[ Wednesday, January 30, 2008 ]
From Modern Healthcare:
N.J. Blues warns customers about stolen data
New Jersey’s largest health insurance company is warning more than 300,000 members that some of their personal information was on a laptop computer that was stolen.
Horizon Blue Cross and Blue Shield says the risk of identity theft is small because the data was password-protected. Also, the computer was programmed to automatically
destroy the information on Jan. 23.
The laptop contained names, Social Security numbers and other personal information for about 10% of the insurer’s 3.3 million customers in New Jersey. Medical information was not included. Company spokesman Daniel Emmer said the computer was stolen on Jan. 5 while it was being taken home by an employee.
Customers whose names were on the computer are being offered a year of free credit monitoring.
Jeff [3:51 PM]
[ Tuesday, January 29, 2008 ]
Marriott's EHR focuses on preventing errors. One of the potential benefits of electronic health records is the ability to see and prevent medical errors before they happen, and that's what
Marriott is selling to its employees.. More information will usually mean less errors. But the real story is probably in trying to get people to take a more active interest in their own health and healthcare.
Jeff [1:23 PM]
[ Wednesday, January 23, 2008 ]
WalMart's EHR: here's an
article on WalMart's efforts to offer electronic health records to its employees.
Jeff [10:32 AM]
[ Tuesday, January 22, 2008 ]
Security, generally: I often link to and cite Bruce Schneier as a solid, reasonable voice where e-security is involved. I'm not the only one; he's considered an expert by anyone who knows anything about this stuff. But he's raised an issue that's got George Hulme, writing on InfoWeek's security blog,
riled up: Bruce
doesn't secure his home wireless network, and George thinks that's a bad idea. Bruce wants his houseguests to have access, thinks its neighborly to let his neighbors have access, and thinks the risks are really too remote to worry about. I have to say that whenever I'm visiting friends or relatives, I love the fact that I can usually find a wireless connection through a neighbor's house on my laptop. In fact, my wife used to think I was really odd when I'd take my computer and sit in the driveway of my mother-in-law's beachhouse to check my emails; she thought I was trying to avoid the noise of the kids or trying to keep my emails private. Far from the truth: I was risking the privacy of my emails (negligibly) and sitting in the driveway because I got a clear connection there. I don't know which neighbor's open network I was surfing, but I was glad they had one. At my MIL's primary residence, the best spot inside the house to access a neighbor's wi-fi is the window of the dining room, although to upload a video birthday greeting I had to go out into the cul-de-sac to get a solid enough connection.
The exchange between Bruce and George is very useful in terms of thinking about security, even if your as technically retarded as I am (I read the comments and don't understand half of them). Security is a balancing act, an assessment of risks. Most matters involving security (of any sort) are decided based on balancing the hassle versus the likelihood of harm: do you lock your car when it's in (i) your garage at home, (ii) in the driveway at home, (iii) in the parking lot at the mall, or (iv) in a friend's driveway? I'd answer no, usually no, always, and sometimes, because it's always a balancing of risks. The hassle of unlocking the car is negligible in most cases, if I've got my keys with me, since it's just pressing a button. But at home, I usually leave my keys on the counter and don't have them in my pocket, so if I needed to get into the car for some reason, the hassle factor would increase. And the risk is almost non-existent if the car is in the garage, since there's a garage door opener on the door (you couldn't just lift the door); of course, there is some risk that someone has a garage door opener that would open my garage door, but even then, I might hear the garage door opening and stop them, or they'd probably steal my tools and bike (that's happened, actually) rather than anything out of my car (or my old car itself). So, on balance, the small hassle of having the car locked in the garage outweighs the even-smaller risks. That's not so if the car's parked in the parking garage downtown or at the mall; the hassle is even smaller (I'll always have my keys with me) and the risks are much larger.
