[ Thursday, June 29, 2006 ]
Stolen VA laptop recovered: As reported in the Washington Post, the FBI recovered the stolen laptop with all of the VA data on it; the FBI determined that the data had not been accessed, but they're not saying how they got it back (other than saying they haven't arrested anyone for the theft). They also note that there have been no reports of data theft from the information either. A couple of interesting notes to the story, though. First, the employee apparently had permission to work with the information from home. The initial reports said the employee had broken policy by taking the information out of the office. Second, what happens to the lawsuit that was already filed against the VA for the data breach? I guess it goes away, since there's no damage done, although would the plaintiffs still claim some sort of emotional distress from the possibility that the data was disclosed?Third, this buttresses my "crackhead" point -- most of these potential data theft problems are really crackhead problems. That is, it's some crackhead stealing a laptop to fence as hardware, not a theft of data in any meaningful sense. Sure, the data is also stolen, but that's not the target, and it's usually deleted so the hardware can be resold. James Lee Burke has a great story in one of his Robicheaux books about some junkie breaking into a house in the Garden District of New Orleans and bundling up a bunch of silver-plate flatware and all the liquor in the house in a priceless Irish Lace tablecloth so he can haul it out of the house, and ditching the only valuable part of his loot -- the Irish Lace -- without even knowing it was valuable. That's the funny thing about data: it's really valuable, but only to certain people; to others, it's absolutely worthless. And that's also why HIPAA is a pretty damn goofy regulatory scheme: the level of protection appropriate for the valuable data is applied to the worthless data. Because we can't tell the gold from the garbage, we treat it all like gold.
(Hat tip, by the way, to Jon Neiditz at Lord Bissell & Brook for the WaPo story)
Jeff [11:08 AM]
[ Monday, June 26, 2006 ]
New in Florida: Jeb Bush recently signed a new law that requires custodians of medical records to comply with the same sort of privacy and confidentiality restrictions that are applicable to the providers who originally produced the records. Protecting at the weak link, I guess. I'll give a link when I get one.Jeff [11:20 AM]
[ Saturday, June 24, 2006 ]
Another data breach: Some people are enjoying this perhaps a little too much for the rich irony of it, but the Federal Trade Commission, the primary government watchdog on commercial data security, has suffered its own data breach. Once again, laptops stolen from a car.Jeff [10:00 AM]
[ Friday, June 23, 2006 ]
On the Federal Front: If you're trying to follow what Congress is doing with regard to medical record electronic storage and interoperability, here's a snapshot of where the various pieces of legislation are.Jeff [9:54 AM]
[ Thursday, June 22, 2006 ]
"Clinical HIPAA?" Interesting article in HealthLeaders today on the need to standardize clinical data in digital format, and how the benefits from such standardization will far outstrip the benefits from standardizing a handful of transactions, but will be harder to jump-start than the standardization of transactions. Basically, HIPAA (the transactions and code sets part) standardized transactions, particularly the form and format of the data to be included in the transaction. If we're going to move toward toward EMR, EHRs, PHRs, or whatever you want to call them, we not only need to digitize the data that make up those medical records, we need to standardize the form and content of that information, as much as possible. "Digitization" can't just mean scanning copies of old records, although even that would be a bit of an improvement; rather, we need to convert existing medical information into meaningful digital information that can be easily scanned, reviewed, collated, compiled, etc. Obviously, diagnosing a medical condition isn't like diagnosing a car problem, nor is medical information particularly suited to fill-in-the-box categorization. But there are large parts of it that are; how else could we have CPT and DRG codes? Can we get those easily-categorized parts of medical records into consistent digital form and content, as part of the migration to EMRs? And where will the push come from? Where is the right place to put that pressure? Are there lessons to be learned from the TCS part of HIPAA implementation? I'm sure there are.Jeff [8:55 AM]
[ Tuesday, June 20, 2006 ]
New Texas HIPAA court decision: The 3rd District Court of Appeals in Austin has ruled that state entities must disclose information to the public that is required under the Public Information Act, even if that information is PHI. The disclosure would be allowed under HIPAA as a disclosure "required by law," and that there's no preemption issue because both statutes can be complied with in case of such a disclosure.More analysis from me shortly.
UPDATE: Here's the "more analysis."
Jeff [8:48 AM]
[ Monday, June 19, 2006 ]
Another laptop theft: Again, the potential damage is in the release of the social security number. And again, it makes me think that having a different number for your health identifier would be a good idea and would de-link the commercial attractiveness of medical information to a potential data thief.Jeff [9:49 AM] Anxiety over electronic data: Here's an interesting article on some common fears about what could happen when information is converted from paper to electronic media.
And here's some fears involving the same factors, but from a totally different perspective.
Jeff [8:36 AM]
[ Sunday, June 18, 2006 ]
Sorry for the light(house) posting. . . .
