HIPAA Blog

[ Thursday, August 25, 2011 ]

 

At the risk of confusing myself, here's another place where I've been known to occasionally blog.

Jeff [4:17 PM]

 

OCR's Standard Response: In the event of a breach that involves noncompliance and some serious impact, you might still get a "resolution agreement" from OCR rather than a fine/penalty (assuming you cooperate, of course). However, according to Theresa Defino at AIS, you should still expect to be requried to re-write your policies, retrain your employees, institute some serious monitoring, and pay out some cash.

Jeff [9:03 AM]

[ Wednesday, August 24, 2011 ]

 

Off Topic: It's nice to know, but it doesn't really matter, as long as the lager yeast actually works. I've got a 5-gallon carboy in my garage fridge, full of this fall's Marzen, lagering away at 45 degrees (a little on the chilly side, but I'll warm it up later).

Jeff [10:54 PM]

[ Tuesday, August 23, 2011 ]

 

When Medical Privacy and Law Enforcement Collide: One headachey area for HIPAAcrats occurs when the demands of the law, and particularly law enforcement, require disclosure of information that is protected under HIPAA. HIPAA specifically addresses a lot of ways police officers can get information from HIPAA covered entities, as well as some limitations. For example, a covered entity can give the police information, including PHI, for purposes of identifying a suspect or victim, but they can't give them DNA without a court order.

Some HIPAA Privacy Officers take their privacy obligations to extremes that exceed what HIPAA requires. That appears to be what's happening in Rhode Island.

Jeff [4:25 PM]

[ Monday, August 22, 2011 ]

 

Digitized data + internet access + PHI = potential trouble. For "data leaks," at least. But then again, you already knew that.

Jeff [10:18 PM]

 

Lost Thumb Drive Results in 500 Breach Notifications: St. Francis Hospital in Delaware misplaced a flash drive that had names of mothers who participated in a prenatal program 10 years ago. No social security numbers were involved, and it doesn't sound like particularly revealing information; also, the flash drive was recovered, apparently with the data intact. I don't know all the information, but I suspect many providers would've concluded after their risk analysis that there was no substantial risk of harm, and therefore no breach. But St. Francis sent out notifications.

Jeff [10:06 PM]

 

The Risks of PHI on the Internet.

Jeff [8:01 AM]

[ Tuesday, August 16, 2011 ]

 

HIPAA Hot Spots: Dom Nicastro and Adam Greene discuss the issues that OCR has identified as "hot spots" that deserve special focus by covered entities:


  1. Incident detection and response

  2. Review of access logs

  3. Wireless network security

  4. Password and user access management

  5. Loss or theft of mobile devices

  6. Up-to-date software

  7. Role-based access and other access management

All of these are things that every covered entity should have addressed in their policies and procedures. And now that you know OCR is concerned about these, they should get special attention.



Jeff [10:33 AM]

[ Monday, August 08, 2011 ]

 

Brigham and Women's Breach: apparently a physician working for the hospital lost a hard drive with medical information on over 600 patients.

Jeff [9:16 AM]

 

KPMG - HIPAA Auditor and HIPAA Breacher: OK, KPMG is a huge company and with a substantial healthcare business. And any big player is going to suffer an occasional problem. But Dom Nicastro points out that the company now charged with conductinig OCR's first rounds of HITECH-required audits once was the subject of a HIPAA breach due to the loss of a flash drive containing PHI. I'm sure KMPG will factor that "s**t happens" defense in when it conducts its audits. . . .

Jeff [9:12 AM]

[ Friday, August 05, 2011 ]

 

CMS' HIPAA Audit Authority: Will CMS audit business associates as well as covered entities when KPMG gets started? According to Dom, they don' t know.

Jeff [8:13 AM]

[ Wednesday, August 03, 2011 ]

 

More Access Report Pushback: the American Hospital Association submitted its comments to the proposed accounting-of-disclosures rule, and like most of the other provider commenters, has pushed back hard against the new requirement to log all instances when any person or entity accesses PHI in a designated record set.

Jeff [9:27 AM]

[ Monday, August 01, 2011 ]

 

HIPAA goodies from HealthLeaders: First, Dom Nicastro has some good analysis on how the new accounting-of-disclosures rule, particularly the access report, can put healthcare providers in a bind if they get sued for malpractice. Of course, when you have access to the experts like Dom, . . . .

And Margaret Tocknell notes how the comments coming in on the proposed rule are heavily in the "me-no-likey" camp. Providers in particular are opposed to the rule. Of course, you can still get your comments in, but better hurry; you've got probably another half-hour or so.

Jeff [3:15 PM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template