Health Law

HHS Presser: Director of OCR Georgina

Posted on July 08, 2010
HHS Presser: Director of OCR Georgina Verdugo. Announces new Notice of Proposed Rule Making (NPRM) (i.e., the new HIPAA regs), which reinforces HIPAA privacy.BAs having liabilityNew limits on fundraisiingNo sales of PHIMore ability of patients to prevent PHI from being disclosed to Plans (i...

HHS Press conference: ONC has a

Posted on July 08, 2010
HHS Press conference: ONC has a Chief Privacy Officer, Joy Pritts.www.hhs.gov/healthprivacy is new website on HHS' privacy page.

HHS Presser: Sebelius: Health IT

Posted on July 08, 2010
HHS Presser: Sebelius: Health IT infrastructure investment is the big government effort, but docs and patients will only participate if info is secure.New rule out today: most sweeping improvements on Privacy and Security since 2003. How does it improve? Increases penalties...

HHS Presser: this will be my Twitter

Posted on July 08, 2010
HHS Presser: this will be my Twitter feed too, so apologies for the multiple posts. K. Sebelius currently speaking -- big obstacle to care = lack of up-to-date info on our health (our financial data is a click away, but our medical records are on paper in a hospital somewhere).

To access this complete feed in the blog feed reader login or register for free.

HHS conference call: I'm currently

Posted on July 08, 2010
HHS conference call: I'm currently holding. I got at least 6 links to the call, so I suspect they have much more phone traffic than they're used to.

New HIPAA Regs are out: You can

Posted on July 08, 2010
New HIPAA Regs are out: You can see all 234 pages here. The version printed in the Federal Register will be shorter, probably around 100 pages, unless there are charts. Obviously, I haven't had a chance to peruse them, but will in the next day or so, perhaps over the weekend...

HealthNet/Connecticut Update: HealthNet

Posted on July 07, 2010
HealthNet/Connecticut Update: HealthNet has settled with Connecticut AG (and Senate candidate) Richard Blumenthal in regards to its data breach issues. $250,000 plus credit monitoring. Not too bad; they probably paid more than that in legal fees.

Totally, totally off-topic: But

Posted on July 07, 2010
Totally, totally off-topic: But this is way too funny. Westboro Baptist Church is a radical Kansas church led by Fred Phelps that protests at completely inappropriate places, like funerals for soldiers, with signs that say things like "God hates fags...

University of Florida: Here's a

Posted on July 07, 2010
University of Florida: Here's a sort of old-fashioned data breach, printing social security or Medicare numbers on address labels when notices are sent out. I suspect that might violate a Florida state law as well; most states have statutes to prevent printing out full credit card numbers on receipts or social security numbers on other documents.

Six Messy Database Breaches: the

Posted on July 06, 2010
Six Messy Database Breaches: the first six months of 2010 had many breaches, but these six highlight some specific issues that might lead to breaches, and should be a focus as you look for ways to secure your systems.

EMRs vs Privacy: More consumer

Posted on July 06, 2010
EMRs vs Privacy: More consumer fears outlined.

Lincoln Hospital, NYC: Data breach

Posted on July 06, 2010
Lincoln Hospital, NYC: Data breach involving lost data disks.

From Dom Nicastro: the OCR list

Posted on July 03, 2010
From Dom Nicastro: the OCR list of big data breaches reaches 100 entries.

New Link: if you're a Human Resources

Posted on July 02, 2010
New Link: if you're a Human Resources officer, you might find this HR Daily Advisor interesting.

California Hospital Data Breaches:

Posted on July 02, 2010
California Hospital Data Breaches: I noted a few weeks ago that several California hospitals had been fined for breaches of confidential information. Jana Aagaard posted on the AHLA listserve earlier this week a good set of resources to help understand California breach rules, which apply to hospitals and nursing homes but not individual physicians...

Wellpoint Data Breach: almost half

Posted on June 30, 2010
Wellpoint Data Breach: almost half a million potential exposures. This seems to be linked to the Anthem Blue Cross data breach I reported Friday.

