Health Law

Oh Where, Oh Where Will the Red Flag End Up (or Down)?

Posted on October 31, 2009
I had an inkling this was going to happen – and, as suspected, the FTC has (yet again) delayed the enforcement deadline date for the health care industry, with the latest deadline date being pushed all the way to June 1, 2010.  Without a doubt, recent developments over the last several weeks have helped spur this latest bump...

Covered Entity Liability for Business Associate Ignorance of Breach under HITECH -- Really?

Posted on October 23, 2009
For covered entities (CEs) who have tight privacy and security measures in place, the breach notification requirements under HITECH (amending HIPAA) might not seem especially onerous.  But what about breaches the CE doesn't know about?  What if the CE's business associate (BA) fails to report a breach of unsecured health information?  What if the BA doesn't even know about the breach?    The Interim Final Rule published by the Office of Civil Rights (OCR), Department of Health and Human Services (HHS) on August 24, 2009 confirms what others doubted when I raised the paranoid-sounding possibility:  "yes, a CE must meet the breach notification requirements and timeline, even when the CE is not responsible for, and does not even know about, a breach...

Governance Considerations from HIT for the Board and Other Hospital Stakeholders - The Need for an IT Champion to Serve as a Link between IT Personnel and Other Stakeholders - Installment 7

Posted on October 22, 2009
This is the seventh installment in a series of blog posts that relate to the governance concerns surrounding developments in HIPAA, HITECH and HIT. For a number of months this series has been emphasizing the importance of establishing a credible and knowledgeable liaison at the governing body and/or senior administrative level to articulate and educate the diverse stakeholders about the new challenges and initiatives in HIPAA and HIT...

Let the Breach Notifications Begin! . . . (in 30 days, or so)

Posted on August 19, 2009
The U.S. Department of Health and Human Services (HHS) announced today in a News Release that it has issued new regulations requiring health care providers, health plans, and other entities (e.g., now also Business Associates) covered by the Health Insurance Portability and Accountability Act (HIPAA), to notify individuals, and in some instances the media and HHS, in the event of a "security breach" of "unsecured" protected health information (PHI)...

To access this complete feed in the blog feed reader login or register for free.

Distressed Hospital Survival Throught HIT?

Posted on August 10, 2009
[Installment 6 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders] On August 4, 2009 the Associated Press reported at http://www.usatoday.com/news/health/2009-08-04-electronic-medical-records_N.htm that Sac-Osage Hospital, a 47-bed hospital in rural western Missouri, 'is borrowing nearly $1 million to pitch its paper medical charts and purchase a state-of-the-art electronic health records  [EHR] system...

Distressed Hospital Survival Through HIT?

Posted on August 10, 2009
[Installment 6 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders] On August 4, 2009 the Associated Press reported at http://www.usatoday.com/news/health/2009-08-04-electronic-medical-records_N.htm that Sac-Osage Hospital, a 47-bed hospital in rural western Missouri, 'is borrowing nearly $1 million to pitch its paper medical charts and purchase a state-of-the-art electronic health records  [EHR] system...

"In The Event That I Can No Longer Make Decisions For Myself, I Wish ..." - Storing Advanced Directives on GoogleHealth

Posted on August 05, 2009
Google Health and National Hospice and Palliative Care Organization's Caring Connections have partnered to allow patients to store and access their advance directives on line.  Advance directives are essentially "directions" that a person gives to their medical professionals about what interventions they wish to have provided or withheld under specific circumstances -- especially in emergencies and at "end-of-life" moments -- when such person can not express those wishes himself or herself...

HITECH Help Is On the Way! August 19, 2009

Posted on July 31, 2009
     Do you need help understanding what to do in light of HITECH's privacy and security changes to HIPAA?  Are you concerned about HITECH's increased penalties for HIPAA violations? Are you struggling to understand what needs to be done under the New Jersey Security Breach Notification Act, and how these state requirements reconcile with the HITECH breach notification requirements?       Join me on Wednesday, August 19, 2009 at 12:00 p...

Should Health Care Providers Bother with Red Flags?

