[ Tuesday, August 31, 2010 ]
EHR Certification Companies: To meet the meaningful use rules, you'll need to have an EHR that is certified as being compliant. Who does the certifying? HHS has
named 2 companies as qualified to do so: some fly-by-night organization out of Chicago called CCHIT, and an Austin company that you know, as soon as you
hear the name, is a good group.
Jeff [2:31 PM]
[ Thursday, August 26, 2010 ]
More on the "harm" threshold (and its possible demise): During this past week, the AHLA "HIT list" listserv has buzzed with commentary on the "harm" threshold (in large part started by the NYT article
mentioned here), whether it should even be in there (or is an unconstitutional expansion of the statute beyond the capacity of HHS to enact), and whether it's a good idea even if it can be instituted via regulation. Dom Nicastro has a
nice article comparing the California breach notification statute, which is a net that catches all, to the the HIPAA breach notification provisions, which allow the "no harm" breaches to be excluded from the reporting requirement. Virtually all of the California healthcare breaches reported to the state were not reported to HHS under the "harm" standard (although it's possible some were not reported because they fit into one of the other HIPAA exceptions to reporting). Which means either we need the "harm" threshold to prevent useless and unnecessary reporting, OR we must get rid of the "harm" threshold because it is abused in its use.
Jeff [9:39 AM]
[ Tuesday, August 24, 2010 ]
IT Contracts: If you are a healthcare provider, you will likely be buying IT products and services in the very near future (hardware, software, services, etc.). It will also probably come as no surprise to you that the contractors your vendors and sellers will propose to you will actually offer you little or no protection. You might want to consider lawyering up, particularly with someone who is used to dealing with software contracts. Also,
these questions mighe be a useful starting point.
PS: Steve Fox, you owe me a beer.
Jeff [9:10 AM]
[ Monday, August 23, 2010 ]
End of the "Harm" standard? As I predicted
below, the
NYT times implies that the reason the final Breach Notification Rule was pulled from publication is to remove the "harm" standard. Of course, it's a ridiculously editorialized "news" article. Just can't play it straight, can they? Has to be a good Democrat, evil Republican/hospital/insurance company story. . . . Most doctors like having the "harm" standard, but they don't fit the "evil" mode for the NYT.
Actually, if they pull the "harm" standard, they'll probably have to allow comment and delay final enforcement.
Jeff [9:16 AM]
[ Friday, August 20, 2010 ]
I am not surprised: Health Care Data Breaches Lag Other Industries. First of all, health care industry participants already have a culture of privacy that goes back to Hippocrates. They're used to maintaining confidentiality. Also, so much of medical data is useless from a data theft standpoint. Why would you want to know about my gall bladder? And if you're looking for data to steal that would be worth something to you, you'd target industries where all the data that companies have on their customers are names, addresses, and account or credit card numbers. My MasterCard number from Home Depot is worth a lot more than my cholesterol numbers from my doctor.
Jeff [8:53 AM]
[ Thursday, August 19, 2010 ]
Survey Says: Preventing data breaches is
the greatest concern of hospital IT folks as they consider migrating to EMR systems.
Jeff [5:00 PM]
Tiger Team Report Out: The HIT Policy Committee's "tiger team" has published some
recommended privacy and security policies in connection with the federal government's EMR push.
Jeff [4:10 PM]
Richard Blumenthal Strikes Again: the
Connecticut AG is investigating Yale Medical School in connection with the theft of a laptop containing PHI of 1000 patients. He got $250,000 out of HealthNet, wonder what he'll take here. . . .
Jeff [4:06 PM]
[ Wednesday, August 18, 2010 ]
The "Other" HIPAA (transaction and code sets news): I don't usually blog about this part of HIPAA, partly because it is pretty static and boring, and partly because I don't really know or understand the technical nuts and bolts of it. But the "standardized forms" that were generated and are required for use under HIPAA are
in for an update (they are going from the the 4010 series of standard transactions to the 5010 series). Transactions will go live in 5010 starting January 1, 2011, and everyone will have to switch from 4010 to 5010 by January 1, 2012.
If this impacts you, check with your medical billing and coding specialist or vendors) to make sure they're ready for the switch.
Jeff [3:25 PM]
Red Flags Update: The Council of Medical Specialty Societies has
joined the AMA lawsuit to stop the application of the Red Flags Rule to physician practices.
Jeff [3:21 PM]
Just because I want to post the headline: Database Threat Modeling and Strip Poker
Jeff [3:18 PM]
Cost of Healthcare Data Breaches So Far? How about over $
800,000,000 in total?
Jeff [3:13 PM]
[ Tuesday, August 17, 2010 ]
What to do when you get breached? Infoweek has an
interesting article on the topic. Not HIPAA-specific, but interesting.
Jeff [8:18 AM]
[ Monday, August 16, 2010 ]
Missing, but not Breached: This is a pretty bizarre story. A veteran discovered a lot of his medical records missing from the VA. Apparently, a rogue employee at the
Milwaukee VFW, which assists veterans in dealing with the VA, decided to take the office paperless by shredding a lot of records of the veterans managed by them. But the missing records are medical records the VA should have, not the limited records the VFW might have, and the VA is standing by its medical record management process; they say they never had those records.
The data wasn't disclosed, so there's not a breach; and since there's no breach, there's no obligation to report under HITECH. But there is likely an improper use under HIPAA.
Hat tip: John Moehrke
Jeff [8:18 AM]
[ Friday, August 13, 2010 ]
More Bad Trash Policy: Someone found medical records from four community hospitals in the Boston area dumped without shredding at a
town dump. A news photographer saw the huge pile of paper, and investigated mainly because he was mad it wasn't being recycled. Looks like the billing company for the pathology service might be the problem.
Jeff [7:12 AM]
[ Thursday, August 12, 2010 ]
Mighty oaks from tiny acorns grow: Those small policy breaches
sometimes are the genesis of some spectacular data breaches. Something for compliance folks to keep in mind.
Jeff [9:02 AM]
[ Friday, August 06, 2010 ]
Physician Practice Data Breaches: Joe Cantlupe
talks about physicians and data breaches. The doctor is a victim (of a burglary or cyber intrusion), but is also responsible for the rest of the victims. Two big take-aways: encryption and the ability to audit access (who looked at what patient files).
Jeff [9:19 AM]
[ Thursday, August 05, 2010 ]
Now Walgreens: On the heels of big fines against CVS and Rite Aid, the third drugstore cowboy is also
under OCR investigation. Dom Nicastro is all over this story.
UPDATE: If you want to know these companies should've done,
here's some advice.
Jeff [9:58 AM]
[ Wednesday, August 04, 2010 ]
Rite Aid: Infoweek's Security Blog
chimes in.
Jeff [7:07 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
