Law Students

HITECH/HIPAA Compliance Newsletter August 2009 Released

Posted on July 30, 2009
Our first issue of the HITECH/HIPAA Compliance Newsletter was released this morning. The featured article is entitled "HITECH/HIPAA and Meaningful Use: Part I." Any new subscribers between July 30, 2009 and August 15, 2009 will be sent an individual copy...

Why HITECH/HIPAA Compliance is a Wicked Problem?

Posted on July 29, 2009
There are many reasons why HITECH/HIPAA compliance is a "wicked problem." To move along the compliance continuum from "no story" to a "good story" is a non-trivial exercise. However true that may be, the real reason that HITECH/HIPAA is a...

Meaningful Use: Connecting with Patients?

Posted on July 29, 2009
Although providers have been slow to adopt email as a mode of communication with patients because of HIPAA, privacy, and other reasons, that may soon be changing. Patients will come to expect providers to be electronically enabled, including the millions...

HITECH Act: Using SaaS to Mitigate Compliance Issues?

Posted on July 28, 2009
There has been has been significant discussion on the "Internets" regarding the pros/cons of going with a software-as-a-service (SaaS) EHR vendor. I don't want to jump into these religious wars but I would like to comment regarding what has not...

To access this complete feed in the blog feed reader login or register for free.

HITECH Act: Breach of 600K records of PHI?

Posted on July 28, 2009
Network Solutions breach exposes nearly 600,000 | InSecurity Complex - CNET News. NO, BUT if you think this is news, wait until there is a breach of a fraction of this number related to protected health information (PHI). Healthcare providers...

HITECH Act: Subtitle D Full Text Available/Clickable Online!

Posted on July 28, 2009
If you are interested in researching/studying the HITECH Act's Subtitle D-Privacy, the full text is now available and "clickable" online (click on the link). HITECH's Subtitle D-Privacy is the intersection point between HIPAA's Privacy and Security Rules and "meaningful use...

HITECH Act Summary: 13410 Improved Enforcement

Posted on July 27, 2009
The HITECH Act's Subtitle D Section 13410 is called "Improved Enforcement." It puts significant teeth into HIPAA enforcement, and has the potential to dramatically change the HIPAA regulatory landscape. 13410(a): In general, non-compliance due to ?willful neglect? mandates a penalty...

HITECH Act: Any role for the FTC & The Red Flags Rule?

Posted on July 26, 2009
Health care providers implicated in the FTC's Red Flags Rule. As the link indicates, enforcement of the Rule begins on August 1, 2009. In short, within five business days. Large numbers of health care providers fall under the Rule since...

HITECH Act: Mandatory HIPAA Audits!

Posted on July 24, 2009
Section 13411 of the HITECH Act's Subtitle D requires that HHS conduct mandatory audits (emphasis added). The Secretary shall provide for periodic audits to ensure that covered entities and business associates that are subject to the requirements of this subtitle...

Want to get paid under HHS' "meaningful use" criteria?

Posted on July 22, 2009
If so then you need to understand HITECH'S Subtitle D. The HIPAA Privacy and Security Rules are now part of HHS' "meaningful use" definition. As a practical matter, what this means is that a provider or facility that is non-HIPAA...

How will the HITECH Act Change HIPAA Enforcement?

Posted on July 22, 2009
You can review HHS' past HIPAA enforcement process as a reference point for how things are likely to change under the HITECH Act. The diagram below is certain to change once the HITECH effective dates kick in.

HITECH Act: We are from the U.S. Government & we are here to help.

Posted on July 22, 2009
HITECH Act Subtitle D: Education on health information privacy (13403). 13403(a): HHS Regional Offices to provide education to Covered Entities, Business Associates, and individuals on their rights and responsibilities related to Federal privacy and security requirements for PHI...

HITECH/HIPAA: Notification in the case of breach (unsecured PHI).

Posted on July 21, 2009
Section 13402 of HITECH's Subtitle D is one of the significant changes between what the HITECH Act requires and versus HIPAA did not. Providers are well advised to have a notification plan in place when (likely not if) the inevitable...

HITECH/HIPAA: Who is a Business Associate?

Posted on July 20, 2009
Business Associate (BA): This term has broad applicability under HITECH/HIPAA and includes "partners" wherein the product/service provided requires the disclosure of protected health information (PHI). BA?s may include: Accountants Consultants EHR/PHR Vendors Potentially Many Others (e...

EHR Implementation: What is it going to take?

