Health Law

Patient Records in Dumpsters: This

Posted on October 27, 2010
Patient Records in Dumpsters: This is a problem that doesn't seem to be going away.

Medical Telemetry via Smartphone?

Posted on October 21, 2010
Medical Telemetry via Smartphone? Sprint has an app for its EVO 4G phone that will allow doctors to receive information from hospital monitor information remotely. They say it's HIPAA compliant, but I wonder: is it encrypted somehow? What if the doctor loses his smartphone? If the doctor is in surgery, someone in the OR is probably going to be answering his phone for him; will they have (not

Philadelphia area Breach: Keystone

Posted on October 21, 2010
Philadelphia area Breach: Keystone Mercy and AmeriHealth Mercy health plans lost a flash drive with names, addresses, and PHI of over 250,000 beneficiaries. So far, no evidence that the information was accessed or used, but another good example of why you should encrypt data at rest, and not transport it via mobile devices like flash drives unless you really need it...

Transparency in Health IT: More

Posted on October 20, 2010
Transparency in Health IT: More on Tiger Team's recommendations.

To access this complete feed in the blog feed reader login or register for free.

Armenian Gangsters: Here's probably

Posted on October 18, 2010
Armenian Gangsters: Here's probably the biggest, scariest health care identity theft and fraud case to date. They not only stole Medicare patient's identities, they stole doctor identities and set up fake clinics to generate over $150 million in phony charges.

Electronic Medical Records and

Posted on October 07, 2010
Electronic Medical Records and Privacy Are In Conflict. CNN figures out what I've been saying all along -- there's a dynamic tension between exchange of health information and privacy, and encouraging one disparages the other. The usual suspect appear.

Texas Case Alleges HIPAA Violation

Posted on October 07, 2010
Texas Case Alleges HIPAA Violation as Basis for RICO Claim: A group of Texas retail pharmacies have sued CVS, alleging it uses PHI it obtains from its Caremark pharmacy benefits management business to help CVS steal customers from other retail pharmacies (Caremark and CVS merged in 2007)...

News From HIPAA Summit West (via

Posted on October 07, 2010
News From HIPAA Summit West (via BNA):The HITECH regs generated 550 comments; HHS expects to have a final rule by late this year or the spring of 2011.160 big breaches (500+) reported so far; 8500 small breaches.Hacking accounts for a very small amount of breaches...

Role-Based Access: This has been

Posted on October 06, 2010
Role-Based Access: This has been a HIPAA requirement from day one; only those with a need to know should have access to PHI. But implementation and fine-tuning of access management policies in light of HITECH has raised the profile of the issue. It's definitely a security issue, since many breaches are caused by employees or contractors who perhaps shouldn't have access to the data in the first

Johns Hopkins data theft: A former

Posted on October 04, 2010
Johns Hopkins data theft: A former employees of Johns Hopkins Hospital and 4 accomplices have been indicted for stealing patient identities and securing $600,000 in property through "instant credit" retail transactions.

New York Presby: a tiny data l

Posted on September 28, 2010
New York Presby: a tiny data leak.

Coming Soon (Possibly): a General

Posted on September 24, 2010
Coming Soon (Possibly): a General Federal Data Breach Notification Requirement. Obviously, we've got the HIPAA data breach notification requirement ushered in by HITECH, and many states (California and Massachusetts in the vanguard) have data breach notification requirements as well...

Slightly Off-Topic: RECs. Houston

Posted on September 23, 2010
Slightly Off-Topic: RECs. Houston Neal at SoftwareAdvice is running a survey on the impact of Regional Extension Centers, which are supposed to help physicians adopt electronic medical records. If you have any input regarding RECs, they'd appreciate it.

UPMC employee charged with HIPAA

Posted on September 21, 2010
UPMC employee charged with HIPAA violations: Paul Pepala, a former employee at University of Pittsburg Medical Center's Shadyside Hospital, has been charged with 14 HIPAA violations involving the use of patient names, addresses and social security numbers to generate false tax returns in order to fraudulently obtain tax refunds.

MLK Ambulatory Care Center data

Posted on September 21, 2010
MLK Ambulatory Care Center data breach: A janitor steals medical records and sells them. Sounds like a typical HIPAA horror story. But the janitor didn't steal celebrity records and sell them to the National Inquirer, or accident victim files to plaintiff's attorneys...

