Health Law

Wisconsin breach: The old "stolen

Posted on December 21, 2010
Wisconsin breach: The old "stolen laptop" scenario has caused a data breach at Dean Health System and St. Mary's Hospital in Wisconsin. 3288 patients are involved. I'm suspecting the data was scrubbed off of the computer, but it's still a breach (since the data apparently wasn't encrypted).

Christmas Lists: What's on your

Posted on December 21, 2010
Christmas Lists: What's on your HIPAA Christmas Gift List?

Red Flags: Here's more on the

Posted on December 20, 2010
Red Flags: Here's more on the Red Flags Rule changes to remove most doctors from the definition of "creditor." Dom Nicastro tells me that President Obama signed the bill into law on Saturday.

Great HIPAA Story: My dear friend

Posted on December 17, 2010
Great HIPAA Story: My dear friend Karen Pyatt phoned this afternoon with an awesome HIPAA story that I just have to share. A woman in her office ordered an item from a company that sells glass products, ornaments, and decorative pieces. The order arrived, packed in a box, with roughly-shredded paper protecting the fragile glass cargo...

To access this complete feed in the blog feed reader login or register for free.

Doctors on Facebook: I don't think

Posted on December 16, 2010
Doctors on Facebook: I don't think these findings are surprising, and would apply to US doctors at least as much as to French ones.

Sometimes the Regulators Screw

Posted on December 16, 2010
Sometimes the Regulators Screw Up, Too: The California Department of Public Health used the mail when they should've used a private courier, and lost some data. I wonder how much they're going to fine themselves.

Mesa, Arizona data breach: Mountain

Posted on December 15, 2010
Mesa, Arizona data breach: Mountain Vista Medical Center has lost a bunch of data cards with patient identifying information and images of endoscopy procedures. No social security numbers or credit card numbers, so it's not much for ID theft purposes...

The Security Risk of the Common

Posted on December 15, 2010
The Security Risk of the Common Copier: Most copy machines these days store images of the documents they copy. If those documents contain PHI, there's a risk that someone could access the storage and obtain the PHI, especially when the copier changes hands...

Get Ready, 2011 To Be A Big Year

Posted on December 15, 2010
Get Ready, 2011 To Be A Big Year for HIPAA/HITECH Regulations? I saw this on BNA yesterday but didn't want to post to it because it's subscription only, but now Dom Nicastro has noted that an Office of Civil Rights presenter at the ONC Update conference stated that sometime next year, OCR will simultaneously publish the breach notification, enforcement, and HIPAA/HITECH privacy and security

Confusion persists over the FDA's

Posted on December 14, 2010
Confusion persists over the FDA's social media rules.

Red Flags: OK, today's earlier

Posted on December 10, 2010
Red Flags: OK, today's earlier post shamed me into actually looking at the "Red Flag Program Clarification Act of 2010" (the Clarification Act) to see if it really did what it said it did. On my first read of it, I thought they revised the wrong definition, particularly when I looked at the regulations implementing the Rule (16 CFR 681 for non-banks)...

Medical Indentity Theft: OK, so

Posted on December 10, 2010
Medical Indentity Theft: OK, so Congress passed and the president signed (I think) a law revising the Red Flags Rule to make it inapplicable to doctors, lawyers, accountants, etc. At least that's what the legislators say it does; I haven't really reviewed it to see if it really does what they say it does (I know, I know, I've been busy), but that's definitely the congressional intent...

Federal Employee Health Data: this

Posted on December 06, 2010
Federal Employee Health Data: this should drive the privacy folks crazy.

Red Flags Update: The Senate has

Posted on December 02, 2010
Red Flags Update: The Senate has unanimously passed the Red Flag Program Clarification Act, which establishes a definition of "creditor" that will reduce the likelihood that doctors, lawyers, accountants, and others who are paid after they provide services, rather than before, are subject to the Red Flags Rule...

Data Breach Reports: Dom Nicastro

Posted on December 02, 2010
Data Breach Reports: Dom Nicastro notes that the pace of data breach reports to OCR (those involving 500 or more people) has increased since the summer.

