[ Thursday, August 31, 2006 ]
Private enforcement of HIPAA: We've noted again and again that there's no private cause of action for a HIPAA violation, but the combination of the HIPAA privacy and security standards (as a benchmark for what type of behavior is expected and what implied warranties might be imposed) and other common-law causes of action like "breach of a duty of confidentiality" or "intentional infliction of emotional distress" might effectively allow for private causes of action where HIPAA has been violated (and a plaintiff has actually suffered measurable damages). Here's an
interesting case in Utah where a possible HIPAA violation is the basis for a claim of a breach of a fiduciary duty of confidentiality.
Hat tip: Kirk Nahra.
Jeff [10:04 AM]
[ Sunday, August 27, 2006 ]
HIPAA stories: here's a nice
article from Health Affairs on the unintended consequences of HIPAA, and how an overwhelming and unrealistic emphasis on privacy, even when the clear public health implications point in another direction, can lead to potentially disasterous results.
Jeff [11:23 PM]
[ Thursday, August 24, 2006 ]
New Privacy Board announced: The American Health Information Community, that group set up by HHS to coordinate governmental and private entities to develop and streamline medical information technology concerns, has put together a separate Confidentiality, Privacy and Security Workgroup. Developing a nationwide health information network is seen by some as a threat to privacy, and some people might react to that threat by keeping their information out of the network, which would hinder the network's ultimate operability. This workgroup is intended to help address those concerns. BNA story on it is
here, but you need a subscription.
Jeff [10:31 AM]
Another Laptop Theft: This time, it's in
Michigan, and again it's home health. Understandable that home health nurses should need to be carrying around laptops, and that those laptops would have PHI on them (although central server technology would be better, lack of wifi or other connectability concerns might require that the info be on the hard drive). Was the data at least access and password protected? Yes it was. That should be the end of the story, right? Wrong; the nurse left her access code and password with the laptop.
Still, it's probably a crackhead stealing the laptop to fence it (scrubbed of data that could be used to identify it as stolen), rather thsn someone trying to steal PHI about Aunt Edna's bad hip.
UPDATE: That was fast -- they found the laptop and determined that the data had not been accessed. The laptop was in a car that was stolen, and a witness saw the car thief throw away the laptop, which the witness recovered. The witness didn't know what to do with the laptop, but figured out what to do with it when the hospital offered a $2,500 reward.
Jeff [10:21 AM]
[ Tuesday, August 22, 2006 ]
Presidential Order re Health Care Transparency: GWB signed an
executive order today. Not sure how much it will impact anything, but it requires governmental agencies and payors to use interoperable technology whenever possible and strive for transparency in the way it measures quality. Whatever.
Jeff [11:49 PM]
EMRs in Houston: Here's an
article on some work a couple of Houston-area hospital systems are doing to implement electronic medical records. Here's an
article on what's going on in Dallas. And here's an
article on Kaiser Permanente in Georgia allowing beneficiaries online access to their own medical records. Patients can also check appointment dates and ask questions.
Jeff [8:27 AM]
[ Monday, August 21, 2006 ]
AOL Tech Chief Resigns: AOL got in hot water earlier this month when it accidentally released information on keyword searches by about a half-million AOL users. The head of AOL's Chief Technology Officer
rolled today. Interesting is that the identity of the users was not disclosed, so it was just information on what a bunch of people were searching, not who those people were. Seems pretty uncontroversial to me.
Jeff [6:09 PM]
EMRs in the News: Here's an
article in the NY Times about why electronic medical records won't bring cost savings. The funny thing about this article is that there's very little put into the privacy concerns. It's mainly about costs, with a long discussion of how EMRs make drug tracking easier, thereby making it easier to use generic drugs and save money. But ultimately, EMRs will probably not deliver appreciable cost savings.
For what it's worth, I tend to agree, and as is most often the case in healthcare, cost savings is the white whale: those who chase it generally come to no good end. I absolutely agree that market forces must play in the healthcare space, and think failing to take costs into account is perilous. I think we, as a society, must take cost into account when making a decision, even though it might result in someone dying earlier than they might otherwise. In other words, we as a society need to address the fact that if we spend "whatever it takes" to keep grandpa alive one more day, or one more month, that's money we won't have to spend on something else. The cost of a liver transplant for a 90-year-old could supply thousands of school lunches, fund drug intervention programs, etc.; you get the idea. And patients and their families are much more excited about spending whatever it takes when it's not their money they're spending. That's where accounting for costs must come in, and keeping market forces at play in the healthcare industry will help balance those costs and outcomes.
EMRs are good for improving care, partly be allowing better coordination and eliminating duplicative tests, partly by improving possible emergency care, and partly because of the potential for data mining to help improve public health overall. But EMRs will provide opportunities for
more care, which will eat up any savings. But, that's OK, since if we're going to spend the same amount of money for more and better care, that's a good result.
