Health Law

Can You Hear Me Now? $4,300,000!!OCR

Posted on February 22, 2011
Can You Hear Me Now? $4,300,000!!OCR has issued a civil penalty for a series of HIPAA violations by Cignet Health of Maryland. Cignet apparently refused to turn over protected health information to individuals when they requested it. 41 separate complaints came from 41 different individuals...

Guest Post: Occasionally other

Posted on February 21, 2011
Guest Post: Occasionally other bloggers ask if they can cross-post on the HIPAA Blog. The following guest contribution was submitted by Jamie Davis, who specializes in writing about masters degrees. Questions and comments can be sent to: davis.jamie17@gmail...

The Doctor will Tweet You Now:

Posted on February 21, 2011
The Doctor will Tweet You Now: Not really; hopefully no doctors actually tweet with or regarding patients, at least not regarding patient-physician issues. Most doctors who tweet do discuss medicine, but not specific patients.

Cloud Computing and Security: I

Posted on February 16, 2011
Cloud Computing and Security: I attended a presentation yesterday on cloud computing for businesses, and came away feeling a little less panicked about the issue of security with cloud computing, mainly because the cloud computing folks know it's an issue even though cloud infrastructure itself doesn't address it...

To access this complete feed in the blog feed reader login or register for free.

Healthcare Social Media Sites:

Posted on February 16, 2011
Healthcare Social Media Sites: A recent report analyzed a handful of social media sites designed for diabetes sufferers, and found that they lacked quality control of the information provided, as well as privacy and security of personal information. So be careful out there, those bloggers and twitterers aren't covered by HIPAA (well, most of them aren't).

Half of all Americans Concerned

Posted on February 15, 2011
Half of all Americans Concerned about Medical Record Security: Or as this article says, "only" half are. More are concerned about security relating to their social security number, banking data, and general contact information. Of course, medical records often contain the first and third areas of concern...

The Bronx: A big data breach in

Posted on February 14, 2011
The Bronx: A big data breach in the Bronx. The story doesn't make clear what medium the data was in when it was stolen, but it seems to be a vendor's fault. Who leaves a van full of data unlocked and unattended in New York City?

Homeland Security: This is interesting,

Posted on February 13, 2011
Homeland Security: This is interesting, from the standpoint of understanding how your favorite government handles sensitive personally identifiable information. Obviously, HHS is going to deal with a lot of sensitive information, so their guidelines are useful...

OT: Connecticut Facebook Case.

Posted on February 13, 2011
OT: Connecticut Facebook Case. Slightly off topic, but I occasionally speak on social media issues. Healthcare entities should have policies and procedures for dealing with social media, both from the standpoint of how the entity uses or allows the use of social media in the active operations of the entity (having a Facebook page) and how employees use social media while on the clock (whether to

Current state of Data Breaches:

Posted on February 11, 2011
Current state of Data Breaches: there have been a lot reported to HHS.

Accounting Rule is Coming: There

Posted on February 11, 2011
Accounting Rule is Coming: There was a lot of buzz in the HIPAAsphere yesterday about the announcement by OMB that HHS was about to publish a rule relating the the obligation of Covered Entities (CEs) to account for disclosures of PHI, as changed by HITECH...

I'm number 1: At least according

Posted on February 10, 2011
I'm number 1: At least according to this survey. What's that phrase about "faint praise"?

San Fran Medi-Cal Data Breach:

Posted on February 09, 2011
San Fran Medi-Cal Data Breach: a disgruntled employee sent beneficiary records to her home computer, 2 lawyers and 2 union representatives. The data wasn't really medical in nature, but did have SSNs. And since it came from MediCal records, it's still PHI, so it's still a HIPAA breach.

Medical Identity Theft (non-Red

Posted on February 09, 2011
Medical Identity Theft (non-Red Flags): the FTC has issued an FAQ page relating to medical identity theft, directed primarily at providers and insurers. It's a pretty worth-while effort, and I'd recommend you review it.This gives some good examples of what can go wrong with medical identity theft...

Good advice from Dom Nicastro:

Posted on February 08, 2011
Good advice from Dom Nicastro: snooping is the most likely cause of your next data breach, and your own employees are the most likely culprits.

