HIPAA Blog

[ Wednesday, December 29, 2010 ]

Is a medical marijuana dispensary a "covered entity"? If so, this is a pretty bad HIPAA breach.

[ Tuesday, December 21, 2010 ]

Wisconsin breach: The old "stolen laptop" scenario has caused a data breach at Dean Health System and St. Mary's Hospital in Wisconsin. 3288 patients are involved. I'm suspecting the data was scrubbed off of the computer, but it's still a breach (since the data apparently wasn't encrypted).

Jeff [11:12 AM]

Christmas Lists: What's on your HIPAA Christmas Gift List?

Jeff [11:10 AM]

[ Monday, December 20, 2010 ]

Red Flags: Here's more on the Red Flags Rule changes to remove most doctors from the definition of "creditor." Dom Nicastro tells me that President Obama signed the bill into law on Saturday.

Jeff [11:30 AM]

[ Friday, December 17, 2010 ]

Great HIPAA Story: My dear friend Karen Pyatt phoned this afternoon with an awesome HIPAA story that I just have to share. A woman in her office ordered an item from a company that sells glass products, ornaments, and decorative pieces. The order arrived, packed in a box, with roughly-shredded paper protecting the fragile glass cargo. However, the shredded paper was not the finely cross-shredded paper you usually see (think ticker tape parade trash), but was shredded in such a way that it was easy to read what had been printed on the paper.

As you have already guessed, the packing paper was the medical record of a clearly-identified woman with a skin rash of some sort. The woman's name, the name of the dermatologist office, and all sorts of medical information about the woman's ailment and her treatment were sent, along with the glass doodad, to a random office in St. Louis.

Presumably, the glass company buys bulk shredded paper to use as packing material. Presumably, the dermatology clinic hires some company to shred and properly (!!) dispose of its medical records. How those two streams of commerce, this input and this output, got connected is the big question. But it almost certainly involves somebody doing something pretty darned stupid, and almost certainly in violation of either HIPAA or a Business Associate Agreement.

Karen has agreed to contact the glass company and ask where they get their packing paper. She's also going to try to contact the dermatology clinic. I'll keep you posted. . . .

Jeff [3:56 PM]

[ Thursday, December 16, 2010 ]

Doctors on Facebook: I don't think these findings are surprising, and would apply to US doctors at least as much as to French ones.

Jeff [8:09 AM]

Sometimes the Regulators Screw Up, Too: The California Department of Public Health used the mail when they should've used a private courier, and lost some data. I wonder how much they're going to fine themselves.

Jeff [8:06 AM]

[ Wednesday, December 15, 2010 ]

Mesa, Arizona data breach: Mountain Vista Medical Center has lost a bunch of data cards with patient identifying information and images of endoscopy procedures. No social security numbers or credit card numbers, so it's not much for ID theft purposes. But it's legitimately a HIPAA problem.

Jeff [3:36 PM]

The Security Risk of the Common Copier: Most copy machines these days store images of the documents they copy. If those documents contain PHI, there's a risk that someone could access the storage and obtain the PHI, especially when the copier changes hands. The FTC has just issued a useful note explaining the problem and giving some advice on what to to about it.

Jeff [11:23 AM]

Get Ready, 2011 To Be A Big Year for HIPAA/HITECH Regulations? I saw this on BNA yesterday but didn't want to post to it because it's subscription only, but now Dom Nicastro has noted that an Office of Civil Rights presenter at the ONC Update conference stated that sometime next year, OCR will simultaneously publish the breach notification, enforcement, and HIPAA/HITECH privacy and security regulations, as well as a new rule implementing the new accounting requirements (if you use an EMR, you have to account for treatment, payment, and healthcare operations disclosure, which were exempt under the original HIPAA accounting rules).

Jeff [11:14 AM]

[ Tuesday, December 14, 2010 ]

Confusion persists over the FDA's social media rules.

Jeff [7:21 AM]

[ Friday, December 10, 2010 ]

Red Flags: OK, today's earlier post shamed me into actually looking at the "Red Flag Program Clarification Act of 2010" (the Clarification Act) to see if it really did what it said it did. On my first read of it, I thought they revised the wrong definition, particularly when I looked at the regulations implementing the Rule (16 CFR 681 for non-banks). But my confusion was based on multiple cross-references in the Fair and Accurate Credit Transactions Act (FACTA), the Fair Credit Reporting Act (FCRA), and the Equal Credit Opportunity Act (ECOA). On further review, the Clarification Act works.

