HIPAA Blog

[ Friday, December 30, 2011 ]

 

Loma Linda Breach: An employee at Loma Linda University Medical Center took home medical records. I'm guessing that, as a nurse, she didn't need to work on her dictation or anything of the sort. She has been fired.

Jeff [8:34 AM]

[ Wednesday, December 28, 2011 ]

 

5010 News: MGMA is asking for more time for transition to 5010. The deadline in January 1, 2012, and was there for a couple of years. HHS has already pushed back a 3-month grace period, and now MGMA wants 6. I'm not technical enough to know why this is such a problem, but can't folks just get this switched over? Then again, how important can it be to make the switch? What advantages does 5010 have over 4010?


Hmm, what if HHS published an interim final rule, effective in 90 days, to include practice management software vendors who have a billing component into the definition of "clearinghouse"? The article states that vendors and clearinghouses are not covered by HIPAA. Au contraire; clearinghouses are (and should be, for just this reason), but vendors aren't. If vendors are the problem getting to 5010, put the onus on them and make them liable to the Feds for any failure to get to 5010, and I bet that would cure the delay.


Jeff [10:32 AM]

 

Nothing to See Here: Here's a story about nothing: customers of small pharmacies complain of privacy violations when the pharmacies are sold to Walgreens and their records are sent there. Isn't that a HIPAA violation? No, it's not. It is definitely part of "healthcare operations" to transfer records to a successor provider, which is the case here. If you don't want Walgreens to have your records, ask them to transfer your records to a new pharmacy.

Jeff [10:28 AM]

[ Tuesday, December 20, 2011 ]

 

UCLA Update: You may remember that a UCLA physician took home a portable hard drive which was stolen from his house (along with the slip of paper with the password to access the data). UCLA has now been sued for $16 million ($1,000 per patient, the California statutory damages amount).

Jeff [9:50 AM]

 

Georgia Hospital Feels the Security Rule Blues: One of the required elements of the security rule standards is the adoption of appropriate software protection, such as virus scanning and other malware prevention and protection. Why is this important? A computer virus can close your hospital.

Jeff [9:17 AM]

[ Monday, December 19, 2011 ]

 

Why There's a HIPAA Privacy Rule: HIPAA's transaction and code set rules drove the move to electronic records (and eventually EMRs and EHRs). Data in electronic form poses a much greater risk of improper access than paper records, for a number of obvious reasons. It was due to that increased risk that the HIPAA Privacy and Security Rules came into play.

The New York Times has discovered the same thing.

Jeff [10:47 PM]

[ Tuesday, December 13, 2011 ]

 

Encryption and Data Loss Prevention: There are a couple of interesting links in today's Dark Reading email: a report on email and data loss, and a white paper on encrypting data in transit and at rest. Both are free, but you must register to access the papers.

Jeff [2:47 PM]

[ Monday, December 12, 2011 ]

 

Florida Law HIPAA preemption: A Florida federal district court has ruled that a Florida statute that requires nursing homes to provide copies of a former resident's medical records to spouses, guardians, proxies and attorneys upon request is preempted by HIPAA. In Opis Management v. Dudek, the court ruled that the Florida statute requires the disclosure, but HIPAA prevents it (inless the spouse, guardian, etc. is a "personal representative" of the former resident). Via BNA (subscription required).

Jeff [6:29 PM]

[ Friday, December 09, 2011 ]

 

Q&A with Larry Ponemon: Wherein the IT expert talks about how a big healthcare data breach could be worse than an oil spill. Interesting, and a little scary.

UPDATE: More on Ponemon's recent report (should that be Pwnemon?) here; of course, I already covered it here.

Jeff [2:49 PM]

[ Friday, December 02, 2011 ]

 

Three Steps to Minimize the Data Breach Epidemic: from Government Health IT:


  1. Inventory your PHI/PII

  2. Develop an Incident Response Plan

  3. Review your Business Associate Agreements

Not a bad starting point. I'd also say you should re-do your HIPAA Security risk analysis. Part of that will be inventorying your PHI, and part of the result should include your incident response plan. The best thing you can to is find out what your troubles are. When you're sick and you go to the doctor, or even if you're feeling fine and you go for an annual physical, the first thing the doctor does is get your vitals and lab work. That's what your risk analysis should be -- a regular checkup to spot trouble (or at least trouble spots to watch) before it happens.


Jeff [11:06 AM]

 

HCPro Survey: Dom notes a recent survey by HCPro (apparently it's not just Ponemon out there asking questions) which indicates that only 17% or healthcare organizations are prepared for an audit. OCR is starting its audit process with a total of 150 "covered entities" over the next 14 months, with 20 or so getting started in November (so far, I haven't heard any names mentioned). I have no idea how many "covered entities" there may be in the US, but 150 is a tiny, tiny fraction. So the odds of being a targeted entity at this point are slim. BUT, this is a good time to think about getting your organization into a position that you could at least manage an audit, even if you don't think you could completely pass it.

At the very least, don't make yourself "low hanging fruit."

Jeff [10:57 AM]

 

Ponemon Report on Healthcare Data Breaches: There's a new report from the Ponemon Institute that indicates a growing number of data breaches in the healthcare sector. The truth of the trend may be questionable -- it could be that breaches are noticed more now than they were in the past due to the high profile of HIPAA after HITECH. But regardless, there are some interesting nuggets in the data:

More here.

Jeff [10:31 AM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template