Posted on July 30, 2009
    Yesterday, the Federal Trade Commission (FTC) announced in a News Release that it will further delay enforcement (yet again!) of the "Red Flags" Rule until November 1, 2009.  The News Release states that the purpose of the delay is to give the FTC additional time to redouble its efforts to educate and assist small businesses and other entities about compliance with the Rule and ease compliance by providing additional resources and guidance to clarify whether businesses are covered by the Rule and what they must do to comply...

HIPAA Paranoia Strikes Deep Among Healthcare Providers

Posted on July 29, 2009
Hospitals, physician practices and other healthcare providers continue to misunderstand patients' rights to their own records years after HIPAA's privacy rule took effect. The Los Angeles Times reported on July 27 that the California Medical Board receives many complaints from patients about trouble accessing medical records from doctors: Candis Cohen, a spokeswoman for the board, says physicians and their office staffs frequently confuse details of the HIPAA privacy law and, even with the best intentions of protecting patients' privacy rights and complying with the law, deny consumers access to their medical records...

Relationship of "Meaningful Use" of Electronic Health Records, and the Department of Veterans Affairs

Posted on July 26, 2009
[Installment 5 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders]  This is the fifth in a series of blog posts that relate to the governance concerns surrounding developments in HIPAA, HITECH and HIT.  The other week, two separate and apparently unrelated events occurred on consecutive days with respect to electronic health records ('EHRs') that dramatically underscore the focus of this series...

Relationship of "Meaningful Use" of EHR, and the Department of Veterans Affairs

Posted on July 26, 2009
[Installment 5 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders]  This is the fifth in a series of blog posts that relate to the governance concerns surrounding developments in HIPAA, HITECH and HIT.  The other week, two separate and apparently unrelated events occurred on consecutive days with respect to electronic health records ('EHRs') that dramatically underscore the focus of this series...

Dare to Take-a-Peek? Think Again.

Posted on July 23, 2009
I have said it before, and I will say it again -- employees must come to understand and truly appreciate the huge risks involved and penalties at stake with "taking a peek" at a patient's medical record for no legitimate purpose...

Securing Protected Health Information (PHI)

Posted on July 16, 2009
[Installment 4 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders].  This is the fourth in a series of blog posts that relate to the governance concerns surrounding developments in HIPAA, HITECH and HIT. Over the next several months, my blog entries will continue to discuss some of the threshold issues that face the manifold stakeholders in the hospital industry as they struggle to cope with the new and somewhat uneven landscape of health information technology ('HIT') and protected health information ('PHI')...

Sharing of Electronic Health Records Among Hospitals

Posted on June 25, 2009
[Installment 3 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders] This is the third in a series of blog posts that relate to the governance concerns surrounding developments in HIPAA, HITECH and HIT. Jim Landers of the Washington Bureau of the Dallas News  wrote an article that was published on June 24, 2009, entitled "Administration: Hospitals unwilling to share electronic records will miss out on billions in stimulus funds...

Will Too Much "Meaning" = Not Enough "Use"?

Posted on June 23, 2009
When I first reviewed the Matrix and other documents released by the HIT Policy Committee's 'Meaningful Use' Workgroup, my initial reaction was 'When did defining ‘Meaningful Use' of EHR morph into attempting to use EHRs to ‘meaningfully' reform the entire healthcare delivery system...

Will Too Much "Meaning" = Not Enough Use?

Posted on June 23, 2009
When I first reviewed the Matrix and other documents released by the HIT Policy Committee's 'Meaningful Use' Workgroup, my initial reaction was 'When did defining ‘Meaningful Use' of EHR morph into attempting to use EHRs to ‘meaningfully' reform the entire healthcare delivery system...

"Meaningful Use" Comments Due June 26th

Posted on June 18, 2009
The Office of the National Coordinator for Health Information Technology (ONC) is seeking comments on the preliminary definition of 'Meaningful Use,' as presented to the HIT Policy Committee on June 16, 2009.  Comments on the draft description of Meaningful Use are due by    5:00 pm EST June 26, 2009...

"Meaningful Use" Definition Recommendation Due out June 16th

Posted on June 11, 2009
The HIT Policy Committee is suppose to unveil its recommendations on the definition of "Meaningful Use" of electronic health records (EHRs) on June 16th, reports Health Data Management.  Any approved definition of "Meaningful Use" would then be forwarded to the Office of National Coordinator for further consideration...

