HIPAA Blog

[ Friday, February 23, 2007 ]

Hospital Blog: There are plenty of doctor blogs, but I didn't know there was a hospital CEO blog.

[ Thursday, February 15, 2007 ]

Off topic, but interesting if you do any radiology work: You've probably heard about the Illinois Attorney General going after radiologists for entering into bogus leasing deals that effectively are just kickbacks to the referring physician. Here's an article discussing them.

Jeff [4:54 PM]

Meanwhile . . . Kaiser continues its EMR project. It's got some growing pains.

Jeff [3:07 PM]

[ Wednesday, February 14, 2007 ]

EHR news: Saw this press release from the Department of Defense stating that the State Department is looking at DoD's electronic health record (AHLTA) to see if it would be a good platform for State to use for its employees and agents electronic health records.

Jeff [9:30 AM]

Technology Adoption Strategies: Interesting article in HealthLeaders on the "big bang" theory of technology adoption. When a hospital looks to upgrade its technology features, it can go slow to allow adaptation, but that can cause problems when some people have transferred to the new system while others have tried to hold on to the departing technology, and the new systems don't necessarily work with all the old components. However, switching everything at once, the "big bang," can be problematic as well.

Jeff [9:26 AM]

St. Mary's joins Johns Hopkins: Another Maryland hospital with a data breach problem. No health or financial information, but names, social security numbers, and birth dates or patients, all unencrypted, on a laptop stolen out of the ER.

Jeff [9:17 AM]

[ Monday, February 12, 2007 ]

Fallout from Johns Hopkins: As you know, Johns Hopkins lost some backup tapes with patient and employee data. This has apparently led to calls from privacy advocates to encrypt data.

This matches what I've been saying for a while. I've never been the fan of encryption that lots of my geekier HIPAAcrat brethren are, mainly because their focus has always been on how unsafe the internet is as a network, and how important it is to encrypt data in transit if you're sending it over the internet. I've always thought that encrypting data in transit is generally a silly concern for people who don't regularly encrypt data in storage. It is possible, but incredibly unlikely, that someone could catch an email in transit and use the unencrypted data. But it's much more likely that someone would obtain the data while it's "at rest" on a computer hard drive or server. A typical scenario would be a document residing on a hospital's server somewhere that contains PHI; the hospital encrypts the data, emails it via the internet to the patient's physician, who decrypts it and reads it, where it sits decrypted in his Outlook inbox. That data is much more likely to be improperly accessed while on the hospital's server or on the physician's computer than it is while being transmitted over the internet. It's like leaving your car unlocked while in the driveway or parked at work, but locking it while you're flying down the interstate.

Encryption of data "at rest" is where the focus should be.

Jeff [9:48 AM]

[ Friday, February 09, 2007 ]

Something New: I now have an actual paying sponsor. It's a medical software company called Medical Software Associates. Naturally, they were attracted because of all the EMR talk around here. Click on the link at the left, under the heading "Advertisers", to check it out. Or just click here.

UPDATE: Nowadays, the Federal government requires all providers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies to obtain a $50,000 DMEPOS Bond.

Jeff [4:30 PM]

Preemption, causes of action under HIPAA, and causes of action related thereto: John Dascoli of West Virginia asks: "I am very interested in your blurbs on private lawsuits involving HIPPA violations, especially the North Carolina Court of Appeals case (Acosta)allowing a HIPPA violation to be evidence in a intentional infliction case. Do you think federal courts will allow similar state cases to go forward or will they ultimately rule that such cases are preempted?"

This raises two issues, preemption and the right to sue someone for violating HIPAA. HIPAA does include a federal preemption, but it is a limited, one-way preemption. HIPAA does not prevent states (or potentially counties or cities) from imposing more-stringent medical record privacy regimes; it merely posits a "floor" of privacy below which no other governmental entity can go in passing laws and regulations. This is noticably different from other federal preemptions (ERISA's preemption is the one I'm probably the most familiar with), which prevent states from imposing similar legislation, whether more or less stringent. HIPAA also has specific procedures for determining whether some state legislation is preempted, so the answers to preemption questions should be easily obtainable (OK, not really easily, but at least clear answers are possible -- again, unlike ERISA preemption questions). Since state privacy laws aren't necessarily bumped, federal courts won't throw out state-specific or state-statute-specific jurisprudence (unless it specifically and only relates to a statute that has been preempted by HIPAA, which seems unlikely). Much of the state common-law tort jurisprudence that would be likely implicated in a HIPAA breach (intentional or negligent infliction of emotional distress, casting in a false light, libel, slander, breach of a confidential relationship, etc.) isn't exclusive to medical record issues anyway, nor is it specifically preempted by HIPAA, since it deals less with the scheme of protecting privacy than the imposition of a duty of privacy or conduct. So, there just won't be an overriding "preemption" of state court actions by federal courts due to HIPAA preemption doctrine.

The "private cause of action" question will remain out there; however, as HIPAA specifically states and a handful of one-way cases makes clear, there's just no private cause of action under HIPAA. If someone breaches HIPAA, it does not matter how badly you are damaged: only the federal government (through OCR and CMS, the investigative and enforcement agencies mentioned in the Enforcement Rule, and anyone else who has a specific grant of jurisdiction) can right that wrong. However, your damages don't necessarily end up un-redressable; you just have to find another statutory or common-law tort into the definition of which your case fits.

