Providence Health & Services Agrees To $100,000 Voluntary Settlement of Potential HIPAA Violation

The U.S. Department of Health and Human Services (HHS) issued a press release last Thursday that it had entered into a Resolution Agreement with Seattle-based Providence Heath & ServicesHealth Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules. The agreement calls for Providence to pay a voluntary settlement of $100,000 and implement a detailed corrective action plan to ensure against future theft or loss of electronic patient health information (ePHI).

The incidents giving rise to the agreement involved two Providence entities, Providence Home and Community Services and Providence Hospice and Home Care. On or about December 30, 2005, data contained on several computer backup disks and tapes was stolen from the unattended car of a Providence employee. In addition to the theft of disks and tapes, several laptop computers were stolen from Providence employees on September 29, 2005, December 7, 2005, February 27, 2006, and March 3, 2006. The laptops, disks and tapes involved in those thefts contained the unencrypted records of more than 386,000 patients of Providence.

Under the terms of the Resolution Agreement, Providence agrees to pay $100,000 by check or electronic funds to HHS. Providence also agrees to enter into and abide by the terms of the Corrective Action Plan that is incorporated into the agreement. The Corrective Action Plan is effective for three years and requires that Providence submit copies of its written policies and procedures to HHS for approval. The Corrective Action Plan outlines nine categories of minimum content required in the policies and procedures. Specifically, the Corrective Action Plan requires that Providence to:

• Conduct a risk assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI when it is created, received, maintained, used or transmitted off-site;
• Implement a risk management plan that incorporates security measures sufficient to reduce the risks and vulnerabilities identified by the risk assessment to a reasonable and appropriate level; and
• Implement several physical and technical safeguards, including encryption, to ensure the protection of ePHI whenever it is stored or transported off-site by any portable device or electronic media.

The Corrective Action Plan also requires Providence train and monitor its workforce so that all employees are familiar with the policies and procedures. Providence is also required to submit to HHS both a one-time Implementation Report and Annual Reports for three years detailing its compliance to the policies and procedures under the Resolution Agreement.

Initially, HHS officials received more than 30 complaints about the stolen tapes and disks after Providence, pursuant to state notification laws, informed patients of theft. Providence also reported the stolen media to HHS. Providence faced a pending class action lawsuit alleging that the health system failed to safeguard the data as required by HIPAA and violated Oregon’s Unfair Trade Practices Act. The proposed class action was dismissed in November, 2007. The incident was also investigated by the Oregon Attorney General’s Office resulting in an Assurance of Voluntary Compliance Agreement requiring Providence to provide credit monitoring services, credit restoration services, implement security program enhancements and pay $95,764 into the Consumer Protection and Education Revolving Account.

Providence settlement and corrective action plan sends a signal that OCR and CMS are taking a stronger position against privacy and security incidents. The settlement should prompt providers who are required to comply with HIPAA to reexamine their privacy and security policies, procedures, employee training protocols and ongoing monitoring of compliance.

Ohio Court Creates New Tort For Unauthorized Dislcosure of Medical Information

The Ohio Supreme Court issued a recent decision in Hageman v. Southwest General Health Center, et al. Slip Opinion No. 2008-Ohio-3343 (July 9, 2008), holding that an attorney's unauthorized disclosure of medical information obtained during litigation in a separate proceeding could be the basis of a tort claim. The decision in Hageman has implications regarding the waiver of confidentiality and the secondary release of medical information under a standard HIPAA compliant authorization.

The Court in Hageman held:

With these considerations in mind, we hold that when the cloak of confidentiality that applies to medical records is waived for the purposes of litigation, the waiver is limited to that case. An attorney can certainly use medical records obtained lawfully through the discovery process for the purposes of the case at hand—e.g., submitting them to expert witnesses for analysis or introducing them at trial. However, an attorney may be liable to an opposing party for the unauthorized disclosure of that party’s medical information that was obtained through litigation. Thus, as in our decision in Biddle, we conclude that an independent tort exists to provide an injured individual with a remedy for such an action.

In ruling the Court in Hageman ooked to the Court's prior decision in Biddle v. Warren General Hospital, 86 Ohio St.3d 395, 715 N.E. 518 (1999), where the Court found a separate tort for breach of privacy and confidentiality related to medical records.

