Advocate Health Care Settles Potential HIPAA Penalties for $5.55 Million

RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement ("Agreement") are: A. The United States Department of Health and Human Services, Office for Civil Rights ("HHS"), which enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the "Privacy Rule"), the Federal standards that govern the security of electronic individually identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the "Security Rule"), and the Federal standards for notification in the case of breach of unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45 C.F.R. Part 164, the "Breach Notification Rule"). HHS has the authority to conduct compliance reviews and investigations of complaints alleging violations of the Privacy, Security, and Breach Notification Rules (the "HIPAA Rules") by covered entities and business associates, and covered entities and business associates must cooperate with HHS compliance reviews and investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and 160.310(b). B. Advocate Health Care Network and all of its subsidiaries that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, and therefore are required to comply with the HIPAA Rules (hereinafter collectively referred to as "Advocate" and individually as "Advocate Entity"). The term "Advocate Entity" shall also refer to any entity that Advocate Health Care Network may create, acquire, over which it may obtain control or with which it may merge at any time after the Effective Date of this Agreement, for so long as this Agreement and the associated Corrective Action Plan ("CAP") are in force; provided that the entity meets the definition of a "covered entity" under 45 C.F.R. § 160.103, and therefore is required to comply with the HIPAA Rules. Advocate, a nonprofit organization, is the largest health care system in Illinois, with more than 250 treatment locations, including twelve acute-care hospitals and one of the region's largest medical groups. HHS and Advocate shall together be referred to herein as the "Parties." 2. Factual Background and Covered Conduct. Between August 23, 2013 and November 1, 2013, Advocate submitted three breach notification reports to HHS. Each breach report pertained to a separate and distinct incident involving Advocate Health and Hospitals Corporation d/b/a Advocate Medical Group (“AMG”), an Advocate subsidiary: On August 23, 2013, Advocate notified HHS regarding a breach of Advocate's unsecured electronic protected health information ("ePHI"). Advocate reported that four desktop computers containing the ePHI of approximately 4,029,530 individuals (later amended to 3,994,175) had been stolen from an AMG administrative office building, located on Touhy Avenue in Park Ridge, Illinois ("Touhy Support Center"), during the early morning hours of July 15, 2013. On August 29, 2013, HHS notified Advocate that HHS was opening an investigation into those aspects of Advocate's compliance with the HIPAA Rules implicated by Advocate's breach report. On September 13, 2013, Advocate notified HHS regarding another breach of Advocate's unsecured ePHI. This breach involved Blackhawk Consulting Group (`Blackhawk"), a business associate of Advocate, which provides billing services to AMG. Advocate reported that, at some point between June 30, 2013 and August 15, 2013, the ePHI of 2,027 AMG patients had been potentially compromised when an unauthorized third party accessed Blackhawk's network. On October 29, 2013, HHS notified Advocate that it was opening an investigation into Advocate's compliance with the HIPAA Rules implicated by Advocate's second breach report. On November 1, 2013, HHS received notification from Advocate regarding a third breach of Advocate's unsecured ePHI. Advocate reported that an unencrypted laptop containing the ePHI of approximately 2,237 individuals was stolen from an AMG workforce member's vehicle. On January 8, 2014, HHS notified Advocate that it was commencing an investigation regarding Advocate's compliance with the HIPAA Rules implicated by Advocate's third breach report. HHS’ investigations of the above breach reports indicated that the following conduct appears to have occurred, which shall be defined as “Covered Conduct” for purposes of this Agreement: a) Advocate failed to conduct an accurate and thorough risk analysis that incorporates all of its facilities, information technology equipment, applications and data systems utilizing ePHI (See 45 C.F.R. § 164.308(a)(1)(ii)(A)). b) Advocate failed to implement policies and procedures to limit physical access to its electronic information systems housed within the Touhy Support Center (See 45 C.F.R. § 164.310(a)(1)); c) Advocate failed to reasonably safeguard the ePHI of approximately 3,994,175 individuals at the Touhy Support Center (See 45 C.F.R. § 164.530(c)); d) Advocate failed to obtain satisfactory assurances in the form of a written business associate contract from Blackhawk that Blackhawk would appropriately safeguard all Advocate ePHI that was in Blackhawk’s possession or control (See 45 C.F.R. § 164.308(b)(1)); 2 e) Advocate impermissibly disclosed the ePHI of approximately 2,027 individuals to Blackhawk when it failed to obtain satisfactory assurances in the form of a business associate contract that Blackhawk would appropriately safeguard all Advocate ePHI that was in Blackhawk’s possession or control (See 45 C.F.R. §§ 160.103 and 164.502(a)); f) Advocate failed to reasonably safeguard the ePHI of approximately 2,237 individuals when an AMG workforce member left an unencrypted laptop in an unlocked vehicle overnight (See 45 C.F.R. § 164.530(c)). 3. No Admission. This Agreement is not an admission of liability by Advocate. 4. No Concession. This Agreement is not a concession by HHS that Advocate is not in violation of the HIPAA Rules and is not liable for civil money penalties. 5. Intention of Parties to Effect Resolution. This Agreement is intended to resolve HHS Transaction Numbers 13-165502, 13-167739, 14-169755, and any violations of the HIPAA Rules related to the Covered Conduct specified in paragraph I.2 of this Agreement. In consideration of the Parties' interest in avoiding the uncertainty, burden, and expense of further investigation and formal proceedings, the Parties agree to resolve this matter according to the Terms and Conditions below. II. Terms and Conditions 6. Payment. HHS has agreed to accept, and Advocate has agreed to pay HHS, the amount of $5,550,000.00 ("Resolution Amount"). Advocate agrees to pay the Resolution Amount on the Effective Date of this Agreement as defined in paragraph II.14 by automated clearinghouse transaction pursuant to written instructions to be provided by HHS. 7. Corrective Action Plan. Advocate has entered into and agrees to comply with the CAP, attached as Appendix A, which is incorporated into this Agreement by reference. If Advocate or any Advocate Entity breaches the CAP, and fails to cure the breach as set forth in the CAP, then Advocate will be in breach of this Agreement, and HHS will not be subject to the release set forth in paragraph II.8 of this Agreement. 