Health Law

Health IT Hacking: Apparently,

Posted on January 28, 2010
Health IT Hacking: Apparently, attempts by hackers to attack healthcare entities increased dramatically in the last quarter of 2009.

Encryption: Since the new data

Posted on January 27, 2010
Encryption: Since the new data breach rules contain a strong push toward using encryption (only breaches of "unsecured" data need be reported, and encryption is the only recognized security operation), the question is occasionally raise about whether one sort of encryption is "enough" to qualify...

Latest Data Breach involving ambulatory

Posted on January 27, 2010
Latest Data Breach involving ambulatory hardware: Methodist Hospital in Houston had a laptop get up and walk away. Apparently the laptop, which was connected to a piece of diagnostic equipment, had information on about 700 patients, including social security numbers (which, I'm pretty certain, Methodist used as patient identifier -- maybe worth thinking about a different identifier).

More on Doctors, email, and the

Posted on January 27, 2010
More on Doctors, email, and the Internet: Also, consider this: most patients use the internet to get medical information, and if they leave the doctor's office unclear about the information they've received, they'll probably look it up online. Should the doctor be available by email to help? Maybe...

To access this complete feed in the blog feed reader login or register for free.

Physician texting and emailing:

Posted on January 27, 2010
Physician texting and emailing: I occasionally get questions about whether physicians should use email and/or text messaging to transmit PHI (usually in the context of physicians consulting with each other over a mutual patient), and my usual response is, "if you do, don't use patient names and otherwise de-identify as best you can...

National Data Bank: David Brailer,

Posted on January 27, 2010
National Data Bank: David Brailer, Obama's healthcare IT czar, is apparently rethinking the idea of a single national health information exchange, switching the focus away from a single repository to anything that will get practitioners to share health information (locally, regionally, or otherwise)...

Social Media: Most hospitals use

Posted on January 26, 2010
Social Media: Most hospitals use it. Few do it well.Want to find out how to do it better? Attend this.

FTC Healthcare Data Breach Notification

Posted on January 15, 2010
FTC Healthcare Data Breach Notification Forms and Other Information: The so-called Stimulus Bill didn't just add breach notification requirements to HIPAA covered entities, it also required the FTC to get involved. The FTC has published this information for web-based business that deal with health information...

Tennessee Blue Cross Blue Shield

Posted on January 14, 2010
Tennessee Blue Cross Blue Shield Data Theft: It's not just in Connecticut that hard drives get stolen. It's also happened in Tennessee. 57 hard drives were stolen, containing personal information on as many as half a million people. Encryption anyone? You've gotta start thinking about it, across the board, for data at rest.

Free Webinar: on the state of healthcare

Posted on January 14, 2010
Free Webinar: on the state of healthcare privacy in the US. Not an endorsement, just for your informatin.

Privacy Links: A huge hat-tip to

Posted on January 13, 2010
Privacy Links: A huge hat-tip to Walter Suarez at Kaiser for posting about this on the AHLA HIT list:State laws on requirements of providers to give patients acces to medical records.State laws on patient permission for disclosure of records.State laws on releasing clinical lab results...

Things to add to your "to do" list

Posted on January 13, 2010
Things to add to your "to do" list before February 17: You can make this a 12-step program by repeating Step 5 six times. Actually, once you get the process started, it's not particularly legal-intensive. It's just chasing paperwork.

Meaningful Use: I still haven't

Posted on January 13, 2010
Meaningful Use: I still haven't waded fully into this swampy pond, but if you're wrestling with "meaningful use" and the new regulations (you must be a meaningful user of EHR technology to get stimulus money and/or to not be penalized later), this might be a pretty handy chart to tell how you're doing and where you need to focus...

Connecticut data breach: The Connecticut

Posted on January 13, 2010
Connecticut data breach: The Connecticut Attorney General is first out of the gate in using the new delegation under HITECH to directly sue a covered entity for a HIPAA violation. HealthNet lost a computer hard drive with unencrypted patient names and social security numbers...

Top 50: This blog is mentioned

Posted on January 13, 2010
Top 50: This blog is mentioned as a "top 50" blog for hospital administration and business.