The Court in Biddle made the following findings:

1. In Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a third party of nonpublic medical information that a physician or hospital has learned within a physician-patient relationship.

2. In the absence of prior authorization, a physician or hospital is privileged to disclose otherwise confidential medical information in those special situations where disclosure is made in accordance with a statutory mandate or common-law duty, or where disclosure is necessary to protect or further a countervailing interest that outweighs the patient’s interest in confidentiality.

3. A third party can be held liable for inducing the unauthorized, unprivileged disclosure of nonpublic medical information that a physician or hospital has learned within a physician-patient relationship. To establish liability the plaintiff must prove that (1) the defendant knew or reasonably should have known of the existence of the physician-patient relationship, (2) the defendant intended to induce the physician to disclose information about the patient or the defendant reasonably should have anticipated that his actions would induce the physician to disclose such information, and (3) the defendant did not reasonably believe that the physician could disclose that information to the defendant without violating the duty of confidentiality
that the physician owed the patient.

ONC-Coordinated Federal HIT Strategic Plan: 2008-2012

Today the Office of the National Coordinator for Health Information Technology (ONC) released "The ONC-Coordinated Federal Health Information Technology Strategic Plan: 2008-2012". Find more information here, including a synopsis of the full report.

The plan is meant to serve as a guide to coordinate the federal government's health IT efforts to achieve a nationwide implementation of an interoperable health information infrastructure.

Robert Kolondner, MD, National Coordinator for Health Information Technology states in the synopsis summary:

Looking toward the future, we can envision a health care system that is centered on each and every individual patient. Clinicians will have at their fingertips all of the information needed to provide the best care; individuals will have access to this and other information that can help them engage and insert their values in the decision-making process about their health and care; and, secure and authorized access to health data will provide new ways that biomedical research and public health can improve individual health, and the health of communities and the Nation.

The synopsis goes on to state that the plan has two goals -- "patient focused health care and population health" and describes them as follows:

Patient-focused Health Care: Enable the transformation to higher quality, more cost-efficient, patient-focused health care through electronic health information access and use by care providers, and by patients and their designees.

Population Health: Enable the appropriate, authorized, and timely access and use of electronic health information to benefit public health, biomedical research, quality improvement, and emergency preparedness.

Each goal has four objectives and the themes of privacy and security, interoperability, adoption, and collaborative governance recur across the goals, but they apply in very different ways to health care and population health.

I've only had a chance to scan the synopsis and the 115 page full report but should make for interesting reading for anyone involved in the ongoing evolution of our health care system and the impact that health technology is having on the industry.

New HHS HIPAA Privacy Compliance and Enforcement Data

DHHS and the Office for Civil Rights (OCR) have added new enforcement statistics and data to the OCR HIPAA Privacy and Compliance and Enforcement site. Previously, I've posted about the statistics.

OCR added new information broken down by the following topics:

• Charts showing state-specific case investigation results (West Virginia shows (see the graphic above): 71% resolved after intake and review; 18% corrective action taken; 11% no violation)
• Calendar-year enforcement results graphs and charts
• Calendar-year graphs showing the number of complaints received
• Yearly variation in the top 5 types of issues resolved through corrective action

The statistics show that the number of complaints made to OCR continue to increase -- from 6,534 complaints in 2004 to 8,132 complaints in 2007.

Also, the statistics show that the top 5 types of complaints requiring corrective action have remained fairly consistent - except in 2007 "notice" jumps into the top 5.

I would be interested to hear others thoughts on the compliance statistics.

Consumers' Checkbook v. HHS Update

The WSJ Health Blog, "Feds Fight to Keep Doctor Data Secret," has the latest on the Consumers' Checkbook v. HHS matter involving whether or not Medicare physicians claims data should be made publicly available. Consumers' Checkbook, a nonprofit consumer information and service resource, wants to use the data to rate physicians and health care services.

