Health Law

Zoom and HIPAA (and encryption)

Posted on April 22, 2020
New article on Zoom and HIPAA.  Fairly accurate but a little alarmist.  And once again, encryption is NOT REQUIRED to be HIPAA compliant; you should always consider encryption in every situation involving data in motion or at rest, but it's merely an addressable standard, not a required one...

More Upcoming Speaking Engagements:

Posted on April 01, 2011
More Upcoming Speaking Engagements: While I'm at it, I'll also be speaking on "Data Security Analysis for Healthcare Providers" for Global Compliance Panel on April 14. I'll be talking about how you analyze your operations for data security, to meet not only the HIPAA requirements but to meet the "meaningful use" rules of HITECH...

New Provider Toolkit: HIMSS and

Posted on March 31, 2011
New Provider Toolkit: HIMSS and MGMA have teamed up to produce a new product to help small clinics and providers meet their privacy obligations. It's called the "HIMSS Privacy and Security Toolkit. Small providers often find themselves stuck without good solutions for privacy and security obligations; most products can be pretty expensive for a small business, so this might be a good solution...

Upcoming Seminar: Just a heads

Posted on March 31, 2011
Upcoming Seminar: Just a heads up, but I will be presenting a web conference next week through Lorman on mental health record compliance. It's a big dollop of HIPAA, with some FERPA, "Part 2" (substance abuse treatment center privacy) rules, psychotherapy note exceptions, and patient release rules included...

To access this complete feed in the blog feed reader login or register for free.

Another Hollywood Data Breach:

Posted on March 31, 2011
Another Hollywood Data Breach: This one with a bit of a twist. It's health data about movie stars, but movie stars of a particular, shall we say, genre.

Often-Overlooked Breach Prevention

Posted on March 29, 2011
Often-Overlooked Breach Prevention Steps: Some pretty good thoughts here. Hat tip: James Brashear of ZixCorp.

Slightly Off-Topic: HIPAA isn't

Posted on March 29, 2011
Slightly Off-Topic: HIPAA isn't the only privacy law that can result in fines if you violate it. Other businesses are required to protect credit card information (under the "PCI" or "payment card industry" rules). A group of restaurants in Massachusetts have agreed to pay a big fine to the Massachusetts AG (what is it about those New England AGs?) for failing to protect credit card information.

Interesting: A group of consumers

Posted on March 28, 2011
Interesting: A group of consumers in California (actually, I'm betting a group of clever lawyers, really) have sued Walgreens for data-mining the patients' prescription information. Apparently, there's a similar suit against CVS in Pennsylvania. Walgreens isn't selling the PHI; they de-identify the information first...

Slightly Off Topic, But Kinda Scary:

Posted on March 27, 2011
Slightly Off Topic, But Kinda Scary: Are you aware of how closely your cell phone is tracking your whereabouts?

Not Yet: For those who asked me

Posted on March 17, 2011
Not Yet: For those who asked me when I thought the HIPAA regs would come out, I was wrong. I had predicted yesterday; no real reason for the prediction, just that it was the middle of spring break, which would have been a good time for HHS to screw us over with a big regulatory dump...

OCR Asks for a Bigger Budget. They're

Posted on March 17, 2011
OCR Asks for a Bigger Budget. They're gonna need it, it seems.

HealthNet Update: Here is HealthNet's

Posted on March 17, 2011
HealthNet Update: Here is HealthNet's press release. There may be less there than first meets the eye. It seems that several server drives have gone missing. IBM is HealthNet's business associate, and could end up being the responsible party. And it's not clear if the drives are lost, stolen, misplaced, or something else...

Interesting Article from Health

Posted on March 16, 2011
Interesting Article from Health Management Technology: Phil Neray points out how healthcare information is vulnerable, and how most healthcare privacy and security folks are concerned about firewalls and improper access, rather than focusing on the damage that "trusted insiders" can do...

Data Breach Stats: There's a lot

Posted on March 16, 2011
Data Breach Stats: There's a lot of discussion on the AHLA HIT list this morning about data breach statistics, some of which I'd like to share. Michael Silhol of HayBoo here in Dallas reports: "At the National HIPAA Summit last week, the OCR reported that there had been more than 14,000 reports of breaches involving fewer than 500 individuals from September 2009 through December 2010...