Social Media Policy: Interesting

Posted on January 12, 2010
Social Media Policy: Interesting article on the increasing use of social media by businesses, and the implementation of policies related thereto. Particularly interesting are the sidebars about legal risks. Your social media policy should really be an extension of your HIPAA and other employee communication policies; social media isn't a different thing, it's a different way.

California Snoopin: Former UCLA

Posted on January 10, 2010
California Snoopin: Former UCLA researcher pleads guilty to 4 criminal counts of violating HIPAA. The Chinese national was accessing patient records of famous people, apparently over 300 times.

Changing your NoPP? As you know,

Posted on January 08, 2010
Changing your NoPP? As you know, the original Privacy Rule requried covered entities to adopt a "Notice of Privacy Practices" to tell patients (or beneficiaries if you're a health plan) how they plan to use and disclose the individuals' PHI. You get this sheet each time you go to a doctor for the first time (it says, almost always in caps and usually bold, "THIS NOTICE DESCRIBES HOW MEDICAL

"Meaningful Use": HHS published

Posted on January 08, 2010
"Meaningful Use": HHS published regulations outlining what they mean when they say providers must be "meaningful users" of electronic health records to get stimulus money and avoid penalties. I haven't really dug into them yet, and I'm not sure I will, but I can tell you that they haven't been particularly well-received...

Is this a HIPAA breach? Governor

Posted on January 07, 2010
Is this a HIPAA breach? Governor tweets that he's looking forward to legislature's suggestions for cutting costs. A worker at a state university hospital tweets back, "schedule regular medical exams like everyone else instead of paying [university] employees overtime to do it when clinics are usually closed...

Snoopers, Hackers and Lax Policies:

Posted on January 05, 2010
Snoopers, Hackers and Lax Policies: the three biggest (or at least highest-profile) breach areas of 2009, and how to address them in 2010.

Assessing HIPAA risks in a post-HITECH

Posted on January 05, 2010
Assessing HIPAA risks in a post-HITECH environment.

Short HITECH-HIPAA Checklist for

Posted on January 04, 2010
Short HITECH-HIPAA Checklist for the New Year:Put together a breach notification policy.Update your business associate agreement form.Find all your existing business associate agreements and update them.Educate your staff about HITECH.Encrypt if you can, or at least where you can...

Off Topic/Health Reform: Paging

Posted on January 01, 2010
Off Topic/Health Reform: Paging Lee Aase. One of the Mayo's Arizona clinics will stop taking new Medicare patieints. Why? It pays too little, and they lose money providing the care. Keep this in mind as health reform and the public option continue to be discussed...

User Authentication: With HITECH

Posted on December 28, 2009
User Authentication: With HITECH adding new emphasis on HIPAA, particularly security issues that can prevent a data breach (or at least the reporting requirements), many covered entities are re-thinking their need to encrypt PHI. That's now a very good idea, even if it's costly or a hassle...

Pretty Interesting: Or scary.

Posted on December 23, 2009
Pretty Interesting: Or scary. The 9 Coolest Hacks of 2009.

New Hampshire: Wentworth-Douglass

Posted on December 17, 2009
New Hampshire: Wentworth-Douglass Hospital in Dover, NH is hip-deep in an apparent data breach problem. As noted here, someone was improperly accessing data in the hospital's pathology records and changing the information. The hospital investigated the breach and notified doctors whose patient's records were accessed, but did not notify the patients...

Off Topic (purchasing health insurance):

Posted on December 17, 2009
Off Topic (purchasing health insurance): I got a tip to this survey from a reader. Are you purchasing insurance in the individual market, or on behalf of a small employer? You might want to look at this survey; I suspect the sellers of health insurance are aware of how this information changes hands and is used by purchasers of insurance.

Red Flags

Posted on December 16, 2009
Red Flags Update: In case you haven't looked lately, check out the FTC's Red Flags Rule page, where there are several click-through programs, including a video program and the template for low-risk businesses. I'm on a conference call right now with an FTC person, and her unofficial feel is that the reason for the latest delay is to allow the FTC to decide how to respond to the ABA case and

UCSF Data Breach: Apparently, there

Posted on December 16, 2009
UCSF Data Breach: Apparently, there was a successful "phishing" incursion into the records of about 600 University of California - San Francisco patients. The data was accessed because a USCF Medical School physician inadvertently disclosed his user name and password in response to a phony email asking for the information (the typical "phishing" attack)...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.