Last week the DOJ filed its appeal and HHS released this statement regarding appeal of Consumers' Checkbook Decision explaining the basis for opposing (and supporting) release of the data. The press release states:

HHS is appealing this decision because of two conflicting court opinions that control HHS’ release of data. Release of certain Medicare claims data is currently governed, in part, under an existing order issued by a federal court in Florida in 1979. That order, which is still in effect, prohibits Medicare from releasing physician reimbursement data in a manner that would enable the user of that data to identify individual physicians. The court order states that this information is protected by the Privacy Act of 1974. The data sought by Consumers Checkbook, when combined with other publicly-available data on Medicare fees, could lead to the disclosure of annual Medicare reimbursement amounts for individual physicians. Release of the data would, therefore, result in a violation of the existing Florida court order. On the other hand, HHS faces the decision rendered last year by the District of Columbia court ordering the release of the data. HHS argues in its appeal that the recent decision is based on an erroneous application of the Florida court order and of the Freedom of Information Act’s exemption that protects privacy. The Department seeks resolution of this conflict from the Court of Appeals.

Beyond the legal issues that must be resolved, HHS recognizes and shares the goals of Consumers Checkbook. Like Consumers Checkbook, HHS seeks to support consumers and providers with quality performance and cost information for a variety of providers and plans. For many years, HHS has worked closely with providers and other stakeholders in developing and reporting quality information, including the use of national consensus-based quality performance measures. While Consumers Checkbook seeks to post the number of times a provider has performed a specific service, the quality measures used by HHS generate more valid, specific, and comprehensive information on the quality of care delivered.

For background on the legal saga check out my prior post.

Thoughts on HIPAA and Privacy: NYT Article on PatientsLikeMe

First, an apology to my regular blog visitors for the lack of posts over the last month. Busy, busy, busy at work and home. No time to blog. The last couple of days I have been experimenting a bit with micro blogging via Twitter as a result of a conversation with my firm's IT director and blogger.

Quick post to this interesting NYT article, Practicing Patients, about PatientsLikeMe. The article covers some ground on some of the questions that periodically swirl in my brain regarding HIPAA, privacy rights, who is (should be) the steward of medical information, pro/cons of patients (consumers) self treatment, etc.

I particularly found interesting Alan Westin's taxonomy of Americans' attitudes toward privacy. The article states:

In 1990, Alan Westin, a political scientist at Columbia University and an expert in privacy issues, offered a useful taxonomy of Americans’ attitudes toward privacy. On one end of the spectrum were what he called privacy fundamentalists — the 25 percent of Americans who feel that their privacy is paramount and that no one, not the government or corporations or their family, should have access to their personal information without explicit permission. At the other end of the spectrum were the privacy-unconcerned — about 15 percent of Americans — who paid no mind to privacy issues and didn’t figure they had anything to hide. In the middle were the vast majority, the 60 percent whom Westin called privacy pragmatists: those who felt that they could give a company they trusted some information — birth date, ZIP code, telephone number — for particular benefits.

Google Health: Google Partners with Cleveland Clinic

The New York Times Technology Section reports on a pilot project between Gooogle and the Cleveland Clinic in an article, Google to Store Patients' Health Records.

The article indicates the pilot project will involve a volunteer patient group transferring their personal health records so that they are available via Google Health, a new health record product being developed by Google. The article quotes Pam Dixon of the World Privacy Forum concerning privacy issues under HIPAA (incorrectly referenced by the Times as HIPPA).

I don't necessarily agree with the scope of the comments regarding the applicability of HIPAA in this situation. Although I don't know the full details of the relationship for the proposed project but it would appear that Google in this situation might be serving as a business associate of the Cleveland Clinic for the project. As a business associate it is likely that Google would be held contractually to many of the HIPAA privacy standards.

Tip to Matthew Holt at Health 2.0 Blog for noticing the NYT article.

UPDATE (2/22/08): ZDNet's Larry Dignan at Between the Lines has more on the pilot project including the Cleveland Clinic's press release.

The comments to Dignan's post are interesting reading especially a couple with a legal perspective. The comment, two misconceptions, highlights the overall light enforcement efforts by OCR and lack of penalties, whether Google might fit the "healthcare clearinghouse" definition under the "covered entity" definition, entering into a contract with the health care provider (business associate requirement) and discusses the subpeona and marketing misconceptions.

Also, more from NYT's Steve Lohr, Google Health Begins Its Preseason at Cleveland Clinic which indicates that Google Health will be made available to the public following completion of the pilot project (appoximately 2 months). The article also has a quote from fellow health care blogger and CIO of Beth Israel Deaconess Medical Center in Boston, John Halamka, who indicates that the hospital is also interested in linking its EMR with Google Health. As a board member of the West Virginia Health Information Network I would like to explore the idea of utilizing and integrating Google Health into our statewide effort to bring about an integrated/interoperable health information system.