There's a similar issue with regard to my home's security system. First, either you install an alarm system or you don't: if you live in a very remote area, you might determine that there's no real value in having an alarm. If you install a system, you might install one with many bells and whistles, or just a basic system. Those decisions will be driven by many factors, but basically will come down to a balance of cost and risk. You might set your alarm every morning when you leave the house for work, but not set it when you run to the grocery store. You might set it when you go to the store, but not when you're working in the yard or go for a run. Those decisions will be a balance of hassle and risk.
Considering your security needs relative to your electronic records and transmissions should be a process of the same balancing considerations. What are the costs, what are the hassle factors, and what are the risks? Like Bruce Schneier's open-access home network, there's very little cost to putting some good privacy in place, but there's at least a little hassle to houseguests or neighbors he wants to be friendly with. And even with costs and hassles that low, do the risks rise enough to make them worthwhile? Bruce says no; George says yes. What that proves is that reasonable, well-informed minds may differ.
That's the point of HIPAA security analysis. You make these balancing decisions without even thinking about them, all the time. With your business and your computer systems and records, your decisionmaking process should be clear, rational, and defensible. The Security Rule requires you to do a risk analysis; you do it anyway, so all you need to do is document it and make sure your decisions are defensible.
Jeff [10:31 AM]
[ Monday, January 21, 2008 ]
More questions from the audience: What an odd weekend; I got 3 different questions from 3 different readers, all emailed to me directly instead of through the comments sections. I also got
another one right before the weekend. I do get questions somewhat regularly, but not usually clustered so closely together. Anyway, here we go:
[Standard disclaimer first: just because you're reading this, doesn't mean I'm your lawyer. Just because I'm answering your question, doesn't mean I'm your lawyer. This is general information, not legal advice. I'd have to know a lot more about your situation than just what you're writing in an email to actually give you legal advice. And, I'd charge you for it. A lot. So, unless you've signed an engagement letter with my firm and left a hefty retainer, I'm not your lawyer. Are we all clear on this? Thank you.]Question One:
Your blog on Friday, January 18 states the acts of an employee count
as the hospital's acts. So here's the problem. My ex gets someone
else to look up PHI on my wife. My ex (repeatedly) shares the PHI
with others or is using it to harass me and my wife and is also harassing us
about the complaint we filed with OCR. The hospital says it's not a
HIPAA violation because my ex is providing PHI and harassing us on her own
time, not the hospital's. We disagree.
We understand HIPAA to state there will be no PHI disclosures, so why
does it matter whether she is at work or on her own time? I know the
harassment issue is vague in HIPAA except for harassment about the
complaint. Other harassment doesn't seem to be addressed by
HIPAA. Your thoughts?
One last thing. The hospital refuses to provide a list of the people
who accessed the records, citing that all employees have the right to
privately check patient records and the employee has the right to keep
their name private. Hospital says its for the privacy of the care
provider. Our argument is the hospital requires the employees to wear
name badges daily with their first and last name on them and therefore there is
not expectation of privacy (with regard to name only). AND, on their
website and posted throughout the hospital
are policies which state all patients have the right to know the
name of their care providers... hence, if only care providers should be looking
up info, what's the problem? Your thoughts on this too,
please.
We think that the hospital is rolling the dice thinking that we won't go as
far as legal (subpoena) relief if they continue to state all above. We are
in process of injunctive relief right now.
Thank you for the BLOG. We use your site and follow it weekly.
Sincerely, Agitated in Atlanta
Response: A couple of clarifications. Just because a person is an employee of Company X, doesn't mean that every act they take is in their capacity as an employee of Company X. Take the Jolt Cola truck driver; if he runs over a kid in a crosswalk while driving his Jolt Cola truck to the QuickieMart to deliver a load of soda, he's acting as an employee of Jolt and the kid's parents can sue Jolt. However, if the same guy hits the same kid on his day off, driving his own car, running personal errands, then Jolt's not responsible for him.
