[ Monday, March 29, 2010 ]
Not Just HealthNet: the Connecticut AG goes after Griffin Hospital because a radiologist on staff was a snooper. This is, I believe, a good indicator of the biggest potential game changer in HITECH: the ability of state AGs to be the new "HIPAA police."UPDATE: More here. Looks like a departed radiologist used other folks' passwords to access the PACS system. Also sounds like the hospital acted quickly and appropriately.
Hat tip: Dom Nicastro.
Jeff [10:45 PM]
[ Friday, March 26, 2010 ]
OT - Healthcare Reform: Excellent article highlighting the basic problem with health care, and health care reform efforts, in America: OPM. No, not the Office of Personnel Management, but "other people's money." The biggest problem with American healthcare service is the lack of an effective governor on spending and the unrealistic expectation of healthcare consumers regarding price. There are areas of healthcare where these issues do not exist; two I can think of off the top of my head are Lasik eye surgery and cosmetic surgery, both of which are profitable services with substantial technological advance. Both of those areas mainly require people to pay with their own money, which is a very effective governor on costs and leaves consumers with the realistic expectation of what the service costs and what they'll have to pay to get it.When I was a pimply-faced kid, I got a job at a McDonald's restaurant that was opening in my little Texas town. We had had a couple of mom-and-pop type restaurants, and our only "fast food" place for years was a Chicken Shak (a great place to pick up fried chicken after at Sunday trip to Galveston). Then we got a Jack in the Box, and learned what fast food really was. But it wasn't until McDonalds came to town that we felt we were really on the map.
Since the crew was hired before the restaurant was open, we had to work a few shifts in a McDonalds in a neighboring town 20 miles away to learn the drill. If you don't know it, McDonalds is pretty famous for its standardization, so that the Quarter Pounder with cheese you get in Paris, Texas is the same as the Quarter Pounder with cheese (or "Royale" with cheese, if Travolta was right) in Paris, France. So working in one McDonalds is good practice for working in another one.
The night before the grand opening, we ran the restaurant through a test dinner, a restaurant version of a "shake-down cruise." All of the crews were there working part of the night, and we also got to be customers as well. We were allowed to invite family and friends to be customers as well, and the evening went just like a real live restaurant operation would, with one small difference. Customers stood in line and made their orders, grill and fry cooks dropped frozen patties on hot grills, buns in toasters, and fries and apple pies in hot grease, and managers tried to keep the kitched ahead of the customers. My edge of the kitchen was mostly buns, fries, fried fish filets, and apple pies. Cashiers took orders, called out for more of whatever was needed, rang up the customers, and told them what their meal cost. As they were trained, the cashiers tried to push the ancillaries: "would you like fries with that?" (this was before value meals, when you separately ordered burgers, fries and drinks), or "would you like a hot apple pie with that?" But here's where reality left the scene -- the customers only had to pretend to hand over money, and the cashiers pretended to make change. And just about everyone said "yes" when asked about that hot apple pie.
The idea was to simulate a real day in the restaurant. And in many ways, it did. But in one way, it was far from reality. I fried up more hot apple pies that shake-down night than I did in the remainder of my McDonalds career combined. My first night of working in the open-to-the-public restaurant, my first check was to make sure we had enough pies cooked and ready to go (the lunch crew had them stocked up). All night, I kept expecting the manager to call out, "drop 8 pies please," a phrase I heard repeatedly the night before. But he never did. All the pies that were there when I got there were still there at the end of the evening.
Why the steep decline in pie popularity? There was only one reason: OPM. When the apple pie is free, there's still a minor cost is asking for it. It may slow down your order at least a second or two (for the cashier to grab the pie), you've got to carry it to your table, it takes up space on your tray, you've got to throw away the box and the remnants, etc. But that's a tiny cost, and you might like a bite of pie; not that you really want pie, when you're after two all beef patties special sauce lettuce cheese pickles onions on a sesame seed bun. But if it's free, you'll take one.