Jane Sarasohn-Kahn at HealthPopuli shares her thoughts and additional link commentary on the Google/Cleveland Clinic project. Jane highlights a recent report, Personal Health Records: Why Many PHRs Threaten Privacy, by the World Privacy Forum looking into privacy issues for PHRs.

Matthew Holt's follow up post taking a closer glimpse at the privacy questions, motives and opportunities both pro/con surrounding the Google Health project.

UPDATE (2/24/08): For the latest article covering the Google Health project check out Newsweek's article, Web Surfer, Health Thyself, out in the March 3 edition.

Also, MSNBC provides some additional insight on how Google Health will interact with the existing Cleveland Clinic EHR (or PHR) in Google Goes to the Doc's Office. The article describes the pilot project as follows:

. . . The Cleveland Clinic already keeps electronic records for all its patients. The system has built-in smarts, so that it will alert doctors about possible drug interactions or when it's time for, say, the next mammogram. In addition, 120,000 patients have signed up for a service called eCleveland Clinic MyChart, which lets patients access their own information on a secure Web site and electronically renew prescriptions and make appointments.

The system has dramatically cut the number of routine calls to the doctor and boosted productivity, though it has yet to effectively deal with information from an outside physician, Harris says. Those records are typically still on paper, and have to be laboriously added to the Cleveland Clinic system. It is a big problem, especially for the clinic's many patients who spend winters in Florida or Arizona, where they see other doctors.

Adding Google's technology lets patients jump from their MyChart page to a Google account. Once on Google, they'll see the relevant health plans and doctors that also keep electronic medical records. That means the patient can choose to share information between, say, the Arizona doctor and the Cleveland Clinic . . .

UPDATED 2/26/08: Scott Shreeve goes Giga over Google Health. Read his first impressions of the Google PHR after his test drive at HIMSS.

However, Dmitriy at TrustedMD makes some great points, including this quote:

Yet, even with free PHRs out there, consumers simply do not care for spending their time to learn and use them. Who would bother entering and checking their medical records if you are healthy and would rather go see a movie? And once you get sick, you do not want to enter them either. You just want your doctors and hospitals to hand your medical records to you. But you see, the providers have different priorities that a mere piece of software just cannot solve . . . PHRs' real problems are not technical, usability or even privacy. The real problem is consumer and provider motivation . . .

He ends his posts with some questions we should all be discussing. Until we see a reimbursement model that creates incentives for providers to look at more health information and consumers to care about and take an active part in their health -- I'm not sure the PHR/EHR initiatives will fully develop and mature.

Follow the latest news (blog posts) and the Techmeme reaction to the project.

Advocating The Need For A Federal Data Breach Disclosure Law

Information Week's Security Blog advocates for a federal data breach disclosure law in this post, The Time Is Now (Better Yet, Yesterday) For A Federal Data Breach Disclosure Law.

Thanks to the HIPAA Blog for point out the article. I agree with Jeff Drummond's conclusion. After having analyzed overlapping and different state disclosure requirements as a part of assisting clients with data breach issue a federal approach is the direction we should go. (caveat: it should require total preemption - not partial preemption like HIPAA privacy).

A federal approach would help set a national industry standard that can be clearly understood, implemented and followed by those who regularly deal in data, health care or otherwise. The state-by-state patchwork of different laws that currently exist create a complexity that is not needed.

For more on the ongoing complexity issue check out California's recently revised law (AB1298) that recently took effect. AB1298 effective January 1, 2008, expands the coverage and protections to medical information and health insurance information under California's State Information Practices Act.

A clear and concise national approach would simplify compliance for those required to maintain and protect data, including health care providers maintaining health information. Customers and patients who expect their data to be maintained would also benefit by a simplified approach and uniform law that provides for a consistent level of breach notification and protection.

For more on state security breach notification legislation/laws check out the National Conference of State Legislatures website page "Breach of Information". Last updated in April 2007, it states "thirty-five states have enacted legislation requiring companies and/or state agencies to disclosure security breaches involving personal information." I suspect this number will increase after the 2008 legislative sessions around the country.

