived, searching across the archive will be much simpler and faster. If we
conservatively assume that the legal staff time will be halved when using an archive,
the legal labor cost will be $32,000 (160 hours x $200 per hour), although in many
cases the reduction in time spent by legal will be significantly lower than this.

Based on these assumptions, the cost of a single e-discovery exercise or regulatory
audit will be $38,000 ($32,000 in labor and $6,000 for the archiving system),
resulting in a net savings per request of $36,538. Based on the rather conservative
assumption of 10 e-discovery requests every three years, that results in a total
savings of about $365,000 over a three-year period.

SCENARIO 2: SETTLING A LEGAL ACTION BEFORE GOING TO TRIAL

• Without archiving
Let’s assume a similar situation to the one above – a sort of informal discovery
conducted by senior management and external legal counsel as part of an early
assessment of a potential lawsuit. This is the type of exercise that might be
conducted if management suspected that some situation – such as a faulty product
that injured a customer or an employee terminated under difficult circumstances –
might result in a lawsuit. This action would probably be less extensive than the ediscovery
example above and, for purposes of this example, would involve searching only
through 100 backup tapes.

In this example, let’s assume that 20 such exercises will be conducted over a three year
period, each one at a cost of $14,908 (one-fifth the cost of a full e-discovery
exercise). The total labor cost of these early case assessments, therefore, would be


$298,152 over a three-year period.

• With archiving
Now, let’s assume that an archiving system could be used to conduct these early
case assessments. Using the same assumptions as shown above (20% of the effort
of a full-blown e-discovery or regulatory audit exercise), the total cost of legal staff
BROAD examining content from the archive will be $6,400. Add to this the cost of the
ARCHIVING archiving system ($60,000) spread out over 20 early case assessments and the total
cost per assessment will be $9,400, or a total three-year cost of $188,000. The net
A broad archiving savings from the use of an archiving system, then, will be $110,152 over three
portfolio enables you to years.
create an accessible
online archive to lower SCENARIO 3: END-USER SELF SERVICE
operational costs and
facilitate retrieval of • Without archiving
valuable information. Users periodically delete content that they will need at some point. This content
might be a word processing document they have taken a considerable amount of
Eliminate the need for time to write, an email with an important communication from a customer, or a
tape backups and financial spreadsheet. For purposes of this example, let’s again assume a 500-
archives. person organization and each employee needs to recover just one document per
month. This results in a total of 6,000 documents that need to be recovered each
Reduce the cost of year (500 employees x one document per month x 12 months). Let’s further
primary storage. assume that IT requires an average of 30 minutes to recover each document from a
backup tape.
Ensure compliance with
regulatory and litigation
Assuming that IT even has the bandwidth to recover all of these documents, IT staff
requirements.
members will spend a total of 3,000 hours annually (6,000 documents x 30 minutes
Remove traditional per document) recovering this content. The total IT cost of document recovery,
archive silos. therefore, will be $115,385, the equivalent of 1.44 full-time IT staff members.

Online Access. • With archiving
Now, let’s assume that the organization has deployed an archiving system that has
Increase content reuse been configured to allow individual users to access their own archived content. If
capabilities and storage we assume that five minutes will be required to recover a document and that the
efficiency throughout average employee salary is identical to that of IT staff members, then the total cost
your organization. of employees recovering their own documents will be $19,231 annually (6,000
documents x five minutes of recovery per document). The total annual savings
compared to IT recovering the documents will be $96,154. Factor in the cost of the
archiving system (average of $20,000 per year) and the cost savings from end-user
access to the archive is still a significant $76,154 per year.


TYPES OF SUMMING UP
ARCHIVING
The examples of cost savings with an archiving system discussed are summarized in the
Backup and archiving following table.

