Health Law

NIH comment site

Posted on June 30, 2009
NIH comment site: The National Institutes for Health have responded, in a way, to the report by the Health Privacy Project of the Center for Democracy and Technology on the need for better de-identification of PHI when it's used in research or for putlic health by setting up a comment site where interested participants can discuss the matter.

Physician email: as more and more

Posted on June 30, 2009
Physician email: as more and more payors agree to pay for it, doctors are conducting more online communications with their patients. But you better have a secure connection and use encryption technologies.

Arkansas Snoopin': Two hospital

Posted on June 30, 2009
Arkansas Snoopin': Two hospital employees and a staff doctor have been charged with illegally accessing patient records in the case of a Little Rock news anchor who was brutally murdered. The case is in Federal court, but the article does not indicate whether the charges are being brought under HIPAA or some other statute...

HIPAA Sanctions Policy: As noted

Posted on June 29, 2009
HIPAA Sanctions Policy: As noted here, HITECH reiterated and refined the tiered penalty structure of HIPAA itself, and it's probably a good idea for every covered entity to have a tiered sanction policy for employees, staff and others who violate HIPAA...

To access this complete feed in the blog feed reader login or register for free.

Wired Patient Rights: I absolutely

Posted on June 23, 2009
Wired Patient Rights: I absolutely agree with this: ". . . informed, motivated patients must play a much greater role in managing their own health if the policy goals of improving the quality of care and curbing costs are to be achieved."More individual responsibility will be the greatest, if not the only, driver of improvements to the healthcare system...

Business Associates: Interesting

Posted on June 23, 2009
Business Associates: Interesting article on the issues HITECH have raised regarding business associates. Two interesting points: "many" experts think business associates won't be ready to comply directly with HIPAA, and some covered entities don't even know who all their BAs are...

Healthcare Reform

Posted on June 18, 2009
Healthcare Reform: This is a little off-topic, but not too far. I'm often asked what I think about the various health reform proposals. I haven't had a chance to draft out my ideas and issues on health reform, despite promising several folks I would do so...

Physician Data Breaches: According

Posted on June 17, 2009
Physician Data Breaches: According to the AMA, physicians have an ethical duty to report electronic medical record breaches to affected patients.

Cedars Sinai

Posted on June 16, 2009
Cedars Sinai employee steals data, goes to jail. Jessica Hardwick didn't tell me about this.

social media

Posted on June 15, 2009
Social Media and Healthcare: I'll be speaking in a few hours on the legal implications of using social media and Web 2.0 platforms for marketing healthcare services, but noticed this timely report from the Pew Research Center. 61% of adults do internet research for healthcare purposes...

4 HITECH areas to act on now: It's

Posted on June 15, 2009
4 HITECH areas to act on now: It's hard to say what you should be doing specifically without regs being issues, but these are all good points.

Red Flags FAQ

Posted on June 12, 2009
Red Flags FAQ: The group of federal regulatory agencies (the FTC and a bunch of financial regulators like FDIC) who put out the Red Flags Rule have issued FAQs. I've skimmed but haven't read them yet; however, I wanted to pass this along anyway. There's nothing specific about physicians or other medical providers.

Hawaii case

Posted on June 11, 2009
One Year in Jail: a woman who works at a medical clinic accesses her friend's sister-in-law's medical records (because the friend and sister-in-law are fighting) and finds out the sister-in-law has HIV/AIDS. The woman posts that info on her MySpace page...

Online enrollment required: Under

Posted on June 11, 2009
Online enrollment required: Under the health reform packages being considered, all health plans will have to have online enrollment. At least that's the part of healthcare reform you'd expect InformationWeek to find newsworthy.

Ross Martin

Posted on June 08, 2009
Ross Martin, M.D.: Holy. Freakin. Cow. This is amazing. And all you need to know about HITECH.

Creepy story from Sears.

Posted on June 04, 2009
Creepy story from Sears.

