Health Law

More slightly-off-topic: Those

Posted on December 16, 2009
More slightly-off-topic: Those of us who deal with HIPAA privacy issues often have to overflow into other privacy laws, particularly Gramm-Leach-Bliley, which protects personal information in the financial context. The various federal agencies with GLB responsibilities recently issued a joint model privacy notice form.

Slightly Off-Topic: Here's a list

Posted on December 16, 2009
Slightly Off-Topic: Here's a list of the Top 9 data breaches for the last year involving banks and other financial institutions. Interesting the geographic and stylistic breadth of the breaches. Remember, privacy and security systems are only as strong as their weakest link...

Keeping Up with HIPAA: How do you

Posted on December 15, 2009
Keeping Up with HIPAA: How do you know that you're current with your HIPAA risk assessments? We've got new law that will be enforceable in a couple of months, with very few regulations. Neither the law nor the regulations will say what specific steps, processes, programs or hardware you might need...

Got paper? Paper-based data breaches

Posted on December 14, 2009
Got paper? Paper-based data breaches on the rise. Which raises 2 issues. First, the new HITECH data breach reporting rules only apply to "unsecured" data, so a breach of "secured" data need not be reported. Unfortunately, with paper records, the only way to "secure" is to "destroy," making the records useless to both intended and unintended users...

To access this complete feed in the blog feed reader login or register for free.

Federal Data Breach Law? As you

Posted on December 11, 2009
Federal Data Breach Law? As you know, California started the trend of general-business data breach notification laws, with most other states following. Now, a bill has passed the US House that would impose a federal data-breach law. Don't know if it's really needed, given state efforts already, and don't know if it would be harsher than the HITECH data breach rules, but something to keep an eye

Houston HIPAA violations

Posted on December 09, 2009
Houston Snoopin': The Harris County Hospital District, which runs Ben Taub Hospital, the Level 1 trauma center and huge public hospital. has fired 16 employees for snoopin'. A medical school resident who was assigned to Ben Taub was shot in a grocery store parking lot and rushed to Ben Taub...

Medical Identity Theft is on the

Posted on November 30, 2009
Medical Identity Theft is on the Rise: According to the Wall Street Journal. It seems likely. But remember, medical identity theft is somewhat a crime of opportunity -- if you don't need medical care, you don't need to steal someone's medical identity...

Latest HIPAA Data Breach: Apparently,

Posted on November 30, 2009
Latest HIPAA Data Breach: Apparently, BCBS of Tennessee is preparing a monster notification effort after a hard drive was stolen at a remote training facility. Based on the story, I'd put it pretty low on the risk scale: the data wasn't encrypted, but it was encoded and scrambled, and the facts make it look like hardware theft, not data theft.

Totally and Ridiculously off-topic,

Posted on November 26, 2009
Totally and Ridiculously off-topic, but funny: Frank J's list of things to be thankful for.

Encryption: More sage advice from

Posted on November 25, 2009
Encryption: More sage advice from Dom Nicastro. Then again, what would you expect, given who he's taking advice from? Actually, early on in the life of the HIPAA Security Rule, many IT guru types jumped onto the encryption bandwagon with both feet, saying things like "encryption is industry standard and failure to encrypt is per se an unreasonable violation of the Security Rule," or "sending

Healthcare Reform: Here's a great

Posted on November 20, 2009
Healthcare Reform: Here's a great article. The key point is #3 (which is the point I've made over and over again): the problems with the American healthcare system are the result of OPM ("other people's money").

Speaking of Medical Records: Check

Posted on November 20, 2009
Speaking of Medical Records: Check out Bob Coffield's blog for a paper medical record, circa 1030. Pretty cool.

EMRs: A study says they don't save

Posted on November 20, 2009
EMRs: A study says they don't save money, either. Of course, if you're a physician practice that takes Medicare, you'll lose money if you don't adopt one. D'ya ever notice whenever the government puts unnatural incentives on some economic action, it results in uneconomic activity (viz...

EMRs: the privacy concerns connected

Posted on November 19, 2009
EMRs: the privacy concerns connected with electronic medical records seem to be getting greater and more visible play these days. There is, no doubt, a trade-off in privacy whenever medical information is in electronic format.

What to do in case of a breach:

Posted on November 19, 2009
What to do in case of a breach: I've done a lousy job of keeping up with this, but this is the last part of a really nice series by Dom Nicastro on how to avoid breaches, what to do when one happens, and how to follow up.