Unchanged data archiving

Enterprise Application
archiving

File System Archiving

Integrated Content
Archiving

Image Archiving
If we assume that each of the scenarios discussed above would apply to a typical 500-
Internet Archiving
person organization, then an archiving system that cost $60,000 per seat over a three year
Email Archiving period would end up saving an organization a total of $884,002 (across all three
scenarios) during that period for a net savings of $824,002 over three years. Even if we
Business Data Archiving assume that an archiving system would cost three times our estimate of $120 per seat
over three years, or $360 ($10 per seat per month), the cost savings would still be a
Patient Data Archiving very substantial $524,002 over three years.
Much More!
Other Justifications for Archiving
In addition to the justifications for archiving based on quantifiable cost savings, there
are a variety of important justifications that are not as readily quantifiable or as
predictable. For example:

• An inability to produce all required content during e-discovery can result in sanctions
directed against the party that cannot produce the necessary content. This might
represent nothing more than incurring a judge’s ire during legal proceedings, or it
could result in significant sanctions. For example, in Keithley v. Homestore, Inc.1,

1 Kevin Keithley v. The Home Store.com, Inc., 2008 U.S. Dist. LEXIS 61741 (August 12, 2008)

Keithley won on summary judgment, but still had to pay $283,000 in fees for its
failure to produce required electronic evidence. In Qualcomm, Inc. v. Broadcom
Corporation2, Qualcomm initially prevailed, but it was later discovered that
thousands of emails were not produced during the case. As a result, the Court
awarded $8.5 million in attorney’s fees and costs against Qualcomm. In some cases,
judges have instructed juries that a party’s inability to produce required content can
be considered evidence of culpability.


• An inability to produce data on demand can result in the loss of reputation, brand
damage or lost opportunities for future revenue. If, for example, a broker-dealer is
sanctioned by the Securities and Exchange Commission for its failure to retain and
produce data, the negative press that could result can harm the company’s
reputation with its shareholders and prospective customers.
BENEFITS OF
ARCHIVING • As noted earlier, if an organization must go through an e-discovery exercise or a
regulatory audit using only backup tapes or some other “quasi-archive”, a substantial
 Reclaims disk amount of time can be spent responding to the request for information. In addition
space to the direct cost associated with IT and legal staff extracting and poring through
 Lowers storage the data, there is also an opportunity cost associated with doing so. The result can
costs be delays in other projects, postponement of infrastructure upgrades and the like,
 Reduces object any of which can have consequences that may be difficult to quantify, but are
maintenance nonetheless impactful.
 Improves the
• One of the primary functional benefits of an archiving system is its ability to act as a
performance of
repository for older electronic content that might otherwise be stored on email
active data
servers or file servers. By migrating older content to an archive, email, file and
 Comply with
other servers can operate more efficiently, backup windows for these servers are
federal
shortened, and restores can be accomplished much more quickly. For example, if
regulations
1,000 users are served by an email server that has gone down and the restoration
 Monitor
process can be shortened by just one hour because an archiving system has
employee
permitted the data store to be smaller, that can result in a significantly lower
communication
productivity loss for those users.
 Searchable data
storage increases
The bottom line is that archiving is, at its core, not a cost of doing business, but a viable
productivity
means of reducing costs.
 Can be “cloud”
based and
accessed
anywhere,
anytime

The major benefits of
archiving are
interrelated.

By reclaiming disk space
that was consumed by
inactive data, you can
effectively lower your
storage costs and reduce
object maintenance. As a
result, access to your
active data becomes
See our archiving brochures: www.mysuccor.com/mymedbackup/brochures/mmcmas.pdf
more efficient.
www.mysuccor.com/mymedbackup/brochures/mmbpro.pdf
www.mysuccor.com/mymedbackup/backups.html


WhitePaper- Archiving Supports HIPAA Compliance

More Related Content

What's hot

Similar to WhitePaper- Archiving Supports HIPAA Compliance

More from Succor Consulting Group, Inc.

Recently uploaded

WhitePaper- Archiving Supports HIPAA Compliance