The question her is whether the hospital's employee was acting in his/her official capacity as an employee of the hospital at the time of the action that's the basis of the complaint. It's really up to hospital, however, to raise this defense. And employers usually defend against employee actions by saying the employee was acting outside the scope of his/her employment because whatever they were doing at the time was against company policies (usually they fire the employee just to show how bad the breach was and how much they care about their policies).
Based on the way you presented the facts, it does look like the "someone else" was a hospital employee, did the looking-up while on the job, and probably disclosed the PHI while on the job. If the ex is also a hospital employee, it would be up to the hospital to show that she wasn't acting in her capacity as an employee when she used or disclosed the PHI, or that the use and/or disclosure were for a permitted purpose (treatment, payment, healthcare operations). Even if she's harrassing you on her own time, if she's using PHI that the obtained in a non-permitted manner, that in itself is problematic.
Furthermore, the hospital must account for all disclosures of PHI, unless they fit within a particular exception to the accounting requirement. Most disclosures fit within the treatment, payment, or healthcare operations exception, or within the disclosures pursuant to authorization exception. However, any improper disclosure must be accounted for. If the disclosure from the other person to the ex was an improper disclosure, the hospital must provide an accounting. If the other person accessed the information outside of his/her official employment, that would be a disclosure that must be accounted for. If the employee accessed the information for a purpose other than treatment/payment/operations, that might be an improper use but not necessarily an improper disclosure, since improper uses need not be accounted for.
The hospital might not have the ability to track every person who has accessed a medical record. This would be somewhat surprising. At least as far as electronic records go, it certainly is an industry standard that this information be captured, and the hospital would have to take the position that it was too expensive or cumbersome to have a system in place that allowed them to track access this specifically. If they're unable to track access, it may be a HIPAA violation. If they don't provide you with a complete accounting of disclosures (including any improper disclosures), that would be a HIPAA violation.
Of course, you don't have a private cause of action under HIPAA, but you can make sure the OIG investigator keeps up on the case. You might have a state-law claim for breach of confidentiality, invasion or privacy, or some other common-law or state statutory tort. And if the ex and "someone else" are licensed (e.g., nurses), their licensing board may have ethical or other obligations that may be grounds for a disciplinary action.
Question 2:
Hello,
I came across your website while researching a HIPAA
question and hope you can help. I was curious as to what the guidelines
were in regards to a staff physician leaving a medical group and wanting to
access medical records of patient surgical cases to submit for their surgical
boards. Is this a HIPAA violation, if it is required
for Board
Certification?
Thank you, and I await your
reply.
Boarding in Birmingham
Response: Disclosure by the practice and use by the physician for submission to a recognized agency for purposes of the physician receiving board certification would be a use/disclosure for healthcare operations. Minimum necessary rules apply. Check with the board in question to ensure that they will maintain confidentiality, and see if they will allow for disclosure to be partially or completely de-identified.
Question 3:
Just wanted to say how much I enjoy your blog, and it indeed DOES require
not just a college education but probably a law degree. Although as a
medical student, resident, and fellow, I have been to countless HIPAA trainings,
it still baffles me.
What seems clear, however, is that HIPAA
is a serious pain and of questionable benefit for patients, and now that I am
about to start my own practice, I am committed to becoming a non-covered entity.
The practice will be cash-only without transmission of electronic information.
We will have an EMR but it will be maintained on site.
I have a
question, though, that I have not been able to get an answer. It is likely that
as I begin the practice, I will work as a part-time employee at a local VA
hospital, which is clearly covered as a government health plan.
Based on this part-time work, would I become a covered entity at
my private practice just because I am an employee doing unrelated work at
another covered entity, e.g., the VA?
Any help on this or information on
where I could get an answer?
