[ Thursday, April 28, 2011 ]
Many breaches unreported by consumers, too: I noted recently that many businesses don't report all breaches or incidents. Well, it's a two-way street, apparently.
Many victims don't report, either.
Jeff [8:33 AM]
Hospital Social Media Checklist: More hospitals are getting into social media, but need to know the pitfalls. Dom provides a
nice checklist.
Jeff [8:30 AM]
[ Monday, April 25, 2011 ]
More Twitter and Facebook: Many healthcare players are getting more and more
social-media savvy. Be careful out there!
Jeff [11:43 AM]
The Other HIPAA: Have your billing systems migrated from the 4010 standards to the 5010 standards? Do you even know what I'm talking about? You don't really need to know what it is or how it works, but the HIPAA transaction standards require that everyone doing electronic transactions in healthcare use specific transaction forms/content/types. Those forms were originally set to a standard known as 4010, but the forms have been updated to the 5010 standard. Everyone should have started testing the new form in 2011, and must
migrate to the new form no later than January 1, 2012. It's a technical thing, so check with your billing folks to make sure you're ready to make the switch by then.
Jeff [11:37 AM]
[ Thursday, April 21, 2011 ]
Social Engineering: Maybe it's because I've been working with Attus Technologies recently on some of their HIPAA products that involve social engineering issues and protections, but I found this list of
Social Engineers' dirty tricks to be pretty interesting.
Now, if you clicked through without thinking about whether
MY link was good, shame on you. You should
always be suspicions, especially when you're dealing with lawyers, bloggers, or both.
Jeff [6:01 PM]
[ Tuesday, April 19, 2011 ]
Facebook as a HIPAA problem:"
The board found Alexandra Thran, of Westerly Hospital, guilty of unprofessional conduct after she recounted some of her emergency-room experiences on Facebook, according to a news release by the state Department of Health. The board said she did not use the names of patients, and did not intend to disclose confidential information, but the nature of the injuries of one patient allowed an unauthorized third party to figure out who it was, the board ruled.
The panel said that Thran deleted her account as soon as she learned what had happened. The board issued a reprimand and told Thran to pay a $500 administrative fee."
Jeff [2:56 PM]
[ Monday, April 18, 2011 ]
Two Years in Prison: that's the just desserts of a Ft. Lauderdale hospital ER clerk for
selling patient data that was used for ID theft. Via BNA, subscription required.
Jeff [8:55 PM]
[ Saturday, April 16, 2011 ]
This makes sense: Most companies
don't report all data breaches and losses unless the loss is big or they have to. Reporting can cause more problems than it solves, especially if the breach is unlikely to cause damage or publicizing it may make it worse.
Jeff [9:24 AM]
[ Thursday, April 14, 2011 ]
Diary of a Breach: This is kinda geeky, and long, but pretty interesting. It's a timeline of a fictional data breach, with mini-vignettes of incidents and responses. If you're the IT guy* in charge of data security (or the guy in charge of that guy), it's worth slogging through. The data you save may be your own.
*As I do with my 4th grade girls volleyball team, I use "guy" in a non-gender-specific way.
Jeff [9:29 AM]
What does a PHI data breach cost? AMA and ANSI are
trying to find out.
Jeff [7:25 AM]
[ Wednesday, April 13, 2011 ]
Texas Comptroller's Office Blows It: Been to busy to timely post stuff from my own home state, it seems. This isn't HIPAA, but the
Texas Comptroller's office left a bunch of social security numbers up online. I think they're going to give 2 years of credit watch services to the 3.5 million people affected. If you get a copy of the letter that they are sending out, shoot me a copy; I'm interested in seeing how they respond. (Of course, I say that assuming I won't be getting a letter. . . .)
Jeff [3:21 PM]
[ Monday, April 11, 2011 ]
5010 News: This is mostly a HIPAA Privacy and Security blog, but occasionally there's news on other HIPAA fronts. If you're not aware, the third leg of the "administrative simplification" provisions of HIPAA relates to transactions and code sets -- the standardization of electronic data interchange in healthcare. Those transaction and code sets, known by the codification "4010," have been in place since the beginning of HIPAA. But they are being updated, with new transaction and code sets known as 5010. These must be in use by January 1, 2012, so covered entities (or more likely their billing companies and/or clearinghouses) should be migrating to the 5010 standards. But it appears that
there aren't that many people focusing on the transition. What with ACOs and the economy and everything else (and this war and that damned SOB Johnson), there are lots of other distractions.
Jeff [10:41 AM]
MidState (Connecticut) Medical Center Data Breach: It's a common-enough story. An employee downloads a bunch of patient data onto a portable hard drive and takes it home to work on it. The download violates hospital policy. The hard drive gets lost. The employee gets fired. The
hospital notifies 93,000 patients.
Jeff [10:06 AM]
[ Tuesday, April 05, 2011 ]
Somewhat Off Topic: The Accountable Care Organization regulations were published on Thursday last week, and several of my partners and I have just published a big analysis of the proposed rule. You can find it
here. There are provisions regarding data sharing that are HIPAA-relevant (which I wrote, along with explanation of the Stark and Anti-Kickback waiver rules). As far as I know,
Jackson Walker is the first law firm out of the gates with a big analysis of this rule, which is going to be a game-changer in healthcare in the near future.
Jeff [7:03 PM]
Guest Post: As you know, I occasionally get requests from other authors to allow them to draft a guest post for this site. Taylor Dardan is a cancer treatment advocate and is extremely interested in insuring that cancer patients' medical privacy is fully protected in our current healthcare system. Recently, Taylor (who can be reached at
dailydardan@gmail.com) wrote the following:
The Strategies for Protecting Patient Privacy
Protecting the privacy of cancer patients in a healthcare environment can present a difficult challenge. This challenge has only been made more difficult with the widespread use of electronic health records. Of course, while electronic health records have their benefits, they can easily result in privacy breaches. And unless privacy concerns are addressed with effective approaches, their outcome can potentially compromise a patient’s well being.
HIPAA has played an increasingly important role in protecting the privacy of individuals who are being treated for an illness. Two common approaches to safeguarding patient privacy, in concurrence with HIPAA, include access restriction and accountability. Restricting access to medical records can reduce potential privacy violations. On the other hand, restricted access can potentially harm a patient if a medical facility is unable to access a record in a timely manner. For many cancer patients, time is of the essence, and failing to act quickly can potentially result in litigation. Several cancers, including mesothelioma and ancreatic cancer, have extremely short life expectancies that are rarely longer than 14 months. The accountability approach works differently; it promotes greater access to medical records. The goal is to prevent potential delays; however, the method is heavily protected by an audit trail, surveillance, and even an investigation if complications arise. By increasing the likelihood of getting caught and facing negative consequences, privacy violations are severely deterred when using this approach.
The most important thing to remember though is that privacy protections, above all, must not increase the risk of harm to patients. If healthcare is inhibited by security policy – there is something clearly wrong. Privacy is important, but there is a very fine line that health care professionals must walk when treating their patients and keeping their records secure.
Jeff [5:17 PM]
[ Sunday, April 03, 2011 ]
World's Biggest Hack? Epsilon, an online marketing company providing services to some very large commercial enterprises (including some in the health industry, such as Walgreens) was
apparently hacked, with client's customer's personal and financial data accessed. Could just be names and email addresses. But it could be more; stay tuned.
Jeff [4:57 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
