[ Thursday, September 29, 2011 ]
TRICARE breach: A contractor, Science Applications International Corp (SAIC) lost a bunch of backup tapes when they were stolen from an employees car while in transit,
says BNA (subscription required). Apparently the data is hard to access, but not encrypted. 4.9 million patients involved. My bet: crackhead. Some crackhead broke into the car and stole something that looked good. Once he saw what it was, and that there was nothing he could do with it, he threw it out. I bet nothing comes from this.
UPDATE:
Here's the story from Reuters (no subscription needed).
Jeff [9:50 PM]
I'm no expert, but
this may be a HIPAA violation. Oh, wait, I am an expert. . . .
Actually, it's
possible that it's not a HIPAA violation,
if the steps the physician took were reasonable and sufficient, and the breach occurred despite taking those reasonable steps. That's a subjective standard, and perhaps could be met. HIPAA doesn't require perfection, just reasonable steps for protection. But at this point, I think it's really just a matter of damages, which frankly could be huge.
Jeff [11:33 AM]
[ Tuesday, September 27, 2011 ]
Proactively Protecting PHI: Here's an
interesting article by M. Eric Johnson of Dartmouth on the greater risks to data in healthcare. Keep in mind that a lot of it is more scare story than tragedy -- very few of the millions of breaches have resulted in any damage to any patient, financial or otherwise. Also keep in mind that while medical information may be incredibly sensitive, much isn't (people discuss their health issues with friends, coworkers, and complete strangers all the time), and the loss of it is neither profitable to the recipient or damaging to the victim. Finally, keep in mind that the healthcare industry
requires the exchange of that information, and efforts to restrict its accessibility, while reasonable to increase security, can literally kill someone. Making sure the data is accessible to those who need it when they need it, and inaccessible to others, requires balancing. It's a much different story than other industries, and head-to-head comparisons aren't always apt.
Just sayin'.
Jeff [10:09 AM]
[ Friday, September 23, 2011 ]
HHS Privacy Policy Form: As promised, HHS had published a
Privacy Policy form for entities that offer or use web-based personal health records. It's interesting, but is also sort of a hodge-podge. It appears to be targeted to PHR-offering companies, rather than providers who may access a PHR when a patient arrives at the provider and says, "you can get my health history at this website." It also doesn't help providers in trying to determine whether they should load a patient's info on such a PHR site. But it's a start, and a window into what HHS is thinking when it comes to PHRs.
Jeff [9:22 AM]
[ Thursday, September 22, 2011 ]
Non-Privacy HIPAA: There seems to be a problem with the HIPAA transaction code for "eligibility." One of the initial components of HIPAA administrative simplification (where privacy and security reside) relates to what we sometimes call "transaction and code sets," where the industry was supposed to settle on specific forms for data and content in specific regularly-occurring "transactions" in healthcare. For example, every electronic claim for payment should be in the same form, no matter who is asking for payment or who is being asked to pay. Another standardized transaction is "eligibility," where a provider can ask an insurer to determine if a patient is eligible for benefits under a particular insurer. That's specifically true for Medicare; if a provider thinks a patient is a Medicare patient, they're supposed to be able to submit a standard electronic form to determine whether the patient is eligible or not.
Apparently, the system isn't working, or at least isn't working quickly enough. Some Senators are
asking CMS to fix the system.
Jeff [5:32 PM]
PWC Report on Healthcare Data Breaches: According to a new report out by PricewaterhouseCoopers'
Health Research Institute, a
majority of healthcare providers aren't taking necessary steps to ensure security of new technologies like mobile devices. They are taking advantage of those technologies and adapting their operations to use increasing amounts of electronic data, but just aren't taking the necessary precautions. The study also found that an increasing amount of data loss in the healthcare industry is
perpetrated by insiders seeking to improperly use the information for identity theft or other improper purposes such as drug access.
