Health Law

Another reason to adopt an Electronic

Posted on March 19, 2010
Another reason to adopt an Electronic Medical Record system? (Slightly OT): Over at the Software Advice blog, Chris Thorman throws out a couple of additional reasons for medical practices to migrate to an EMR system, perhaps sooner rather than later...

Privacy versus open source medicine:

Posted on March 18, 2010
Privacy versus open source medicine: I've noted often the dynamic tension between privacy and healthcare. The best privacy you can get is when nobody, including your doctor, gets your PHI; the best medicine you could get would be if everyone had access to your PHI (an "open source" arrangement, if you will) and could recommend possible solutions for your problems...

Not exactly "Official," but at

Posted on March 17, 2010
Not exactly "Official," but at least "More Official:" OCR is working on a Notice of Proposed Rulemaking (NPRM), which is what they call drafted regulations, to address the HITECH issues that became "effective" February 17, 2010, but still need guidance...

Minnesota Blue Cross has been sued

Posted on March 15, 2010
Minnesota Blue Cross has been sued by a member for disclosing her personal information. It seems like, in preparing an educational brochure for members that tells them how to submit claims, they took a real member's EOB and included it without changing the names...

To access this complete feed in the blog feed reader login or register for free.

Delay becomes more semi-official:

Posted on March 12, 2010
Delay becomes more semi-official: AIS is reporting that HHS' Office of Civil Rights is again indicating that it will delay enforcement of the portions of the HITECH Act that went into effect February 17, at least until regulations have been published...

Bleg: Do you sell HIPAA insurance?

Posted on March 10, 2010
Bleg: Do you sell HIPAA insurance? Have you purchased it?There's a conversation going on at the AHLS HIT listserv about HIPAA insurance. People occasionally aske me about this, and I tell them I believe it is available but don't really know who's selling it or what's covered...

Red Flags Rule: A major part of

Posted on March 07, 2010
Red Flags Rule: A major part of the argument that, even if you aren't a "creditor" under the Red Flags Rule, you ought to institute an Identity Theft Prevention Plan anyway.On another Red Flags note, the rule requires affected businesses to monitor their service providers (at least those who deal with the "accounts" that make the business a "creditor") to make sure they follow the entity's ID

Privacy vs Effective Healthcare

Posted on March 03, 2010
Privacy vs Effective Healthcare Communications: Another look at the conundrum.

HITECH BAA reg

Posted on March 03, 2010
When? Soon.

What's the Cost of a Data Breach?

Posted on March 02, 2010
What's the Cost of a Data Breach? For Blue Cross, it's $7 million and counting, and that's just figuring out who to contact. Think about that, and think about how you'd respond. What are your capabilities for finding out who is impacted in a data breach? Do you have the ability to audit and figure out what information might've been compromised if a particular office was burglarized? Maybe

How Secure Are You? As evidenced

Posted on February 24, 2010
How Secure Are You? As evidenced by the Galveston case I posted on yesterday, this story from the FTC should serve as a wake-up call that you need to make sure your employees aren't using your work computers to access peer-to-peer file sharing for their personal stuff...

When Rogue Employees Attack: a

Posted on February 23, 2010
When Rogue Employees Attack: a data/identity thief goes after UT Medical Branch (Galveston) patients, taking a job with a billing contractor to get access to patient identity data.

Effectiveness vs Enforcement.

Posted on February 22, 2010
Effectiveness vs Enforcement. I spent some time Friday discussing with a reporter the distinction between a statute becoming effective and it being enforced. Apparently, there's been some stir in the air, at the least generated by the appearance of some HHS folks at various venues explaining HHS' lack of regulations on the business associate provisions of HITECH (which became effective on

Publicly-Disclosed Data Breaches:

Posted on February 22, 2010
Publicly-Disclosed Data Breaches: As you should know, the data breach reporting requirements have been effective since September; if you're a covered entity and suffered a data breach, you needed to report to the individual and, if it involved 500 or more people, to HHS and the local media...

