Texas 2019 - 86th Regular

Texas House Bill HCR78 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1		-	~~86R23508~~ KSM-D
	1	+	86R12119 KSM-F
2	2		By: Capriglione H.C.R. No. 78
3		-	Substitute the following for H.C.R. No. 78:
4		-	By: Smith C.S.H.C.R. No. 78
5	3
6	4
7		-	~~HOUSE~~ CONCURRENT RESOLUTION
	5	+	CONCURRENT RESOLUTION
8	6		WHEREAS, On June 11, 2015, the Department of Aging and
9	7		Disability Services ("DADS"), a "covered entity" under Privacy,
10	8		Security, and Breach Notification Rules ("HIPAA Rules"), filed a
11	9		breach notification report with the United States Department of
12	10		Health and Human Services, Office for Civil Rights ("OCR") stating
13	11		that an impermissible disclosure of unsecured electronic protected
14	12		health information (ePHI) in violation of HIPAA Rules had occurred
15	13		when a DADS web application was accessible to unauthorized parties;
16	14		and
17	15		WHEREAS, On July 23, 2015, OCR notified DADS of its
18	16		investigation of DADS compliance with the HIPAA Rules and
19	17		determined that:
20	18		a. DADS failed to conduct an accurate and thorough
21	19		assessment of the potential risks and vulnerabilities to the
22	20		confidentiality, integrity, and availability of ePHI held by the
23	21		covered entity. (See 45 C.F.R. Section 164.308(a)(1)(ii)(A))
24	22		b. DADS failed to implement appropriate technical
25	23		policies and procedures for electronic information systems that
26	24		maintain electronic protected health information to allow access
27	25		only to those persons or software programs that have been granted
28		-	access rights as specified in 45 C.F.R. Section 164.308(a)(4).
29		-	~~(See~~ 45 C.F.R. Section 164.312(a)(1))
	26	+	access rights as specified in 45 C.F.R. Section 164.308(a)(4). (See
	27	+	45 C.F.R. Section 164.312(a)(1))
30	28		c. DADS failed to implement appropriate hardware,
31	29		software, and/or procedural mechanisms that record and examine
32	30		activity in information systems that contained or used ePHI. (See
33	31		45 C.F.R. Section 164.312(b))
34		-	d. As a result of its failure to appropriately
35		-	~~safeguard~~ the ePHI in a web-based application, DADS impermissibly
36		-	~~disclosed~~ the ePHI of up to 6,617 individuals. (See 45
37		-	~~C.F.R. Section~~ 164.502(a)); and
	32	+	d. As a result of its failure to appropriately safeguard
	33	+	the ePHI in a web-based application, DADS impermissibly disclosed
	34	+	the ePHI of up to 6,617 individuals. (See 45 C.F.R. Section
	35	+	164.502(a)); and
38	36		WHEREAS, OCR presented the State of Texas a Resolution
39	37		Agreement with Corrective Action Plan (the "Settlement Agreement")
40	38		in lieu of civil monetary penalties and to provide DADS an
41	39		opportunity to correct DADS's failures to safeguard ePHI; and
42	40		WHEREAS, The State of Texas has presented a counter-proposal
43	41		to the Settlement Agreement to OCR that applies to those covered
44	42		functions and information resources involved in the breach that
45	43		were formerly operated by DADS but that have been transferred to the
46	44		Health and Human Services Commission ("TX HHS"); and
47	45		WHEREAS, The proposed Settlement Agreement comprises the
48	46		following terms and conditions:
49		-	Payment. TX HHS agrees to pay OCR the amount of
50		-	$1,600,000.00 ("Resolution Amount" or "RA").
	47	+	Payment. OCR has agreed to deduct, and HHSC agrees to
	48	+	not contest deduction by OCR, the amount of $1,600,000.00
	49	+	("Resolution Amount" or "RA") on or before May 31, 2019, from any
	50	+	sum owing to HHSC from the Centers for Medicare and Medicaid
	51	+	Services pursuant to 45 C.F.R. Section 160.424(c).
51	52		Corrective Action Plan. TX HHS has entered into and
52	53		agrees to comply with a Corrective Action Plan ("CAP"). If TX HHS
53	54		breaches the CAP, and fails to cure the breach as set forth in the
54	55		CAP, then TX HHS will be in breach of the Settlement Agreement and
55	56		OCR will not be subject to the release set forth in the Settlement
56	57		Agreement. Compliance with the RA/CAP of the Settlement Agreement
57	58		by TX HHS is conditioned upon TX HHS obtaining the approval of, and
58	59		appropriation of funds needed to comply with, the RA/CAP by the
59	60		Legislature of the State of Texas. (See Texas Civil Practice and
60	61		Remedies Code Section 111.003(b)). The term of the Corrective
61	62		Action Plan will be three (3) years from the effective date of the
62	63		proposed agreement.
63	64		Release by OCR. In consideration of and conditioned
64	65		upon performance by TX HHS of its obligations under the proposed
65	66		Settlement Agreement, OCR releases TX HHS from any actions it may
66	67		have against TX HHS under the HIPAA Rules arising out of or related
67	68		to the conduct identified in paragraph 2 of this concurrent
68	69		resolution. OCR does not release TX HHS from, nor waive any rights,
69	70		obligations, or causes of action other than those arising out of or
70	71		related to said conduct and referred to in this paragraph.
71		-	Agreement by Released Parties. TX HHS shall not
72		-	~~contest~~ the validity of its obligation to pay, nor the amount of,
73		-	~~the~~ Resolution Amount or any other obligations agreed to under the
	72	+	Agreement by Released Parties. TX HHS shall not contest
	73	+	the validity of its obligation to pay, nor the amount of, the
	74	+	Resolution Amount or any other obligations agreed to under the
74	75		proposed Settlement Agreement. TX HHS waives all procedural rights
75	76		granted under Section 1128A of the Social Security Act (42
76	77		U.S.C. Section 1320a-7a); and 45 C.F.R. Part 160, Subpart E; and
77	78		claims collection regulations at 45 C.F.R. Part 30, including, but
78	79		not limited to, notice, hearing, and appeal with respect to the
79	80		Resolution Amount; and
80	81		WHEREAS, Section 111.003(a)(2), Civil Practice and Remedies
81	82		Code, requires the legislature to approve a settlement of a claim or
82	83		action against the state if the settlement commits the state to a
83	84		course of action that in reasonable probability will entail a
84	85		continuing increased expenditure of state funds over subsequent
85	86		state fiscal biennia; and
86	87		WHEREAS, The CAP of the proposed agreement commits the State
87	88		of Texas to a course of action that in reasonable probability
88	89		entails a continuing increased expenditure of state funds over
89	90		subsequent state fiscal biennia; now, therefore, be it
90	91		RESOLVED, That the 86th Legislature of the State of Texas
91	92		hereby approve the proposed Settlement Agreement.