[ Thursday, December 27, 2007 ]
New Hampshire fights back: New Hampshire has a
new law on its books that allows a victim of identity theft to sue an ID thief for their losses. Don't know how much you could get out of the perp, but it's nice to see the victims have the specific right to go after them.
Jeff [11:40 AM]
Maine follows New Hampshire: Maine enacted a law similar to New Hampshire to prevent "data mining" of physician prescribing patterns. Drug companies and their minions buy this information from pharmacies, and us it to target market to particular physicians who (i) aren't prescribing enough of their drugs and instead prescribing another drugmaker's drug, or (ii) are prescribing enough but the data indicates they might want to consider other treatments. You can easily see how this could be used for good purposes (drug regimens change all the time, and perhaps the doctor is behind the times to the detriment of his patients) or bad (the information is always incomplete because some of the doctor's patients may use other pharmacies, the drug companies will be pushing for use of more expensive/profitable drugs, etc.). So some states made it illegal for that information to be shared by pharmacies.
The data miners challenged these laws, and won a notable case in New Hampshire (that I blogged about below). Now, a judge in Maine has
struck down that state's law as well. The opinion is
here.
Hat tips: Alan Goldberg and Arnie Friede
Jeff [10:43 AM]
[ Sunday, December 23, 2007 ]
Infoweek on Security: I wish I could just link to the email, but Information Week's weekly Saturday email is
all about security. Here's a story on
a hacker. Here's one on
botnets. Here's on on
the hacker economy. Here's something about
Linux virus programs. As Tom Lasusa's blog post indicates, 2007 was not a good year for security, but if you're not learning from the mistakes of others, you're setting yourself up to be the next mistake.
Jeff [3:00 PM]
[ Tuesday, December 18, 2007 ]
HIPAA Hinders Research: I think I posted on this recently, but a
study printed in JAMA indicates that many researchers feel that HIPAA has unnecessarily hindered their research activities.
Jeff [12:36 PM]
What, me worry? It seems most on-line users
aren't all that concerned about how much information about themselves is available online. That sounds about right to me. I've long contended that the concern over privacy, particularly health information privacy, is misstated and overblown due to the dazzling anecdote factor. Like this:
Woman comes into doctors office, tests pregnant. Doctor's office staff
calls her house, says her prenatal vitamins are ready to be picked up.
Husband, who hasn't had relations with woman for some time, gets message, kills
wife.
That's what people envision when they think about the privacy of their health information. But, the problem is that:
A: much of your health information is out there for anyone to see. People talk about their health all the time; your office mates will know if you're pregnant; it's obvious if you're on crutches that you're injured, and when people ask you what happened, you tell them, don't you?
B: Unless you're known to the person getting the information, nobody really cares about your health information, no matter how tawdry or embarrasing. If you knew that someone named Bill Hayes took Viagra, but you didn't know anyone named Bill Hayes, would you care? And would Bill Hayes really care (remember, he picks up his prescription from the pharmacist, who he probably doesn't know)?
C: The really valuable part of PHI is not the "health" part but the financial part. It's not Bill Hayes' Viagra prescription in his medical record that's valuable to a hacker, it's Bill Hayes' social security number that's also in his medical record.
Scott McNealy of Sun Microsystems said, "you have no privacy; get over it." That's an obvious overstatement, but still, I think that most people who are savvy about information and technology realize that there's a lot of information out there that's not private (hey, those folks are actually looking for that information, too, so if they want to find it on their own targets, they know it's out there on themselves), and they actually might like it that way -- don't hide your light under a bushel basket.
I also tend to think that there's actually a lot more opportunity to maintain your own privacy in this modern world than there was in the past, if that's what you're really looking to do. Think Mayberry: everybody knew everyone's secrets in small towns. Now, like the Purloined Letter, the best place to hide may be in plain sight. With so much information available, it may actually be easier to get privacy. Think about that.
Jeff [11:08 AM]
Health Informatics Horror Stories: Here's an interesting (if somewhat scary)
compilation of stories where bad health information systems, bad information, or poor training in healthcare technology caused problems, injury, or death. Many of these are health information issues, but a few (like the deplorable first one) are just bad training on technology. But, as
John Christiansen points out, there are teachable lessons here. Read 'em and reap (knowledge to prevent a similar mistake in your own shop).
Jeff [11:02 AM]
[ Friday, December 14, 2007 ]
Beware HHS audits of electronic patient data systems: that's the message being pushed at the 15th annual HIPAA summit this week (I admit, I'm not there, just reporting what I'm hearing. In fact, BNA has an
article (subscription requires) on it. Snippet:
The next time the Department of Health and Human Services conducts a HIPAA compliance audit on a hospital that maintains electronic data on patients, the chief information, security, and privacy officers are likely to have a very bad day.
That was the message several speakers delivered Dec. 12 to hospital privacy and security professionals attending the 15th Annual HIPAA Summit. Their warnings come after a reportedly rigorous audit of the electronic systems at Atlanta's Piedmont Hospital by HHS's Office for Civil Rights, the agency in charge of privacy compliance under the Health Insurance Portability and Accountability Act (HIPAA).
"There has been a dramatic change at OCR," said attorney Marc Goldstone, who observed that for the last seven years, the office has been a "nice guy" helping health care institutions comply with the law. Goldstone, general counsel at Community Health Systems, added that Piedmont was "pretty well managed" and considered HIPAA-compliant. According to the hospital's Web site, it was deemed by U.S. News and World Report one of the nation's "most wired" hospitals in 2004, 2005, and 2006 .
Goldstone said that neither OCR nor Piedmont has revealed the results of the March audit. As bad as it might have been, "they're still in business," he commented.