Jeff [5:21 PM]
[ Wednesday, September 21, 2011 ]
Massachusetts Data Breach Totals: 2,000,000. Massachusetts has its own data breach reporting law, which so far has resulted in reports of 2 million individuals being involved in data loss incidents of some sort. Most interesting quote: "About 2.1 million residents were affected by the various incidents, though it's unknown whether any of them were actually defrauded as a result of the data leaks." That's something to keep in mind when you hear big numbers like this: every data breach is potentially catastrophic, but almost all are entirely innocuous.
Update: The biggest loser? South Shore Hospital, which lost 17 years of data when a vendor didn't destroy documents like it was hired to do.
Jeff [8:38 AM]
[ Tuesday, September 20, 2011 ]
There is a Plan. You can relax; if you thought the Office of the National Coordinator for Health Information Technology (was called ONCHIT, now just ONC) was just going willy-nilly worward without a strategic plan in place, you can rest assured that they do have a
Strategic Plan. At least for the next year or so.
Jeff [3:14 PM]
HIPAA Pain: How to Cope. InfoWeek
weighs in on how concerned covered entities are regarding breaches, how most breaches aren't structural or organizational but rather are human error, and why things are going to get harder and worse.
Jeff [1:35 PM]
State AGs and HIPAA: As you probably know, the HITECH Act allows state attorneys general to prosecute covered entities for HIPAA violations. With a handful of notable exceptions, not too many state AGs are pursuing those, but more may in the future (OCR has held training sessions to bring AGs up to speed on how to do it).
Here's an article on the state of the playing field (with some pretty sharp experts quoted therein).
Jeff [1:32 PM]
[ Monday, September 19, 2011 ]
2012 HIPAA Audits: Here's an interesting
White Paper from Clearwater Compliance on the impending HIPAA audits coming next year. I haven't had a chance to read it yet, but it should be interesting to see what types of predictions are being made.
Jeff [12:39 PM]
Medical Home Arrangements and HIPAA: A
North Dakota clinic has opted out of a medical home plan established by Blue Cross Blue Shield of North Dakota because they believe the arrangement violates HIPAA. BCBS provides patient information to a consultant who mines the data for quality of care purposes. The consultant looks for best practices or areas where physicians or physician groups could provide better care, or for particular information or patters with particular patients that indicate specific medical issues, and advise the physician how to better treat that patient. The physician participation agreement requires the physician to get all required consents, but the staff at BCBS have adamantly held that no specific consent is required for the disclosure of PHI to the consultant.
Presumably, the consultant is a business associate of BCBS, so can receive the information in that capacity. The disclosure is presumably for healthcare operations, and perhaps for data aggregation purposes. Depending on the consultantcy agreement and the participation agreement, it's possible that BCBS is a BA of the participating physicians, and the consultant is a sub-BA (or "subcontractor in HITECH lingo) of BCBS.
One of the doctors in the objecting group has filed a HIPAA complaint. It will be interesting to watch this to see how it all plays out. . . .
Jeff [9:29 AM]
Interesting Hospital Privacy Case: A cop in Hawaii
posts a picture on his facebook page with the caption, "See when you like steal copper." The picture is of a suspected copper thief, in a hospital bed, with burns all over his body. The Honolulu Police Department and the District Attorney are trying to figure out a way to charge the cop with a crime. HPD has no social media policy, so the cop didn't violate that. Of course, HIPAA is mentioned but (i) the newspaper makes a total botch of trying to explain it, and (ii) HIPAA doesn't apply to a cop or a police force, unless they are a healthcare plan, provider, or clearinghouse, or a business associate of a plan, provider or clearinghouse.
The hospital could theoretically be liable, but only if they could have reasonably prevented the cop from taking the picture; I don't see that happening.
Jeff [9:19 AM]
[ Friday, September 16, 2011 ]
Indiana University Laptop Theft Breach: The PHI of about 3,000 patients of IU Medical School (including about 200 social security numbers) have
potentially been exposed due to the theft of a laptop from one of its physicians. The laptop was password protected, but the data was not encrypted. According to the school, they are using the incident as a learning opportunity, which is a good idea. They should also be reassessing their overall HIPAA compliance, and perhaps reconsidering when and how they use encryption.
