[ Wednesday, November 24, 2010 ]
Complaint filed with FTC against QualityHealth: The health information website is the subject of the
complaint for
sharing personal data.
Hat tip: Alan Goldberg
Jeff [9:21 AM]
[ Monday, November 22, 2010 ]
Data Security: One of the requirements for "meaningful use" of EHRs (which all providers are going to have to show at some point or they'll take lower Medicare/Medicaid reimbursement) is that the provider
regularly assess its data security risks. This is also a requirement of the HIPAA Security Rule -- in fact, based on what I've discovered when helping clients meet the HITECH requirements, it's probably the most consistently missed HIPAA requirement.
If you haven't done a risk analysis, you're in violation of the HIPAA Security Rule, plain and simple. If you did one back in 2003 - 2005 before the Security Rule came into play, then you should be consistently redoing it. And if you're not, you might not meet the "meaningful use" rules, either.
Jeff [9:18 AM]
More California fines: the California Department of Public Health periodically lists the healthcare providers it has fined for privacy violations. Here's
the latest news.
Jeff [9:15 AM]
[ Wednesday, November 17, 2010 ]
Henry Ford Data Breach: A
stolen laptop leads to a data breach, and a public report.
Jeff [7:45 AM]
[ Tuesday, November 16, 2010 ]
Guest Post: I occasionally allow guest bloggers to post here, and here's one on a topic I deal with regularly: doctors and social media.
Jacqueline Klosek, lawyer, radio host, and author of
several books on
privacy and
electronic communication, including "
Protecting Your Health Privacy: A Citizen's Guide to Safeguarding the Security of Your Medical Information," posts the following:
Should Doctors and Patients Be “Friends”?
- The Use of Social Media by Medical Professionalsby Jacqueline Klosek
The growing popularity of social networking platforms such as Facebook is enabling all of us to connect and, in many cases, reconnect, with classmates, co-workers, family members, employers and others. However, the social networking realm may not be appropriate for all relationships.
A number of experts have written about this issue from the physician’s perspective. Dr. Sachin H. Jain wrote a particularly insightful piece for the New England Journal of Medicine concerning his trepidations about merging his professional life as a physical and his personal life. And sure, from the physician’s perspective, being online friends with patients can result in the creation of a dual relationship between patients and physicians, a relationship that can ultimately raise ethical issues and impair the physician’s professional judgment. Dr. Jain also touched upon the privacy issues that can arise when doctors and patients meet in cyberspace. As an example, Dr. Jain discusses how a nurse’s blog about a difficult patient can raise issues if, for instance, individuals acquainted with the “difficult patient” read the blog and can identify the patient at issue.
This issue of patient privacy is one of the biggest concerns about the prospects of patients and physicians being friends in cyberspace. While social networking sites such as Facebook do have a variety of privacy settings for users to implement, it is not a medium to be used for patient and physician communications. Even if a physician wishes to use his or her Facebook account to communicate with patients on a “friendly” basis, over time, there is a risk that discussions of medical issues will arise and the physician may end up crossing the line and discussing sensitive medical issues concerning identifiable patients via online communications that are not sufficiently secure. This is a significant concern because physicians that use social networking sites to exchange protected health information run the risk of violating the Health Information Portability and Accountability Act (HIPAA), as well as applicable state laws and professional codes of conduct.
In light of the prevalence of social media and in recognition of the potential risks of the use of social media by physicians, the American Medical Association (AMA) recently endorsed a new policy that addresses physicians’ use of social media. In its introduction to the new policy, the AMA observed that social media such as social networks, blogs and other forms of communication “create new challenges to the patient-physician relationship”. The AMA then advised physicians to weigh the following considerations when maintaining a presence online:
(a) Physicians should be cognizant of standards of patient privacy and confidentiality that must be maintained in all environments, including online, and must refrain from posting identifiable patient information online.
(b) When using the Internet for social networking, physicians should use privacy settings to safeguard personal information and content to the extent possible, but should realize that privacy settings are not absolute and that once on the Internet, content is likely there permanently. Thus, physicians should routinely monitor their own Internet presence to ensure that the personal and professional information on their own sites and, to the extent possible, content posted about them by others, is accurate and appropriate.
(c) If they interact with patients on the Internet, physicians must maintain appropriate boundaries of the patient-physician relationship in accordance with professional ethical guidelines just, as they would in any other context.
(d) To maintain appropriate professional boundaries physicians should consider separating personal and professional content online.