Doctor sues patient who complains

Posted on December 01, 2010
Doctor sues patient who complains online. Not the first one (Booth Eye Care and Laser Center in North Texas has done the same), but not very common.

Role-Based User Access to PHI:

Posted on December 01, 2010
Role-Based User Access to PHI: HITECH has both raised the stakes and provided an opportunity to review and reassess HIPAA compliance generally. Additionally, the "meaningful use" rules coming down the road for electronic medical records should spur healthcare providers in particular to increase their use of EMRs; this should also trigger a re-evaluation of policies and procedures governing use

Complaint filed with FTC against

Posted on November 24, 2010
Complaint filed with FTC against QualityHealth: The health information website is the subject of the complaint for sharing personal data. Hat tip: Alan Goldberg

Data Security: One of the requirements

Posted on November 22, 2010
Data Security: One of the requirements for "meaningful use" of EHRs (which all providers are going to have to show at some point or they'll take lower Medicare/Medicaid reimbursement) is that the provider regularly assess its data security risks. This is also a requirement of the HIPAA Security Rule -- in fact, based on what I've discovered when helping clients meet the HITECH requirements, it's

More California fines: the California

Posted on November 22, 2010
More California fines: the California Department of Public Health periodically lists the healthcare providers it has fined for privacy violations. Here's the latest news.

Henry Ford Data Breach: A stolen

Posted on November 17, 2010
Henry Ford Data Breach: A stolen laptop leads to a data breach, and a public report.

Guest Post: I occasionally allow

Posted on November 16, 2010
Guest Post: I occasionally allow guest bloggers to post here, and here's one on a topic I deal with regularly: doctors and social media. Jacqueline Klosek, lawyer, radio host, and author of several books on privacy and electronic communication, including "Protecting Your Health Privacy: A Citizen's Guide to Safeguarding the Security of Your Medical Information," posts the following:Should Doctors

EMRs versus Privacy: followers

Posted on November 15, 2010
EMRs versus Privacy: followers of this blog know that I like to point out how almost every effort to increase access to medical records almost always improve care, but decrease privacy. If you want the best possible medical care, make sure every possible provider of medical care or advice has your medical information; broadcast it far and wide, because there might be someone in some far-flung

HealthNet (Conn.) Breach news:

Posted on November 12, 2010
HealthNet (Conn.) Breach news: HealthNet has settled with the State of Connecticut over its data breach and failure to timely notify affected parties. The fine: $375,000.

Social Media: You may be aware

Posted on November 10, 2010
Social Media: You may be aware that I occasionally speak on the use of social media in healthcare marketing. Via Alan Goldberg and Robert Coffield, I've been informed that the AMA now has a policy to guide physicians who use social media. The AMA policy says:AMA POLICY: PROFESSIONALISM IN THE USE OF SOCIAL MEDIAThe Internet has created the ability for medical students and physicians to

Hospitals and Social Media: As

Posted on November 08, 2010
Hospitals and Social Media: As some of you know, I occasionally speak on the use of social media in healthcare marketing. It's a growing area, as noted here.

Annual Cost of Data Breaches: for

Posted on November 05, 2010
Annual Cost of Data Breaches: for hospitals, it's $6 billion.

Wellpoint in Indiana: The Indiana

Posted on November 03, 2010
Wellpoint in Indiana: The Indiana attorney general has sued Wellpoint for failing to notify customers of a breach. The breach was the result of personal data (social security numbers, health data, and financial information) left available on a website.

Very weird (and off topic): patients

Posted on November 03, 2010
Very weird (and off topic): patients swallow funny things, and need endoscopy or surgery to get them back out. Pens, batteries, knives?

Hartford Hospital (Conn.): This

Posted on October 28, 2010
Hartford Hospital (Conn.): This is really about contract negotiations between a hospital and an insurer, but the state employee's union says the hospital violated their HIPAA privacy rights by sending them letters. I think a provider can notify patients that their insurer might not be contracted any more; the only use is of the demographic information of the patient, and it seems to be related,

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.