How PPACA Impacts Privacy: Apparently

Posted on September 20, 2010
How PPACA Impacts Privacy: Apparently pretty harshly. This story is from The American Thinker, which is pretty conservative. But privacy zealousness isn't really a conservative/liberal thing -- folks on both sides can be pretty extreme about it.

Worried About Snoopers? You probably

Posted on September 17, 2010
Worried About Snoopers? You probably should be, and you might want to consider honeypots if the problem is bad enough.

State Regulators in Action: One

Posted on September 10, 2010
State Regulators in Action: One of the biggest changes wrought by HITECH is adding states' Attorneys General to the short list of authorities who can prosecute HIPAA violations. However, there's never been anything stopping states from instituting their own privacy rules and enforceing them...

I'm torn over whether they should

Posted on September 10, 2010
I'm torn over whether they should have named the violator: Mayo fires a snooping employee. Good for them.

South Shore Boston: I posted on

Posted on September 09, 2010
South Shore Boston: I posted on this a couple of months ago: a hospital sent backup tapes to a vendor to be destroyed, but they got lost in transit. After investigating, the hospital has apparently decided that the missing files pose minimal data breach risk, since it would take specialized equipment to retrieve the data...

Not HIPAA, but a data breach: A

Posted on September 02, 2010
Not HIPAA, but a data breach: A benefits consultant to the state of Delaware accidently posts 22,000 SSNs and DOBs on the state's procurement website as part of an RFP. No names, though.

Ex Parte Communications In Missouri:

Posted on September 02, 2010
Ex Parte Communications In Missouri: The Missouri Supreme Court has held that HIPAA prevents a party in a lawsuit from having ex parte communications with the other party's physicians without the authorization of the individual or some other HIPAA exception...

EHR Certification Companies: To

Posted on August 31, 2010
EHR Certification Companies: To meet the meaningful use rules, you'll need to have an EHR that is certified as being compliant. Who does the certifying? HHS has named 2 companies as qualified to do so: some fly-by-night organization out of Chicago called CCHIT, and an Austin company that you know, as soon as you hear the name, is a good group.

More on the "harm" threshold (and

Posted on August 26, 2010
More on the "harm" threshold (and its possible demise): During this past week, the AHLA "HIT list" listserv has buzzed with commentary on the "harm" threshold (in large part started by the NYT article mentioned here), whether it should even be in there (or is an unconstitutional expansion of the statute beyond the capacity of HHS to enact), and whether it's a good idea even if it can be

IT Contracts: If you are a healthcare

Posted on August 24, 2010
IT Contracts: If you are a healthcare provider, you will likely be buying IT products and services in the very near future (hardware, software, services, etc.). It will also probably come as no surprise to you that the contractors your vendors and sellers will propose to you will actually offer you little or no protection...

End of the "Harm" standard? As

Posted on August 23, 2010
End of the "Harm" standard? As I predicted below, the NYT times implies that the reason the final Breach Notification Rule was pulled from publication is to remove the "harm" standard. Of course, it's a ridiculously editorialized "news" article. Just can't play it straight, can they? Has to be a good Democrat, evil Republican/hospital/insurance company story...

Survey Says: Preventing data breaches

Posted on August 20, 2010
Survey Says: Preventing data breaches is the greatest concern of hospital IT folks as they consider migrating to EMR systems.

I am not surprised: Health Care

Posted on August 20, 2010
I am not surprised: Health Care Data Breaches Lag Other Industries. First of all, health care industry participants already have a culture of privacy that goes back to Hippocrates. They're used to maintaining confidentiality. Also, so much of medical data is useless from a data theft standpoint...

The "Other" HIPAA (transaction

Posted on August 19, 2010
The "Other" HIPAA (transaction and code sets news): I don't usually blog about this part of HIPAA, partly because it is pretty static and boring, and partly because I don't really know or understand the technical nuts and bolts of it. But the "standardized forms" that were generated and are required for use under HIPAA are in for an update (they are going from the the 4010 series of standard

Tiger Team Report Out: The HIT

Posted on August 19, 2010
Tiger Team Report Out: The HIT Policy Committee's "tiger team" has published some recommended privacy and security policies in connection with the federal government's EMR push.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.