Red Flags and Doctors: The FTC

Posted on June 26, 2010
Red Flags and Doctors: The FTC has agreed to hold off enforcing the Red Flags Rule, which requires financial institutions and "creditors" to adopt anti-ID theft policies, against physicians until the American Bar Association's challenge is finally ruled on...

Anthem Blue Cross data breach:

Posted on June 25, 2010
Anthem Blue Cross data breach: Insurance application information (including social security numbers) involving residents of the LA area may have been accessed by attorneys suing Anthem Blue Cross in a class action lawsuit. As many as 230,000 people may have been affected...

The New Regs are Coming!! Word

Posted on June 24, 2010
The New Regs are Coming!! Word is that July 8 will be the publication date. That is later than I predicted -- I thought we'd see them in time to take them to the beach to read over the July 4 weekend.Hat tip: Jud DeLoss

Playing Defense: What types of

Posted on June 24, 2010
Playing Defense: What types of activities do you monitor in your computer systems and medical records to ensure that your HIPAA policies and procedures are being met? Gartner is putting on a free webinar next Tuesday outlining 10 database activities you should monitor to uncover and prevent data breaches...

Interesting: Microsoft establishes

Posted on June 18, 2010
Interesting: Microsoft establishes centralized fraud alert system for reporting stolen data. Will be good for researchers to determine vulnerabilities and track impact of lost and stolen data.

Red Flags Update: BNA is reporting

Posted on June 17, 2010
Red Flags Update: BNA is reporting that the FTC will agree to exempt health care providers from the Red Flags Rule requirements while the AMA's lawsuit against the FTC proceeds. Doesn't mean they're giving up entirely, just that while the suit is ongoing, the Rule isn't applicable to doctors.

Nice mention: on a list of blogs

Posted on June 17, 2010
Nice mention: on a list of blogs and articles about understanding HIPAA.

What a Lovely Audience!I'm in Chicago

Posted on June 14, 2010
What a Lovely Audience!I'm in Chicago (Evanston, actually) at the Health Care New Media Marketing Conference, put on by Q1 Productions.

From Dark Reading: Tips on interfacing

Posted on June 14, 2010
From Dark Reading: Tips on interfacing with law enforcement after a data breach. Not too much concrete, and it would've been nice to be in that conference, but it's worth thinking about. If you're a big provider, you really should be prepared for the when, rather than the if, of a data breach.

Five California Hospitals fined

Posted on June 11, 2010
Five California Hospitals fined for data breaches (via BNA; subscription required). Fines range from $25,000 to $325,000, and mainly relate to the failure of the facilities to prevent employees from unauthorized access. Can't tell for sure if these are snooping cases or something more...

Data Breach Examiner: I recently

Posted on June 09, 2010
Data Breach Examiner: I recently had the chance to meet with Rick Kam and Christine Arevalo of ID Experts. ID Experts assists clients in dealing with data breaches, both of the HIPAA variety and the commercial variety. They can assist with determining the extent and scope of the damage, notifying affected individuals, and coordinating the entire response in a way that complies with appropriate

Big Merger in Health IT: Misys

Posted on June 09, 2010
Big Merger in Health IT: Misys was one of the original medical information systems that pushed offered electronic medical record platforms, and merged some time ago with Allscripts, which originally focused on IT in the prescription medicine business...

Social Media Risks: I'm gearing

Posted on June 09, 2010
Social Media Risks: I'm gearing up for my speech in Chicago next week, so I'm thinking about social media issues. I just came across this whitepaper on the top five risks to business pursuing a social media strategy, from the IT pro group ISACA. Their basic premise: social networking is here to stay and is a necessary part of business; you can't stop your employees from Facebooking and

Learn something new every day:

Posted on June 08, 2010
Learn something new every day: thanks to Jim Brashear of ZixCorp, I now know that there's a statute in Massachusetts requiring anyone who owns of licenses personal information (first name or initial + last name + social security, drivers license, financial account, credit card, or similar number) must have a comprehensive information security program and must establish and maintain a security

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.