8. Release by HHS. In consideration of and conditioned upon Advocate's performance of its obligations under this Agreement, HHS releases Advocate from any actions it may have against Advocate under the HIPAA Rules arising out of or related to the Factual Background and Covered Conduct identified in paragraph I.2 of this Agreement. HHS does not release Advocate from, nor waive any rights, obligations, or causes of action other than those arising out of or related to the Factual Background and Covered Conduct and referred to in this paragraph. This 3 release does not extend to actions that may be brought under section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6. 9. Agreement by Released Parties. Advocate shall not contest the validity of its obligation to pay, nor the amount of, the Resolution Amount or any other obligations agreed to under this Agreement. Advocate waives all procedural rights granted under Section 1128A of the Social Security Act (42 U.S.C. § 1320a-7a) and 45 C.F.R. Part 160 Subpart E, and HHS claims collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal with respect to the Resolution Amount. 10. Binding on Successors. This Agreement is binding on Advocate and its successors, heirs, transferees, and assigns. 11. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement. 12. No Additional Releases. This Agreement is intended to be for the benefit of the Parties only, and by this instrument the Parties do not release any claims against or by any other person or entity. 13. Effect of Agreement. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties. 14. Execution of Agreement and Effective Date. The Agreement shall become effective (i.e., final and binding) on the date of signing of this Agreement and the CAP by the last signatory ("Effective Date"). 15. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a- 7a(c)(1), a civil money penalty ("CMP") must be imposed within six (6) years from the date of the occurrence of the violation. To ensure that this six-year period does not expire during the term of this Agreement, Advocate agrees that the time between the Effective Date of this Agreement and the date this Agreement may be terminated by reason of Advocate or any Advocate Entity's breach, plus one year thereafter, will not be included in calculating the six-year statute of limitations applicable to the violations which are the subject of this Agreement. Advocate waives and will not plead any statute of limitations, laches, or similar defenses to any administrative action relating to the Covered Conduct identified in paragraph I.2 that is filed by HHS within the time period set forth above, except to the extent that such defenses would have been available had an administrative action been filed on the Effective Date of this Agreement. 4 16. Disclosure. HHS places no restriction on the publication of the Agreement. In addition, HHS may be required to disclose material related to this Agreement to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. 552, and its implementing regulations, 45 C.F.R. Part 5. This provision does not limit HHS’ ability to appropriately withhold information from disclosure under the Freedom of Information Act. 17. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. 18. Authorizations. The individual(s) signing this Agreement on behalf of Advocate represent and warrant that they are authorized by Advocate to execute this Agreement. The individual(s) signing this Agreement on behalf of HHS represent and warrant that they are signing this Agreement in their official capacities and that they are authorized to execute this Agreement. For Advocate Entities /s/ 7/7/2016 Dominic Nakis Date Senior Vice President and Chief Financial Officer Advocate Health Care For United States Department of Health and Human Services /s/ 7/8/2016 Steven Mitchell Date Acting Regional Manager, Midwest Region Office for Civil Rights 5 APPENDIX A CORRECTIVE ACTION PLAN BETWEEN THE UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES AND ADVOCATE HEALTH CARE NETWORK I. Preamble Advocate Health Care Network, on behalf of itself and all of its subsidiaries that meet the definition of a "covered entity" under 45 C.F.R. § 160.103, and therefore are required to comply with the Privacy, Security and Breach Notification Rules ("HIPAA Rules") (hereinafter collectively referred to as "Advocate" and individually as "Advocate Entity"), hereby enters into this Corrective Action Plan ("CAP") with the United States Department of Health and Human Services, Office for Civil Rights ("HHS"). Contemporaneously with this CAP, Advocate is entering into a Resolution Agreement ("Agreement") with HHS, and this CAP is incorporated by reference into the Agreement as Appendix A. Advocate enters into this CAP as part of the consideration for the release set forth in paragraph II.8 of the Agreement. II. Contact Persons and Submissions A. Contact Person Advocate has identified the following individual as its authorized representative and contact person regarding the implementation of this CAP and for receipt and submission of notifications and reports (“Contact Person”): Laura Merten Chief Privacy Officer Advocate Health Care 3075 Highland Parkway, Suite 600 Downers Grove, Illinois 60515 Telephone: 630-929-5754 Facsimile: (to be supplied) Email: laura.merten@advocatehealth.com 1 HHS has identified the following individual as its authorized representative and contact person with whom Advocate is to report information regarding the implementation of this CAP: Steven M. Mitchell Acting Regional Manager, U.S. Department of Health and Human Services Office for Civil Rights, Midwest Region 601 E. 12th Street, Room 353 Kansas City, Missouri 64106 Steven.Mitchell@hhs.gov Telephone: 816-426-7278 Facsimile: 816-426-3686 Advocate and HHS mutually agree to promptly notify each other of any changes in the contact person or other information