HIPAA Blog

[ Wednesday, May 31, 2006 ]

HIPAA junior? Here's something to keep an eye on: House Bill 4157, which passed out of subcommittee (Ways and Means - Health) last week. Named the health Information Technology Promotion Act of 2006, it could be a mini-HIPAA. It would statutorily establish the Office of National Coordinator of Healthcare Information Technology (the HIT Czar, previously David Brailer) and push the American Health Information Community and other coordinated efforts to implement HIT, require Stark exceptions and safe harbors for HIT and EMR, require a study of areas of mismatch between federal and state privacy protections (and, if no legislation follows the study after 18 months, allows the Secretary of HHS to promulgate rules -- hmmm, that sounds familiar), and push the updating of the X12 transaction standards. It hasn't passed out of committee, and might not, since it's got some major privacy rights folks in full war dance. But, it warrants watching, that's for sure.

Jeff [4:58 PM]

Toward a Privacy-Minded Culture: Also in HealthLeaders, a special by Sonnenschein's Gina Cavalier on nine tips for incubating a privacy-minded culture at your health care operation. I particularly find interesting no. 2 (review and update privacy policies and procedures) and no. 5 (include privacy reminders in newsletters and compliance alerts), since they address the most likely culprit preventing a good privacy culture: habit. A sign on the wall is good, but only for a while; once you're used to it being there, you stop paying attention to it. Reminders and periodic scheduled updates to policies and procedures help re-awaken the HIPAAcrat in all your employees.

Jeff [4:56 PM]

EMRs in the news: There are a couple of interesting articles up at the HealthLeaders site that impact some of the topics usually discussed here. First, you know I talk about electronic medical records or electronic health records a lot, since it involves a lot of the concepts in HIPAA and raises a lot of the same concerns that HIPAA addresses. Partly because of those concerns, partly because of the cost, and partly because nobody wants to own the "betamax" version, physician groups have been slow to jump into EMRs, even though there certainly seem to be cost and quality reasons to want an EMR system. In this story , HealthLeaders' Gary Baldwin tracks the problems and progress of five different medical practices that adopted EMR technology.

Jeff [4:52 PM]

National Provider IDs: As I noted earlier, CMS has given all Medicare providers until May of 2007 to get apply for their new National Provider Indentification Number (NPI), which is part of the HIPAA AdminSimp provisions intended to streamline the electronic exchange of information in the healthcare industry. It's kind of like the bank commercial where they staple the bar code to the bank customers' foreheads: CMS wants all providers to have a single number that they use to identify themselves for all healthcare transactions.

However, you don't actually have until May 2007 if you're enrolling as a Medicare provider or changing your enrollment information: the new NPI is required information on any new enrollment application or change of enrollment information filed with CMS starting this month (May 2006). So, if you haven't gotten your NPI, you might as well git 'er done.

Jeff [4:48 PM]

[ Tuesday, May 30, 2006 ]

Texas Medical Records Case: It's not really a HIPAA case, but rather a physician-patient privilege case. Med-mal plaintiff Boren wanted to look at the operative reports and discharge records from a Tenet hospital on all patients (non-parties to the lawsuit, naturally) who had received a particular procedure at the hospital. Since that would obviously not be granted, Boren asked for the information, with all patient identifying information removed. The hospital could, under HIPAA, release that information since it would no longer be PHI if it was truly de-identified.

The Tenet hospital objected to the request, claiming that the information was still subject to the physician-paitent confidentiality privilege, even if de-identified. The trial judge overruled that objection, and ordered the information disclosed. Tenet appealed, and sought a writ of mandamus requiring the trial judge to rescind his discovery order. In a decision under the name "In re Tenet Healthcare Ltd.", Tex. Ct. App., No. 12-05-00310-CV, 3/31/06, the appeals court granted the writ of mandamus and overturned the trial court's ruling. Said the appeals court: "The redaction of identifying information does not address the concerns regarding portions of nonparty medical records relating to diagnosis, evaluation, or treatment. . . . Therefore, redaction of identifying information from nonparty medical records does not defeat the medical records privilege. . . . Consequently, the records Boren seeks are privileged in their entirety."

This case serves as a reminder that even though a disclosure might be allowed under HIPAA, you should still consider whether there's a more stringent state law that requires continued confidentiality.

