Health Law

New OCR website

Posted on February 10, 2009
New OCR Website: just hours after I sent a link to the old site to a partner of mine, the US HHS Office of Civil Rights (the enforcement agency for HIPAA privacy) has a new website up with information on the HIPAA privacy rule and the Patient Safety Rule.

IOM proposes new privacy structure

Posted on February 05, 2009
IOM: HIPAA is flawed. The Institutes of Medicine had determined that the current privacy regime in HIPAA hinders medical research, and they're proposing a new privacy regime, at least where medical research is involved. They do put their finger on the issue -- best privacy and best healthcare are diametrically opposed, and the problem is finding a good balance.

EMR pushback

Posted on February 05, 2009
EMR's not to everyone's liking: Here's an interesting policy-driven push-back piece on EMRs. Not all they're cracked up to be, and possibly a camel's nose issue.

Off Topic - Kosenske

Posted on February 04, 2009
Off-Topic: Just so you won't think all I do is HIPAA: I've got a couple other things I do, professionally-speaking. Not to mention fishing.

To access this complete feed in the blog feed reader login or register for free.

Stimulus bill HIPAA provision`

Posted on February 03, 2009
Read the Stimulus Bill? OK, I haven't either. But BNA tells me (subscription required) that section 4410(e) grants authority to the 50 states' Attorneys General to enforce the provisions of HIPAA. I don't know if this monster Bill will pass (like I did with the physician-owned hospital provisions in the House version of the SCHIP bill, I suspect it will not pass as written), but if it does, this

Data Breach costs

Posted on February 03, 2009
Another Good Reason to Avoid Data Breaches: the cost. On average, companies pay about $200 per customer record in responding to a data breach. And that's even if nothing bad happens. And if that's not enough: if you're in the healthcare business, you'll lose 6...

Detroit

Posted on January 30, 2009
Detroit Receiving Hospital: An interesting medical record access case is brewing in Detroit. A patient in a psych unit died, and a federally-funded state-appointed advocacy group has sued for access to peer review and other records. The hospital refused, citing privacy restrictions...

Making BAs into CEs

Posted on January 30, 2009
Making BAs into CEs: The sausage is still being made in Washington, DC, but it's looking like the so-called stimulus bill will increase at least some of the existing health information privacy requirements. According to this article, the House version of the bill contains provisions that will impose the same HIPAA privacy requirements that are already applicable to health plans, providers and

Finally, A Reasonable Approach:

Posted on January 27, 2009
Finally, A Reasonable Approach: Or at least that's what it seems at first blush. The Center for Democracy and Technology has issued a paper that proposes a new framework for thinking about patient consent and medical record privacy. I've only glanced over it, but they seem to have hit the nail on the head: the system should assume consent for normal/usual/proper uses, so the delivery,

Surgeon General's family PHR site

Posted on January 14, 2009
HIPAA FAQs for SG's FPHR site (huh?): I mentioned a couple of weeks ago that the Surgeon General is promoting a government-sponsored site for individuals to compile their personal family health histories, sort of a family personal health record (FPHR)...

influential blogs

Posted on January 08, 2009
Am I influential? Someone thinks this blog is one of the top 100 health care policy blogs. Who am I to disagree?

Healthcare IT and Privacy at war:

Posted on December 29, 2008
Healthcare IT and Privacy at war: BNA has a report (subscription required) on some current conflicting letters urging action by the new Congress on healthcare IT and patient privacy. It seems the Confidentiality Coalition is urging Congress to encourage and stimulate spending on healthcare IT, but wants to make sure they don't overdo it with privacy protections that hinder HIT adoption...

FTC report on use of social security

Posted on December 24, 2008
FTC report on use of social security numbers: I've stated over and over, the biggest problem with medical data theft/loss is the fact that the information can be used for fraud, ID theft, or related evils, not that the medical part of the information could be used for any value (other than the California snoopin'/celebrity issues)...

New Hampshire State DHHS data leak:

Posted on December 24, 2008
New Hampshire State DHHS data leak: Here's a data leak story with a special twist: it was the New Hampshire state department of Health and Human Services that inadvertently leaked records of state participants in the Medicare Part D prescription drug benefit plan...

More EMR vs Privacy stuff: As long

Posted on December 24, 2008
More EMR vs Privacy stuff: As long as we're navel-gazing re what the new administration may do with EMRs, it seems HHS has also issued a "framework" for the electronic exchange of PHI. It is HHS' way of trying to note, and strike a balance between, the needs for electronic information interchange as well the countervaling need for privacy and security of the underlying information...