provided above. B. Proof of Submissions. Unless otherwise specified, all notifications and reports required by this CAP may be made by any means, including certified mail, overnight mail, or hand delivery, provided that there is proof that such notification was received. Emailed notices and reports are acceptable only in addition to those means identified above. For purposes of this requirement, internal facsimile confirmation sheets do not constitute proof of receipt. III. Effective Date and Term of CAP The Effective Date for this CAP shall be calculated in accordance with paragraph II.14 of the Agreement ("Effective Date"). The period for compliance ("Compliance Term") with the obligations assumed by Advocate under this CAP shall begin on the Effective Date of this CAP and end two (2) years from the date of HHS’ final approval of all corrective action obligations set forth in section V below, unless HHS has notified Advocate under section VIII hereof of its determination that Advocate or any Advocate Entity has breached this CAP. In the event of such a notification by HHS under section VIII hereof, the Compliance Term shall not end until HHS notifies Advocate that it has determined that the breach has been cured. After the Compliance Term ends, the Contact Person shall still be obligated to submit the final Periodic Report as required by section VI and comply with the document retention requirements in section VII. IV. Time In computing any period of time prescribed or allowed by this CAP, all days referred to shall be calendar days. The day of the act, event, or default 2 from which the designated period of time begins to run shall not be included. The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a legal holiday, in which event the period runs until the end of the next day that is not one of the aforementioned days. V. Corrective Action Obligations Advocate agrees to the following: A. Modify Existing Risk Analysis 1. Advocate shall conduct a comprehensive and thorough Risk Analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by Advocate. This Risk Analysis shall incorporate all Advocate facilities, whether owned or rented, and evaluate the risks to the ePHI on all of its electronic equipment, data systems, and applications controlled, administered or owned by Advocate or any Advocate Entity, that contain, store, transmit, or receive ePHI. Prior to conducting the Risk Analysis, Advocate shall develop a complete inventory of all of its facilities, electronic equipment, data systems, and applications that contain or store ePHI that will then be incorporated into its Risk Analysis. Advocate may submit a Risk Analysis currently underway for consideration by HHS for compliance with this provision. 2. The Contact Person shall provide the Risk Analysis, consistent with section V.A. 1, to HHS within one hundred eighty (180) days of the Effective Date for HHS' review. Within sixty (60) days of its receipt of Advocate's Risk Analysis, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the Risk Analysis. If HHS disapproves of the Risk Analysis, HHS shall provide the Contact Person with a detailed, written explanation of the basis of its disapproval and with comments and recommendations in order for Advocate to be able to prepare a revised Risk Analysis Upon receiving a letter of disapproval of the Risk Analysis from HHS and a description of any required changes to the Risk Analysis, Advocate shall have sixty (60) days in which to revise its Risk Analysis accordingly, and then have the Contact Person submit the revised Risk Analysis to HHS for review and approval. This submission and review process shall continue until HHS approves the Risk Analysis; provided that at no point in the process may HHS' approval be unreasonably withheld. B. Develop and Implement a Risk Management Plan 1. Advocate shall develop an enterprise-wide Risk Management Plan to address and mitigate any security risks and vulnerabilities found in the Risk Analysis described in section V.A. above. The 3 Risk Management Plan shall include a process and timeline for Advocate's implementation, evaluation, and revision of its risk remediation activities. Advocate may submit a Risk Management Plan currently underway for consideration by HHS for compliance with this provision. 2. Within ninety (90) days of HHS' final approval of the Risk Analysis described in section V.A. above, the Contact Person shall submit Advocate's Risk Management Plan to HHS for HHS' review. Within sixty (60) days of its receipt of Advocate's Risk Management Plan, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the Risk Management Plan. If HHS disapproves of the Risk Management Plan, HHS shall provide the Contact Person with detailed comments and recommendations in order for Advocate to be able to prepare a revised Risk Management Plan. Upon receiving a letter of disapproval of the Risk Management Plan from HHS and a description of any required changes to the Risk Management Plan, Advocate shall have sixty (60) days in which to revise its Risk Management Plan accordingly, and, through the Contact Person, submit the revised Risk Management Plan to HHS for review and approval. This submission and review process shall continue until HHS approves the Risk Management Plan; provided that at no point in the process may HHS' approval be unreasonably withheld. 3. Within sixty (60) days of HHS' approval of the Risk Management Plan, Advocate shall begin implementation of the Risk Management Plan and distribute the plan to workforce members involved with implementation of the plan. C. Implement Process for Evaluating Environmental and Operational Changes 1. Advocate shall develop a written process ("Process") to regularly evaluate any environmental or operational changes that affect the security of ePHI in Advocate's possession or control, including Advocate's acquisition of new entities. 2. Within ninety (90) days of HHS' final approval of the Risk Analysis described in section V.A. above, the Contact Person shall submit Advocate's Process to HHS for HHS' review. Within sixty (60) days of its receipt of Advocate's proposed Process, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the Process. If HHS disapproves of the Process, HHS shall provide the Contact Person with detailed comments and recommendations in order for Advocate to be able to prepare a revised Process. Upon receiving a letter of disapproval from HHS and a listing or description of any required revisions to such Process, Advocate shall have thirty (30) days in which to revise its written Process 4 accordingly, and then submit the revised Process to HHS for review and approval or disapproval. This submission and review process shall continue until HHS approves the Process; provided that at no point in the process may HHS' approval be unreasonably withheld. 