Health Law

Privacy Needed for E-Prescribing

Posted on May 14, 2008
Privacy Needed for E-Prescribing Efforts: The Coalition for Patient Privacy has asked Congress to implement 11 specific measures to make sure that the drive toward electronic prescribing of medications does not lead to the disclosure of patient medical information...

Oklahoma criminal HIPAA violation

Posted on May 14, 2008
Now from Oklahoma: from today's Modern Healthcare Daily Dose news email: Okla. woman faces prison, fine for HIPAA violation A 30-year-old Oklahoma City woman pleaded guilty to one count of a criminal violation of the privacy protection provisions of the Health Insurance Portability and Accountability Act of 1996, according to a news release by U...

UCLA snoopers

Posted on May 13, 2008
It's now up to 68: That's how many UCLA Medical Center staff members have been implicated in the celebrity-PHI-snooping scandal that came about after Britney went wacko.

New OCR Data website

Posted on May 12, 2008
New from OCR: The Office of Civil Rights of HHS, which is tasked with enforcing the HIPAA privacy rule, has a new website where they've put a whole ton of information on HIPAA violations, enforcement actions, complaint receipts, and lots of other information, on a state-by-state basis...

To access this complete feed in the blog feed reader login or register for free.

Sevocity EMR

Posted on May 09, 2008
Sevocity is OK: The Certification Commission for Health Information Technology has certified the EMR system offered by Conceptual Mindworks. Sevocity passed the CCHIT's requirements for security, interoperability, and functionality. And the folks at Conceptual Mindworks are good folks, too -- I've worked with them for years on ensuring that Sevocity meets and exceeds all HIPAA requirements.

video

Posted on May 07, 2008
National HIPAA Summit video: this week's installment: Organizing a Privacy Program.

Identity thiefs use PHI

Posted on May 07, 2008
PHI is a Data Thief's Gold Mine: As this article in USA Today points out, data thieves know that medical information is a good place to find the information they need to steal your identity. There are two branches of this to be aware of: the thieves who get your social security number and other information to set up bogus credit cards and otherwise access your credit and/or accounts for their

New HIPAA Summit video - GLB and HIPAA

Posted on April 30, 2008
New Video Posted: this is a pretty cool feature. The National HIPAA Summit folks have loaded some of their presentations onto streaming video, so you can watch them from the comfort of your computer screen. Here's the latest, featuring hot topics in HIPAA, Gramm-Leach-Bliley and state privacy laws.

UCLA Staffer Lawanda Jackson

Posted on April 29, 2008
UCLA Staffer Charged: Lawanda Jackson, an administrative staffer at UCLA Medical Center, has been charged with selling celebrity medical information to tabloids. More to come.

Access to medical records

Posted on April 29, 2008
Access to Medical Records: For some people, there's not enough access. For certain others (sorry, subscription needed for the WSJ piece), too much. That's the problem with fetishizing "privacy" or "interoperability." There's got to be at least a recognition that there needs to be balance.

Doctor email

Posted on April 23, 2008
Doctor email: Guess what? Most doctors don't communicate with patients via email. I'm not surprised.

UMiami data theft

Posted on April 22, 2008
University of Miami Data Theft: Seems some computer files were stolen from a van belonging to the University of Miami's storage company. However, the data was stored using a proprietary program that basically serves to encrypt the information, so the University feels comfortable that nobody's information is at risk...

Your relatives' DNA

Posted on April 21, 2008
You have the right to remain silent (but your relatives' DNA might testify against you): Interesting case pointed out to me by Theresa Defino at AIS Report On Patient Privacy shows how police are using DNA of relatives of suspects to pin the suspects for crimes...

PHRs for Spimes

Posted on April 21, 2008
PHRs for Spimes: Seattle-based tech lawyer John Christiansen, a solid contributor to the AHLA's Health Information Technology listserv, posted an interesting observation about personal health records last night on the HIT list: I Seem to Be a Spime: Why Nobody Wants EHRs and PHRs How's that for an obscure subject line? Please bear with me; I will explain...

Andrea Smith

Posted on April 17, 2008
Arkansas felony HIPAA conviction: The DOJ took a plea from a 25-year-old LPN for the highest degree HIPAA criminal charge -- disclosing PHI for personal gain. I've corresponded with the husband in the case, and it's not as bad as it seems. Elementally, though, the government's case is solid, if the result is draconian...