But if it's not free, you don't. It's not that the pies were expensive, just that the cost was not negligible.
And that's the problem with healthcare. It costs money to provide healthcare. Someone has to pay that money (which is why the "right" to healthcare is a bogus argument). But if the recipient doesn't have to pay anything, or has to pay a tiny portion for it (like the carrying cost of taking the free pie), there is no limit on what the recipient will demand and expect. If it's OPM that's paying, there's no limit on my wants (and since it's healthcare, all my wants are automatically transformed into needs).
Jeff [11:14 AM]
[ Wednesday, March 24, 2010 ]
Interesting: I previously posted about the page on the OCR website where they list everyone who reported a data breach involving 500 or more people in a single jurisdiction. I noted in an update that not everyone is happy with the level of detail, mainly where they don't identify certain reporting entities. Well, OCR has now said that it will only identify the reporting entity if the reporting entity gives its consent to the disclosure. As noted here, HITECH requires HHS to publish "a list that identifies each covered entity" reporting a breach. Should HHS name names?hat tip: Theresa Defino
Jeff [11:19 AM]
[ Tuesday, March 23, 2010 ]
Medical ID theft: It's on the rise. Reports say there were 275,000 cases of medical ID theft last year, with an average of $12,000 in fraudulent charges.Jeff [9:00 AM]
[ Monday, March 22, 2010 ]
Totally OT: This is what my house looked like Sunday morning:
Gotta love snow in Dallas
Jeff [5:33 PM]
[ Friday, March 19, 2010 ]
Another reason to adopt an Electronic Medical Record system? (Slightly OT): Over at the Software Advice blog, Chris Thorman throws out a couple of additional reasons for medical practices to migrate to an EMR system, perhaps sooner rather than later. The primary focus: having an EMR makes participating in clinical trials much easier and productive. I've heard presenters at physician conferences for years talk about the potential profits from participating in clinical trials (my sister works for a British company that conducts and manages clinical trials, and I've helped a rheumatology practice set up a separate clinical trials entity), but for a lot of practices, getting involved in clinical trials turns into a tar baby that's not worth the extra effort. Chris' point is that, with an EMR, many of the headaches of clinical trial involvement (which seem to be mostly about recordkeeping) either go away entirely or are reduced to an easily manageable hassle).Since you're going to have to become a "meaningful user" at some point, why not consider the possible clinical trials payday as an additional incentive?
Jeff [10:47 AM]
[ Wednesday, March 17, 2010 ]
Privacy versus open source medicine: I've noted often the dynamic tension between privacy and healthcare. The best privacy you can get is when nobody, including your doctor, gets your PHI; the best medicine you could get would be if everyone had access to your PHI (an "open source" arrangement, if you will) and could recommend possible solutions for your problems. Obviously, these are in direct conflict with each other, and HIPAA (and the healthcare industry) is constantly seeking the right balance.Here's a story on how open source medicine might have helped a Harvard professor. However, just by a little social engineering, the identity of the patient got out. Sort of proves both parts of my point.
And here's a little more on social engineering. And the question of privacy. People breach their own privacy all the time, intentionally and unintentionally.
Hat tip: Alan Goldberg
Jeff [5:24 PM] Not exactly "Official," but at least "More Official:" OCR is working on a Notice of Proposed Rulemaking (NPRM), which is what they call drafted regulations, to address the HITECH issues that became "effective" February 17, 2010, but still need guidance. They don't know when they're going to publish, but the NPRM will address "the expected date of compliance and enforcement of these new requirements."
So, compliance and enforcement aren't current, although effectiveness is.
Hat tip: Theresa Defino
Jeff [3:16 PM]
[ Monday, March 15, 2010 ]
Minnesota Blue Cross has been sued by a member for disclosing her personal information. It seems like, in preparing an educational brochure for members that tells them how to submit claims, they took a real member's EOB and included it without changing the names. No procedures were disclosed, just that the woman was a patient of a particular surgery center and how much her care cost. But it's still a HIPAA violation, since that's definitely PHI.This could be a very interesting case; I'm assuming it happened before HITECH, so I don't think the woman gets a part of any financial revocery from BCBS. And even with HITECH, there's no private cause of action. I don't know what her actual damages are -- that will determine her recovery from suing BCBS.