3. Within sixty (60) days of HHS' approval of the Process, Advocate shall implement the Process and distribute copies of it to all workforce members involved with performing such evaluations. D. Develop Encryption Report 1. Within ninety (90) days of HHS' final approval of the Risk Management Plan required in section V.B, Advocate shall develop, and the Contact Person shall submit to HHS, a written report regarding Advocate's encryption status ("Encryption Report"), which shall include: a. The total number of all Advocate devices and equipment including, but not limited to, desktop computers, laptop computers, tablets, mobile phone devices, USB drives, and medical equipment, that may be used to access, store, download, or transmit Advocate ePHI, as of the date of the Encryption Report. b. The total number of all Advocate devices and equipment including, but not limited to, desktop computers, laptop computers, tablets, mobile phone devices, USB drives, and medical equipment, that may be used to access, store, download, or transmit Advocate ePHI, that are encrypted as of the date of the Encryption Report, as well as evidence of such encryption. c. An explanation for the total number of devices and equipment described in subsection b above that are not encrypted as of the date of the Encryption Report. E. Review and Revise Policies and Procedures on Device and Media Controls 1. Advocate shall review, and to the extent necessary, revise its policies and procedures related to the use of hardware and electronic media including, but not limited to, desktop computers, laptop computers, servers, tablets, mobile phone devices, USB drives, external hard drives, DVDs and CDs that may be used to access, store, download, or transmit Advocate ePHI. The policies shall identify criteria for the use of such hardware and electronic media and procedures for obtaining authorization for the use of personal devices and media that utilize Advocate ePHI systems. The policies shall also address security responsibilities, including disposal and reuse of personal devices and media, and regular compliance monitoring. 5 2. Within ninety (90) days of HHS' final approval of the Risk Analysis described in section V.A. above, the Contact Person shall submit the policies and procedures to HHS for HHS' review. Within sixty (60) days of its receipt of Advocate's revised policies and procedures, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the revised policies and procedures. If HHS does not approve them, HHS shall provide the Contact Person with detailed, written requirements and recommendations in order for Advocate to be able to prepare acceptable, revised policies and procedures. Upon receiving a letter of disapproval of its proposed policies and procedures from HHS, Advocate shall have thirty (30) days in which to revise its policies and procedures accordingly, and then have the Contact Person submit the revised policies and procedures to HHS for review and approval. This submission and review process shall continue until HHS approves the policies and procedures; provided that at no point in the process may HHS' approval be unreasonably withheld. 3. Within thirty (30) days of HHS' approval of the policies and procedures, Advocate shall finalize and officially adopt its policies and procedures in accordance with its applicable administrative procedures. F. Review and Revise Policies and Procedures on Facility Access Controls 1. Advocate shall review, and to the extent necessary, revise its policies and procedures to limit physical access to all of its electronic information systems and the facilities in which they are housed, while ensuring that properly authorized access is allowed. The revised policies shall include details of physical security safeguards that are implemented to restrict unauthorized access. 2. Within ninety (90) days of HHS' final approval of the Risk Analysis described in section V.A. above, the Advocate Contact Person shall submit the policies and procedures required by section V.F.1 to HHS for HHS' review. Within sixty (60) days of its receipt of Advocate's revised policies and procedures, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the revised policies and procedures. If HHS does not approve them, HHS shall provide the Contact Person with detailed, written comments and recommendations in order for Advocate to be able to prepare acceptable, revised policies and procedures. Upon receiving a letter of disapproval from HHS, Advocate shall have thirty (30) days in which to revise its policies and procedures accordingly, and then have the Contact Person submit the revised policies and procedures to HHS for review and approval. This submission and review process shall continue until HHS approves the policies and procedures; provided that at no point in the process may HHS' approval be unreasonably withheld. 6 3. Within thirty (30) days of HHS' approval of the policies and procedures, Advocate shall finalize and officially adopt its policies and procedures in accordance with its applicable administrative procedures. G. Review and Revise Policies and Procedures Related to Business Associates 1. Advocate shall review, and to the extent necessary, revise its policies and procedures related to business associates. The policies shall: (a) designate one or more individual(s) who are responsible for ensuring that Advocate enters into a business associate agreement with each of its business associates, as defined by the HIPAA Rules, prior to Advocate disclosing ePHI or non-electronic PHI to the business associate; (b) create a process for assessing Advocate's current and future business relationships to determine whether each relationship involves a business associate, as defined by the HIPAA Rules; (c) create a process for negotiating and entering into business associate agreements with business associates prior to Advocate disclosing ePHI or nonelectronic PHI to the business associates; (d) limit disclosures of ePHI and non-electronic PHI to the minimum amount that is reasonably necessary for business associates to perform their duties; and (e) create a process for maintaining documentation of a business associate agreement for at least six (6) years beyond the date of when the business associate relationship is terminated. 