[ Tuesday, September 28, 2010 ]
New York Presby: a
tiny data leak.
Jeff [12:43 PM]
[ Friday, September 24, 2010 ]
Coming Soon (Possibly): a General Federal Data Breach Notification Requirement. Obviously, we've got the HIPAA data breach notification requirement ushered in by HITECH, and many states (California and Massachusetts in the vanguard) have data breach notification requirements as well. But apparently the
FTC has testified before Congress in support of a federal statute.
I guess I could go for it, as long as there's preemption. I'm generally against more laws, and specifically more federal laws (on Federalist grounds), but if everyone has to do breach notification anyway under state laws, at least there can be one set of rules.
Jeff [12:36 PM]
[ Thursday, September 23, 2010 ]
Slightly Off-Topic: RECs. Houston Neal at SoftwareAdvice is
running a survey on the impact of Regional Extension Centers, which are supposed to help physicians adopt electronic medical records. If you have any input regarding RECs, they'd appreciate it.
Jeff [1:26 PM]
[ Tuesday, September 21, 2010 ]
UPMC employee charged with HIPAA violations: Paul Pepala, a former employee at University of Pittsburg Medical Center's Shadyside Hospital,
has been charged with 14 HIPAA violations involving the use of patient names, addresses and social security numbers to generate false tax returns in order to fraudulently obtain tax refunds.
Jeff [10:15 AM]
MLK Ambulatory Care Center data breach: A janitor
steals medical records and sells them. Sounds like a typical HIPAA horror story. But the janitor didn't steal celebrity records and sell them to the National Inquirer, or accident victim files to plaintiff's attorneys. Rather, the janitor was just selling the paper to a recycler. Of course, if they had been shredded first, it would have been fine. But they weren't, and the whole episode exposes weaknesses in the PHI protection system of the center.
Jeff [10:09 AM]
[ Monday, September 20, 2010 ]
How PPACA Impacts Privacy: Apparently pretty harshly.
This story is from The American Thinker, which is pretty conservative. But privacy zealousness isn't really a conservative/liberal thing -- folks on both sides can be pretty extreme about it.
Jeff [11:24 AM]
[ Thursday, September 16, 2010 ]
Worried About Snoopers? You probably should be, and you might want to consider
honeypots if the problem is bad enough.
Jeff [9:59 PM]
[ Friday, September 10, 2010 ]
State Regulators in Action: One of the biggest changes wrought by HITECH is adding states' Attorneys General to the short list of authorities who can prosecute HIPAA violations. However, there's never been anything stopping states from instituting their own privacy rules and enforceing them. Massachusetts recently implemented a data breach rule that basically requires encryption, and we may see some real enforcement there. But the clear leader is California, which regularly fines hospitals for mishandling patient data. The latest to be hit is the Packard Children's Hospital at Stanford University, for
failing to report a data breach when an employee stole a computer.
Jeff [11:11 AM]
I'm torn over whether they should have named the violator: Mayo
fires a snooping employee. Good for them.
Jeff [11:02 AM]
[ Thursday, September 09, 2010 ]
South Shore Boston: I
posted on this a couple of months ago: a hospital sent backup tapes to a vendor to be destroyed, but they got lost in transit. After investigating, the hospital has
apparently decided that the missing files pose minimal data breach risk, since it would take specialized equipment to retrieve the data. This is probably about right -- there's no reason to believe that it's in any way likely that someone stole the tapes or, having come across them, would go to the effort to try to extract data. In all likelihood, the tapes are rotting in a New England landfill somewhere.
Jeff [9:22 AM]
[ Thursday, September 02, 2010 ]
Not HIPAA, but a data breach: A benefits consultant to the state of Delaware
accidently posts 22,000 SSNs and DOBs on the state's procurement website as part of an RFP. No names, though.
Jeff [11:35 AM]
Ex Parte Communications In Missouri: The Missouri Supreme Court has held that HIPAA prevents a party in a lawsuit from having
ex parte communications with the other party's physicians without the authorization of the individual or some other HIPAA exception. As is normally the case, this came up in a med mal case, where the defendant wanted to talk to the plaintiff's physicians. Since the communication between counsel for the defense and the plaintiff's physicians did not include plaintiff's counsel or the court, it was not part of the litigation proceeding.
Via BNA, so subscription may be required.
Jeff [11:25 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
