[ Thursday, October 28, 2010 ]
Hartford Hospital (Conn.): This is really about contract negotiations between a hospital and an insurer, but the state employee's union says the hospital
violated their HIPAA privacy rights by sending them letters. I think a provider can notify patients that their insurer might not be contracted any more; the only use is of the demographic information of the patient, and it seems to be related, at least potentially, to each of treatment, payment, and healthcare operations. It might not be polite or right for the hospital to put union member patients in the middle of the fight, but I'm not sure this is a HIPAA violation.
Jeff [11:28 AM]
[ Wednesday, October 27, 2010 ]
Patient Records in Dumpsters: This is
a problem that doesn't seem to be going away.
Jeff [9:34 AM]
[ Thursday, October 21, 2010 ]
Medical Telemetry via Smartphone? Sprint
has an app for its EVO 4G phone that will allow doctors to receive information from hospital monitor information remotely. They say it's HIPAA compliant, but I wonder: is it encrypted somehow? What if the doctor loses his smartphone? If the doctor is in surgery, someone in the OR is probably going to be answering his phone for him; will they have (not necessarily proper) access to this data?
Generally, having more access to data is good, but I'm not sure you can be absolutely certain that the HIPAA aspects are "compliant."
UPDATE: on this post (as with all others), click on the time-stamp below to see comments.
Jeff [10:05 AM]
Philadelphia area Breach: Keystone Mercy and AmeriHealth Mercy health plans lost
a flash drive with names, addresses, and PHI of over 250,000 beneficiaries. So far, no evidence that the information was accessed or used, but another good example of why you should encrypt data at rest, and not transport it via mobile devices like flash drives unless you really need it. Might be no harm in the end, but it's surely sloppy data management.
Jeff [9:18 AM]
[ Wednesday, October 20, 2010 ]
Transparency in Health IT: More on
Tiger Team's recommendations.
Jeff [7:33 AM]
[ Monday, October 18, 2010 ]
Armenian Gangsters: Here's probably the
biggest, scariest health care identity theft and fraud case to date. They not only stole Medicare patient's identities, they stole doctor identities and set up fake clinics to generate over $150 million in phony charges.
Jeff [8:57 AM]
[ Thursday, October 07, 2010 ]
Electronic Medical Records and Privacy Are In Conflict. CNN figures out what I've been saying all along -- there's a dynamic tension between exchange of health information and privacy, and encouraging one disparages the other. The usual suspect appear.
Jeff [11:16 AM]
Texas Case Alleges HIPAA Violation as Basis for RICO Claim: A group of Texas retail pharmacies have sued CVS, alleging it uses PHI it obtains from its Caremark pharmacy benefits management business to help CVS steal customers from other retail pharmacies (Caremark and CVS merged in 2007). They claim that the combined entity uses PHI in a manner that violates HIPAA, which allows the RICO (Racketeer Influenced and Corrupt Organizations) Act. (
via BNA, subscription required)
As fellow HIPAAcrat Kirk Nahra notes, this is an uphill battle for the plaintiffs. First, it's hard to say that the way the PHI was used actually violates HIPAA (there seems to be a good "healthcare operations" justification there). Secondly, the criminal law the plaintiff's lawyers use to tie in RICO might not be a correct fit. However, the case will be interesting because it touches on several issues directly dealt with in HITECH, including sales of PHI and use of PHI for marketing purposes.
Jeff [10:54 AM]
News From HIPAA Summit West (via BNA):
- The HITECH regs generated 550 comments; HHS expects to have a final rule by late this year or the spring of 2011.
- 160 big breaches (500+) reported so far; 8500 small breaches.
- Hacking accounts for a very small amount of breaches. Don't focus too much on technical solutions, so that you forget physical solutions (i.e., keeping your laptops safe from theft).
- However, "Encrypt, encrypt, encrypt. We can't say that enough."
- Complaint level ebbs and flows between 6,000 and 9,000 per year, but the top 4 complaints remain consistent: improper use, lack of safeguards, failure to provide access, and violation of the minimum necessary rule.
- 2/3 of OCR investigations result in some corrective action, while 1/3 find no violation.
- OCR likes settlements, and prefers them to civil money penalties, because it means the perpetrator is cooperating and resolving the issue. But if a covered entity doesn't cooperate, OCR will not hesitate to levy a stiff CMP.
Jeff [10:40 AM]
[ Wednesday, October 06, 2010 ]
Role-Based Access: This has been a HIPAA requirement from day one; only those with a need to know should have access to PHI. But implementation and fine-tuning of access management policies in light of HITECH has raised the profile of the issue. It's definitely a security issue, since many breaches are caused by employees or contractors who perhaps shouldn't have access to the data in the first place. Now there's a
white paper out the issue.
Jeff [9:49 AM]
[ Monday, October 04, 2010 ]
Johns Hopkins data theft: A former employees of Johns Hopkins Hospital and 4 accomplices have been
indicted for stealing patient identities and securing $600,000 in property through "instant credit" retail transactions.
Jeff [1:41 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