2. Within ninety (90) days of HHS' final approval of the Risk Analysis described in section V.A. above, the Contact Person shall submit the policies and procedures to HHS for HHS' review. Within sixty (60) days of its receipt of Advocate's revised policies and procedures, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the revised policies and procedures. If HHS does not approve them, HHS shall provide the Contact Person with detailed, written comments and recommendations in order for Advocate to be able to prepare acceptable, revised policies and procedures. Upon receiving a letter of disapproval of its proposed policies and procedures from HHS, Advocate shall have thirty (30) days in which to revise its policies and procedures accordingly, and then have the Contact Person submit the revised policies and procedures to HHS for review and approval. This submission and review process shall continue until HHS approves the policies and procedures; provided that at no point in the process may HHS' approval be unreasonably withheld. 3. Within thirty (30) days of HHS' approval of the policies and procedures, Advocate shall finalize and officially adopt its policies and procedures in accordance with its applicable administrative procedures. 7 H. Develop an Enhanced Privacy and Security Awareness Training Program 1. Advocate shall augment its existing mandatory Health Information Privacy and Security Awareness Training Program ("Training Program") for all Advocate workforce members who have access to PHI, including ePHl. The Training Program shall include general instruction on compliance with Advocate's policies and procedures related to the HIPAA Rules. The augmented Training Program shall also include training on all of the new and revised policies and procedures described in section V of this CAP, to the extent such new policies and procedures are developed and existing policies and procedures are revised. The Training Program may be conducted online and/or electronically, in its entirety, using computers and eLearning tools. 2. Within ninety (90) days of HHS' final approval of the Risk Management Plan required in section V.B above, the Contact Person shall submit the proposed training materials for HHS' review. Within sixty (60) days of its receipt of Advocate's training materials, HHS will inform the Contact Person in writing as to whether HHS approves or disapproves of the proposed training materials. If HHS does not approve them, HHS shall provide the Contact Person with detailed, written comments and recommendations in order for Advocate to be able to prepare acceptable, revised training materials. Upon receiving a letter of disapproval of its proposed training materials from HHS, Advocate shall have thirty (30) days in which to revise its training materials accordingly, and then have the Contact Person submit the revised training materials to HHS for review and approval. This submission and review process shall continue until HHS approves the training materials; provided that at no point in the process may HHS' approval be unreasonably withheld. 3. Within one hundred twenty (120) days of HHS' approval of Advocate's training materials, Advocate shall provide training on its approved policies and procedures to all active Advocate workforce members, as necessary and appropriate for the workforce members to carry out their functions. In addition, Advocate shall train members who return to the active workforce after this 120-day period and any workforce members who commence working for Advocate, or that are given access to PHI, including ePHI, after the development of the Training Program, within thirty (30) days of the commencement of their employment or affiliation with Advocate. 4. Each individual who is required to attend training shall certify, in writing or in electronic form that he or she has received the required training and the date training was received. Advocate shall retain 8 copies of such certifications for no less than six (6) years following the date training was provided. 5. Advocate shall review the Training Program as reasonable and appropriate, but no less than every two years. Advocate must update the Training Program to reflect any material changes in Advocate’s policies and procedures, federal law, HHS guidance, and/or any material compliance issue(s) discovered during audits or reviews within a reasonable period of time after the material change becomes effective. 6. Advocate shall provide training on its policies and procedures related to the HIPAA Rules to all active Advocate workforce members, as necessary and appropriate for the workforce members to carry out their functions, annually. All training may be conducted online and/or electronically, in its entirety, using computers and eLearning tools. I. Monitoring 1. Internal Monitoring. Within ninety (90) days of the Effective Date, Advocate shall develop, and the Contact Person shall submit to HHS, a written description of Advocate's plan to monitor internally its compliance with this CAP ("Internal Monitoring Plan"). Within sixty (60) days of receipt of the submission, HHS shall inform the Contact Person of its approval or disapproval of the proposed Internal Monitoring Plan. If HHS does not approve the proposed Internal Monitoring Plan, HHS shall set forth in writing the reasons for its disapproval and recommendations for the necessary modifications to the proposed Internal Monitoring Plan. If the proposed Internal Monitoring Plan is not approved by HHS, Advocate shall submit a revised Internal Monitoring Plan to HHS, incorporating HHS' comments and requested revisions, within thirty (30) days of HHS' issuance of its disapproval of the proposed Internal Monitoring Plan. While this CAP is in effect, Advocate may wish, or be required by changes in the law, technology, or otherwise, to update, revise or prepare a new Internal Monitoring Plan. Advocate shall be permitted to do so provided that Advocate first submit any updated, revised, or new Internal Monitoring Plan to the Assessor, the appointment of whom is provided for in section V.I.2 below, and obtain the Assessor's approval before Advocate implements the revised version of the Internal Monitoring Plan; and, further provided, that Advocate also submits any updated, revised, or new Internal Monitoring Plan to HHS for its review and comment, and obtain HHS' approval, not to be unreasonably withheld, before