Jeff [8:51 AM]
[ Friday, March 12, 2010 ]
Delay becomes more semi-official: AIS is reporting that HHS' Office of Civil Rights is again indicating that it will delay enforcement of the portions of the HITECH Act that went into effect February 17, at least until regulations have been published. Again, caution should be exercised: while OCR might not come after you, the law is still the law, and you may be subject to an enforcement action by an individual or a state Attorney General (even though OCR might stay its hand, there's no reason a state AG would have to).Jeff [9:03 AM]
[ Wednesday, March 10, 2010 ]
Bleg: Do you sell HIPAA insurance? Have you purchased it?There's a conversation going on at the AHLS HIT listserv about HIPAA insurance. People occasionally aske me about this, and I tell them I believe it is available but don't really know who's selling it or what's covered. So, if you're a seller of HIPAA Insurance (insuring covered entities, business associates and others from losses, damages, costs, etc. of HIPAA breaches by those insured entities), or if you buy that insurance, post a comment to this blog post or email me at jdrummond-at-jw.com. I'll post info as updates to this post.
What I've gleaned so far is that products are out there, and they vary based on how many individuals have to be impacted before it kicks in, whether it covers costs of fines/penalties/damages or just costs of notification, whether it just covers the insured breaches or breaches by the insured's business associates, and what the limits are.
UPDATE: I haven't got much information on insurance, but did get a lot of info on what to do when you have a breach. Who do you contact, what issues do you need to address? Here's some information I've received. I can't vouch for whether any of these folks know what they're doing, but if you're looking at consultants to help you with a breach and the necessary notification, you might consider Kroll, but probably only if the breach is really big. You also might contact Identity Force, AHA's preferred vendor, I'm told. Someone mentioned Debix, particularly if you have a patient population that might not be web-saavy (or have web access). You'll definitely want to talk to your insurance broker to see what they recommend. They might have folks they'd propose, might be able to tell you things to look out for (like indemnification clauses), and might keep you from doing something that might adversely impact the insurance you've got. Also, consider what you really need. Do you need deep forensic analysis of the data breach? Or is it pretty straight-forward, and all you need help with is printing letters and stuffing envelopes?
Jeff [9:53 AM]
[ Thursday, March 04, 2010 ]
Red Flags Rule: A major part of the argument that, even if you aren't a "creditor" under the Red Flags Rule, you ought to institute an Identity Theft Prevention Plan anyway.On another Red Flags note, the rule requires affected businesses to monitor their service providers (at least those who deal with the "accounts" that make the business a "creditor") to make sure they follow the entity's ID Theft Prevention Plan or otherwise have their own plan. Some folks are incorporating Red Flags language into their BAAs; this isn't necessary if your business associate doesn't access those accounts, which many business associates won't. But, if you want one-stop-shopping for your vendor contracts, it's an idea.
BTW, if you're wondering, we're still waiting for a summer start date for the Red Flags rule to be effective against physicians.
Jeff [10:04 AM]
[ Wednesday, March 03, 2010 ]
Privacy vs Effective Healthcare Communications: Another look at the conundrum.Jeff [9:28 AM] When? Soon.
Jeff [9:12 AM]
[ Tuesday, March 02, 2010 ]
What's the Cost of a Data Breach? For Blue Cross, it's $7 million and counting, and that's just figuring out who to contact. Think about that, and think about how you'd respond. What are your capabilities for finding out who is impacted in a data breach? Do you have the ability to audit and figure out what information might've been compromised if a particular office was burglarized? Maybe you should consider encryption of data at rest. . . .Jeff [9:24 AM] http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template
