Health Law

Health Information Trust Alliance

Posted on November 12, 2008
Health Information Trust Alliance: From the AHLA daily briefings:The Wall Street Journal (11/12) [subscription needed] reports that "a group of large healthcare companies is trying to create a common set of security practices, but it remains to be seen whether they can persuade businesses in the fragmented industry to join their effort...

HIPAA Exam Question: Scenario: Susie,

Posted on November 11, 2008
HIPAA Exam Question: Scenario: Susie, RN, gets a phone call and the caller ID shows it is coming from Jane (a co-worker). Jane asks how an employee can get a pregnancy test done. Susie tells her to go to the lab and the results will be sent to the clinic and then she can come in to see a provider...

Baylor laptop theft

Posted on November 06, 2008
Baylor Health System suffers data loss: A laptop was stolen from the car of a manager of HealthTexas Provider Network, the physician organization within the Baylor Health Care System. The laptop had names and some medical procedure information (CPT codes) for about 7,500 patients, but the data wasn't comprehensive, and apparently contained social security numbers, so Baylor's offering free

Georgia Preemption case

Posted on November 05, 2008
Georgia Courts Rule on Preemption: From BNA: "Defense attorneys wishing to engage in ex parte communications with a plaintiff's treating physicians must comply with the privacy rule under the Health Insurance Portability and Accountability Act, the Georgia Supreme Court ruled Nov...

To access this complete feed in the blog feed reader login or register for free.

Portland VA

Posted on November 03, 2008
Oregon VA error posts personal info online: In a case of open government/open records versus personal privacy, the VA in Portland, Oregon posted some spending information to an online website that allows the public to keep track of government spending...

HHS lax HIPAA enforcement

Posted on October 31, 2008
OIG slaps down HHS for lax HIPAA enforcement: The OIG has sent HHS a letter grading it's HIPAA enforcement activities. Apparently the OIG wants HHS to be more like it, at least in terms of aggressiveness. HHS' mechanism for complaints is good, but they need to investigate more, says the OIG...

California Snoopin'

Posted on October 31, 2008
California Snoopin' update: 1000 patients had their medical records improperly accessed at UCLA Medical Center. Heads should roll.

ACT/AIC Leadership Conference

Posted on October 30, 2008
ACT/AIC Leadership Conference: Below is an email I got from Alan Goldberg, who got it from Tom Evans of KMK Consulting: Earlier this week, I was privileged to join over 250 government and more than 600 IT professionals for the American Council for Technology (ACT)/Industry Advisory Council (IAC) 2008 Executive Leadership Conference in Williamsburg, Virginia...

UPI

Posted on October 30, 2008
UPI Costs and Benefits: The Rand Corporation has a monograph out discussing the benefits to efficiency and quality, and the risks to privacy, of finally migrating to the HIPAA-required Unique Patient Indentifier. We've moved to one number for each payor and one number for each provider, but can't get to the one number for each patient to complete the third leg of the stool...

Kentucky: No HIPAA private cause of action

Posted on October 28, 2008
Kentucky: No HIPAA Private Cause of Action: In Young v. Carran, Ms. Young sued her baby-daddy's law firm for letting him have her psychiatric records. Apparently Young and the daddy Martin were in a child custody fight. Martin got the right for his lawyers to access Young's medical records, but he wasn't allowed to see them...

Aetna and Microsoft's HealthVault

Posted on October 22, 2008
Aetna and Microsoft's HealthVault: Aetna is rolling out HealthVault to its subscribers to use to make their Aetna-internal PHR portable. We'll see how it works. Personally, I tried tinkering around in HealthVault and found it relatively user-unfriendly and non-intuitive (jeez, who'da thunk Microsoft would make a user-unfriendly, non-intuitive product? Vista, anyone [and I don't mean the VA's

Medical Identity Theft and the unique patient identifier

Posted on October 21, 2008
Medical Identity Theft and the Unique Patient Identifier: One of the goals of HIPAA was to increase the digitization and electronification of information. If we standardize the information and computerize it, we'll drive a lot of the inherent inefficiency out of the healthcare industry...

Watch your Excel

Posted on October 17, 2008
Watch your Excel: Some first-year associate at Cleary Gottlieb is probably out of a job because of a formatting error in dealing with Excel. I suspect a software program was used to make the conversion; if they'd just printed out the Excel spreadsheet, reviewed it in hard copy, and used a multi-function device to scan it into pdf format, they wouldn't be facing this problem.