Thanks,
The Composer
Response: It is an interesting question whether one can have some "HIPAA absolution" to cease being a covered entity once you've been one. If you are a healthcare provider who transmit PHI in connection with a HIPAA transactions, you are a covered entity. However, does "transmit" only refer to the present tense, so that you are covered at the instant you are transmitting but not necessarily any other time? What if you transmit once, but never again? What if you operate your practice for a period of time as a HIPAA-covered physician, but then purposely change your practice so you will no longer be transmitting PHI electronically; can you cease to be a covered entity, or is the rule "once a covered entity, always a covered entity"? There isn't a clear answer to this. However, you certainly could make the argument that as a VA doctor,
you never engage in HIPAA transactions, only the VA does; and when you start up your own practice, there will be a clear demarcation of what's the VA stuff and what's the private practice stuff. Since there's no private cause of action under HIPAA, who's going to complain, anyway?
However, our musical physician overstates the burdens of HIPAA. As a physician, you have an ethical (and depending on location, probably a legal) requirement to maintain a certain level of confidentiality. HIPAA adds some paperwork, and requires that certain things be thought out to ensure that the required level of confidentiality is met. But it's really not all that hard, and there are a lot of physician office management programs that include almost all you really need from a HIPAA standpoint. And while I don't really get involved in the practicalities of my clients' medical practices, I would think that trying to operate a practice where you never do HIPAA-covered transactions (electronically obtaining percertifications or determining eligibility are covered transactions) would be pretty cumbersome. I know doctors who do so, but usually it's older, well-established practices where they've been operating exclusively on paper for years and don't want to go electronic anyway.
Jeff [10:23 AM]
[ Friday, January 18, 2008 ]
Medco update: I
previously posted on the Medco Health Solutions system administrator who got caught planting a logic bomb that would blow up their computer systems (he thought he would be getting fired), and who pled guilty. As I predicted, he got
30 month in the slammer. One quarter of what he could've got, but still a pretty decent stint. Seems about right.
Jeff [3:33 PM]
Question from the Audience: Yes, young lady, you in the back. What's your question?
I have a question. I have done a search and haven't been able to find an
answer. Perhaps I'm just not typing in the correct words!I am a nurse and
I keep a public blog. In my blog, I sometimes tell stories from my shifts
in the hospital. I never identify any patient by name and often change
circumstances and gender as necessary to retain privacy for the patient. I have
a friend who sent me a fiery email today, telling me that she is terrified that
I'm breaking HIPAA violations and breaching confidentiality.Many people tell
stories. I'm no different. That said, it is CERTAINLY not my
intention to breach anyone's private information and I typically put a
disclaimer on my stories stating such. Can you tell me if I'm in the wrong
here? If so, I'll delete the information immediately.Thanks for the
blog... I found you on a search and learned some new things today!
Well, I'm so glad you asked that. I've blogged before about how medbloggers tread a tricky line, due to the possibility that they might disclose protected health information (PHI). If you're disclosing PHI on your blog, unless you have the consent of the patient (or you can reasonably claim the disclosure is for treatment, payment, or healthcare operations), you are causing a HIPAA violation; you probably aren't a covered entity, but your hospital is, you're their employee, and your acts count as the hospital's acts. It's probably a firing offense, too.
BUT, the question is whether you are disclosing PHI. For it to be (PHI), it has to be IIHI (individually indentifiable health information). To be IIHI, it has to either identify the individual or there must be a reasonable basis to believe the information can be used to identify the individual.
So that's the question: If I read your blog, could I figure out who you were talking about? For example, if you stated on your blog that you live in a city known for its rain, its coffee, and grunge music, and that the quarterback of the local pro football team came into the hospital recently and tested positive for HIV, that would be a disclosure of PHI even though you didn't mention Matt's name.
There's no magical formula for what or how much you can say before you reach that "reasonable basis" threshold, so the less identifying information you give the better. Further disguising the individual by fictionalizing facts and circumstances is also a good idea.