Basically, under the original Red Flags Rule, in FACTA Congress required the Secretary of the Treasury, the FTC, and others to jointly write Red Flags regulations, which they did. They referenced the definitions in FCRA, which gives some definitions, but cross-references the ECOA for the definition of "creditor." The Clarification Act adds a specific definition for "Creditor," which takes the ECOA definition of creditor ("any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew or continue credit"), but limits it to creditors who (i) use consumer reports in connection with credit transactions, (ii) furnish information to consumer reporting agencies in connection with credit transactions, or (iii) advance funds, based on the obligation to repay the funds or secured against certain pledged property. If the advance of funds is to pay expenses incidental to services provided, (iii) doesn't apply.

The Clarification Act does allow the FTC and banking regulatory agencies to include others in the definition of "creditor," but only if they determine that the creditor "offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft." This is a bit of a back door that could allow the FTC to continue to include physicians as subject to the Red Flags Rule; however, any such interpretation would be contrary to clear Congressional intent.

So, if the President signs the Clarification Act, that should remove the Red Flags Rule requirement from any healthcare provider that does not regularly establish payment plans. Some providers (lasik surgery providers, plastic surgeons, bariatric practices, and others that establish payment plans for patients) will still likely be considered creditors, but your garden variety medical practice will be out from under this requirement.

Jeff [4:48 PM]

Medical Indentity Theft: OK, so Congress passed and the president signed (I think) a law revising the Red Flags Rule to make it inapplicable to doctors, lawyers, accountants, etc. At least that's what the legislators say it does; I haven't really reviewed it to see if it really does what they say it does (I know, I know, I've been busy), but that's definitely the congressional intent.

While physicians and physician groups no longer have to comply with the Red Flags Rule, you should still consider it. Medical ID theft is a big problem, and will only get bigger. Take care of your patients. An ID theft prevention plan isn't hard to do, and it's good customer service.

Jeff [9:29 AM]

[ Monday, December 06, 2010 ]

Federal Employee Health Data: this should drive the privacy folks crazy.

Jeff [12:23 PM]

[ Thursday, December 02, 2010 ]

Red Flags Update: The Senate has unanimously passed the Red Flag Program Clarification Act, which establishes a definition of "creditor" that will reduce the likelihood that doctors, lawyers, accountants, and others who are paid after they provide services, rather than before, are subject to the Red Flags Rule. Previous proposed legislation focused on the size of the entity or the specific services provided to determine whether the Red Flags Rule applied, but this amendment signifies a different approach.

It's still possible that doctors, lawyers and others could be considered "creditors" and therefore subject to the Red Flags Rule, if the entity engages in credit transactions, advances funds to customers, or otherwise "offers or maintains accounts that are subject to a reasonably forseeable risk of identity theft." It's possible that the FTC could take an expansive approach to this definition. However, the legislative intent (including specific statements by Chris Dodd and Mark Begich) makes clear that doctors, lawyers and other small business should be free from the Red Flags Rule (if the House passes the bill and the President signs it).

Jeff [11:31 AM]

Data Breach Reports: Dom Nicastro notes that the pace of data breach reports to OCR (those involving 500 or more people) has increased since the summer.

Jeff [10:53 AM]

[ Wednesday, December 01, 2010 ]

Doctor sues patient who complains online. Not the first one (Booth Eye Care and Laser Center in North Texas has done the same), but not very common.

Jeff [10:02 AM]

Role-Based User Access to PHI: HITECH has both raised the stakes and provided an opportunity to review and reassess HIPAA compliance generally. Additionally, the "meaningful use" rules coming down the road for electronic medical records should spur healthcare providers in particular to increase their use of EMRs; this should also trigger a re-evaluation of policies and procedures governing use of and access to PHI generally.

Now is a good time to reassess your employee's access to PHI. HIPAA requires that access decisions relate to the role the employee plays. Here's a timely white paper from InformationWeek on role-based access issues. Check it out.

Jeff [9:57 AM]

http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template