[ Thursday, August 30, 2012 ]
Heatlhcare Data Breaches Decreasing in Number: However, the number of affected individuals is increasing, as are the
damages from those breaches.
Jeff [10:43 AM]
[ Wednesday, August 29, 2012 ]
Medical Identity Theft: HHS' Office of the Inspector General is
putting on a webinar for the general public describing the steps you can take to prevent medical identity theft. It's designed for healthcare providers, but is probably good advice for everyone.
Jeff [1:06 PM]
Another Stolen Laptop: An Indianapolis radiation oncology center
lost a laptop that contained the practice's medical record backups. Stolen from an employee's car. Two suggestions, guys: (i) use online backup (encrypted, of course); and (ii) encrypt whatever goes outside on media -- laptops, PDAs, smartphones, disks, thumb drives, portable hard drives, EVERYTHING!
Jeff [9:25 AM]
[ Sunday, August 26, 2012 ]
State AG HIPAA enforcement training site: I was cleaning out some emails and came across this link to
HHS' training materials for State attorneys general. As you may know, prior to the HITECH Act, only the HHS Office of Civil Rights could bring a HIPAA enforcement action or levy a fine. However, the HITECH Act allows state attorneys general to also bring enforcement actions, which might make for more enforcement actions, and might also result in different interpretations in different jurisdictions. In order to help the state AGs figure out how to pursue an enforcement action, HHS conducted some seminars, which are now
available online. If you're a target of a state enforcement action, it would behoove you to check this out.
Jeff [3:32 PM]
[ Wednesday, August 22, 2012 ]
Oops. MD Anderson
lost an unencrypted thumb drive containing data on 2200 patients. A trainee lost it on the employee bus. It's the
3rd 2nd loss this year, the other
2 being
laptops a laptop stolen from a physician's house
and an accountant/auditor's house.
UPDATE: as noted above, the auditor's laptop theft did occur, but way, way back in 2006, not in 2012. Many thanks to "Dissent" from
PHI Privacy.net.
Jeff [9:36 PM]
[ Tuesday, August 21, 2012 ]
Guest Post: As you may know, I occasionally allow guest bloggers to post articles here that have some passing relevance to HIPAA and health information technology. This is one such article:
Health Informatics Creating New Professional Career Opportunities Health informatics is a discipline that is advancing technologically and is in high demand in many hospitals across the world. As a combination of the computer and information sciences and the health care field, health informatics is based on the use of computers and information systems to input, manage and interpret medical records. Although health informatics is not a new discipline, it has yet to reach its pinnacle, in terms of widespread use. Slowly but surely, hospitals across the United States are beginning to implement a health informatics system into their operation, and with this new way of managing patient data comes the need to train and hire health care professionals with a background in health informatics. In a recent article published online at BostonHerald.com and titled Medical Moneyball: Informatics takes pulse of medicine, Dr. Jonathan Bickel, Boston Children’s Hospital’s director of clinical research informatics points out the need for professionals who are well-versed in both sides of the subject. In the article, Dr. Bickel is quoted as saying that, “To be good at informatics, you have to be good in two realms – the world of health care and the world of information technology.” Universities and colleges all across the country are answering this call for better educated professionals by creating programs on both the undergraduate and graduate degree levels. However, most are designed at the master’s level for experienced health professionals such as doctors, nurses and pharmacists. For added convenience, many schools offer an online course option. For those health professionals interested in a career in health informatics, it is best to first discuss this interest with your employer, because they may already know of opportunities within your organization or offer tuition reimbursement for training. According to the same BostonHerald.com article, job demand for health information managers and technicians is at a healthy and promising level. The article quotes Northeastern University’s Master of Science in Health Informatics director, Daniel Feinberg, as saying that, “anybody who is getting a degree from this (Northeastern’s) or other local master’s programs is getting a job.” As for the legality and ethics of using patient records for research purposes, policy compliance and government reporting regulations play a major role in health informatics education. The issue of patient privacy is one that does not go unnoticed, but it looks as though the benefits of informatics and electronic medical records are winning the battle. Health informatics is here to stay and grow and will continue to offer a new career opportunity for many health care professionals with an interest in computer science, research and statistics. Lauren Bailey is a freelance blogger who often contributes her knowledge of online education to www.BestCollegesOnline.com. In addition to topics related to education, Lauren also loves to cover issues related to new technology, lifestyle and health. She welcomes your questions and comments at blauren99@gmail.com.
Jeff [4:33 PM]
[ Monday, August 20, 2012 ]
EMR vs EHR: Is it just phraseology, or do those acronyms mean different things?