Jeff [11:01 AM]
[ Wednesday, January 16, 2008 ]
Federalizing the California data breach law: Infoweek is
urging the data breach law, passed in California about 5 years ago and copied in most of the other 49 states, to be made a federal law, so that all jurisdictions are covered. I'm a federalist at heart, but that seems to be a pretty good idea.
Jeff [11:37 AM]
[ Monday, January 14, 2008 ]
Texas AG sues PT firm for dumping patient records: From today's BNA reporter:
Texas Attorney General Greg Abbott (R) Jan. 10 sued a Pennsylvania-based provider of physical therapy services, alleging thousands of pieces of sensitive personal information, including medical records, were thrown in the garbage (Texas v. Select Med. Corp., Tex. Dist. Ct., No. 08-01-21154, petition filed 1/10/08).
A failure to properly dispose of such information would violate the state's 2005 Identity Theft Enforcement and Protection Act.
Abbott is seeking temporary and permanent injunctions enjoining the defendants from disposing of records containing personal identifying information or sensitive personal information without shredding or erasing to make the data unreadable or undecipherable. Alternatively, the attorney general asked the court to order the defendants to contract with a business that properly disposes of confidential patient and business records.
According to the lawsuit filed in a Texas District Court for Hockley County, Abbott said Select Physical Therapy Texas Limited Partnership, headquartered in Birmingham, Ala., and its parent company, Select Medical Corp., of Mechanicsburg, Pa., systematically exposed patients to identity theft.
More here (subscription required).
Jeff [2:41 PM]
Isn't it Ironic: Security issues at the Transportation Security Administration. I know, I usually think of a different kind of "security" than data security when I think of the TSA (i.e., security in the knowledge I'm going to lose a penknife or tweezers), but still, "security" is even in their name.
Jeff [11:24 AM]
[ Friday, January 11, 2008 ]
Off Topic, mostly: Occasionally I'm in the position of trying to defend "obscene" doctor's salaries. Usually it's with healthcare industry reformers or managed care companies, but occasionally even young, idealistic doctors think "doctors" get paid too much (usually, they think it's a generalized problem but don't think they're part of the problem subset). My primary defense is that the market must determine the worth or value of a particular individual with a particular skill, and that doctors provide a particularly worthy service. But my shut-down-the-argument point is this: if doctors don't make much money, smart young men and women coming out of college will not go into medicine. Why work that hard in med school, internships, residencies, fellowships, etc. if you could make a hell of a lot more money being a lawyer or investment banker? Like water flowing downhill, the best and brightest will (and should) go where they can make the most money. Do you want the really smart kids to become investment bankers, and let the bright-but-not-brightest become doctors?
Well, it's apparently true that this happens. According to
this article and
this article, the best and brightest ARA shunning not only med school but law school for the investment banking business.
Jeff [10:41 AM]
[ Thursday, January 10, 2008 ]
Troubling if True: A couple of ex-drug reps for Amgen are suing the company, and have alleged that Amgen encouraged them to
search through the patient records of doctors they visited to try to find patients who might be good candidates for a particular drug Amgen makes. These are the types of things that get blown out of proportion when people are suing each other, so I'd caution against taking them on face value. However, it
could be a HIPAA violation if patient data is used this way. It may be possible to couch the activity as a part of the physician's healthcare operations (in the way of education, for example). But it could be illegal marketing.
Jeff [11:08 AM]
[ Friday, January 04, 2008 ]
California leads again: California led the pack in instituting a data breach law requiring companies to notify customers and clients if they suffered a computer breach or other incident that exposed private or personal information. Now, the California law has
been amended to include electronic PHI or health insurance information. I think this just fills in some holes, since I think the existing law would have required notification in most cases of harmful PHI breach (since financial information is what data thieves are looking for anyway). However, even if there's little likelihood that the data was stolen for identity theft or similar purposes, if the data include health information, you gotta report it.
Jeff [12:18 PM]
[ Wednesday, January 02, 2008 ]
No surprise here: 2007 was a record year for
data breaches.
Jeff [9:22 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