Medical Identity Theft: I've been

Posted on March 16, 2011
Medical Identity Theft: I've been preaching about the risks of medical identity theft, as opposed to regular (financial) identity theft, for as long as I've been talking about the Red Flags Rule. If you're a physician, you may not be covered by the rule, but it's still a good idea to have an identity theft prevention program, just to protect yourself from having to correct records or refund a

So What? This blog turned 9 back

Posted on March 15, 2011
So What? This blog turned 9 back on March 8th.

HealthNet: has stepped into it

Posted on March 14, 2011
HealthNet: has stepped into it again.Hat tip: Dom again.

State AG's HIPAA School: Of all

Posted on March 14, 2011
State AG's HIPAA School: Of all the HITECH amendments and enhancements to HIPAA, the ones that I think may have the most indellible impact on healthcare providers and health plans are the ones that are likely to increase enforcement activities. There are two in particular that stand to have huge impacts: one allows individuals who are injured by a HIPAA breach to obtain a portion of any fines

Biggest Concern About EMRs: among

Posted on March 11, 2011
Biggest Concern About EMRs: among technology leaders in the healthcare industry, security and privacy is the number one concern when considering EMRs.

Sudden Thought: Does Cignet even

Posted on March 10, 2011
Sudden Thought: Does Cignet even really exist? Two weeks ago, the first ever real HIPAA civil penalty was handed down, and it was HUGE. $4.3 Million. That ain't no party, that ain't no disco, that ain't no foolin' around. Cignet, which I thought was a health insurer, which I've heard described as a hospital system, and which Modern Healthcare says is a company with a health plan and 4

Average Cost of a Data Breach:

Posted on March 09, 2011
Average Cost of a Data Breach: The average cost of a data breach for a US company continues to rise. For 2010, US companies that suffered a data breach spent on average $7.2 MILLION due to the breach. Interestingly, companies that reported quickly actually spent more...

Doing HIPAA Compliance Right: Dom

Posted on March 08, 2011
Doing HIPAA Compliance Right: Dom Nicastro has a nice interview with a California hospital's information security officer on how to do HIPAA the right way.

Red Flags Update: The US Court

Posted on March 07, 2011
Red Flags Update: The US Court of Appeals for the DC Circuit has dismissed the ABA's case against the FTC. As you may recall, the ABA sued the FTC for implying that the Red Flags Rule applies to lawyers as "creditors" because they bill after they provide services...

Stolen Laptops with Unencrypted

Posted on March 04, 2011
Stolen Laptops with Unencrypted PHI: that's probably the biggest HIPAA threat most organizations face. Be particularly cautious if you see this Italian dude lurking around your facility. Of course, that goes without saying.

Delaware Hospital Data Theft: This

Posted on March 03, 2011
Delaware Hospital Data Theft: This time it's Beebe Medical Center in Lewes, Delaware. An employee took a financial report home to work on it. The report was on paper and in the employee's briefcase, and contained patient names, Medicare numbers and social security numbers for a little over 100 people...

Is it a Crackdown? Or just coincidence?

Posted on March 02, 2011
Is it a Crackdown? Or just coincidence? Some folks are starting to notice the seeming increase in HIPAA activity.

Fasten Your Seat Belts: OCR is

Posted on February 25, 2011
Fasten Your Seat Belts: OCR is definitely planning on tightening up HIPAA requirements, as well as ratcheting up penalties. So said Adam Greene at the HIMSS conference.

OCR is OAR (on a roll): Mass General

Posted on February 24, 2011
OCR is OAR (on a roll): Mass General and its physician organization have just agreed to a $1 million settlement with OCR over HIPAA violations stemming from an incident where a Mass General employee left a scheduling chart on a subway train. The records, which were never recovered included names and medical record numbers of HIV/AIDS patients...

4.9 Million Patients suffered data

Posted on February 24, 2011
4.9 Million Patients suffered data breaches in the first year of HITECH, according to this report. Encryption would've solved a lot of those breaches.

Fine and Dandy: More on the Cignet

Posted on February 23, 2011
Fine and Dandy: More on the Cignet fine, from Dom Nicastro. He's also got an article up on business associate agreements and HITECH.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.