Jeff [11:11 AM]
[ Thursday, June 15, 2006 ]
Another corporate data breach: This time, it's AIG. Again, it was a burglary where computers were stolen. Interestingly, AIG waited 3 months to report the theft publicly, because the police investigating the theft opined that the thief was after the equipment, not the data, and notifying the public about the data being out there would only increase the risk that the thief would actually try to access and use the data.Jeff [12:01 PM] "Sick" blogs: Here's a perfectly logical extension of the blogging phenomenon.
Jeff [11:58 AM]
[ Tuesday, June 13, 2006 ]
Blawg Taxonomy: I've been informed by Ian Best that this blog has been included (twice, no less) in his taxonomy of legal blogs. I'm categorized as a Legal Specialty blog (Health Law) as well as a Statute blog.Cool. And cool to find a list of blawgs organized like that.
And, I'm glad it's taxonomy rather than taxidermy.
And check this out, too.
Jeff [11:08 AM]
[ Thursday, June 08, 2006 ]
EMRs hurt HIT? Is the new emphasis on electronic medical records a help or a hinderance to the underlying goal of increasing the robust development and use of electronic data interchange in healthcare and the development of health information technology? I've always considered it a help, in that it answers the "what's in it for me?" question for patients and practitioners. But others think it's a distraction.Jeff [9:46 AM]
[ Tuesday, June 06, 2006 ]
VA data breach update: apparently, a coalition of veterans groups has filed a class action suit over the VA data breach incident. As far as Iknow, there are no reports yet of any improper data use (what we lawyers would call "damages") from the stolen data. I'm guessing that, at this point, there won't be any. But that doesn't stop the lawyers from asking for $1,000 per person, or about $25 Billion Dollars. And who's to pay? The government (i.e., you and me), of course.Jeff [11:34 AM] Upstate New York Gets EMR Help: There are a handful of pilot projects out there where government and industry grants are used as leverage to get communities of providers to move to electronic health records. Here's a story of what's going on in upstate NY.
Jeff [10:38 AM]
[ Monday, June 05, 2006 ]
HIPAA Unenforced? Calling Fox Butterfield. You've probably already seen the Washington Post story on how "the Bush administration" is failing to enforce HIPAA. Why so little enforcement? Perhaps it's because the law purports to fix a problem that wasn't really a problem. Almost every single player in the healthcare industry scrupulously protects the patient information it holds. Sure, there are a few really bad eggs that misuse information, but mostly those are individual scammers and criminals who just happen to be in healthcare; they would steal information if they worked at the DMV or for a retailer. By and large, virtually all physicians and hospitals are pretty damned diligent about keeping PHI under wraps. HIPAA helps keep everyone's eye on the ball and makes the players "think" about privacy, but there just wasn't a huge problem that needed HIPAA to fix it.Secondly, the entire enforcement aim of HIPAA is to protect the information, not send otherwise good players to jail. Since there wasn't a big problem to begin with, would you be surprised to find that most of the problems that do come up are easily fixed with just a little counseling and training? Why would anyone be surprised that a law intended to fix a non-existent problem is "essentially meaningless"? I wouldn't expect anything but.
You could pass a law that anyone exceeding 250 miles per hour on a public street would automatically be given a 20 year non-probatable sentence; would you complain if after three years, nobody had yet been sentenced? Perhaps it's because nobody is driving 250 miles per hour.
Who (or what) is Fox Butterfield, you ask? He's a NY Times reporter famous for wondering how crime rates could be dropping when prison populations keep rising. This isn't exactly the same, but it's pretty close.
Here's a better question: it seems to me that there have been precious few, if any, cases prosecuted under the Patriot Act. Why isn't the Washington Post complaining that the Patriot Act isn't being enforced enough? Surely the Patriot Act was enacted to address a much more serious issue than HIPAA; why won't the Washington Post bemoan its underenforcement? Actually, wouldn't you want more vigorous, zealous pursuit of terrorists than of hospitals who don't do enough to keep your gall bladder information out of public hands?
Jeff [4:16 PM] Non-Healthcare Identity Theft: Two new stories over the weekend of loss of personal information that could lead to identity theft. One involves Royal Ahold, the Dutch company that runs the US grocery stores Giant, Stop & Shop, and Tops, which reported that a laptop containing social security numbers and other information on employees was lost when an employee of a data vendor to the company, EDS, disappeared on a commercial flight (the EDS employee was asked to check the bag with the computer because the overhead bins were full; I'm guessing the employee was carrying a purse or something that went under the seat in front of her).
The second involves Hotels.com, and also involves a vendor, this time Ernst & Young. An E&Y employee's laptop was stolen; the laptop had information on about a quarter million Hotels.com customers. The information included credit card information of the customers. The laptop was password-protected, but apparently the information was no encrypted.
Jeff [4:04 PM] http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template
