HIPAA Blog

[ Tuesday, March 28, 2006 ]

On the Funny Pages:

Tank McNamara references HIPAA. Not correctly, I don't think, but still. . . .

[ Thursday, March 23, 2006 ]

Another Stolen Computer . . .

. . . another security breach. This time it's Fidelity, with Hewlett Packard retirement plan members information.

I wonder if the laptop was an HP.

Jeff [6:14 PM]

[ Tuesday, March 21, 2006 ]

Ohio Preemption Case:

[Oops, I drafted this Monday, 3/21, but forgot to post it. Sorry for the delay]

As I previously noted, there has been a case on appeal to the Ohio Supreme Court that drills into the disconnect (which I've noted before, although not necessarily in this blog) between the preemption requirement of HIPAA (HIPAA supercedes any state laws that are "less stringent" in protecting privacy) and the "required by law" exception to HIPAA.

In the case, the Cincinnati, Ohio Health Department issued citations to building owners when lead paint was discovered in their buildings. The citations note the building owner, the location of the building, and the date the presence of the lead paint was discovered. In theory, the presence of lead contamination could come from any type of source, but in reality, the only way the Health Department knows to go looking for lead is when a child is diagnosed with lead poisoning; once that happens, the Health Department investigates the child's residence, usually finds the source of the lead, and The Cincinnati Enquirer newspaper tried to obtain copies of the citations under the Ohio Public Records Law, but the Health Department refused, due to the fact that anyone looking at the citation would know the date and location of the discovery of the lead, and could easily surmise that the discover was due to the diagnosis of lead poisoning of a child living at that location at that time. Therefore, simply by looking at the citation and asking a few questions, the newspaper reporter could easily determine who the child was with lead poisoning. So the newspaper sued, demanding disclosure under the open records law; the Health Department answered, that HIPAA prevented them from disclosing PHI, and disclosing the citations would be a release of PHI.

Over the weekend, it was reported that the Ohio Supreme Court ruled that the Ohio Public Records Law mandates the disclosure, and that the disclosure is permitted under HIPAA by the "required by law" exception. The court assumed that the Health Department was covered by HIPAA, but even with HIPAA's applicability assumed, the allowance under HIPAA for disclosures "required by law" would fit, rather than HIPAA's preemption of less-protective state laws. In other words, the Ohio Supreme Court determined that the "required by law" provision of HIPAA pretty much supersedes the "preemption of state laws" provision of HIPAA ("the Ohio Public Records Law requires disclosure of these reports and the HIPAA does not supersede state disclosure requirements").

I doubt the city will appeal to the US Supreme Court, and even if they did, I don't know if the US Supreme Court would even take up the appeal. I suspect this is a "terminal" opinion. Given that, what should we take away from it?

The court does not draw the distinctions here that would be particularly helpful in determining when "required by law" applies and when "preemption" applies, but it might be useful to look at the specific language regarding preemption in the Privacy Rule, 45 CFR 160.203:

A standard, requriement, or implementation specification adopted under this
subchapter that is contrary to a provision of State law preempts the provision
of State law. This general rule applies, except if one or more of the following conditions are met:
(a) A determination is made by the Secretary [of HHS] that the provision of
State law . . . is necessary . . . to prevent fraud and abuse related to the provision of or payment for health care; to ensure appropriate State regulation of insurance . . . ; for State reporting on health care delivery or costs; or for purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement or implementation specification under [the Privacy Rule or Security Rule] is at issue, the Secretary determines that the intrusion into privacy is waranted when balanced against the need to be served. . . .
(b) [the State law is more stringent];
(c) the provision of State law . . . provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention; or
(d) [related to health plan reporting and auditing].

Obviously, the Secretary of HHS hasn't made any determination, and the Ohio Supreme Court didn't address the "public health reporting" aspects of the lead paint citations, which would have answered the question regarding this conflict. Additionally, the Ohio Supreme Court could have noted that the preemption requirement should be read to relate only to state laws that are about medical record privacy (even though a reading of Section 160.203 does not really support that, since the text quoted above is really much broader), and that if the state law in question is about public records or public reporting, preemption isn't really the question. Unfortunately, this quandry is still unsolved.

Jeff [10:57 AM]

[ Thursday, March 16, 2006 ]

HIPAA slows down exchange of health information. So says the Milwaukee Journal Sentinel. Of course, others ahve thought the same thing.

Jeff [6:22 PM]

We interrupt spring break to inform you that the enforcement rule becomes effective today. Yawn.

Jeff [6:15 PM]

[ Wednesday, March 15, 2006 ]

Oregon "gets" HIPAA: Something like the Providence fiasco will do that to you.

Jeff [12:26 PM]

Futurama: You can have your entire medical record recorded on a microchip and implanted on your body, so that your medical record is always with you wherever you go. But of course, there's the privacy problem as well. Someone once said that there's a true dynamic tension between medical care and privacy, and any advance in one is to the detriment of the other.

Jeff [12:13 PM]

[ Tuesday, March 14, 2006 ]

Another HIPAA crime (and by a non-CE)? Check this out: a woman working in a doctor's office offers to sell an FBI agent's medical file to drug runners. But it turns out her buyer isn't a drug runner, but an FBI snitch. She's going to jail for wrongfully obtaining an individual identifier in order to wrongfully disclose PHI for personal gain. But she worked in a doctor's office; she's not a doctor. And the practice isn't accused, she is. Looks like Gibson again. But the DOJ said non-covered entities like employees, vendors, and business associates can't be held liable for a HIPAA violation. (Further discussion of that below, and here).

Unless the actual crime isn't a HIPAA crime (there are a lot of similar identity theft crimes that might apply here). . . .

I'll check it out a little more when I get a chance. I'm sorta out of pocket at the moment.

Jeff [11:28 AM]

[ Thursday, March 09, 2006 ]

Blogiversary: I completely forgot to mention that yesterday was the 4th birthday of this blog.

Jeff [10:04 AM]

[ Tuesday, March 07, 2006 ]

A Public Service Announcement: I just got an email telling me that HHS has put a new FAQ up that is really a reminder to health plans that they have to send out new NoPPs every 3 years. New people get them when they sign up (and if you have a whole lotta turnover in employees, it may never matter), but if you've got an employee who has been in the plan for 3 years, it's time to send him another NoPP. FAQ is here.

Jeff [2:07 PM]

[ Friday, March 03, 2006 ]

Data Breach Disclosure Laws: Interesting article on these new laws, which are popping up in states around the country and require businesses to notify customers if their information is breached. Technology moves much faster than lawmakers, and these laws will be pretty useless pretty shortly, simply because the technology gets better and faster. It's not entirely benign, though: businesses will still have to comply with all the bureaucracy of the old laws, even though they are ineffectual, and Congress and legislatures will be mostly unwilling to undo the laws that they rushed to pass, even though they aren't effectual anymore, because the legislators are more concerned that they look like they're protecting constituents' privacy than actually doing something to protect that privacy.

Jeff [4:27 PM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template