Jeff [11:38 AM]

[ Friday, May 26, 2006 ]

Unique Patient Identifier: A while back, I posted on one possible reason why it's a big mistake to not push for the establishment of a system of unique identifiers for each patient who ever enters the healthcare system. You know the advantages: all your records in one place, easy to find, no worries that your information won't be where you need it when you need it, no confusion that you are someone else, and the final link in digitizing all of the participants in the healthcare stream of commerce. You also know the disadvantages: concerns about privacy, about someone posing as someone else to get their information, concerns about possible data mining of the consolidated information for commercial or nefarious purposes, such as denying insurance to people because their medical records indicate a tendency toward disease, etc. Add to that the (perhaps paranoid) natural suspicions of Americans for whom a "national identity card" is the equivalent of the "papers" that Germans had to carry in WWII movies. This hurdle, the privacy red flag that blinds the conspiracy theorists, has been very high, and there's nobody motivated enough on the other side to have enough momentum to try to jump it.

I've indicated that, personally, I think having a UPI would be useful for a single powerful reason: there already is a common UPI for healthcare patients, and that's their social security number. 99 percent of the population already uses their social security number as their patient identifier. For those who say it's unAmerican to have a national ID card, I say the horse has already left the barn: we don't usually show our Social Security Cards to prove our identity, but we certainly do disclose our Social Security Numbers to do so.

That number is the key to your financial information, and the key for someone who wants to steal your identity for financial fraud. And really, there aren't too many people who want to steal your identity for the purpose of having your medical records appear as their own. Sure, there are instances where someone wants to steal your healthcare-specific identity to allow them to get healthcare, but that's a very small risk compared to the risk that someone would want to steal your identity to commit financial fraud.

But what if your financial identity was separated from your healthcare identity? Wouldn't that make you less hostile to the possibility that someone might get hold of your ID number? Also, if someone who hacked into your healthcare records only got your UPI and not your SSN, it would be a lot less useful to them, which would make your healthcare records a lot less of a juicy target for a data thief. Sure, I know, there are still valuable nuggets in your healthcare information, at least for the right person viewing them. But the target value would go down pretty dramatically.

Anyway, why am I rehashing? Because there's a great article on the possible rebirth of at least the debate over implementing a UPI system in this week's Modern Healthcare (subscription may be required). It's pretty easy to see the divide between the commercialists and informaticists on the one side and the privacy Nazis on the other side (note: I'm not calling them Nazis in a Godwin's Law fashion that they're really fascists -- they're the opposite -- but in a "Soup Nazi" fashion). For example, Joy Pritts of Georgetown says that a UPI "is not necessarily a horrible idea if it's done right. . . ." Actually, it's a fabulous idea if done right; the question is if it's necessarily a horrible idea if it's done not-so-right. And I don't think it is. I think it's a worthwhile endeavor even if it has a few hiccups. It will still make medical records a poor source of data for identity theft, which is a pretty good idea.

Jeff [2:23 PM]

[ Wednesday, May 24, 2006 ]

Off-topic, but healthcare related: If you deal much with healthcare regulations, you're aware of the federal antikickback statute (sometimes short-handed to "fraud and abuse"), which outlaws the payment for referrals of government-pay patients. And you're probably aware that several states have adopted state law versions of fraud and abuse restrictions, often adding in "all payor" categories of patients. In fact, the Texas legislature tried to do that in 1991, drafting a state law that purports to outlaw payment for referrals of any patients; however, the legislation is so poorly drafted that it actually contradicts itself and makes itself virtually unenforceable. Which might explain why there have been no prosecutions under that law in Texas.

Florida also has a state fraud and abuse law, but the Florida Supreme Court has just struck down the anti-kickback provisions as being preempted by federal law. I haven't read the case yet, but it looks interesting, if you're into that sort of thing.

Jeff [12:23 PM]

[ Tuesday, May 23, 2006 ]

Off topic, but I found this interesting, even before reading it and noticing that my partner Chip Babcock is all over this. Which also probably means I shouldn't say what my initial opinion was on reading it.

I can state, however, that the quote is vintage Babcock.

Jeff [5:02 PM]

VA Data Theft: Need I even report on this? In yet another high-profile case of data theft, (perhaps the highest profile case to date) , a Veteran's Administration worker takes home a laptop computer with name, social security, and other information on about a bazillion veterans (OK, over 25 million). The VA employee was not supposed to take home the data took it home anyway, and it was stolen from the analyst's house in a burglary. It's unclear whether the data would count as PHI (was it part of the medical records or was it more like employment data?), but it will probably need to be disclosed and reported in most of the states where data breach disclosure laws have been passed. Foreign law might be implicated as well.

Ugly.

(Hat tip on the related implications: John Christiansen)

Jeff [11:30 AM]

[ Thursday, May 18, 2006 ]

Totally off topic: My oldest brother Art sent the attached card to me for my birthday last week. Inside the card he wrote:

Dear Father Jeff:

I've gotta find a better card shop. This was the last card in the
place written in English that didn't have some fat chicks or midgets on
it. Hope you had a great birthday. We'll have to raise a jar next
time we get together. Like we don't do that every time anyway!