Medical ID Theft

Posted on October 17, 2008
Medical Identity Theft: This is becoming a hot topic; expect some federal legislation, some experts say.

Nevada encryption law

Posted on October 14, 2008
Nevada encryption law: This is the first I've heard of it, but apparently there's a new law in Nevada that requires the encryption of any "personal information" (name + either SSN, driver's license number, or [account number + password]) if it's sent by electronic means other than fax outside the business...

California

Posted on October 08, 2008
More California: more news stories on the new California hospital medical record privacy bureaucracy here and here.

HHS FAQ

Posted on October 07, 2008
Is the Privacy Rule suspended during emergencies? That a frequently asked question that HHS has decided to answer on its website FAQs. The answer is no, but the Secretary can suspend parts, particularly the paperwork-type rules, special-circumstance rules, and rules related to notifying relatives and friends...

California snoopin'

Posted on October 02, 2008
More California: Here's Modern Healthcare's take on it.

WalMart-Dossia

Posted on October 02, 2008
Wal-Mart: It seems Wal-Mart has included electronic personal health records for all its employees as part of its open enrollment process for next year's beneficiaries. Wal-Mart is part of the Dossia consortium of large employers that's trying to make PHRs available to employees and encourage employees to use a PHR to maintain medical information and manage their healthcare.

California Snoopin: Ahnuld signed

Posted on October 01, 2008
California Snoopin: Ahnuld signed the law creating the new state agency to enforce the new hospital medical record privacy law.

employee cell phone cameras MySpace

Posted on September 22, 2008
Cell Phone Cameras: In Albuquerque, 2 UNM Hospital workers took pictures of patients receiving treatment, and posted them on their MySpace pages. Once discovered, they got fired. Good. Seriously, just how dumb is that? The hospital should have a policy prohibiting it, but do you really need an explicit policy not to take pictures of patients and post them on the internet? Isn't that common

OIG guidance re friends and family

Posted on September 16, 2008
Friends and Family: the OIG has issued new guidance for providers to follow when trying to determine when they can provide PHI to friends and family of patients.

media disposal

Posted on September 15, 2008
How do you dispose of old backup tapes? Obviously, you follow your document retention policy. But what should that policy look like? Duration is definitely an issue; there are legal requirements for certain records, business uses, and other reasons to keep them a long time, as well as good reasons for deleting them as soon as possible (legal risks [including simply the cost of responding to

Medical ID theft

Posted on September 10, 2008
Medical Identity theft accounts for 3% of all identity theft cases, according to this article.

Piedmont and Providence: Feds finally

Posted on September 08, 2008
Piedmont and Providence: Feds finally put teeth into HIPAA, according to ComputerWeek. I'm not so sure. So far, nothing's come from Piedmont, except other audits and an attractive government contract for PwC. And Providence was a settlement of a bad (in the sense of being high-profile) data breach, and the penalty amount isn't really enough to scare too many people...

new California healthcare data breach law

Posted on September 02, 2008
New California legislation: From a post to the AHLA Health Information Technology listserv: Here's a summary of the two companion legislative bills; they are all but signed, and will take effect January 1, 2009. The scuttlebutt in Sacramento is that the bills are directly driven by Governor Schwarzenegger's personal interest in their passage, following unauthorized access by UCLA Medical Center

Snoopin

Posted on August 28, 2008
Celebrity Snoopin': USA Today is on the case. The lawyers quoted are right: celebrities have as much right as anyone to the privacy protections of HIPAA, but tabloids aren't responsible or liable for republishing medical information about celebrities...

Britney/UCLA/California snoopin'

Posted on August 27, 2008
Britney Update: More news from California on the "California Snoopin'" problem exposed by the LA Times regarding UCLA Medical Center and celebrity patient medical records. The California legislature has proposed legislation to require hospitals to have plans in place to safeguard medical records from inappropriate viewing, and to set up a state agency to review the plans and fine hospitals up to

Data Breaches in 2008 so far

Posted on August 26, 2008
Data Breach Problem: It keeps getting worse. We've already had as many personal data breaches this year so far as we had in all of 2007, and it's only August.

Health ID Theft

Posted on August 22, 2008
Health Identity Theft: another article. Again, insiders are the most likely culprit.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.