Health Law

Richard Blumenthal Strikes Again:

Posted on August 19, 2010
Richard Blumenthal Strikes Again: the Connecticut AG is investigating Yale Medical School in connection with the theft of a laptop containing PHI of 1000 patients. He got $250,000 out of HealthNet, wonder what he'll take here. . . .

Red Flags Update: The Council of

Posted on August 18, 2010
Red Flags Update: The Council of Medical Specialty Societies has joined the AMA lawsuit to stop the application of the Red Flags Rule to physician practices.

Just because I want to post the

Posted on August 18, 2010
Just because I want to post the headline: Database Threat Modeling and Strip Poker

Cost of Healthcare Data Breaches

Posted on August 18, 2010
Cost of Healthcare Data Breaches So Far? How about over $800,000,000 in total?

To access this complete feed in the blog feed reader login or register for free.

What to do when you get breached?

Posted on August 17, 2010
What to do when you get breached? Infoweek has an interesting article on the topic. Not HIPAA-specific, but interesting.

Missing, but not Breached: This

Posted on August 16, 2010
Missing, but not Breached: This is a pretty bizarre story. A veteran discovered a lot of his medical records missing from the VA. Apparently, a rogue employee at the Milwaukee VFW, which assists veterans in dealing with the VA, decided to take the office paperless by shredding a lot of records of the veterans managed by them...

More Bad Trash Policy: Someone

Posted on August 13, 2010
More Bad Trash Policy: Someone found medical records from four community hospitals in the Boston area dumped without shredding at a town dump. A news photographer saw the huge pile of paper, and investigated mainly because he was mad it wasn't being recycled...

Mighty oaks from tiny acorns grow:

Posted on August 12, 2010
Mighty oaks from tiny acorns grow: Those small policy breaches sometimes are the genesis of some spectacular data breaches. Something for compliance folks to keep in mind.

Physician Practice Data Breaches:

Posted on August 06, 2010
Physician Practice Data Breaches: Joe Cantlupetalks about physicians and data breaches. The doctor is a victim (of a burglary or cyber intrusion), but is also responsible for the rest of the victims. Two big take-aways: encryption and the ability to audit access (who looked at what patient files).

Now Walgreens: On the heels of

Posted on August 05, 2010
Now Walgreens: On the heels of big fines against CVS and Rite Aid, the third drugstore cowboy is also under OCR investigation. Dom Nicastro is all over this story.UPDATE: If you want to know these companies should've done, here's some advice.

Rite Aid: Infoweek's Security Blog

Posted on August 04, 2010
Rite Aid: Infoweek's Security Blog chimes in.

Interesting: The breach notification

Posted on July 30, 2010
Interesting: The breach notification rule came out in "Interim Final" form on 8/24 of last year, and became effective "as is" thirty days later, on 9/23/09. However, HHS accepted comments for 60 days and, in response to those comments, HHS developed a final rule (i...

Rite Aid Data Breach Settlement:

Posted on July 28, 2010
Rite Aid Data Breach Settlement: $1 Million for throwing prescriptions and labeled pill bottles into regular trash. The problem showed up as a result of some dumpster-diving by local TV news reporters.

Mayo goes all twittery: Lee Aase

Posted on July 28, 2010
Mayo goes all twittery: Lee Aase steps up.

Interesting Stat: I attended a

Posted on July 27, 2010
Interesting Stat: I attended a lunch presentation put on by Scott & Scott and Chartis here in Dallas today, and picked up this statistic: Roughly 5.8% of American adults have been victims of medical identity theft,with $20,160 being the average cost per victim.

New Data Breach Tool: HITECH now

Posted on July 27, 2010
New Data Breach Tool: HITECH now requires HIPAA-covered entities and business associates to provide notice to affected parties in the event of data breaches involving unsecured PHI, but not for breaches where there's not a substantial risk of harm. How do you determine whether an incident rises to the level of a breach, or whether a breach carries a risk of harm substantial enough to require

State AGs and HIPAA Enforcement:

Posted on July 27, 2010
State AGs and HIPAA Enforcement: This may be the biggest impact of HITECH -- more enforcers with more incentive to enforce will matter more than bigger penalties.