Also, NCSL provides a summary of data breach notification legislation introduced by year. For 2007, they list three bills introduced (but not passed) before the West Virginia Legislature:

WEST VIRGINIA

WV H 2175	Sponsor: Marshall (D) Title: Acquisition of Security Compromising Data Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Relates to the unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2263	Sponsor: Brown (D) Title: Clean Credit Information and Identity Theft Protection Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Ensures clean credit information and identity theft protection (FN). Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2705

Sponsor: Marshall (D) Title: Consumer Right to Impose Freeze on Credit Reports Introduced: 01/30/2007 Location: House Judiciary Committee Summary: Establishes a procedure whereby a consumer may implement a security freeze to prohibit a consumer reporting agency from releasing all or any part of the consumer's credit report. Status: 01/30/2007 INTRODUCED. 01/30/2007 To HOUSE Committee on JUDICIA

As a result of high profile cases like this one that occurred in West Virginia, we will again see activity this year in West Virginia.

2008 WV Legislature: Modification to WV Mental Health Confidentiality Provisions

iHealthBeat (courtesy of Daily Mail) reports on proposed House Bill 4020 introduced last week before the West Virginia Legislature to modify W.Va. Code 27-3-1 authorizing the disclosure of certain mental health records to the National Instant Criminal Background Check System.

According to the article, West Virginia is one of about 24 states that do not allow the release of records to the database. Some states have declined to participate in the federal database because of privacy concerns.

Data Missing on 200,000 West Virginia PEIA Members

WSAZ News, the State Journal and Charleston Gazette are reporting that data on approximately 200,000 past and current members of West Virginia Public Employees Insurance Agency (PEIA) is missing. According to the articles, the data was contained on a computer tape being mailed to a data analyst in Pennsylvania and was reported missing on October 18.

The data tape included names and maiden names, addresses, social security numbers, telephone numbers, and marital status of program participants and their covered dependents. The article indicates that the data tape did not contain medical or prescription claims information.

According to the article, letters will be mailed to impacted members and a hotline will be set up to answer questions about the lost data.

UPDATE: For more information check out the PEIA Data Loss Press Release and the Letter to Affected Policyholders about PEIA's Recent Data Loss.

Medicare Physician Data: Transparency vs. Privacy

iHealthBeat provides commentary and an update on the outcome of the Consumers' Checkbook v. HHS matter involving whether or not Medicare physicians claims data should be made publicly available.

The United States District Court for the District of Columbia ruled in favor of Consumers' Checkbook on August 22 requiring that HHS release the physician data requested under FOIA to Consumers' Checkbook. So far HHS has not appealed the decision and the data is required to by produced by September 21.

It will be interesting to see if HHS appeals the decision. Classic example of transparency vs. privacy. Brian Kleppner has more over at that The Health Care Blog.

UPDATE (10/22/07): The WSJ Health Blog reports that HHS has decided to appeal the decision requiring that HHS release data under FOIA to Consumers' Checkbook. The decision initially required production of the data by September 21 which was then extended until October 22.

Learning: Privacy and Security Monitoring, Audits and Investigations

On November 13, 2007, I will be speaking at a Lorman Eduational Services seminar to be held in Charleston, West Virginia. The seminar topic is "Health Care Information Privacy and Security Monitoring, Audits and Investigations: How to avoid an investigation and what you should expect if the state or federal officials call". You can register online here.

Also speaking at the seminar will be (read full bios):

• Terri Barrett, the assistant chief privacy officer at the West Virginia Health Care Authority in Charleston

• Mike Harmon, compliance officer for the West Virginia Public Employees Insurance Agency who oversees HIPAA compliance for PEIA and the Department of Administration

• Jack Shaffer, CIO for the Community Health Network of West Virginia who has experience in all aspects of technology, including systems development, enterprise application integration, networking, telecommunications, data center operations, database administration, disaster recovery, security and mobile computing.

