[ Friday, October 21, 2011 ]
HIPAA 5010 News: While most of this blog is focused on HIPAA's privacy and security requirements, there are other parts of HIPAA as well. One of the "other" components of HIPAA is the transactions and code sets business, which basically sets forms (format and content) for specific electronic healthcare transactions, such as submission of bills. The theory is that by reducing the number of different electronic forms/formats, and requiring everyone to use the same form/format, duplicative "translation" efforts can be eliminated and cost savings will occur. The American National Standards Institute (ANSI), the same group that sets standard sizes for light bulb screw-in threads and electrical plugs, sets these standards, and they are occasionally revised.The original (I believe) HIPAA transaction and code set forms were called the 4010 formats; however, new standards, called 5010, have been proposed. All healthcare entities engaging in standard transaction via electronic formats were supposed to start testing the 5010 formats by January 1 of 2011, and everyone is required by law to switch to 5010 by January 1, 2012.
Unfortunately, not everyone is ready. If you're not ready, you could hire a "clearinghouse" to translate your current forms into 5010 format, so by the time your transactions hit the electronic marketplace, they are up to snuff. It seems that California's Medicaid program is not ready, and will not be translating. Rather, they are requiring all Medi-Cal participants to translate their 5010 formats back into 4010 format. Can they do that? Not without violating HIPAA.
It will be interesting to see how the HIPAA enforcement agencies treat the largest Medicaid program in the country when it boldly decides not to comply with HIPAA.
(Big) Hat tip to Stanley Nachimson for flagging this.
Jeff [11:27 AM]
[ Monday, October 17, 2011 ]
Medical Identity Theft: It's growing, says American Medical News. As with other data losses, as usual, if you want to look for the highest risk areas, look to where someone can profit from the data theft. With a regular data breach, it's not the medical information that's valuable, it's the social security numbers and other information that enables identity theft. And if it's not ID Theft the miscreants are after, it's medical identity theft.Jeff [7:29 AM] Spectrum Health System (Worcester, Mass), a mental health and substance abuse provider, has reported the theft of a hard drive, one containing patient identifying data (including SSNs). Of course, the nature of the services make the information particularly sensitive. The data wasn't encrypted, but was double-password protected.
Jeff [7:24 AM]
[ Friday, October 14, 2011 ]
Nemours Data Loss: The Nemours Foundation, which operates health facilities in Delaware, Pennsylvania, New Jersey and Florida, has lost 3 backup tapes containing patient data. The data, which includes names, DOBs, SSNs, and bank account information, is coded, but apparently not encrypted.The good news is that the data is old (pre-2005) and there's no indication the tapes were stolen: they were in a storage cabinet that got removed when the the building was remodeled. My guess is that they are in a commercial landfill somewhere (a few layers above Jimmy Hoffa). It's actually kinda amazing that they even knew the tapes were gone.
Jeff [10:37 AM]
[ Thursday, October 13, 2011 ]
Totally Off-Topic, but Awesome Nevertheless.The Most Interesting Baseball Player in the World:
Sorry, Detroit fans.
Jeff [11:28 AM]
[ Wednesday, October 12, 2011 ]
Today's data breach news: As seems so often to be the case, portable data storage is the Achilles heel of PHI security. In New Hampshire, a flash drive with data of 2000 patients was stolen from a clinic employee's car. The flash drive was in a computer bag in a locked car; presumably the thief thought he was getting a computer, not a flash drive. The data apparently wasn't encrypted, but fortunately it didn't have social security numbers or credit card numbers either.Meanwhile, in Baltimore, the lawyer representing Dr. Mark Midei (the alleged stent over-user) in multiple malpractice claims lost a portable hard drive containing medical records of 161 of the plaintiffs. This one makes for some interesting reading. The law firm claims that the data was taken home nightly as a security precaution (basically, a data backup). But the data wasn't encrypted. And the firm waited two months before sending notice letters. The firm isn't a covered entity, but it's certainly a business associate, which would make it subject to the HIPAA Security Rule and the privacy provisions of HITECH. The plaintiff lawyer is pretty sanguine about it, calling it an honest mistake. I suspect the data has long been erased and this breach won't ever result in harm to the individuals whose data was on there (like the New Hamshire case, the value of the hard drive to a likely thief would be the hardware, not the data), but it's a pretty bad story.
Jeff [9:21 AM]
[ Thursday, October 06, 2011 ]
This seems about right: Doctors are big users of social media, but do not use it to connect with patients, and even avoid patient forum sites.Jeff [2:41 PM] Stanford Update: The New York Times has picked up the Stanford data breach story I noted below; that definitely explains a lot about how the data ended up where it did. As a further twist on the story, a plaintiff has already appeared and filed suit (what damages she can show, I can't begin to imagine), but Stanford has vowed to defend itself vigorously. Good on 'em.
Jeff [8:50 AM]
[ Wednesday, October 05, 2011 ]
Kermit (Winkler County), Texas Update: If you followed the Winkler County case at all, this is a pretty interesting denouement: Two nurses in this small west Texas town filed a complaint against the local doctor. It was obvious that there was a clash of personalities and a personal feud going on. But the doctor got his pal the local prosecutor to file charges against the nurses for improperly disclosing PHI in filing the complaints with the Medical Board. That backfired -- the nurses were acquitted, and the doctor and prosecutor both wound up being charged with misconduct. The prosecutor was found guilty of Misuse of Official Information, Official Oppression, and Retaliation. Apparently his prediliction for prostitutes became part of the case.Jeff [8:44 AM] http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template