Open Notes: A very interesting

Posted on July 23, 2010
Open Notes: A very interesting study coming down the road on whether transparency in medical records is a good idea or not.

New Regs Highlights: From my soon-to-be

Posted on July 21, 2010
New Regs Highlights: From my soon-to-be copresenter Rebecca Herold and Dom Nicastro, some highlights of the new HIPAA regs that were published in the July 14 Federal Register. I'll have an eAlert on the new regs out probably today or tomorrow.

Big Boston Data Breach: South Shore

Posted on July 21, 2010
Big Boston Data Breach: South Shore Hospital sent back-up computer files to an off-site contractor for destruction, but the shipment wasn't received. Data on 800,000 patients and employees might've been in the files. I really doubt anything untoward happened, and it might not even count as a data breach under HIPAA, but there's a Massachusetts data breach law that requires the notification.

Anonymous no more: The previously

Posted on July 13, 2010
Anonymous no more: The previously un-named "private practice" data breachers on the HHS big data breach (i.e. > 500 names) web page have now been revealed.

Meaningful Use Rules: the Stimulus

Posted on July 13, 2010
Meaningful Use Rules: the Stimulus bill added financial incentives (both carrots and sticks) to healthcare providers to encourage them to adopt electronic medical record technologies and become "meaningful users" of that technology. What does "meaningful use" mean? The latest regulations are out...

Off Topic: over a nice meal of

Posted on July 10, 2010
Off Topic: over a nice meal of grilled pork chops (yes, it's raining, but you can grill with an umbrella just fine -- in fact, you get to revisit the meal the next couple of times you open up the umbrella), herb rolls and a Greek salad, I've been enjoying this:It's the Sierra Nevada "Estate" beer, a nutty, malty ale produced from barley and hops grown on the Sierra Nevada brewery property in

HHS Presser: Here's the statement

Posted on July 09, 2010
HHS Presser: Here's the statement from the HHS Press Conference this morning.

Regular readers of this blog know

Posted on July 09, 2010
Regular readers of this blog know that I occasionally am requested to allow a guest blogger to post here. The following is a guest blog post from Alexis Bonari at onlinedegrees.org. Convenience at the Cost of Privacy: Medical Records in an Electronic AgeWhen paper documentation was standard, privacy issues were fairly easy to legislate and resolve...

From the Data Breach List: Here's

Posted on July 09, 2010
From the Data Breach List: Here's some excellent advice from Post & Schell's Edward Shay:Yesterday, OCR updated its breach notification website [ http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html]which now summarizes 107 breaches involving 500+ individuals...

HHS Presser: I wanted to ask a

Posted on July 08, 2010
HHS Presser: I wanted to ask a question about the "harm" rule, so I pressed *1 and gave my name. I was returned to the press conference, but after the second question, everything went dead. My line is still open, just dead. OK, now they announce that the press conference is over...

HHS Presser: Answering a question

Posted on July 08, 2010
HHS Presser: Answering a question from AIS, NPRM does not address Breach Notification Provisions (i.e., the "harm" standard), nor does it address the new accounting for disclosures rules. That will come later.

HHS Presser: Deborah Peel asks

Posted on July 08, 2010
HHS Presser: Deborah Peel asks a question: Concerned whether NPRM fulfills promises if HHS doesn't even define "privacy." When will a definition be provided? Want to make sure public gets to participate in listening tour. Answer: we welcome your input...

HHS Presser: David Blumenthal (National

Posted on July 08, 2010
HHS Presser: David Blumenthal (National Coordinator for Health Information Technology (otherwise known as Office of the National Coordinator, or ONC): More discussion (context) of NPRM and new websitesGoal: interoperable, private and secure Health Information System...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.