Just felt compelled to share that.

Jeff [12:01 AM]

[ Wednesday, May 17, 2006 ]

Insurers get into the act: A handful of large health insurers, lead by the industry group America's Health Insurance Plans and some big players like some of the BC/BS groups, are combining to set up insured-specific electronic medical records, so individual patients can have access to their own electronic medical file and can grant access to the file to new physicians. Individuals who switch jobs will be able to keep their on-line health record, even if they switch insurers, if both the former and new insurers are participants.

This is a twist on the RHIO concept, where various providers in a region share patient records in a unified database. Instead of being provider-centric, this is payor-centric, and is really in the hands of the patients. It will be interesting to see how this rolls our. This concept, and the Dell concept discussed below, sure look like good solutions to potential Katrina-style medical record casualty issues.

Jeff [10:02 PM]

The Feds join in: The US House of Representatives got busy recently doing something other than trying to grandstand on gas prices or illegal aliens, when Sensenbrenner introduced HR 5318, the Cyber-Security Enhancement and Data Protection Act, which doesn't even have a funny acronym. The bill will make it a federal offense to use a botnet or otherwise access a computer without authorization to obtain identification information. Any computer "affecting" interstate or international commerce would be protected, and RICO would apply.

Jeff [1:45 PM]

[ Tuesday, May 16, 2006 ]

OK, I was wrong. I've been blabbing on and on about how PHI is primarily only attractive for the identity-theft data it contains, such as social security information and other demographic data. My point has been that nobody cares about your gallstones or your hypertension, they just want your social security number so they can get bogus credit cards and ruin your credit.

But it turns out, there actually is a growing epidemic of real life medical identity theft, where someone gets hold of your name and insurance information, poses as you, and gets medical care, all paid for by your insurance company. Obviously, these people are stealing from the insurance company that pays for the care, thinking it's you that's receiving it. But if they pay the copay and deductible, perhaps that would even help you in the end (you'd meet your deductible sooner). Certainly, unless the legitimate insured gets a bill in the end, there's not a big incentive to get the "victim" to seek out and expose the theft.

Or perhaps there is: the medical identity theif may use so much healthcare that you end up going over your annual or lifetime limit for insurance. And worse, if someone steals your medical identity and you end up with false information in your medical record, you could miss getting treatment you need, could get transfused with the wrong blood type, could be treated for ailments you don't have, and could be refused for life insurance if the medical identity thief had a disqualifying disease that got attributed to you.

It's still identity theft. But it's not what I was primarily concerned about, the ruin-your-credit kind. Instead, it could kill you.

UPDATE: Crap, who are these World Privacy Forum people? If you read the linked article and want to request an "accounting of disclosures" as recommended by those folks, you won't find out everyone who accessed your records, not by any stretch of the imagination. Instead, you won't get information on disclosures made for treatment or payment purposes, which is where the medical identity theft described in the article would be occuring. Instead, you'll just be tying up the providers and payors from whom you're asking for accountings. Sheesh.

Jeff [5:05 PM]

[ Thursday, May 11, 2006 ]

911 Calls to EMS: The Louisiana Supreme Court has ruled that 911 calls to a government-run EMS service do not have to be provided to journalists under Open Records rules since they are protected under HIPAA. Louisiana Secretary of State Fox McKeithen suffered a paralyzing fall at his Baton Rouge home and three calls were placed to the Baton Rouge city-parish 911 service. Mr. McKeithen, who was rendered a quadriplegic by the fall and has since passed away, was alone at the time, so presumably the calls were made by him. Several news organizations requested that the city-parish EMS service release the content of those calls, but the EMS refused, citing HIPAA. The news organizations sued, but the courts apparently held that (i) the EMS is a "provider" and covered under HIPAA, (ii) the content of the 911 calls contained PHI, and (iii) HIPAA prohibits the disclosure, despite the open records law.

This (health information in government hands) is the primary area where the HIPAA preemption and the "otherwise required by law" provision collide, and where more guidance is needed. I haven't had a chance to review the Louisiana Supreme Court opinion yet, nor do I know much about the particulars of the Louisiana public records laws, but this result, at least, tracks the result the Texas Attorney General reached in his opinion regarding whether governmental entities are subject to HIPAA. AG Abbott relied on some loose language in the Texas Public Information Act regarding "personal" information to determine that government-run ambulance services or public hospitals my refuse to provide PHI to newspapers, even though the PHI is a "record" of the public entity and public entities are generally required to make their "records" available to the public.

Hat tip: Marc Goldstone at Tenet (in sunny south Florida).

