HIPAA Blog

[ Tuesday, May 31, 2011 ]

What does a Data Breach Cost? For some organizations, it's $100,000 per day.

Speaking of going to jail for HIPAA violations, Dom has a story about a guy in Alabama going up the river for 6 years. It's really a healthcare fraud case, but there's a HIPAA component because he accessed PHI of various individuals to use their identity and insurance to purchase drugs he could then resell.

Jeff [4:55 PM]

Liability for Corporate Officers: A couple of my partners and I spoke to one of our hospital clients recently, addressing aboug 250 staff members for a compliance primer and overview. One part of the presentation, about current enforcement activity by the OIG and Department of Justice, caught the attention of pretty much everyone in the room: the government's latest tactic of going after the corporate officers directly. The theory is sometimes called the Responsible Corporate Officer doctrine. A corporate officer can be personally held liable for criminal activity of his company, even if he didn't know about the wrongdoing, if he could have or should have known and failed to find out and stop it. There are several high-profile cases going on right now; even though the corporate officers may settle for a small fine, the OIG will follow up and exclude them from participating in the Medicare or Medicaid programs. This can leave people who build a multi-year career in healthcare virtually unemployable in their profession, simply because someone in their company broke the law and they failed to detect and stop it.

Obviously, there's a HIPAA connection here. We haven't seen this theory yet in any HIPAA enforcement activities, but there are criminal liabilities for HIPAA violations. That means a corporate officer could face criminal charges if his company violates HIPAA, and any guilty plea, even as part of a plea bargain, might be the end of that executive's career.

Just a little something to keep in mind.

Jeff [4:44 PM]

From the NY Times: Newsworthy data breaches are causing federal regulators (and legislators) to look more closely at healthcare data security. It doesn't take a psychic to see where this leads: more robust enforcement and bigger fines and penalties. Get ready for it (and take your HIPAA obligations seriously).

Jeff [4:38 PM]

Somewhat off topic: Looking for a nursing job?

Jeff [4:36 PM]

[ Friday, May 27, 2011 ]

OCR letter: An interesting blog post about OCR's investigative response to a small medical practice that suffered a laptop theft. I'm not particularly surprised by what they're asking for. But what it should highlight is that if you haven't done a Security Risk Analysis (you were required to do it in 2003 and "periodically" update it), you're going to have a hard time explaining that failure if you suffer a breach.

Jeff [11:52 AM]

Accounting Rule Released Today: In addition to laying out the rules providers and plans must abide by in using and disclosing PHI, the original privacy rule sought to outline the specific rights every individual has in their own PHI. One of those rights is a right to know where your information has gone, in the form or a right to request an accounting of disclosures from a covered entity. Obvioualy, there are a lot of disclosures that are usual and customary, and a requirement to provide a full accounting to any patient who asked would be unweildy and expensive. So while the accounting requirement is broadly drafted, many (almost all, actually) disclosures are exempted from the disclosure requirement. A covered entity does not have to account for disclosures that are made for treatment, healthcare or operations purposes (which accounts for virtually all disclosures in the ordinary course of business), disclosures to the individual, or disclosures pursuant to an authorization by the individual. There's a rational basis for these exclusions: individuals should know or expect that these types of disclosures will be made.

The HITECH Act changed the accounting requirement somewhat for covered entities that use electronic health records. Specifically, the exception for treatment, payment, and healthcare operations (TPO) is removed. The thought is that covered entities that use EHRs should be able to easily and automatically track TPO disclosures, simply by setting the EHR to do so. I'm not so sure that's actually as easily done as said.

Today, HHS has pre-published its regulations regarding the new "accounting for disclosures" rule. I haven't reviewed yet, but will do so and will let you know what I think.

UPDATE (already, yeah): Kirk Nahra says they look ugly and obtrusive, and even go beyond what HITECH calls for. The industry concern was that HITECH implied that it would be easy to set an EHR to do the accounting, which isn't the case in some (if not many, if not most) EHRs. Apparently HHS' response to those concerns is, "Drop dead."

Jeff [9:57 AM]

[ Thursday, May 19, 2011 ]

Press Release: I'm not sure how useful this is, but small providers certainly are particularly vulnerable to information security problems.
nCircle and HITRUST announce security service for small healthcare providers.

Jeff [1:52 PM]

[ Tuesday, May 17, 2011 ]

How do ONC and OCR deal with security? Apparently not very well, according to the OIG.

Jeff [4:15 PM]

[ Monday, May 16, 2011 ]

Charging for copies: The LA times notes, correctly, that covered entities must provide access to, and copies of, medical records, but they can charge a reasonable fee for them. Texas state law sets the fee that can be charged. HIPAA does not allow the covered entity to charge for the time its staff spends, though.

Jeff [9:21 AM]

[ Thursday, May 12, 2011 ]

Is Social Media an Effective Marketing Tool for Healthcare? So asks HealthLeaders. I think the answer to that specific question is, "probably not," but I don't think that's really the right question. I'd ask if social media is an essential marketing tool for healthcare. I think it is, since I think social media is a required element of any healthcare entity's marketing strategy, and perhaps any business entity's marketing strategy. Even if it's just a defensive position of watching what's being said about you on social media sites, or tracking your own staff and employees, you can't ignore social media. Whatever you include in your marketing bag of tricks, you've got to address social media. That makes it essential, if not actually effective for marketing purposes.

Jeff [3:05 PM]

[ Monday, May 09, 2011 ]

Mass Firing for Mass HIPAA Breach: A high school party in Blaine, Minn. got out of hand and resulted in the hospitalization of 11 teenagers (and one death). Apparently, a lot of employees at the hospitals where they were sent couldn't resist snooping into their medical records. The hospital responded (appropriately, in my opinion) by firing 32 employees. Absolutely appropriate, and a nice "object lesson" not only for the ex-employees, but for all the employees who remain.

Hat tip: Phil Zarone of Horty Springer

Jeff [11:28 AM]

[ Thursday, May 05, 2011 ]

Social Media usage: Interesting new survey by SCCE and HCCA on entities' use of social media, adoption of policies, and monitoring of employee use. Still evolving, but it is definitely evolving.

Jeff [10:55 AM]

Off-Topic: If 26 out of 50 agree to something, would you say "more than 2 dozen" or "more than half"? Seems like subtle bias to me. . . .

Jeff [7:06 AM]

[ Monday, May 02, 2011 ]

A top fifty listing: Healthcare law and legislation blogs.

Jeff [4:41 PM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template