Back in the early days of HIPAA, there was a stated push to move the healthcare industry out of the paper record universe into the electronic (easily transferrable, storable, and searchable) record universe. It seems that most folks "electronic medical record" to refer to the what the paper records were converted into. Perhaps that's because doctors talk about "the medical record" as a phrase with specific meaning and the end result of good medical documentation. If you call the total patient record "the medical record," then the electronic version would be an "electronic medical record" or EMR.
However, when the HITECH Act and the meaningful use regulations came around, suddenly we were dealing with electronic health records, or EHRs (which Microsoft Word unhelpfully keeps translating into "HER" or "HERS"). Is there a difference? If not, is there a preferred form?
Nate Bagley at Software Advice weighs in
here. While there used to be some distinction among health IT folks some years ago, EMR and EHR have sort of merged into two words for the same thing. And, as you might expect, once the government starts calling something by a particular name in regulations, that name tends to stick. So, I guess we'll have to get used to EHRs.
Jeff [4:24 PM]
[ Monday, August 13, 2012 ]
EMR Hacking Becomes Extortion: Hackers attacked the electronic medical records of a suburban Chicago surgery practice, but didn't steal the information or expose it to the public; rather, they
encrypted it and demanded ransom for the encryption key.
Hat tip: Tatiana Melnik
Jeff [8:46 AM]
[ Friday, August 10, 2012 ]
Cerner EMR Outage: Last Friday, I told you about a computer outage at Cerner that took the EMRs of dozens of hospitals off-line for about 5 hours. Cerner is
now reporting that it was human error that caused the outage.
Whether you use Cerner or some other vendor, if you use any EMR system, you MUST test it to see if you can operate when (not if) it goes down. According to Cerner, all of the affected hospitals had down-time procedures that apparently worked, whether it's using other-site-located backup or relying on paper formats for physicians orders (and entering them in the system when it comes back up).
Jeff [9:29 AM]
Accretive: Ascension has
signed a new 5-year deal with Accretive, despite the bad press in Minnesota. Very interesting.
Jeff [9:19 AM]
[ Wednesday, August 08, 2012 ]
Stanford Hospitals & Clinics Has a New Data Breach: Somebody
stole a physician's password protected (but apparently not encrypted) laptop. 2500 patient files were compromised. It's their
second in a year.
Jeff [9:56 PM]
[ Friday, August 03, 2012 ]
Computer Outage takes EMRs off-line: A huge computer
network outage earlier this week took the electronic medical records of dozens of hospitals "off-line" for 5 hours. What happens in a hospital when you can't access medical records for 5 hours?
HIPAA requires covered entities to have administrative, physical and technical safeguards in place to protect the confidentiality, integrity, and availability of PHI it keeps in electronic format. Every BAA should impose that specific requirement on the business associate (I use the memnonic "APT-CIA" to remember the requirement when I'm reviewing a BAA). Everyone always thinks of the "C": that's what the vast majority of HIPAA compliance is all about. The "I" ("integrity" means that the data can't be easily corrupted or changed) generally takes care of itself when you take steps to protect confidentiality like audit trails. But what about availability?
The issue with availability came into stark relief when the tornado hit Joplin, Missouri last year. While the hospital was devastated and paper medical records were found miles away, the hospital's electronic medical record system was backed up offsite, and the backup was brought online almost immediately. Many hospitals (especially those in tornado-prone areas in the middle of the country) began investigating their EMR backup and recovery capabilities in the event of a natural disaster like a fire, flood or tornado. But what if the problem isn't with nature, but with your computer system?
This is another learning opportunity, and hospitals and physician practices with EMRs should take a close look at how they operate and what would happen to their PHI's "availability" in a computer outage.
Jeff [8:47 AM]
[ Thursday, August 02, 2012 ]
On the Social Media Front: another example of why you should temper your use of social media if you are a healthcare provider or otherwise covered by HIPAA: a Yuma (AZ) Regional Medical Center
nurse posted a comment on the Yuma Sun blaming a motorcycle rider who died in a fatal crash with an ambulance that was making a U-turn. The incendiary comments set off a firestorm that ended with the nurse getting fired. The story doesn't indicate whether the commenter, as a nurse, had any access to the deceased's PHI, so it's not clear if it's a HIPAA issue.
UPDATE: Link was bad, fixed now. Sorry! Thanks for noticing, Theresa Defino, MFPR (my favorite privacy reporter).
Jeff [3:32 PM]
[ Wednesday, August 01, 2012 ]
Laptop stolen: Hartford (CT) Hospital
gets a laptop stolen, and the Connecticut AG is looking into it. The laptop was unencrypted, and had PHI on about 10,000 patients.
Jeff [10:03 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