Jeff [12:12 PM]
[ Thursday, December 13, 2007 ]
Electronic Prescriptions: For those extra-techy doctors who own iPhones and who also ePrescribe, you can now
do the latter on the former.
Jeff [11:44 AM]
[ Tuesday, December 11, 2007 ]
RHIOs: DOAIt looks like Regional Health Information Organizations (RHIOs) have fallen victim to the same privacy-versus-access conundrum that prevents interoperative EMRs and other migrations of health information into the 21st century. According to
this report, about 75% of RHIOs have disbanded. These types of things just won't work as long as privacy is fetishized.
Jeff [10:16 AM]
[ Monday, December 10, 2007 ]
How to build a PHR. And a
discussion of the risks.
Jeff [11:53 AM]
TJX and Facebook: Different Approaches to Data Breaches.Ugh. I just drafted a long expositive post on the diametrically opposed ways you can treat a data breach: confess and beg forgiveness, or dispense the minimum information and damn the torpedos. And blogger ate my post.
The reason I was posting was because of
this blog post on Infoweek.
HIPAA doesn't require a covered entity to disclose a bad use or disclosure, necessarily. A covered entity must account for disclosures if asked, but there's no requirement that you proactively give such an accounting. And a covered entity must take
reasonable steps to mitigate any
known adverse effects of a breach, but there's a lot of wiggle room to allow non-disclosure. And in some instances, letting people know that there might be a problem, when there's virtually no way the bad disclosure will occur (let's say a plane crashes in the Andes, and one of the passengers was a healthcare executive with a laptop full of data -- it's possible that someone recovered the laptop from the wreckage and took the data to use for identity theft, but it's also possible that the laptop was destroyed), would cause unnecessary panic.
So, the blog post posits that perhaps it's better to keep a stiff upper lip, rather than throw yourself on the mercy of the court. Hell, you may not need mercy after all.
Something to think about.
UPDATE: that was fast; take a look at
this story, and see the implications.
Jeff [11:18 AM]
[ Friday, December 07, 2007 ]
Something to Watch: The state of Vermont has a law on the books that seems to require pharmacies to identify to police the names of patients who order certain pain medications (basically trying to stop the oxycontin/hydrocodone illegal trade). The State Police have said they'd only ask for names if a specific investigation is ongoing; however, at least
one state pharmacist was asked for the names of all his patients receiving the specified drugs, and he refused to hand it over "unless they get a court order."
Under HIPAA, if state law requires the release, that overrides HIPAA's protections. If state law authorizes it, you may have to look at the "partial preemption" issue, where HIPAA preempts state laws that are less protective of privacy.
Jeff [11:51 AM]
[ Thursday, December 06, 2007 ]
Companies banding together to promote secutity standards: Short
article in the Wall Street Journal on the Health Information Trust Alliance, or Hitrust, a consortuim formed by a handful of big players in the healthcare industry. The goal is to standardize security practices so everyone operates under the same playbook. Ultimately, that promotes good security practices, but it also gives all the participants some comfort that if they meet the standards set by Hitrust, they'll at least have a pretty persuasive argument that they've taken sufficient security steps. Having the standards doesn't mean that's all an industry participant has to do; however, it's a useful report card on whether the participant has done enough.
Jeff [10:10 AM]
[ Monday, December 03, 2007 ]
Slightly off-topic: You may be aware of the huge ID-theft-inducing data security breach by the parent company of the TJ Maxx discount retailer. Well, it seems they've settled with a couple of credit card issuers who were probably left holding the bag on the data theft losses:
BOSTON – TJX Cos. announced the company will pay as much as $40.9-million in a settlement with Visa Inc. and Fifth Third Bank, over a massive breach of TJX customers' card data.
The funds will be used to help U.S. credit card issuers such as banks recover costs related to the breach, which may have exposed more than 100 million cards to potential fraud. The breach is believed to be the largest ever, based on the number of customer records involved.
Costs for the settlement, which also includes TJX card payment processor Fifth Third Bank, were part of $118-million in charges that TJX recorded in August 2007.
Separately, a federal judge presiding in a lawsuit brought by several banks ruled late last week that the banks cannot pursue claims against TJX and Fifth Third Bank as a class. The decision, a victory for TJX, means the banks must individually seek to recover costs from reissuing customers' credit cards as a precaution against fraud.
After initially disclosing the data heist in January 2007, TJX said three months later that at least 45.7 million cards were exposed to possible fraud in a breach of the company’s computer systems that began in July 2005. However, the breach went undetected until December 2006.
Hat tip: Jordan Herman
Jeff [11:56 AM]
Privacy Dispute Covered by Arbitration Agreement: In
Titolo v. Cano, Cal. Ct. App., No. G037641, 11/28/07, a California patient signed an arbitration agreement when she first saw her physician, agreeing to go to arbitration if there was a dispute between them. These agreements are typically an attempt by physicians to move potential malpractice cases into arbitration settings to save costs. The patient ended up in a dispute with the physician over the physician's disclosure of information to the patient's disability insurer. Actually, the physician noted that the patient was a "scam artist and a fraud" in her medical record while finding the patient not to be disabled, and then sent the medical record to the disability insurer. The patient sued for that disclosure, calling it a breach of fiduciary duty, violation of privacy rights, and other things. The doctor moved to have the court case moved to arbitration; the trial court said it wasn't covered by the arbitration agreement, but the appeals court disagreed. The case hasn't been decided on the merits yet, but the appellate decision moving it to arbitration is
here.
Via
BNA (subscription required).
Jeff [11:38 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