Jeff [10:17 AM]
[ Thursday, September 15, 2011 ]
HIPAA Criminal Guilty Plea: This is
an interesting one. A guy pretends to be a doctor. He approaches a bunch of other doctors, and gets the other doctors to hire him to be an allergist for them, giving patients allergy shots at the doctor's office and at health fairs. Fake doc turns over all his receipts to the employing doc, except he keeps between half and 85% as his compensation. For the employing docs, it's good money for hiring this guy to work for them, except for the fact that he's not a real doctor.
So where's the HIPAA violation Fake Doc admits? He kept a spreadsheet showing how profitable his business is, and shows it to a potential investor. That's the HIPAA violation. If he were legit, the exposure to the investor might not be a violation, assuming the minimum necessary rules are met and the disclosure was a "healthcare operation" related to legitimate due diligence.
Jeff [12:19 PM]
[ Tuesday, September 13, 2011 ]
Peyton Manning on HIPAA: When asked to explain what specific issues were causing doctors to not clear him to practice, the
Indianapolis Colts QB said, "I don't know what HIPAA stands for, but I believe in it and I practice it. So, uh, I'll leave it at that."
Jeff [3:38 PM]
HIPAA Rumblings from HHS: HHS just held its Consumer Health IT Summit, with a handful of major players in HIT and assorted government flacks. Three relatively big announcements:
CLIA: HHS has
proposed a new rule to allow individuals to access PHI that is held by a clinical lab. Under original HIPAA, individuals did not have the right to access their lab results or other PHI that was held by a CLIA-certified lab (basically, most medical clinical labs). They really had to get that info from their doctors. I don't know why this was the rule, but I suspect the concern was that patients won't really know what the information means unless their doctor looks at it, interprets it, and explains it. I don't know whether this intermediation is a good thing, or if the new disintermediation is better. But the CLIA lab exception to the individual's right to access is going away.
PHR Model Notice: The HITECH Act made providers of personal health records (PHRs) subject to HIPAA, but it's still not clear what that means. However, HHS has not presented a form of
Notice of Privacy Practices (NoPP) for PHRs.
New Head of OCR: There's a new Sheriff at OCR:
Leon Rodriguez, who is a lawyer with a prosecutorial background. He comes to OCR from DOJ, but spent most of his career as a prosecutor of one sort or another, with a private practice healthcare litigation stint at Ober Kaler. Interesting to consider what that protends.
Hat tips: Bob Coffield and Theresa Defino.
Jeff [10:45 AM]
[ Monday, September 12, 2011 ]
Stanford Data Breach: Data left online unintentionally leads to a
data breach involving 20,000 ER patients at Stanford Hospital. The data included no SSNs or birth dates, which is good, but did include name and diagnosis, which isn't. What is odd is that the data made it from a Stanford vendor to the "Student of Fortune" website as an example of how to convert data into a graph. But the biggest lesson is that data that is leaked or lost unknowingly might be a long-term breach -- this data was online and freely available on the internet for almost a year.
Jeff [8:58 AM]
[ Friday, September 09, 2011 ]
Telemedicine: very
interesting article on how new technology and a patient's own privacy concerns/efforts will drive new developments in telemedicine.
Jeff [9:40 AM]
[ Thursday, September 08, 2011 ]
HHS Reports: Almost 8 million records. Over 30,000 separate breaches. That's the current
status of the breaches that have been reported to HHS, according to HHS'
report to Congress required by HITECH.
Two things to remember about these breaches. First, almost all of them were breaches of fewer than 500 records; only about 250 out of over 30,000 breaches were "big" breaches. Second, almost all of these breaches were NOT violations of HIPAA. Look, sometimes a bad employee will do a bad thing; sometimes a good employee will give in to temptation; sometimes someone makes a mistake and throws out something that should be shredded; sometimes a flash drive gets lost; and sometimes someone breaks in and steals your laptop. Those are not HIPAA breaches. HIPAA doesn't require exact and perfect protection -- no law does. These numbers, while big, don't indicate damage from breaches (the vast, vast majority of these incidents resulted in no harm to the individuals). And they certainly don't indicate that HIPAA doesn't work.
Jeff [10:07 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