Jeff [10:30 AM]
[ Friday, August 18, 2006 ]
REAL Government Healthcare Information Technology News: Here's a really useful site: a seemingly exhaustive listing of all governmental healthcare IT websites. Pretty cool, and definitely useful.
Hat tip for this and the CIA story: Alan Goldberg
Jeff [9:41 AM]
LOOK OUT, BLACK HELICOPTERS!! Here's something to get your blood flowing: check out
this story about the Central Intelligence Agency has a venture capital firm (Hey, who doesn't? You should see their hedge fund!) that has invested in a software company that makes tools to manage EMRs. Oooooh, scary. Think of how the paranoid HIPAAcrats are going to react to this news!
Seriously, though, think just how creepy those VC guys would be if they weren't just VC guys, but CIA guys as well!
UPDATE: sorry, bad link.
This is the right link.
Jeff [9:31 AM]
[ Wednesday, August 16, 2006 ]
"Contingency" comes to an end: I haven't thought about it much, but back when the transaction standards first came into effect, CMS implemented a "contingency plan" to allow provider to continue to submit non-HIPAA-compliant transactions and still get paid. The contingency plan for claims submitted to CMS ended last year, but "electronic remittance advice" transactions ("ERAs") could still be in non-HIPAA-compliant format.
That will end this October. Probably won't impact you, since over 99% of all submitters of ERAs are compliant. But if you're still relying on the "contingency plan," better get your ERAs in shape.
Jeff [5:54 PM]
HIPAA at 10: Would you believe that HIPAA will turn 10 years old this month? The original statute (passed 98-0 in the Senate and 421-2 in the House) was signed into law by President Clinton on August 21, 1996. There's a
great story with some historical perspective in last week's Modern Healthcare (yes, the "dead tree" version hit my mailbox on the firm distribution list yesterday). Kinda makes me wax nostalgic.
Just kidding.
Jeff [5:50 PM]
VA Update: As discussed below, the VA had an ugly data breach that brought out the plaintiff lawyer vultures but ultimately was a non-issue. A laptop was stolen, but the was recovered and the information was not used improperly. However, the VA has decided to
take action to prevent even the scare from happening again: they're going to encrypt all data on laptops. (Hat tip: Robert Q. Wilson).
Jeff [10:11 AM]
[ Tuesday, August 15, 2006 ]
More Health IT: From Milwaukee, a
story of how access to electronic medical records and a link between a hospital emergency room and a medical clinic has helped ease ER crowding and helped move the care for certain patients to a better, cheaper, and more efficient location.
Jeff [9:11 AM]
Federal Health IT Bill: This one is still working its way through Congress, but yesterday's
LA Times contains a really good and balanced analysis of the issues involved in the federal efforts to develop and push forward a strategy for implementation of electronic medical records nation-wide.
Jeff [9:05 AM]
[ Friday, August 11, 2006 ]
NEWS FLASH: HCA COMPUTERS STOLEN; DATA INCLUDES THAT OF HIPAA BLOGGER!OK, "could" contain data on me, since I was a patient in an HCA hospital between 1996 and 2006 in Texas. Anyhoo, 10 computers were stolen from a regional HCA office (I'm guessing Dallas) and they could contain data on patients who were at HCA hospitals in Colorado, Kansas, Louisiana, Mississippi, Oklahoma, Oregon, Washington or Texas, between 1996 and 2006. The "authorities" think it was a "gang" that stole the computers for the hardware, not for the data. HCA's side of the story is
here.
UPDATE: Shoulda read the thing first: not only is it only those states, it's also only information on Medicare and Medicaid patients who didn't pay their copays or deductibles and had overdue accounts. Not me. And since they're deadbeats, they don't have my sympathy. But it does make you wonder: they have so many Medicare/Medicaid deadbeats that it takes TEN COMPUTERS to hold all the information???
Further Update: eWeek's story is
here. The FBI is investigating.
Jeff [3:42 PM]
[ Wednesday, August 02, 2006 ]
New Phoenix Survey: Phoenix Health Systems has been keeping up a tremendous public service by continually running surveys on the status, efforts, and effect of health industry participants in working with HIPAA. These surveys give us all a good snapshot into just how big a problem HIPAA is, who is complying and who isn't, where the trouble spots are, etc.
They have a new one that they'd like for industry participants to complete. If you're a covered entity, consultant, or otherwise involved in the space where the HIPAA rubber hits the health industry road, please go
here and complete the survey. It won't take long, I promise.
Jeff [9:26 AM]
[ Tuesday, August 01, 2006 ]
My other job: Yes, for those of you who have been asking,
Roger Goodell is my
nom de guerre for my football stuff. IF (and it's not a lock yet) I get that job, I am sure it will not detract from my other duties at JW and on this blog.
Jeff [1:39 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