HITECH due dates: You saw my post

Posted on February 18, 2010
HITECH due dates: You saw my post yesterday -- it was the due date for most of the HITECH revisions to HIPAA. However, I've been asked a couple of times in the last few days when certian parts of the HIPAA revisions are applicable, specifically the data breach rules...

Today is the Day.One year ago,

Posted on February 17, 2010
Today is the Day.One year ago, February 17, 2009, the President signed the American Recovery and Reinvestment Act of 2009 ("ARRA"), sometimes called the Stimulus Bill. Within ARRA was an act with the clever acronymic name of the Health Information Technology for Economic and Clinical Health Act (or "HITECH"), which contained a number of health-technology-wish-list items like financial incentives

Another Top 50 Blogs Listing: This

Posted on February 16, 2010
Another Top 50 Blogs Listing: This time for nursing assistants.

Illinois school dental records:

Posted on February 15, 2010
Illinois school dental records: A question from the audience:Here in Illinois, the public schools require all students in 2nd grade (and acouple others) to furnish proof of dental checkups, along with some diagnosisinformation on a form to be signed by the dentist...

Winkler County, Texas Nurses Trial:

Posted on February 12, 2010
Winkler County, Texas Nurses Trial: The two nurses accused of improperly disclosing government information (patient records) have been acquitted. The nurses were charged in connection with their reporting of a doctor on the State Medical Board, and including patient information in their report to the Board...

HIPAA's Relevance: How dare she

Posted on February 10, 2010
HIPAA's Relevance: How dare she ask this question? Actually, the concern that OCR isn't doing much/enough rests on the assumption that there are a lot of violations that aren't being pursued. What if most healthcare providers and health plans actually are good stewards of the privacy and confidentiality of their patients and beneficiaries? But the real reason why some of us care about HIPAA (

California Data Breach: Social

Posted on February 09, 2010
California Data Breach: Social Security numbers were printed on the outside of envelopes sent to about 50,000 Adult Day Health Care program participants.

New HIPAA Privacy and Security

Posted on February 05, 2010
New HIPAA Privacy and Security Rules On the Way? According to Sue McAndrew, OCR's Deputy Director for Health Information Privacy, who spoke at the 18th National HIPAA Summit this week, a "proposed HIPAA privacy and security rule" is forthcoming, and Ms...

Five HIPAA Stumbling Blocks: From

Posted on February 04, 2010
Five HIPAA Stumbling Blocks: From Chris Apgar, via Dom NicastroNo risk analysisNo policies and proceduresNo trainingNo compliance auditsNo disaster/recovery plansRight now, I'm revising a lot of policies and procedures prior to the February 17 deadline, and many, many folks never did a risk analysis...

A nice mention: Top 50 Health IT

Posted on February 03, 2010
A nice mention: Top 50 Health IT blogs.

EMR useful info: Are you in the

Posted on February 03, 2010
EMR useful info: Are you in the process of acquiring an electronic medical record system? If you don't already have one, you should at least be looking into this. Here's a useful list of tips to help you save money while you do so.

Non-HIPAA Breach in Alaska: PwC

Posted on February 01, 2010
Non-HIPAA Breach in Alaska: PwC loses state retirement data.

Port St. Lucie, Florida: medical

Posted on January 29, 2010
Port St. Lucie, Florida: medical records found in a dumpster. Apparently thrown out by University Medical Clinics.

Red Flags Update: the AMA is still

Posted on January 29, 2010
Red Flags Update: the AMA is still trying to get physicians exempted from the Red Flags Rule. This week, they sent a letter, co-signed by the American Veterinary Medical Association, the American Osteopathic Association, and the American Dental Association, trying to get tag-along rights on the ABA litigation...

Data Breach: This one involves

Posted on January 28, 2010
Data Breach: This one involves the National Archives, including information on White House staff and visitors.

Twitter-squatting: You knew it

Posted on January 28, 2010
Twitter-squatting: You knew it was going to happen. Just as some sneaky (er, entrepreneurial?) folks registered IP addresses and domain names that they knew other businesses would want, and tried to sell those names/addresses to those businesses ("cybersquatting"), apparently some folks are establishing twitter accounts with brand names, celebrity names, and other names that might be worth

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.