[ Wednesday, April 28, 2010 ]
Zhou goes to jail: 4 months for
California Snoopin'. But, he didn't just look at celebrity records; he also looked at the medical records of the boss who fired him. That's creepier.
Jeff [5:01 PM]
Like a lot of other things: Costs of data breaches are
much higher in the US.
Jeff [4:38 PM]
[ Monday, April 26, 2010 ]
Social Media: This is a little off-topic, but I
occasionally speak on the particular privacy issues raised by the use of social media in healthcare marketing. Gienna Shaw at Healthleaders has an
interesting article on how to choose your social media coordinator and strategy.
Jeff [11:05 AM]
[ Wednesday, April 21, 2010 ]
Mass. Eye and Ear Data Breach: Interesting story. A Mass. Eye and Ear Infirmary doctor was lecturing in South Korea and his laptop was stolen. The data was password protected, the computer had LoJack on it, and an automatic hard-drive scrubber that could be activated in case of emergency (although some commentators have noted that the hard-drive eraser won't work until the computer is connected to the internet). They have notified the individuals affected, put a notice on their website, and published this press release. The data almost certainly wasn't compromised, and didn't contain really bad stuff like Social Security numbers. Sounds like Mass Eye and Ear did a bang-up job.
But. . . .
If they had encrypted, rather than password-protected, they wouldn't have to put out the notice, do the press release, or otherwise deal with any of this. There's no data breach notification requirements if the data is "secure," and if it's encrypted, it's secure.
One tiny extra step would have really saved them time, money, frustration, damage to reputation, etc.
Jeff [11:42 AM]
[ Thursday, April 15, 2010 ]
Why no names? I
recently posted that some folks are unhappy that, when HHS lists the covered entities with data breaches involving over 500 people, they don't always list the name of the entity. In some cases, they just say it's a "private practice" without saying which private practice. Dom Nicastro has
ferreted out an answer why HHS does that -- they're applying the Privacy Act of 1974 (what? there was privacy before HIPAA?), which says they can only release the name if the covered entity gives its approval.
UPDATE (or,
Nicastro gets results): the ferreting out has resulted in a change of heart on HHS' part -- they will now list the names. According to HHS, the Privacy Act allows them to list the entity's name without consent only for a purpose that is "compatible with the purpose(s) for which the information was collected." Is disclosing the names compatable with the purpose for which the information was collected? I guess it depends on why you think HHS is collecting information on >500 person disclosures. Is it to shame the disclosers? To warn the general public about possible disclosures, to the extent the general public dealt with those entities? Is it to give an anonymized snapshot of just how much data leakage there is? If it's the first 2, then HHS could, under the Privacy Act, name names. If the purpose of the data breach list is just to give a blind idea of how bad privacy protection is all over, then they can't name names.
Whichever the answer is (who knows? I guess only Congress knows), HHS has defaulted from naming names being contrary to the purpose(s) of the list, to being part of the purpose(s) of the list.
In other words, HHS will now name names.
Jeff [2:49 AM]
New HIPAA Regs one step closer: Earlier this week, HHS' Office of Civil Rights
sent their draft of new HIPAA regulations to the Office of Management and Budget for review. These are the regs that we've all been awaiting, which
should give us some specifics on what we need to do with business associate agreements, along with guidance on how to comply with all of the other provisions in the HITECH Act.
UPDATE: Dom
explains it all.
Jeff [2:41 AM]
[ Tuesday, April 13, 2010 ]
Interesting NIST paper: This publication from NIST is a good, common-sense discussion of how to properly protect "personally identifiable information." It's not specifically HIPAA-oriented, but it sure makes sense when you do a risk analysis (which you should be doing regularly under the Security Rule; you know that, right?). Figure out what you've got, don't keep what you don't need, categorize based on impact value, and protect accordingly. They quote McGeorge Bundy: "If we guard our toothbrushes and diamonds with equal zeal, we will lose fewer toothbrushes and more diamonds." True.
Hat tip: Alan Goldberg
Jeff [11:18 AM]
[ Monday, April 12, 2010 ]
The AMA jumps on the encryption bandwagon: When the Security Rule initially came out in the spring of 2003 (and became effective April 2005), the question of encryption was an "addressable" one -- in other words, encryption was not required. Covered entities had to consider whether it was necessary, but if the entity determined it was not, the entity did not have to adopt encryption technologies. I occasionally advised clients that they did not have to adopt encryption technology, even though some in the industry said it had become "industry standard" and therefore was really necessary. I disagreed; depending on the context, safe data transfer practices would be sufficient.
HITECH changed that (actually, the regulations defining "secured" data under HITECH). The new data breach rules give you a "get out of jail free" card, and that card is encryption: that's because, if you encrypt, you can avoid the data breach disclosure problem. Data breaches must be disclosed to the individual and HHS, but only if the data is unsecure; and HHS defines "secure" to mean encrypted. In fact, encryption is really the only way to secure PHI.
The AMA has now taken a similar stance. As you can see from this, physicians and physician practices should look again at encryption technology and adopt it if possible. You should consider it for data in transit or at rest. It's not free, but it may save you a ton of money and embarrasment in the long run if your data breaches are not reportable.
Jeff [11:19 AM]
HIPAA (but not privacy) News: there's a part of HIPAA that prevents health plans from discriminating based on health condition (to keep insurers from cherrypicking or charging more for those with worse health conditions). The regulations for the nondiscrimination provisions are cowritten by HHS, the IRS, and the Dept. of Labor, since they tend to impact those administrations. And the major focus is on "wellness plans," making sure they aren't surrogates for discriminating, where "wellness" is code for "healthier."
As originally drafted, the benefit an insurer (typically an employer) could give a beneficiary (typically an employee) as a bonus for complying with a wellness plan was an amount equal to 20% of the total premium (what the employer pays plus what the employee pays). The PPACA (the health reform law) has now
increased that benefit to 30%.
Jeff [8:56 AM]
[ Thursday, April 08, 2010 ]
Non-HIPAA Data Breach News: Customers of Countrywide Financial have
sued the company for allowing employees to steal and sell personal information.
Jeff [11:18 AM]
[ Tuesday, April 06, 2010 ]
John Muir Data Breach: 2 stolen laptops with password-protected but apparently not encrypted data means 4,500 notifications.
Jeff [8:53 AM]
[ Friday, April 02, 2010 ]
Florida Identity Theft from Cancer Patients: There's no HIPAA claims
made here, although the case looks pretty identical (other than in terms of scale) to the Gibson case. Pretty dispicable; if they're guilty, I hope they get long sentences.
Jeff [5:18 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