Jeff [10:18 AM]

40%. According to a recent Harvard survey 40% of malpractice cases are "baseless," with either no showing or harm or no showing of error. Unfortunately, the story is in the subscription-only Wall Street Journal, so I can't post on the whole thing. We'll see if someone else picks it up (I don't hold out much hope for the NYT or Wash Post).

UPDATE: Here's more to the story from the AP.

Jeff [9:19 AM]

[ Wednesday, May 10, 2006 ]

Medical Identity Theft: You've read my bleatings about the fact that the valuable jewels in most medical records aren't medical information, but personal information that could be useful in an identity theft situation. That doesn't mean that there's no such thing as medical identity theft. It is there, represents a potential financial benefit for those who could use the information for financial gain (the best example is an insurance company that refuses to issue a policy to an individual on account of medical information), and even more so, represents a potential danger to the life or health of the individual. Improper access to an individual's medical identity, including the addition or removal of information, can kill. More here.

Jeff [12:58 PM]

[ Monday, May 08, 2006 ]

Disappearing images: St. Anthony's Hospital in Pendleton, Oregon, offers today's lesson in the need for data backup. According to Modern Healthcare's Daily Dose (4th item), 4 of 5 hard drives on their GE system failed, and the hospital is unable to recover about 5,000 x-ray images on about 900 patients. Don't know yet whether the hospital had a policy of doing back-ups (probably required by HIPAA's Security Rule -- yah, yah, I know it's scalable, but jeez, isn't simple back-up reasonable for anyone to do?) and didn't follow it, or didn't have the policy in the first place; I suspect we'll hear more soon.

Jeff [5:05 PM]

Another Dumpster Full of Medical Records: Dental records, actually, but the point is the same. According to KING-TV (registration required), records from a dental practice were accidentally taken by a salvage company that was supposed to remove some restaurant equipment but also took the records, which were nearby. The salvage company handed off the paper "salvage" for recycling, and that's how the records ended up in a recycling bin. According to the story, all of the records that made it into the recycling bin were retrieved, but more records may have simply gone to the dump.

Naturally, the big problem is not that the records contain medical (or in this case dental) records, but that they contain bank account numbers, social security numbers, and other demographic data that could be used by an identity thief.

Hat tip: Emma Squillace.

Jeff [4:51 PM]

Update: Federal Data Breach Notification Law unlikely to pass this year. As discussed earlier in this blog, many states have recently passed legislation requiring companies doing business in those states to actively notify individuals, customers, and clients if they become aware of a data security breach that puts the personal information of those people at risk of disclosure or misuse. As you might expect, and as I pointed out, several of our esteemed Members of Congress jumped into high-demogogue mode and proposed federal legislation to do the same thing. Actually, I'm not at all opposed to federal legislation to displace the various state laws, so that everyone operates under the same rules, but would hate to see federal legislation merely layered on top of all the state law mandates.

Well, according to MacWorld, federal legislation is unlikely this year. Sometimes, having a totally disfunctional legislative branch pays unintended benefits. Of course, if there was some lobbyist who could get an "earmark" out of this, I'm sure the legislation would pass.

Jeff [10:56 AM]

On the other hand, I can't decide if this is funny or just sick.

Jeff [10:28 AM]

Personal Protesting: Is it just me, or does anyone think this is a really good idea?

Several hundred activists from throughout the country demonstrated at the
doorstep of Health and Human Services Secretary Mike Leavitt yesterday to
protest the administration's prescription drug plan for senior citizens.
Betty Gazaway, 72, of Cincinnati, who knocked on Leavitt's door, said a woman
who identified herself as his wife politely told Gazaway that Leavitt was on a
plane and could not be reached by phone. "She was real nervous, but she
was real nice," Gazaway said of the woman.

The community action stunters were demanding that Leavitt extend the deadline for seniors to apply for Medicare Part D from May 15 to December 31. Actually, they're just pulling off a publicity stunt, and an awfully stupid and dangerous one.

Jeff [10:20 AM]

[ Friday, May 05, 2006 ]

HIPAA Compliance Problems: As reported by eWeek, hospitals and other providers are failing to comply with HIPAA, and patients are getting less and less willing to sign authorizations to allow disclosure of information. These trends, highlighted by this AHIMA survey, bode ill for the future development and implementation of interconnected healthcare information systems.

Jeff [11:06 AM]

[ Monday, May 01, 2006 ]

TRICARE hacking: The Department of Defense announced recently that somebody tried to hack into the data files held on one of the servers of TRICARE Management Activity. Tricare is one of the federal healthcare programs for the military. Apparently, the computer security guys noticed some hyperactivity on the server and intervened. Potentially affected people have been notified. As usual, the big concern is identity theft.

Jeff [11:56 AM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template