Governance Considerations from HIT for the Board and Other Hospital Stakeholders - Twitter and Patient Privacy Rights

Posted on May 26, 2009
This is the second in a series of blog posts that relate to the governance concerns surrounding HIPAA, HITECH and HIT.  It is, however, not the second posting that I had originally planned. A front-page article on May 25, 2009 in the New York Times by Pam Bullock, entitled 'Hospitals Using Internet to Interact with Public,' prompted me to write on this topic as part of the series...

Twitter and Patient Privacy Rights

Posted on May 26, 2009
[Installment 2 - Governance Considerations from HIT for the Board and Other Hospital Stakeholders] This is the second in a series of blog posts that relate to the governance concerns surrounding HIPAA, HITECH and HIT.  It is, however, not the second posting that I had originally planned...

Governance Considerations from HIT for the Board and Other Hospital Stakeholders [Installment 1]

Posted on May 18, 2009
The pressure on healthcare providers to convert to electronic medical records (EMR) as part of the overall HIT movement has increased dramatically in recent months. Promulgations from HHS and FTC, the federal stimulus package and HITECH, which recently heavily-amended HIPAA, create new challenges for healthcare providers...

Putting ARRA Money in the HIPAA/HITECH Enforcement Mouth

Posted on May 18, 2009
In accordance with the 90-day deadline established for an operating plan to be submitted to Congress on expenditures related to the $2 Billion Dollars appropriated under the American Recovery and Reinvestment Act ("ARRA") relating to health information technology ("HIT"), the Office of the National Coordinator ("ONC") has submitted its proposed ARRA Implementation Plan to Congress...

Governance Considerations from HIT for the Board and Other Hospital Stakeholders

Posted on May 18, 2009
[Installment 1] The pressure on healthcare providers to convert to electronic medical records (EMR) as part of the overall HIT movement has increased dramatically in recent months. Promulgations from HHS and FTC, the federal stimulus package and HITECH, which recently heavily-amended HIPAA, create new challenges for healthcare providers...

Fox Rothschild to Participate at NIST/CMS Security Rule Conference

Posted on May 11, 2009
As HITECH refocuses the health care industry's attention on security, the role of National Institute of Standards and Technology ('NIST') in developing standards for health information security will become more center stage.   On May 18, 2009, Fox Rothschild LLP will present at the NIST and CMS Security Rule Conference in Gaithersburg, Maryland called: 'Safeguarding Health Information:  Building Assurance Through HIPAA Security'...

Fox Rothschild to Participate at NIST and CMS Security Rule Conference

Posted on May 11, 2009
As HITECH refocuses the health care industry's attention on security, the role of National Institute of Standards and Technology ('NIST') in developing standards for health information security will become more center stage.   On May 18, 2009, Fox Rothschild LLP will present at the NIST and CMS Security Rule Conference in Gaithersburg, Maryland called: 'Safeguarding Health Information:  Building Assurance Through HIPAA Security'...

A Little Intellectual Property 101 for HIT

Posted on May 08, 2009
Introduction to Intellectual Property As my initial entry to this blog, I would like to provide a high-level overview of U.S. Intellectual Property ("IP') law. This overview will provide background information on the various areas of IP. Future entries will consider how the various aspects of IP effect and are effected by HIPPA/HITECH and the electronic patient record initiatives...

Red Flag Enforcement Delayed to August 1, 2009

Posted on May 01, 2009
This morning, the Federal Trade Commission (FTC) announced it will delay (again) enforcement of the new 'Red Flags Rule,' now until August 1, 2009 to give affected entities more time to comply. In the press release, FTC Chairman Jon Leibowitz said: 'Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further...

Review Health Information Before You Click "Upload to Google Health"

Posted on April 21, 2009
Using Google Health, a free personal health record tool, requires patients to be proactive both in terms of creating their electronic health record (EHR) and in checking the accuracy of the information loaded into the EHR, particularly when it comes from insurance claims data...

HHS Issues Guidance on Security Breach Notification

Posted on April 20, 2009
On April 17, 2009, the federal Department of Health and Human Services (HHS) issued guidance specifying the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals, as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act passed as part of the American Recovery and Reinvestment Act of 2009 (ARRA)...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.