ADVERTISEMENT



Google       

Home -> Law Blog Directory -> Health Law Blogs -> HealthBlawg

OR PHONE (866) 635-1838 for Bankruptcy Help, (866) 635-6190 for Divorce,
(866) 635-2689 for Personal Injury or (866) 635-9402 for Criminal Defense

Find a Local Lawyer

Bankruptcy (866) 635-1838
Divorce (866) 635-6190
Personal Injury (866) 635-2689
Criminal Defense (866) 635-9402

Bookmark

Health Law

: HealthBlawg

Privacy and Security: Joke or No Joke?

By David Harlow

ADVERTISEMENTS

The Wall of Shame welcomes Sutter Health. Another computer with unencrypted protected health information on over 4 million patients - gone. Now, those guys are pretty smart, so why don't they encrypt all computers with PHI?  One of life's persistent questions.  I mean, I can accept the fact that a health plan operator like Cignet Health might have issues with getting a grip on HIPAA compliance, but Sutter Health?What were they thinking? Can't happen here?  Encryption is a drag?  It's an easy way to avoid major egg-on-face and to avoid spending significant coin on PR, credit reporting services, and potentially on court judgments -- all in addition to significant administrative fines payable to HHS and state regulators.

So the federales are piloting the HIPAA audit program. I know it's required by the HITECH Act, but who believes that it will motivate behavior change?  Anyone?  Sutter Health was clearly not motivated to seek a safe harbor that would have made the loss of 4 million patient records a non-event.  I know encryption can be a drag, but I'm not a techie. If you are, I invite you to educate me (and the other non-techies out there) on the question of how miserable it really is to have to deal with encrypted data; if you're really a techie, write a program to enable light-touch encryption that doesn't interfere with use of data.

Whether or not encryption is miserable, we should be asking: Why is this data on a barely secured computer (password-protected desktop) in the first place? Shouldn't it be stored on a server that stays in a secure facility, or in a secure private cloud?

Furthermore, as data loss incidents like this keep happening -- even among other industry leaders (see, e.g., Mass General) -- perhaps we need a new framework for thinking about access to health information. If we knew for sure that employment and insurance decisions would not be affected by the availability of otherwise private health record information, perhaps we would be more sanguine about their release. Perhaps government resources would be better spent on beefing up education and enforcement in those arenas (vs. auditing and enforcing compliance with privacy and security standards).

David Harlow 
The Harlow Group LLC
Health Care Law and Consulting
 

Full post as published by HealthBlawg on November 20, 2011 (boomark / email).

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.
Related Law Blog Posts
Search Blog Directory:

Search Blog Directory:

Related Law Articles

Lawsuits and Settlements

Related Searches

























































































































US Law
#1 Online Legal Resource













Your Blog Subscriptions
Subscribe to blogs

10,000+ Law Job Listings
Lawyer . Police . Paralegal . Etc
Earn a law-related degree
Are you the author of this blog? Adding USLaw.com to your Blogroll increases relevance. You qualify to display a USLaw Network badge.
Suggest changes to this blog's description or nominate another for inclusion. Register for updates.


Practice Area
Zip Code:

Contact a Lawyer Now!






0.4266 secs (from cache 04/23/14 16:02:38)