Somewhat off topic: Joint Commission

Posted on December 24, 2008
Somewhat off topic: Joint Commission HIT Safety Alert: The Joint Commission has issues a Sentinel Event Alert to its accredited hospitals, warning them about potential problems caused by the use of certain technologies, particularly things like computerized physician order entry, electronic prescribing, and the like...

HIMSS Blueprint: The Health Information

Posted on December 24, 2008
HIMSS Blueprint: The Health Information and Management Systems Society has published its own "call to action" to offer recommendations and priorities to reform the healthcare system. How? Of course, through better health information technology. Hat tip: Alan Goldberg

Family Medical History: In January,

Posted on December 24, 2008
Family Medical History: In January, the Surgeon General is going to unveil a program that will allow people to record their family medical histories and load them onto a government website, so they could be accessed and used for future healthcare needs of the person recording the information and their family...

Politics and EMRs

Posted on December 24, 2008
New push for EMRs? Some folks (not surprisingly those with an economic interest in such a strategy) are strongly advocating to the new Obama administration that greater use of electronic medical records is a necessary part of any healthcare reform. Of course, that's half the story; what about privacy (of course, the author says stringent privacy protections must be baked in; of course; he even

Colorado cross-entity electronic

Posted on December 24, 2008
Colorado cross-entity electronic PHI file-sharing: Kaiser Permanente and the ER departments at Children's Hospital, Denver Health and Hospital Authority, and UC Hospital, working with the Colorado Regional Health Information Organization (CoRHIO), will share access to lab results, medication history, EKG and imaging studies, and other medical records on 1...

California Snoopin', Cedars Sinai

Posted on December 24, 2008
California Snoopin', Cedars Sinai version: Less an identity theft or tabloid trash story, this time a hospital employee stole patient identifier information and used it to bill insurance companies for phony lab charges for those patients. Also different from earlier California Snoopin' problems, the original access by the employee in this case was legitimate (he worked in the billing department)

Slightly OT: The impending/current

Posted on December 15, 2008
Slightly OT: The impending/current doctor shortage: I have a particular pet peeve that occasionally bubbles to the surface. I think the last time I brought it up was in response to a medical school resident. He was in the age category that HR folks would call a "millenial" -- these are the post-generation-X (and post-gen Y) young adults who are just entering the job market and as a group have a

State health IT efforts

Posted on December 11, 2008
State Health IT Efforts: States are starting to push for health IT, according to the Government Health IT website. Here's a report from the National Conference of State Legislatures tracking the bills passed state by state. What's in store, at the state or federal level? Will subsidies continue (carrots), or will states and the feds (particularly CMS) require adoption of IT, particularly as a

HIPAA Insurance: There was plenty

Posted on December 04, 2008
HIPAA Insurance: There was plenty of talk early on about whether "HIPAA Insurance" would evolve as a form of D&O or malpractice insurance, either to insure against losses and damages for a HIPAA breach by a covered entity or an indemnification or other loss suffered by a business associate who breaches a BA Agreement...

NIST HIPAA security guide

Posted on December 04, 2008
NIST weighs in: This is cool (OK, geeky and long, but still potentially very useful): the National Institute of Standards and Technology has a very important job: they standardize everything, so things work together in industry, commerce, society, etc...

HIPAA and FERPA

Posted on December 03, 2008
HIPAA and FERPA: One of the interesting boundaries of HIPAA is FERPA, the Family Educational Rights and Privacy Act. HIPAA obviously restricts the use and disclosure of Protected Health Information or PHI, which is broadly described as any information about past, present or future health or medical conditions or the payment therefor...

California snoopin guilty plea

Posted on December 02, 2008
California Snoopin' Update: The admin employee at Ronald Reagan UCLA Medical Center has pleaded guilty to a state felony count of accessing confidential information for commercial gain. Apparently, she snooped and sold the information she found to tabloid reporters...

Iowa snoopers

Posted on November 19, 2008
It's not just California: In Iowa, hospital employees snoop, too. One fired, 7 disciplined = a good start. Teach 'em a lesson.

Lawyer survey

Posted on November 18, 2008
Lawyer Survey: Are you a lawyer? Are you being affected by the recession? Well, the ABA Journal wants your input. They are conducting a survey, which you can access here, and they're asking blawgers to spread the word. So, if you fit the criteria, please go fill out the survey.

Six Steps to Insuring Data Privacy:

Posted on November 12, 2008
Six Steps to Insuring Data Privacy: The CIO Blog at InformationWeek has an interesting post outlining six steps for making sure you keep your electronic data private. What's interesting is that the first two are specifically required by the HIPAA Security Rule: you must do a security assessment and risk analysis, and you must appoint a Security Officer...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.