Google, Microsoft PHR efforts

Posted on April 17, 2008
A different twist: I've noted here the efforts by some big tech companies, like Microsoft and Google, to get into the personal health record business. They hold and transfer lots of data, so it would make sense this would be a service they'd be in. Obviously, there are privacy issues -- particularly with Microsoft, there's a sense of distrust that they'd do the right thing and resist efforts to

video

Posted on April 16, 2008
This week's HIPAA video: it's on coordinating your privacy and security operations.

Wellpoint Data Breach

Posted on April 16, 2008
Wellpoint Data Breach: Seems health insurer Wellpoint inadvertently exposed some subscriber data to access via internet. There was some health information such as subscription records, but the worst is probably information that could be used for identity theft...

NY Pres Data Theft

Posted on April 14, 2008
New York Presbyterian: Yet another story of a staff member improperly accessing records, but in this case, it's theft rather than idle (idol?) curiosity. He didn't steal medical information, but rather demographic information that could potentially be used for ID theft, and he sold it for 75 cents a name.

UCLA breaches

Posted on April 14, 2008
UCLA Privacy Breaches: someone commented earlier on the post about Britney, and how the doctors weren't punished as harshly as the staff. My suspicion was that the doctors aren't employees, so the hospital doesn't have the ability to punish them as much (for example, the hospital can't revoke their medical staff privileges without giving them a fair hearing)...

HIPAA effectiveness questioned

Posted on April 09, 2008
Is HIPAA Enough? In the wake of the UCLA celebrity-watching debacle, it seems a lot of folks are looking at it and determining that the law isn't strong enough. I say, this looks a lot like the response of knee-jerks who say more gun control would prevent gun tragedies like Virginia Tech...

Kroll study

Posted on April 09, 2008
A New Study: According to a study by Kroll Fraud Solutions, health care industry participants pay so much attention to medical record privacy and compliance that they miss the boat when it comes to patient identity theft. Now, Kroll is in that business, so it's understandable that that's what they'd see; but I tend to agree...

Schwarzenegger

Posted on April 08, 2008
From Modern Healthcare's "Daily Dose" newsletter: Schwarzenegger vows to tackle privacy woes SchwarzeneggerCalifornia Gov. Arnold Schwarzenegger said his administration will work with hospitals to stop patient data security breaches, adding that he is among the celebrities whose confidential records have been breached...

More celebrity sightings (UCLA)

Posted on April 07, 2008
More Celebrity Sightings: Seems Britney wasn't the first UCLA Medical Center patient to suffer a little medical record peek-a-boo. According to this story, at least one "rogue" employee went sniffing into medical records of quite a few celebrities. As Kirk Nahra points out, this is a pretty good opportunity to look at your own access logging practices to see if you have employees peeking where

NPI by May 23

Posted on April 04, 2008
National Provider Identifier: If you're not using an NPI by now, you can't do a HIPAA electronic transaction without it, starting May 23.

New HIPAA video

Posted on April 02, 2008
New HIPAA video: on CHP, CHSS, CHA and other certifications.

Wellness Plans

Posted on April 02, 2008
Wellness Plans: According to this article, they might not be as useful as some people think. Why is this on-topic? Well, one of the potential weak spots for wellness plans (where a company or insurer offers some benefit to employees or beneficiaries who live healthy lifestyles -- since those healthy lifestyles reduce health insurance costs) is the HIPAA non-discriminition rule...

California PHR

Posted on April 02, 2008
California Physician Clinic offers Free PHR to Patients: Bright Health Physicians, apparently in connection with installing an electronic medical record system, will offer an on-line internet-accessable personal health record for its patients. This seems like a good model to push out PHRs to patients -- start with the primary care doctors who will have most if not all of the records for most of

Wal-Mart abandons subrogation claim

Posted on April 02, 2008
Wal-Mart Abandons Subrogation Claim: This story is off-topic, but interesting for healthcare players. A Wal-Mart employee was hurt in a traffic accident. Her insurance through Wal-Mart (that's right, contrary to what you've been told, apparently Wal-Mart DOES provide insurance to its employees) paid her medical bills, which amounted, apparently, to $400,000...

HHS announces enforcement stats

Posted on March 31, 2008
Enforcement so far: From BNA: The Department of Health and Human Services has not imposed any fines for violations of the Health Insurance Portability and Accountability Act's privacy rule, but stricter penalties may be necessary in the future if violators do not voluntarily come into compliance, an HHS official said March 27...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.