Now, if you go pursuing a statutory breach of a duty of confidentiality, or a common-law claim for intentional infliction of emotional distress, you'll have to meet the statutory or common-law elements for the case, part of which will involve proving that the actions of the tortfeasor breached a standard of conduct to which he/she was bound. (As an aside, I have to mention that I'm currently having nightmare flashbacks of Torts class as a first-year law student -- shudder.) Here's where HIPAA steps in to help: If common law requires a potential tortfeasor to abide by a standard of conduct such as a reasonable man standard, does not HIPAA provide some bright lines of what conduct is within the standard and what is outside it? It would be awfully hard for a defendant to argue that while his conduct violated the HIPAA privacy obligations, it didn't violate the reasonable man standard. I said this years ago: even though there's no private right of action, if you violate HIPAA, you've already lost the lawsuit, and it's all just a question of what the damages are. It won't be a HIPAA lawsuit, but HIPAA will be the de facto standard.

So, to answer the question, I think state court cases will be the most prevalent, and I think they'll proliferate where they're appropriate given the facts. The causes of action will be intentional infliction of emotional distress, breach of a confidential relationship and the like. Fortunately for defendants, it will be hard for plaintiffs to show real damages in most cases: what's the financial loss from embarrasment?

Jeff [10:47 AM]

[ Thursday, February 08, 2007 ]

Security Breach at Johns Hopkins: I forgot to mention the news the other day of a big data security breach at Johns Hopkins University and Hospital. Computer data backup tapes that were sent to a vendor for further backup (microfilming) never got returned, and nobody knows where they are. They contain employee and patient information. Here's a story on it. Here's their own press release.

And here's a story from Modern Healthcare's Daily Dose (you need to subscribe, but you should, it's free and a good newsy afternoon email every day), with Hopkins' promising to make everything right.

Jeff [3:43 PM]

[ Wednesday, February 07, 2007 ]

Compliance and Enforcement Statistics: Just in from Alan Goldberg, moderator of the American Health Lawyers Association's Health Information Technology listserv (the "HIT list"), from OCR's compliance activity report of January 31, 2007:

As of the date of this summary, OCR has received and initiated reviews of
over 25,031 complaints, and has closed 76% of those cases. Case closures include
those where OCR lacks jurisdiction under HIPAA – such as a complaint alleging a
violation prior to the compliance date or alleging a violation by an entity not
covered by the Privacy Rule; where the activity alleged does not violate the
Rule – such as when the covered entity has declined to disclose protected health
information in circumstances where the Rule would permit such a disclosure; and
where the matter has been satisfactorily resolved through voluntary compliance –
for example, where an individual is provided access to their medical record
based on a complaint that such access had been previously denied.

The allegations raised most frequently in the complaints are: (1) the
impermissible use or disclosure of an individual’s identifiable health
information; (2) the lack of adequate safeguards to protect identifiable health
information; (3) refusal or failure to provide the individual with access to or
a copy of his or her records; (4) the disclosure of more information than is
minimally necessary to satisfy a particular request for information; and (5)
failure to have the individual’s valid authorization for a disclosure that
requires one.

Complaints are most often filed against the following types of covered
entities: (1) private health care practices; (2) general hospitals; (3)
outpatient facilities; (4) group health plans and health insurance issuers; and
(5) pharmacies.

OCR refers to the Department of Justice (DOJ) appropriate cases
involving the knowing disclosure or obtaining of protected health information in
violation of the Rule for criminal investigation. As of the date of this
summary, OCR made over 369 such referrals to DOJ.

Thought you'd like to know that. Thanks, Alan!

UPDATE: Dennis Melamed posts on the HIT list that CMS (which enforces the security and transactions/code sets portions of HIPAA) has imposed corrective action plans on two health plans that violated the transactions and code sets provisions.

Jeff [11:29 AM]

Totally Off Topic: Cool. Funny (although Althouse's headline "When Astronauts Attack" is pretty good too).

Jeff [10:33 AM]

[ Monday, February 05, 2007 ]

Identity Theft: the good news is that cases of (and damages from) identity theft are trending downward. My guess is that it's a combination of awareness on the part of potential victims and increasing protection provided by businesses, partly due to legal requirements, partly due to fear of lawsuits, and partly because security is good business).

Jeff [3:24 PM]

[ Friday, February 02, 2007 ]

HIPAA in litigation: The following blurb is from a BNA report (subscription required; the ruling is here, but you may need a subscription for that too) out today: "The Health Insurance Portability and Accountability Act does not prohibit experts hired by the defendants in a medical negligence case from interviewing employees at the institutions where the alleged negligence took place, a federal district court ruled Jan. 25 (Santaniello v. Sweet, D. Conn., No. 3:04-cv-00806-RNC, 1/25/07). " The key is that there be a sufficient protective order in place; if the litigation has proceeded to the point where there's a protective order, and it's a HIPAA-compliant one, then the disclosure would be allowed under 164.512(e)

Jeff [12:11 PM]

[ Thursday, February 01, 2007 ]

Florida HIPAA Case: You know that Gibson was the first HIPAA criminal case, but that was a plea bargain case. Now, we've had a case go to trial in Florida, with the US Attorney alleging criminal violations of HIPAA by former employees of a Cleveland Clinic hospital in Florida, and the jury did return a guilty verdict against Fernando Ferrer Jr. for "wrongful disclosure of individually identifiable health information," which is a violation of HIPAA. Of course, it was pretty much an identity theft case, but it's interesting to see the conviction, since Ferrer wasn't a "covered entity" himself.

Once I get a cite to any official court papers I'll post them. Sorry for the delay in reporting this (I originally found out last week): I've been busy, and Blogger has been goofy.

Jeff [3:10 PM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template