Posted on July 20, 2009
What is it going to take for a health care provider to implement an electronic health record (EHR) system so that they can participate in the HITECH Act's incentives? Redefined Workflows National Health Care Infrastructure Certified Electronic Health Records Industry...

Summary of HHS? Meaningful Use Matrix

Posted on July 19, 2009
1) Five Policy Priorities (a) Improved Quality, Safety, and Efficiency (b) Engage Patients and Families (c) Improve Care Coordination (d) Improve Public Health (e) Ensure Privacy & Security Protection for PHI* 2) Care Goals 3) A Set of Objectives &...

CDT Provides an Excellent Summary of HITECH/HIPAA Mods.

Posted on July 19, 2009
The Center For Democracy & Technology is a great resource for health privacy related information. Here is how they describe their Health Privacy Project: CDT?s Health Privacy Project will take on key policy questions, including: the proper role of notice...

HITECH/HIPAA Subtitle D - Privacy.

Posted on July 18, 2009
A more readable version of the HITECH Act's Subtitle D - Privacy can be found here. The table of contents can be found below. The sections highlighted in red are part of the reason that HIPAA is no longer a...

Much To Do About Nothing?

Posted on July 18, 2009
Why So Much Hand-Wringing Over TechCrunch's Decision to Publish 'Hacked' Twitter Documents? - Techcrunch - Gawker. It seems to me that from a legal perspective Techcrunch's decision to publish Twitter's confidential documents is, as the link suggests, just good 'ole...

What does "willful neglect" mean under HITECH/HIPAA?

Posted on July 17, 2009
Well that is anybody's guess at this point but as a privacy lawyer I can assure you that HHS/OCR or CMS will "know it when they see it." I am going to offer up a common sense definition of what...

HITECH Act "Meaningful Use" Final Definition.

Posted on July 17, 2009
The final definition of "meaningful use" under the HITECH Act can be found here. One thing to note is that compliance with HIPAA's Privacy & Security Rules not only remain part of the meaningful use definition as a policy priority,...

HIPAA, HITECH & FTC Red Flags Rule

Posted on July 15, 2009
HealthBlawg: Red Flags Rule: The FTC piles on, because HIPAA, ARRA and overlapping state laws just weren't enough. David has an excellent post summarizing the impact that the FTC's Red Flags Rule may have on healthcare providers. As I have...

HITECH / HIPAA Compliance is Serious Business!

Posted on July 14, 2009
Well yes it is but, then again we all need a little levity, and no one needs it more than a HIPAA lawyer or a HIPAA compliance officer. Without a little humor, the HITECH alphabet soup might just drive you...

Copyright Holders Beware!

Posted on July 14, 2009
Are You Gambling With Your Copyright By Entering That Photography Contest? : Owners, Borrowers & Thieves 2.0. Lots of copyright traps to fall into for the unwary. Most small businesses and independent contractors simply do not pay enough attention to...

HITECH/HIPAA Timelines?

Posted on July 11, 2009
Here are some of the relevant timelines for HITECH/HIPAA compliance. Refer to the Subtitle-D table of contents below for a quick reference to the respective sections. HITECH enactment (February 17, 2009) Tiered civil penalties based on the nature of HIPAA...

FTC Red Flags Rule & Health Care Providers?

Posted on July 11, 2009
Many health care providers probably do not realize that they may be considered "creditors" under the FTC's Red Flags Rule, designed to prevent identity theft, usually involved with financial transactions, but which is increasingly spreading into other domains...

Gloom and Doom or the New Reality?

Posted on July 09, 2009
When Will The Recovery Begin? Never. | Robert Reich's Blog. I think it's the latter. The old economy is dead and it "ain't never coming back." Why? Because the consumer is broke, and becoming more broke everyday, globally. We are...

Twitter & Virus Tracking?

Posted on July 09, 2009
Twitter: Growing Virally But Can It Stop Viruses?. Interesting post from Chris Thorman regarding the use of Twitter by health care professionals to track viruses. Of course, as the post highlights, there are many issues to be worked out before...

Canadien Health Care Data Breach

Posted on July 09, 2009
Computer virus copied thousands of Alberta health records. This is not the kind of thing a health care organization wants to be talking about. The next time a health care data breach of this magnitude happens in the U.S. it...

Canadian Health Care Data Breach

Posted on July 09, 2009
Computer virus copied thousands of Alberta health records. This is not the kind of thing a health care organization wants to be talking about. The next time a health care data breach of this magnitude happens in the U.S. it...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.