EMRs: So far, the benefits of switching

Posted on November 16, 2009
EMRs: So far, the benefits of switching to electronic medical records aren't exactly overwhelming. Something to keep in mind when the debate over healthcare reform starts to overheat.

Ready for HITECH? You are alone,

Posted on November 16, 2009
Ready for HITECH? You are alone, according to this survey. 94% of healthcare entities aren't ready for the February 2010 effective date of the HITECH revisions to HIPAA. Caution, it's a small sample size, but I suspect most of us have a lot of work to do.

What if Quizno's Were Run Like

Posted on November 11, 2009
What if Quizno's Were Run Like Healthcare? This is pretty funny, and goes a long way to explain what's wrong with the healthcare system.

Anthem BCBS (Connecticut) Data

Posted on November 10, 2009
Anthem BCBS (Connecticut) Data Breach: I noted below that Anthem Blue Cross Blue Shield had a laptop stolen that had data on about 18,000 doctors, including some social security numbers (not PHI, though, so it's [probably] not a HIPAA violation). The information was unencrypted, which was against company policy...

Interesting Georgia personal representative

Posted on November 05, 2009
Interesting Georgia personal representative decision: Well, interesting if you're a HIPAA geek. The Georgia Supreme Court has ruled that a spouse of a deceased person is that person's "personal representative" for HIPAA purposes. It seems the complicating factor in Alvista Healthcare Center v...

Data Breach experience: Here's

Posted on November 03, 2009
Data Breach experience: Here's an interesting first-person perspective of a data breach victim. Understandable (if not really balanced) concerns about the ability of research organizations to use data without consent.

Survey: As I mentioned below,

Posted on November 02, 2009
Survey: As I mentioned below, SoftwareAdvice is taking a survey on EMR adoption. They've decided to hold the survey open until Thursday, November 5th to see if they can compile more data. You can take the survey here.

Miami HIPAA/ID Theft sentencing:

Posted on November 02, 2009
Miami HIPAA/ID Theft sentencing: As noted below, the Miami ID theft ring at Palmetto General Hospital resulted in two convictions of a medical records employee and an outside accomplice. The hospital employee got 2 years and 5 days (?) and the accomplice got 11 months in jail...

Red Flags Update: I didn't see

Posted on October 31, 2009
Red Flags Update: I didn't see this until this morning, but knew it was coming. Sunday is November 1, the date the much-delayed Red Flags Rule would become enforceable against "creditors" (financial institutions, which obviously ought to implement identity theft prevention programs, have been under the Red Flags Rule for about a year)...

Cost-efficient technology: HIPAA

Posted on October 30, 2009
Cost-efficient technology: HIPAA issues abound, obviously, but there sure are some good iPhone and smartphone apps that doctors and patients can use that deliver a big bang for the buck.

Red Flags and Small Businesses:

Posted on October 29, 2009
Red Flags and Small Businesses: To stop ID theft, businesses need to follow the Red Flags Rule. TJMaxx and other high-profile breaches show that. But is it even more important for small businesses to follow the Red Flags Rule? Some say so.Pro: small businesses have less technology, so lower technological defenses against ID theft...

Arkansas Snoopin' update: Sentences

Posted on October 28, 2009
Arkansas Snoopin' update: Sentences have been handed down in the Little Rock, Arkansas snoopin' case, which involved the brutal murder of Ann Pressly, a Little Rock news anchor. A doctor and two hospital employees were caught accessing the medical records of the victim, and have each been sentenced to a year's probation, plus fines and community service.

EHR Adoption Due to Stimulus Bill

Posted on October 28, 2009
EHR Adoption Due to Stimulus Bill Provisions: Have the EHR provisions in the so-called Stimulus Bill impacted your decision and/or timing about adopting electronic medical records? The folks at SoftwareAdvice are surveying folks to see if the statutory changes caused healthcare providers to take action, or just go looking...

5 Vulnerabilities that Lead to

Posted on October 28, 2009
5 Vulnerabilities that Lead to Identity Theft: Interesting article in InfoWeek's Dark Reading on areas to watch for ID theft. I thought it would be about specific items and behaviors that could pose risks, but it's more global than that. Interestingly, #5 is "Healthcare...

Curb Your Enthusiasm: The digitization

Posted on October 26, 2009
Curb Your Enthusiasm: The digitization of medical records is not the cure-all some claim it will be. As with just about every other component of the health reform debate, nothing will be as good (the public option will end the uninsured problem), bad (death panels will kill grandma), or efficient (cutting fraud and abuse will save $500 billion) as the most vocal proponents/critics say...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.