Advocate implements the revised Internal Monitoring Plan. Whenever the existing Internal Monitoring Plan is updated or revised and the updated or revised version has been approved by both the Assessor and HHS and has then gone into effect, the updated or revised Internal Monitoring Plan shall be deemed to have superseded the prior Internal Monitoring Plan. 9 2. Assessments a. Applicability. The requirements of Paragraph V.I.2 of this CAP are, unless otherwise noted, applicable to Advocate Health and Hospitals Corporation d/b/a Advocate Medical Group (“AMG”) and all of its subsidiaries that meet the definition of a "covered entity" under 45 C.F.R. § 160.103. This includes any entity that AMG may create, acquire, over which it may obtain control or with which it may merge at any time after the Effective Date of the Agreement, for so long as the Agreement and the CAP are in force; provided that the entity meets the definition of a "covered entity" under 45 C.F.R. § 160.103, and therefore is required to comply with the HIPAA Rules. As applicable, the requirements of Paragraph V.I.2 of this CAP are binding on AMG and its successors, heirs, transferees, and assigns. b. Selection and Engagement. Within ninety (90) days of the Effective Date, Advocate shall engage a qualified, objective, independent third- party assessor to review AMG’s compliance with this CAP ("Assessor") and, through the Contact Person, inform HHS in writing of the name of the individual or entity Advocate designates to serve as the Assessor. The Assessor may not be currently employed by or affiliated with Advocate and shall not have been employed by or affiliated with Advocate for at least five (5) years prior to the Effective Date. The Contact Person shall also simultaneously submit to HHS the proposed Assessor's curriculum vitae or a statement of the Assessor's expertise in the area of monitoring compliance with federal and/or state statutes and regulations, including privacy statutes and regulations. Any individual or entity designated by Advocate to serve as the Assessor must certify in writing at the time of his, her or its designation, and must provide reasonable written documentation to the effect that he, she or it has the requisite expertise and experience regarding the implementation of the HIPAA Rules and has the necessary resources and is otherwise able to perform the assessments and reviews described herein in a professionally independent fashion, taking into account any other business relationships or other engagements that the individual or entity may have. HHS shall be permitted to interview an individual who is designated by Advocate to serve as the Assessor or representatives of any entity that is designated. HHS shall either approve or disapprove of the designation in writing. HHS' approval shall not be unreasonably withheld. If HHS does not approve the designation, HHS shall explain the basis of its disapproval in writing, and the process described above shall be repeated until HHS has approved a designated Assessor. Upon receiving HHS' approval, Advocate shall enter into a written contract with the Assessor for the performance of the assessments and reviews described herein. c. Assessor's Plan. Within ninety (90) days of being approved for service by HHS, the Assessor shall submit to HHS and 10 Advocate a written plan, describing with adequate detail, the Assessor's plan for fulfilling the duties set forth in this subsection ("Assessor's Plan"). HHS shall inform the Contact Person of its approval or disapproval of the proposed Assessor's Plan. If HHS does not approve the proposed Assessor's Plan, HHS shall set forth in writing the reasons for its disapproval and recommendations for the necessary modifications to the proposed Assessor's Plan. If the proposed Assessor's Plan is not approved by HHS, the Assessor shall submit a revised Assessor's Plan to HHS, incorporating HHS' comments and requested revisions, within thirty (30) days of HHS' issuance of its disapproval of the proposed Assessor's Plan. The Assessor shall review the Assessor's Plan at least annually and shall provide HHS and Advocate with a copy of any revisions to the Assessor Plan's within ten (10) business days of the Assessor's making such revisions. HHS shall have a reasonable opportunity to comment and make recommendations regarding any revisions or modifications at any time while the CAP is in effect. The Assessor, in his, her, or its discretion, shall make such changes to the revisions as HHS may reasonably request. d. Description of Assessor Reviews. The Assessor reviews shall investigate, assess, and make specific determinations about Advocate's compliance with the requirements of this CAP. Among other things, the Assessor will perform unannounced site visits to the various Advocate facilities and departments (as determined in the Assessor's Plan) to determine if workforce members are complying with the Advocate policies and procedures described above; will conduct quarterly progress meetings with Advocate's Security Officer; interview workforce members and business associates as needed; and will follow up on reports of noncompliance with the CAP, including follow-up on reports of Reportable Events (as defined by section V.J.). e. Assessor Reports and Response. The Assessor shall prepare written reports based on the work that the Assessor performs as described in subsection V.I.2.d above ("Assessor Report"). The Assessor shall provide such written reports to HHS and Advocate. The first Assessor Report shall be due sixty (60) days after the one-year anniversary of HHS' issuance of its approval of the appointment of the Assessor, as provided in subsection (a) above. The Assessor shall also submit reports within sixty (60) days of the second anniversary of the date of HHS' approval of the Assessor's appointment and within sixty (60) days of the third anniversary of the date of HHS' approval of the Assessor's appointment. Within sixty (60) days of Advocate's receipt of each Assessor Report, the Contact Person shall submit to HHS and the Assessor a written response to the Assessor Report. HHS may, but is not required to, comment on any of the reports submitted by the Assessor and/or any response from the Contact Person. 