Law Students

The Implementation Workgroup Testimony. Great post by John Halamka summarizing our current status regarding implementation of the beseline standards required to effectively exchange healthcare data across a number of domains (e.g. ePerscribing, Labs, administrative transactions, etc.). What is encouraging is that these folks have "grokked" the lessons of historically successful standards development initiatives. Here is a gross oversimplification of these lessons:

• Keep the standards lightweight for widespread adoption
• Target the simple use cases first
• Implement early and often

Notice also in John's post he links to an online, government sponsored forum, for achieving widespread collaboration on this work. The is proof that the power behind enabling technologies is starting to permeate government led initiatives, which should be a cause for celebration. President Obama gets it and correctly sums this up in his mantra of: "we don't need big government or small government, what we need is smart government."

John also makes a subtle but important distinction when he states that privacy and security concerns clearly need to be addressed as standards are developed, concurrent with said development, but of the two having the correct privacy policy in place is the more important. Why is that? Let me attempt an answer to this premise. Security, although often non trivial to implement based on the technical complexity, is a problem that has already been solved in other industries, it is an engineering problem. We are good at solving engineering problems (e.g. insert "man on the moon" meme).

A privacy policy, however, is culturally and organizationally complex (i.e. a wicked problem) and historically we have not been so good at solving these kinds of problems. All the really tough problems facing us (and the planet) are wicked problems. We should collectively become more fluent in problem identification because if we don't understand the nature of the problem, we have little hope of solving it effectively or efficiently.

Check out a FREE EHR Checklist. For more information on HITECH / HIPAA Privacy and Security Rules go to The HIPAA Survival Guide website or sign up for Digital Business Law Group's free monthly compliance newsletter.

Note: We will start conducting HITECH / HIPAA Risk Management Webinars beginning in January, 2010 that may also be of interest. These webinars will be managed as a forum of "round-table" discussions on the pertinent issues, with many opportunities for audience participation and questions.