Health Law

Theresa Defino and Dissent "Pogo" Doe, two of my favorite people

Posted on October 20, 2020
Defino and Dissent: If you follow me on Twitter these days, you know I'm not too happy with the sorry performance of the vast majority of American media.  I'm not alone: the American public actually trusts Donald Trump to provide honest information about Covid more than they trust the media to honestly report on it...

Ransomware update: exfiltration is becoming common

Posted on October 20, 2020
 Ransomware update: exfiltration is becoming common: I just read a very interesting article from the Crypsis Group on recent ransomware activity. I'm no techie, so the discussion of TTP's (Techniques, Tactics and Procedures) was a little much for me, but the underlying takeaway was pretty disturbing: about a quarter of all ransomware attacks now also include data exfiltration...

Better prepared for cybersecurity?

Posted on October 15, 2020
Did the pandemic cause the healthcare industry to improve cybersecurity?  Apparently, many cybersecurity professionals in the healthcare industry think so.  

More OCR fines for failure to provide access

Posted on October 12, 2020
More OCR fines for failure to provide access: As I noted earlier, OCR has been on a tear lately, fining covered entities for failing to grant patients access to their PHI.  Last week, they announced their eighth access-related settlement this year, with Phoenix-based Dignity Health's St...

To access this complete feed in the blog feed reader login or register for free.

Answer: Yes, you idiots.

Posted on October 08, 2020
 Why are people asking if HIPAA protects President Trump?  Because the country is overrun by idiots and members of the press (but I repeat myself) who think laws should give protection to people they don't like.  

Louisiana to stop sharing Covid information with First Responders

Posted on October 07, 2020
 There was much talk about this earlier in the pandemic, but it's clear that HIPAA allows covered entities to notify 911 operators and other first responder entities of the identity of covid pateints, so that the responders can protect themselves and others...

More on the Universal Health Services hack

Posted on October 04, 2020
 Apparently all of USH's 250 hospitals were affected by the big malware attack.

CHSPSC breached, fined $2.3 million

Posted on September 28, 2020
 CHSPSC is Community Health System's management service organization, which provides business management, IT, and HIM services to hospitals and physician practices.  That makes them a Business Associate.  They got hacked by an APT from a hacker group in 2014, and the hackers got access to and absconded with PHI on over 6 million patients...

Premera Blue Cross pays 2nd biggest ever HIPAA fine: $6.85 million

Posted on September 27, 2020
 Permera, the biggest insurer in Alaska and Hawaii, suffered a phishing attack that managed to install advanced persistent threat malware, resulting in the breach of PHI of over 10 million people, including social security numbers, bank account numbers, and health informtion...

Athens Orthopedic Clinic gets hacked by The Dark Overlord, gets fined $1.5 million

Posted on September 24, 2020
 I should've noted this Monday when I found out, but news came out this week of a big fine for a HIPAA breach.  Athens Orthopedic first heard from a journalist from www.databreaches.net (that journalist would be my friend, the inestimable Dissent Doe, also known as @PogoWasRight on Twitter) that a notorious hacker group, that goes by the handle TheDarkOverlord or TDO, had access to their patient

Cybersecurity and ransomware are particular problems for the healthcare industry

Posted on September 24, 2020
 A couple of news items from earlier this week point out how cybersecurity and ransomware are particularly problematic for the healthcare industry:Less than half of all large health systems meet national cybersecurity standards.Two-thirds of all healthcare data breaches are caused by hackers...

Chldren's Minnesota and Allina Health caught up in Blackbaud ransomware hack

Posted on September 17, 2020
 Blackbaud is (was?) one of the nation's largest service vendors to charitable institutions, helping them manage their donor lists and fundraising efforts.  They were subject to a ransomware attack that might've hit the mother lode of data, mainly on donors to these charities, but also to some of the beneficiaries and/or customers of the charities...

Updates to the HIPAA SRA

Posted on September 16, 2020
 ONC has announced updates to the Security Risk Assessment framework that OCR encourages HIPAA covered entities to use in conducting their risk assessments.  Remember, conducting a risk assessment is a required Security Rule safeguard; since you gotta do it, you might as well do it right...

Access to PHI (or the denial thereof) is a big OCR priority

Posted on September 16, 2020
 Yesterday OCR announced 5 new settlements involving covered entities that failed or refused to provide patients with access to their PHI, as required by HIPAA.  In addition to restrictions on uses and disclosures of PHI, HIPAA also grants individuals 6 rights with regard to their PHI...

WSJ article: are HIPAA changes coming

Posted on September 14, 2020
 I don't particularly agree either with the premise or conclusion of this WSJ article (probably paywall protected).  HIPAA works very well for what it does.  It's not a all-health-information-gets-privacy law, because that's unworkable and unreasonable...