11 The Assessor shall immediately report to Advocate and HHS on any significant violation of the CAP which the Assessor identifies during the course of the performance of the Assessor's duties. The Contact Person shall prepare a written response, including, when appropriate, a plan of correction, and provide such response to HHS and the Assessor, within ten (10) business days of the issuance of the Assessor's report of the significant violation. f. Retention of Records. The Assessor, the Contact Person, and Advocate shall retain and make available to HHS, upon HHS' request, all work papers, supporting documentation, correspondence, and draft reports (those exchanged between the Assessor and the Contact Person or Advocate) related to the Assessor's reviews. g. Assessor Removal/Termination. Advocate may not terminate the Assessor except for cause and may only do so with HHS' consent, which shall not be unreasonably withheld. In the event that Advocate seeks to terminate the Assessor, the Contact Person shall provide a written statement to HHS setting out in detail the basis for the request and HHS shall take those steps it deems appropriate in reviewing and deciding whether adequate cause actually exists for the termination of the Assessor. If HHS agrees that the current Assessor should be terminated, HHS will so inform the Contact Person in writing and Advocate will be authorized to terminate the services of the current Assessor. If such termination does occur, Advocate must engage a replacement Assessor in accordance with section V.I.2 of this CAP within thirty (30) days of the termination of the previous Assessor, subject to HHS' approval, as provided in section V.I.2. If HHS concludes that cause does not exist for the removal of the original Assessor, it shall so inform the Contact Person in writing and the original Assessor shall remain in place and be authorized to function in all respects as if Advocate had never sought to remove the Assessor. In the event HHS determines that the Assessor does not possess the expertise, independence, or objectivity required by this CAP, or has failed to carry out its responsibilities as set forth in this CAP, HHS may, at its sole discretion, require Advocate to terminate the original Assessor and to engage a new Assessor in accordance with section V.I.2 of this CAP. Prior to requiring such action, HHS shall provide a written explanation to the Contact Person explaining the rationale for HHS' decision. In such event, Advocate must engage a replacement Assessor in accordance with section V.I.2 of this CAP within thirty (30) days of the termination of the previous Assessor. In the event that the Assessor resigns while the CAP is in effect, Advocate shall nominate a replacement Assessor using the same process as 12 described herein for appointing a replacement Assessor who is removed for cause at the instigation of either Advocate or HHS. h. Validation Review. In the event HHS, in its discretion, determines or has reason to believe that: (a) one or more Assessor Reports fail to conform to the requirements of this CAP; or (b) one or more Assessor Reports are factually inaccurate or otherwise improper or incomplete, HHS may, in its sole discretion, conduct its own review to determine whether the Assessor Report(s) comply with the requirements of this CAP and/or are factually inaccurate, incorrect or otherwise improper ("Validation Review"). Prior to initiating a Validation Review, HHS shall notify the Contact Person of its intent to do so and provide a written explanation of why HHS believes such a review is necessary. To resolve any concerns raised by HHS, the Contact Person may request a meeting with HHS to discuss the results of any Assessor review submissions or findings; present any additional or relevant information to clarify the results of the Assessor review to correct the inaccuracy of the Assessor review; and/or propose alternatives to the proposed Validation Review. The Contact Person shall provide any additional information as may be requested by HHS under this section in an expedited manner. HHS will attempt in good faith to resolve any Assessor review concerns with the Contact Person prior to conducting a Validation Review. However, the final determination as to whether or not to proceed with a Validation Review shall be made at the sole discretion of HHS. 3. HHS' Authority Is Not Superseded. The use of an assessor does not affect or limit, in any way, HHS' authority to investigate complaints against any Advocate Entity or conduct additional compliance reviews of any Advocate Entity under any applicable statute or regulation that HHS administers. J. Reportable Events During the Compliance Term Advocate shall, upon receiving information that a workforce member (or business associate) may have failed to comply with its Privacy, Security or Breach Notification Rule Policies and Procedures, promptly investigate this matter. If Advocate determines, after review and investigation that a member of its workforce (or its business associate) has failed to comply with the policies and procedures under sections V.E, V.F and/or V.G, Advocate shall notify in writing HHS, and the Assessor described in section V.I.2, if applicable, within sixty (60) days. The report to HHS and the Assessor, if applicable, shall include the following information: 13 1. A complete description of the event, including the relevant facts, the title of the persons involved, and the provision(s) of the policies and procedures implicated; and 2. A description of the actions taken and any further steps Advocate plans to take to address the matter to mitigate any harm, and to prevent it from recurring, including application of appropriate sanctions against workforce members who failed to comply with its Policies and Procedures. VI. Implementation Report and Periodic Reports A. Implementation Report 1. Within one hundred twenty (120) days after receiving HHS' last approval of the Risk Management Plan, Process, any revised policies and procedures, and training materials consistent with section V, the Contact Person shall submit a written report to HHS and the Assessor summarizing the status of its implementation of this CAP. This report, known as the "Implementation Report" shall include the following: a. An attestation signed by the Advocate Chief Compliance Officer, attesting that, to the best of his or her knowledge, the policies and procedures required in section V have been implemented and distributed to all workforce members identified in section V.H.3 and all of the compliance certifications required by section V.H.4 have been obtained by Advocate; b. A copy of all training materials used for the training required by section V.H and a written description of the training, including a summary