CVS

Posted on June 02, 2009
CVS: You may remember that CVS got tagged with a $2+ million fine for failing to protect patient data (mainly, they dumped records). Now, they've announced some of their plans to improve their operations and better protect the information. Of course, shredding is a big part...

New Advertiser

Posted on June 01, 2009
New Advertiser: please welcome my new advertiser, AIG Direct Health Insurance. If you're looking for an individual insurance policy, this is a good place to go.

Testy, testy: CCHIT is accused

Posted on May 29, 2009
Testy, testy: CCHIT is accused of whoring for HIMSS, which is accused of whoring for tech vendors. Personally, I think that's an unfair indictment of both organizations. HIMSS is made up of tech pros; it's obviously influenced by tech vendors, since many of the tech pros work there and the rest deal with those vendors and their products...

AEtna Web Site Hacked: 65,000 people

Posted on May 28, 2009
AEtna Web Site Hacked: 65,000 people offered credit monitoring: It's a job application website, not medical records, so not exactly a HIPAA issue.

UNC + IBM = improved quality?

Posted on May 28, 2009
UNC + IBM = Improved Quality? That's what they're hoping for.

Tenet Florida employee medical record theft

Posted on May 27, 2009
Tenet Employee Caught Stealing Medical Records: Your basic identity theft/credit card fraud case. But since it involves medical records, HIPAA is implicated, and the story indicates that the duo will be charged with criminal HIPAA violations. Under the original DOJ guidelines that say employees can't violate HIPAA (the thief was a records tech, not a nurse or other specialty that might be

HIPAA enforcement under the HITECH

Posted on May 26, 2009
HIPAA enforcement under the HITECH Act: The HITECH provisions in the so-called stimulus bill revise HIPAA and add additional enforcement powers, but how will they really be enforced? We'll have to wait for regulations, but in the interim, the Office of the National Coordinator for Health Information Technology has issued a white paper indicating how it will carry out the new enforcement powers.

Tips for catching snoopers

Posted on May 22, 2009
Tips for Catching Snoopers: This is a pretty useful little article. Bottom line: use honeypots to catch those who are inclined to snoop before they actually snoop on something important. You don't know if your next patient is going to be the Octomom, so you don't know which files to more closely guard...

Data Breach, But No Proof of Damages:

Posted on May 21, 2009
Data Breach, But No Proof of Damages: I just saw an interesting case out of Iowa (via BNA, subscription required), Doe v. Central Iowa Health System, Iowa, No. 07-1017, 5/15/09, where an employee/patient who had attempted suicide sued several hospitals and other providers over improper access to his medical records by coworkers...

Red Flags Rule

Posted on May 18, 2009
Red Flags Rule: I've noted below and in eBriefs that healthcare providers are expected by the FTC to comply with the Red Flags Rule and adopt identity theft prevention programs. You have until August 1 to do so.

Octomom Snooping Case

Posted on May 15, 2009
Octomom Snooping Case: Kaiser hospital fined $250,000 for failing to prevent employees from snooping. Frankly, that seems unfair; the hospital acted pretty quickly to punish the snoopers. . . .

Scare Force One -- NOT

Posted on May 13, 2009
Totally off topic: Here is the antithesis of the "Scare Force One" fiasco.

Johns Hopkins insider data theft

Posted on May 13, 2009
More Insider Data Theft: this time, it's Johns Hopkins. Again, the HIPAA issue here is not the medical aspect of the information, but the demographic part that's useful for identity theft.

Securing against the Inside Job

Posted on May 11, 2009
Securing Against the Inside Job: Most of the security focus baked into HIPAA relates to protecting the PHI you send, use and maintain focuses on outside threats. The Virginia prescription drug hacking case is a good recent example. But, where is your biggest threat? It's not so much an outsider; most cases of data loss due to outside actors are laptop and pda thefts, or office break-ins.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.