Keep up the good work: Iowa hospital

Posted on February 04, 2011
Keep up the good work: Iowa hospital fires 3 for snooping. Looking at medical records of a group of Iowa football players who are suffering from a mysterious muscle disease. The best way to prevent snooping is to swiftly and vigorously punish those who fall to that temptation.

Meaningful Use and Expedited Adoption

Posted on January 26, 2011
Meaningful Use and Expedited Adoption of HIT: Anthony Guerra has a very interesting article on HIT adoption for purposes of meeting the meaningful use rewards. His point is that, by requiring the specific elements and the speed at which HIT systems must be adopted, ONCHIT is setting up many hospital and health systems for failure...

Vermont: It's not just Connecticut

Posted on January 26, 2011
Vermont: It's not just Connecticut that has an AG going after HealthNet. Vermont has fined HealthNet $55,000 for failing to protect a hard drive with medical data on it.

EMRs and iPads: Unless you've been

Posted on January 20, 2011
EMRs and iPads: Unless you've been under a rock for the last year or so, you know that the iPad is the current cutting edge in mobile computing. But so far, it doesn't seem that EMR vendors are moving very quickly to develop iPad apps that connect their EMR technology with iPad users.

Psychotherapy Notes: tomorrow in

Posted on January 17, 2011
Psychotherapy Notes: tomorrow in LA (I think) and across the internet, HHS is hosting a webinar to discuss whether test data should be included in the definition of "psychotherapy notes" under HIPAA. Psychotherapy notes get special treatment under HIPAA; the patient doesn't have access to them as part of an individual's right to access their medical records, and they are subject to some other

Off Topic: Rich Doctors: One of

Posted on January 17, 2011
Off Topic: Rich Doctors: One of my least-favorite gripes about the US healthcare system is how doctors are greedy and make too much money. Do you want the best and brightest to become doctors? If you're at the head of your class, why go to medical school (and residency and fellowship etc...

Well Done!! University Medical

Posted on January 12, 2011
Well Done!! University Medical Center in Tucson fired 4 personnel for improperly accessing medical records, apparently of those injured in the Tucson shooting spree. No time wasted, no explanations requested or offered. Just fired. That's the right thing to do...

Rowan Regional Medical Center,

Posted on January 10, 2011
Rowan Regional Medical Center, North Carolina: this hospital was investigated by OCR for a potential HIPAA violation. OCR did not find a violation, but the hospital has required the personnel involved to undergo more HIPAA training. The individual is going to sue the hospital, and the personnel, apparently...

Facebook posting: A nurse in east

Posted on January 06, 2011
Facebook posting: A nurse in east Texas claims she was fired in retaliation for her complaints that other staff and physicians posted photos of sedated patients on their Facebook pages. If true, it would be hard to argue that posting a photo of a patient's face was not a disclosure of PHI, if there was any indication that the individual was a patient...

The Doctor will Skype you now:

Posted on January 06, 2011
The Doctor will Skype you now: Telemedicine comes to the masses, thanks to videochat technology like Skype. Frankly, this is a lot less troubling than doctors texting or emailing, since there's no retained packets of information. I don't know if/how Skype or other transmitters might encrypt signals, or how important that might be anyway, since intercepting and snooping on a Skype feed looks a

Reportable Data Breaches: How many

Posted on January 05, 2011
Reportable Data Breaches: How many big HIPAA breaches have there been? As of today, 217 separate breaches of data involving over 500 individuals have been reported to HHS, involving over 6.3 million individuals. There might be some overlap there, but I'd suspect well over 6 million individuals have had their PHI breached in the 15 months...

Top Trends for Health Information

Posted on January 05, 2011
Top Trends for Health Information Privacy: The InfomationWeek offshoot "Dark Reading" contacted some health information privacy folks to get their preditions for the near future. As you might expect, they expect some bad things to happen.Here's their "top 7 trends...

What to expect in 2011: Look for

Posted on January 04, 2011
What to expect in 2011: Look for some new/final HIPAA regs in March. At least that's when they are due, and that's what HHS spokesmen have been saying.

Doctors and Facebook: The Wall

Posted on January 03, 2011
Doctors and Facebook: The Wall Street Jounal takes up the debate.

Is a medical marijuana dispensary

Posted on January 02, 2011
Is a medical marijuana dispensary a "covered entity"? If so, this is a pretty bad HIPAA breach.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.