(e) When physicians see content posted by colleagues that appears unprofessional they have a responsibility to bring that content to the attention of the individual, so that he or she can remove it and/or take other appropriate actions. If the behavior significantly violates professional norms and the individual does not take appropriate action to resolve the situation, the physician should report the matter to appropriate authorities.
(f) Physicians must recognize that actions online and content posted may negatively affect their reputations among patients and colleagues, may have consequences for their medical careers (particularly for physicians-in-training and medical students), and can undermine public trust in the medical profession.
These are prudent and reasonable recommendations that should allow physicians to make productive uses of social media while also reminding physicians of the importance of protecting patient privacy and confidentiality.
Jeff [4:51 PM]
[ Monday, November 15, 2010 ]
EMRs versus Privacy: followers of this blog know that I like to point out how almost every effort to increase access to medical records almost always improve care, but decrease privacy. If you want the best possible medical care, make sure every possible provider of medical care or advice has your medical information; broadcast it far and wide, because there might be someone in some far-flung locale who has seen your exact issue and dealt with it successfully. But that is the exact opposite of medical record privacy. If you want the best privacy, don't let anyone see your medical records, even your own doctor.
EMRs sit at this intersection between quality increases due to information exchange, and privacy concerns that balk at any information exchange.
Here's a good article on how discussions about EMR adoption highlight these privacy concerns.
UPDATE: Here's
another article.
Jeff [7:35 AM]
[ Friday, November 12, 2010 ]
HealthNet (Conn.) Breach news: HealthNet
has settled with the State of Connecticut over its data breach and failure to timely notify affected parties. The fine: $375,000.
Jeff [9:50 AM]
[ Wednesday, November 10, 2010 ]
Social Media: You may be aware that I occasionally speak on the use of social media in healthcare marketing. Via Alan Goldberg and Robert Coffield, I've been informed that the AMA
now has a policy to guide physicians who use social media. The AMA policy says:
AMA POLICY: PROFESSIONALISM IN THE USE OF SOCIAL MEDIA
The Internet has created the ability for medical students and physicians to communicate and share information quickly and to reach millions of people easily. Participating in social networking and other similar Internet opportunities can support physicians’ personal expression, enable individual physicians to have a professional presence online, foster collegiality and camaraderie within the profession, provide opportunity to widely disseminate public health messages and
other health communication. Social networks, blogs, and other forms of communication online also create new challenges to the patient-physician relationship. Physicians should weigh a number of considerations when maintaining a presence online:
(a) Physicians should be cognizant of standards of patient privacy and confidentiality that must be maintained in all environments, including online, and must refrain from posting identifiable patient information online.
(b) When using the Internet for social networking, physicians should use privacy settings to safeguard personal information and content to the extent possible, but should realize that privacy settings are not absolute and that once on the Internet, content is likely there permanently. Thus, physicians should routinely monitor their own Internet presence to ensure that the personal and professional information on their own sites and, to the extent possible, content posted about them by others, is
accurate and appropriate.
(c) If they interact with patients on the Internet, physicians must maintain appropriate boundaries of the patient-physician relationship in accordance with professional ethical guidelines just, as they would in any other context.
(d) To maintain appropriate professional boundaries physicians should consider separating personal and professional content online.
(e) When physicians see content posted by colleagues that appears unprofessional they have a responsibility to bring that content to the attention of the individual, so that he or she can remove it and/or take other appropriate actions. If the behavior significantly violates professional norms and the individual does not take appropriate action to resolve the situation, the physician should report the matter to appropriate authorities.
(f) Physicians must recognize that actions online and content posted may negatively affect their reputations among patients and colleagues, may have consequences for their medical careers (particularly for physicians-in-training and medical students), and can undermine public trust in the medical profession.
Jeff [1:52 PM]
[ Monday, November 08, 2010 ]
Hospitals and Social Media: As some of you know, I occasionally speak on the use of social media in healthcare marketing. It's a growing area, as
noted here.
Jeff [8:50 AM]
[ Friday, November 05, 2010 ]
Annual Cost of Data Breaches: for hospitals, it's
$6 billion.
Jeff [7:57 AM]
[ Wednesday, November 03, 2010 ]
Wellpoint in Indiana: The Indiana attorney general
has sued Wellpoint for failing to notify customers of a breach. The breach was the result of personal data (social security numbers, health data, and financial information) left available on a website.
Jeff [9:49 AM]
Very weird (and off topic): patients
swallow funny things, and need endoscopy or surgery to get them back out. Pens, batteries, knives?
Jeff [9:47 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