Asset Inventory as a HIPAA Security Rule exercise

Posted on September 08, 2020
OK, there's no excuse, but I haven't blogged much and I've got a lot of items stacked up in the queue.  One of those is discussing OCR's summer cybersecurity newsletter.But since I've been remiss, let me point out an article by Jackson Lewis on OCR's tips for conducting an IT asset inventory...

ORC's Mobile Health Apps Page

Posted on September 03, 2020
Do you have questions about the HIPAA impact of the use of mobile health apps?  Can you/should you use one?  Which ones to choose?  Is the app provider your business associate?  How does the use of an app implicate your obligations to provide access, amendment, an accounting of disclosures?Well, OCR is actually going to help you out (a little) with a page dedicated to healthcare apps...

2020 OCR Settlement

Posted on September 03, 2020
 Interestingly, as this article by Sidley points out, through the first 3 quarters of 2020, it appears that OCR has only issued 3 major settlements involving HIPAA, all of which involve Security Rule issues.  All involved breaches: one stolen laptop, one hacked email (phishing,I'm sure), and one settlement that could've been avoided if the provider had simply accepted the help OCR offered (see

New Technology Raises Risks of PHI in Images

Posted on August 27, 2020
Interesting article highlighting recent actions by several large radiology organizations.  Recent technological advances have made optical character recognition (OCR) (*uh, not that OCR) more pervasive. This is the technology that allows you to search a PDF for a particular word...

Dental practice hit by ransomware attack not liable for damages

Posted on July 21, 2020
Alabama's Sarrell Dental Center suffered a ransomware attack that affected the records of almost 400,000 patients.  Some patients sued in a putative class action, but a federal judge has dismissed the suit, noting that actual damages haven't been shown since the records were not copied, downloaded or removed...

Part 2 News

Posted on July 19, 2020
Part 2 News: In addition to HIPAA (45 CFR parts 160 and 164), federally supported substance abuse treatment centers must also comply with 42 CFR part 2.  The original purpose of the rule is to prevent substance abusers from refusing treatment out of fear that their treatment records could be used to prosecute them for drug crimes...

Aetna goes after the plaintiff's firms

Posted on July 17, 2020
I haven't been able to read the whole story here (it leads to a Westlaw paid page), but it looks like Aetna wants the plaintiff's firms that caused their big breach (discussed here; it was a really bad one involving HIV information) by using window envelopes...

New HIPAA regs?

Posted on July 06, 2020
HIPAA Changes Coming?  According to Becker's Health IT, HHS is considering new HIPAA rulemaking, impacting two areas.  First, the agency is considering a specific revision to expand the ability to share data for care coordination and case management, presumably to assist ACOs and other integrated (but independent) care providers...

recent data breaches in the news

Posted on June 15, 2020
Today's news brings a couple of actions in recent data breaches. Individual patients of Community Care Physicians in Albany, NY have sued Community's CPA firm, which suffered a ransomware attack that resulted in the data of Community patients being available for sale on the dark web...

Can you contact Covid+ patients to donate blood and plasma?

Posted on June 12, 2020
Can a provider contact patients who have tested positive for Covid-19 and encourage them to donate blood and/or plasma?  The answer is yes, so long as it does not meet the definition of marketing (or if it does, meets an exception).  OCR has just issued guidance specifically on this issue...

Different States Have Different Rules for Sharing Covid-19 Information

Posted on June 05, 2020
Reporting Covid information to first responders: We are starting to see different jurisdictions issue different rules for sharing Covid-19 patient information with first responders.  A few days ago Tennessee announced that it would stop sharing, while yesterday Oklahoma announced that, having stopped, was going to resume sharing...

Question and answer on disclosing Covid-19+ status to dispatchers

Posted on May 15, 2020
Question: Hello Mr. Drummond, I've just read the COSMOS April Privacy Brief by Theresa Defino that cites comments from you regarding the press release issued March 24 on the OIG guidance allowing CEs to share lists of people exposed to or treated for covid with first responder dispatches...

Can providers disclose Covid-19 test results to employers?

Posted on May 12, 2020
In the right circumstances, yes.  The Faegere Drinker health law group has a good explainer here, but the key elements are: Patient gives consent. At the time of service, health care providers can obtain written consent from the patient authorizing the release of COVID-19 testing results directly to his or her employer...

Providing Covid infection PHI to the police

Posted on May 12, 2020
I've been quoted several times by the media about the recent OCR guidance on allowing covered entities to provide Covid-19 infection information to first responders.  There was an article this morning about the state of Tennessee, and its efforts to notify law enforcement agencies of the identity of Covid-19 patients...

Has OCR revised HIPAA? No.

Posted on May 12, 2020
I keep getting this question: during the course of the pandemic, hasn't OCR revised HIPAA to allow a lot of different uses and disclosures that were not permitted before? The answer is No.  What has OCR done?  Well . . .  So, basically there have been 7 different announcements (addressing 6 topics) from HHS/OCR about HIPAA since the pandemic began...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.