[ Thursday, June 30, 2011 ]
New Texas HIPAA law: The Texas legislature has passed and the governor signed some new
privacy rights provisions. Basically, it expands the definition of "covered entity" to any person or entity who handles medical information, requires employee training within 60 days of hiring and at least every 2 years, require copies of electronic records within 15 business days of a request, and prohibits the sale of PHI. It also expands the potential fines for a Texas data breach (and could allow for double-dipping on fines: $1.5 million for violating HIPAA, $1.5 million for violating the Texas statute), and makes it a felony to perpetrate identity theft by electronic device when the information or data accessed or stolen is PHI.
Jeff [4:19 PM]
[ Tuesday, June 28, 2011 ]
It's a Fair Point: While providers and patients fret about hackers getting into their computerized medical records, the
vast majority of breaches relate to theft of computers components and media such as flash drives. Nobody's hacking into the hospital computers; instead, a clerk is taking data home on a laptop that gets stolen, or the cleaning crew throws out a box containing data disks. That's the bigger risk, by far.
Jeff [3:44 PM]
Here's a Great Twist: A patient
dies after heart surgery, and the family decides to sue the hospital. However, first, the family has to acknowledge that the patient checked into the hospital under his brother's name: it seems the brother had health insurance and the patient didn't. So, the fraudulent patient's family sues the hospital, the insurer isn't going to pay now that they know it wasn't their insured being operated on, and the hospital gets to swallow that bill as well. Sound fair?
Hat tip: Nancy Davis.
Jeff [8:55 AM]
[ Monday, June 27, 2011 ]
Cool Tool: Looking for a comprehensive list of reported data security breaches since 2005? The Privacy Rights Clearinghouse has
just the answer.
Hat tip: Alan Goldberg
Jeff [10:44 AM]
California Department of Public Health: Another breach. This time, an employee copied information on about 9,000 individuals onto a portable hard drive. The article doesn't give a suspected motive, but says that this breach, unlike the previous one (data tape lost in the mail), was intentional. The information contained social security numbers, but also contained case information on workers comp cases.
Jeff [8:11 AM]
[ Friday, June 24, 2011 ]
The Other HIPAA: In case you don't know, providers and payors need to switch to a new standard for data in HIPAA information exchanges: specifically, everyone must migrate to the HIPAA 5010 standards by 1/1/12 (you should be testing sometime during calendar year 2011). Well, it seems that most know they need to do it, but most
don't think they'll be ready in time. Could be an interesting January.
Jeff [7:26 AM]
[ Thursday, June 23, 2011 ]
HIPAA Criminal Case, Not Involving ID Theft: Very
interesting indictment out of Virginia. A psychiatrist treated a patient in an inpatient setting. Upon release, the doctor noted that the patient was not considered a danger to others. However, the doctor then, on 3 different occasions, disclosed the patient's PHI to someone at the patient's employer. Apparently, the doctor said that the disclosures were OK because the patient was dangerous, even though his release notes said otherwise. Not unusual to see a HIPAA complaint and violation out of a scenario like this, but a criminal case is pretty unusual.
Hat tip: Patricia Bass
Jeff [3:17 PM]
[ Tuesday, June 21, 2011 ]
How Vulnerable is the Cloud? Providers don't want to use "the cloud" because they're afraid of security risks. So far,
no big breaches can be blamed on the potential lack of security of using "the cloud" for data storage and retrieval. However, that could be because no providers are using the cloud.
I'm still a little suspicious. If you're using the cloud and good encryption, then it shouldn't be a problem. If you're putting unencrypted PHI in the cloud, I think you may well be taking a much bigger risk than you realize. Be safe out there.
Jeff [8:19 AM]
[ Thursday, June 16, 2011 ]
Colorado ID Theft: In today's "healthcare workers acting badly" news, it's a
Colorado nurse stealing identitied of patients.
Jeff [8:40 AM]
Off-Topic: nurse-oriented blogs.
Jeff [8:26 AM]
[ Tuesday, June 14, 2011 ]
More Florida: Now it's
Jackson Health where an employee is accused of stealing data.
Jeff [8:22 AM]
[ Friday, June 10, 2011 ]
Yikes: 80% of businesses lost data last year. That's as many dentists who choose Trident. Mostly it's consumer data, and mostly it's because of stolen laptops, lost disks, etc.
Jeff [2:59 PM]
[ Thursday, June 09, 2011 ]
From Dom: Six Things You Ought to Know about the newly-proposed HIPAA Accounting Rule (in addition to the fact that it doesn't have anything to do with acounting, as in CPAs, but is about accounting for disclosures).
Jeff [5:24 PM]
Could be worth looking into: the
Commerce Department is recommending some voluntary Security "Best Practices" for businesses with a cyber-presence (i.e., everyone).
Jeff [5:18 PM]
[ Monday, June 06, 2011 ]
Alabama Data Theft: Once again,
a HIPAA breach that's really an ID theft case.
Jeff [11:08 AM]
[ Friday, June 03, 2011 ]
HIPAA Implications of Tornado Damage: One of the Security Rule requirements for covered entities is that they have emergency operations ability and contingency plans.
Here's a good example of why.
Jeff [11:48 AM]
[ Wednesday, June 01, 2011 ]
One further note on the new Accounting for Disclosures rule: Kirk Nahra made an interesting point on the AHLA HIT list: perhaps the intent of HHS in making the accounting rule so burdensome is to protect the "harm" threshold in the breach notification rule. The "harm" rule has been under attack by privacy advocates and congressmen, and may go away. But if HHS can impose a harsh accounting requirement (accounting requests are few and far between, so even if the rule is harsh, it won't happen enough to be truly burdensome), then it can justify keeping the breach notification rule easier, and maintain the "no harm" threshold for breach notification. Hmmmmm. . . . . . .
UPDATE: Katherine Keefe also points out that this rule may really catch health plans flat-footed and off-guard. They don't have EHRs. But they do maintain ePHI, and they maintain it in a way that would fit the definition of a designated record set. The access rule applies to all ePHI, regardless of whether it's in an EHR or not. Yikes.
Jeff [10:57 AM]
The Accounting Rule: As you can tell from the posts yesterday, I've been busy and am trying to clear up the backlog. As I
noted Friday, HHS has released a revised rule relating to how covered entities (and business associates) must account for disclosures of PHI. I was busy over the weekend graduating my eldest daughter from high school, so with ceremonies and parties and out of town guests, I didn't have a chance to read the rule, but I started in on it yesterday. I have read most of the commentary to the rule and will have a more in-depth analysis later. But it is a pretty dramatic change. There's press on it
here and
here.
There are two components now, an accounting of disclosures and an access report. The accounting involves cataloguing (i) a set group of disclosures (ii) of all PHI (electronic or paper) that (iii) is maintained in a designated record set (iv) over the preceding 3 years. The access report involves cataloguing (i) any access to ePHI (not including paper PHI, but including ePHI in an EHR or in any other system or condition), (ii) regardless of whether the access is for a use or a disclosure, (iii) out of a designated record set (iv) for any purpose (v) over the preceding 3 years.
This really has a similar feel to the way the original Privacy Rule dealt with "health plans" as if they are separate legal entities (when most are not): it's as if HHS doesn't really know how hospitals and medical practices use and store ePHI.
More to come, I promise.
Jeff [10:27 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