of the topics covered, the length of the session(s) and a schedule of when the training session(s) were held and/or the days during which on-line training was provided; c. An attestation signed by the Advocate Chief Compliance Officer attesting that, to the best of his or her knowledge, members of the workforce identified in section V.H.3 have completed the training required by this CAP and have executed the training certifications required by section V.H.4; d. A copy of the engagement letter with the Assessor, a summary description of all engagements between Advocate and the Assessor, including, but not limited to, any outside financial audits, compliance program engagements, or reimbursement consulting, and the proposed start and completion dates of the first Assessor review; e. A copy of the certification from the Assessor regarding its professional independence from Advocate as required by section V.I.2; 14 f. An attestation signed by the Advocate Chief Compliance Officer listing all Advocate locations (including locations and mailing addresses), the corresponding name(s) under which each location is doing business, the corresponding telephone numbers and fax numbers, and attesting that each location is in compliance with the obligations of this CAP; and g. An attestation signed by the Advocate Chief Compliance Officer, attesting that he or she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content and believes that, based upon such inquiry, the information is accurate and truthful. B. Periodic Reports 1. The one-year period beginning on the date of HHS' final approval of the Risk Management Plan, Process, any revised policies and procedures, and training materials consistent with section V of this CAP, to the first anniversary of that date and each subsequent one-year period during which this CAP is in effect, shall be referred to as the "Reporting Period(s)." The Contact Person shall submit to HHS, and the Assessor, a Periodic Report for each Reporting Period no later than ninety (90) days after the end of each corresponding Reporting Period, including the final Reporting Period which concludes with the expiration date of the CAP. The Periodic Report shall include: a. A schedule, topic outline, and copies of the training materials for any training programs attended in accordance with this CAP during the Reporting Period that is the subject of the report; b. An attestation signed by the Advocate Chief Compliance Officer, attesting that, to the best of his or her knowledge, each Advocate Entity has obtained and is maintaining written or electronic training certifications from all workforce members who are required to take training under this CAP during the Reporting Period that they did, in fact, receive the requisite training pursuant to the requirements set forth in this CAP; c. A summary/description of all engagements between Advocate and the Assessor, including, but not limited to, any outside financial audits, compliance program engagements, or reimbursement consulting, if different from what the Contact Person submitted to HHS as part of the Implementation Report; d. A summary of Reportable Events (as defined in section V.J.1) identified during the Reporting Period, a thorough description of the facts regarding any such Reportable Event, if the Compliance Representative has not previously reported the event, and the status of any corrective and preventative action(s) relating to each such Reportable Event; and e. An attestation signed by the Advocate Chief Compliance Officer, attesting that he or she has reviewed the Periodic Report, has made a 15 reasonable inquiry regarding its content and believes that, based upon such inquiry, the information is accurate and truthful. VII. Document Retention Advocate shall maintain for inspection and copying, and shall provide to HHS, upon request, all documents and records relating to compliance with this CAP for six (6) years from the Effective Date. VIII. Requests for Extensions and Breach Provisions Advocate is expected to fully and timely comply with all provisions contained in this CAP. A. Timely Written Requests for Extensions. Advocate may, in advance of any due date set forth in this CAP, submit a timely written request for an extension of time to perform any act required by this CAP. A "timely written request" is defined as a request in writing received by HHS at least five (5) business days prior to the date by which any act is due to be performed. B. Notice of Breach of this CAP and Intent to Impose Civil Money Penalty. The parties agree that a breach of this CAP by Advocate or any Advocate Entity constitutes a breach of the Agreement. Upon determination by HHS that Advocate or any Advocate Entity has breached this CAP, HHS may notify the Contact Person and the Assessor of: (1) the breach; and (2) HHS' intent to impose a civil money penalty ("CMP"), pursuant to 45 CF.R. Part 160, or other remedies for the Covered Conduct set forth in paragraph I.2 of the Agreement and any other conduct that constitutes a violation of the HIPAA Rules ("Notice of Breach and Intent to Impose CMP"). C. Advocate's Response. Advocate shall have thirty (30) days from the date of receipt of the Notice of Breach and Intent to Impose CMP to demonstrate to HHS' satisfaction that: 1. Advocate is in compliance with the obligations of the CAP that HHS cited as the basis for the breach; 2. The alleged breach has been cured; or 3. The alleged breach cannot be cured within the 30-day period, but: (i) Advocate has begun to take the action(s) necessary to cure the breach; (ii) Advocate is pursuing such action with due diligence; and (iii) Advocate has provided to HHS a reasonable timetable for curing the breach. D. Imposition of CMP. If at the conclusion of the 30-day period, Advocate fails to meet the requirements of section VIII.C of this CAP to HHS' satisfaction, HHS may proceed with the imposition of a CMP against Advocate 16 pursuant to 45 C.F.R. Part 160, for any violations of the Covered Conduct set forth in paragraph I.2 of the Agreement and for any other act or failure to act that constitutes a violation of the HIPAA Rules. HHS shall notify Advocate in writing of its determination to proceed with the imposition of a CMP. For Advocate Entities /s/ 7/7/2016 Dominic Nakis Date Senior Vice President and Chief Financial Officer Advocate Health Care For United States Department of Health and Human Services /s/ 7/8/2016 Steven Mitchell Date Acting Regional Manager, Midwest Region Office for Civil Rights 17