Below is a copy of the seminar agenda:

9:00 am – 10:30 am	Legal Overview of HIPAA Privacy and Security Enforcement
	Robert L. Coffield, Esq.
	HIPAA Refresher on Enforcement Rules and Penalties OCR Privacy Investigation Statistics Best Practices on Conducting Internal Investigations Responding to OCR/CMS Investigation
10:30 am – 10:45 am	Break
10:45 am – 11:30 am	Preparing for an Audit
	Michael T. Harmon, CIPP/G
	Auditing vs. Monitoring Other Governmental Auditors – e.g., OIG, Legislature Elements of the OIG Audit of Piedmont Hospital in Atlanta New Kennedy/Leahy Legislation and Changes to Current Practice Privacy and Security Accreditation
11:30 am – 12:30 pm	Lunch (On Your Own)
12:30 pm – 2:30 pm	Technologies and Procedures for HIPAA Compliance
	Jack L. Shaffer Jr.
	Acceptable Use Policies and Enforcement Protecting PHI With Encryption Technologies Auditing and Monitoring Tools
2:30 pm – 2:45 pm	Break
2:45 pm – 3:45 pm	The Role of the Privacy Officer
	Terrisita Barrett, CIPP
	The Changing Privacy and Security Landscape Role and Responsibilities: Past, Present and Future Challenges Affecting the Privacy Officer Role
3:45 pm – 4:30 pm	Panel Discussion, and Questions and Answers
	Terrisita Barrett, CIPP, Robert L. Coffield, Esq.,
	Michael T. Harmon, CIPP/G, and Jack L. Shaffer Jr.

MD Net Guide Article: Are Physician Blogs in a Legal and Ethical Twilight Zone?

Last month I had the opportunity to collaborate with Fard Johnmar of Envision Solutions on an article for MD Net Guide, "Social Media Notebook: Are Physician Blogs in a Legal and Ethical Twilight Zone?" The article looks at the recent incident involving Dr. Lindeman, who blogged under the pseudonym "Flea," and the risks associated with physician blogging.

I shared some legal tips that physician bloggers should consider when blogging, including:

• Anonymous blogging does not guarantee your privacy
• Consider informing your employer about your blog
• Follow your HIPAA training
• Post a legal disclaimer
• Be cautious about giving advice to patients

Check out the current issue of MD Net Guide to read the complete article. Also, the complete article, "Social Media Notebook: Are Physician Blogs in a Legal and Ethical Twilight Zone?" can be accessed via the web (registration required).

Scoble On Google Privacy Discussion

Scoble has a good round up of the ongoing discussion about Google's ranking in the recent Privacy International Report titled, A Race to the Bottom: Privacy Ranking of Internet Service Companies and Privacy International's Open Letter to Google.

New HIPAA Privacy Compliance and Enforcement Website

Yesterday I received an email via the OCR-Privacy listserv announcing the launch of a new HHS web site on HIPAA Privacy Compliance and Enforcement.

I haven't had time to check out the new website but plan to in the coming days. While scanning the website I found the "Enforcement Highlights" and "Case Examples" section very interesting. In the meantime, here is the press release issued in the email by HHS.

To coincide with the fourth anniversary of the enforcement of the HIPAA Privacy Rule, the Department of Health and Human Services (HHS) announced today the launch of an enhanced Web site that will make it easier for consumers, health care providers and others to get information about how the Department enforces health information privacy rights and standards. In launching the website, Winston Wilkinson, the Director of the HHS Office for Civil Rights, noted: "HHS has obtained significant change in the privacy practices of covered entities through its enforcement program. Corrective actions obtained by HHS from these entities have resulted in change that is systemic and affects all the individuals they serve."

The Health Information Privacy Web site provides comprehensive information about the Privacy Rule, which creates important federal rights and requirements to protect the privacy of personal health information. The enhanced Web site, http://www.hhs.gov/ocr/privacy/enforcement provides information for consumers, health care providers, health plans and others in the health care industry about HHS’s compliance and enforcement efforts. The new information describes HHS activities in enforcing the Privacy Rule, the results of those enforcement activities, and statistics showing which types of complaints are received most frequently and the types of entities most often required to take corrective as a result of consumer complaints. The other information on the Web site covers consumers’ rights to access their health information and significantly control how their personal health information is used and disclosed, as well as guidance about how to submit complaints about possible violations of the law and extensive guidance for entities who must comply with the rule.

HHS issued the patient privacy protections pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The first and only comprehensive federal privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers took effect on April 14, 2003. Developed by HHS, these standards provide patients with access to their medical records and more control over how their personal health information is used and disclosed. The regulation covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions (e.g., enrollment, billing and eligibility verification) electronically. HHS has conducted extensive outreach and provided guidance and technical assistance to providers and businesses to help them to implement the new privacy protections. These materials are available at http://www.hhs.gov/ocr/hipaa.

Recent HIPAA Enforcement Stats

for the latest on HIPAA enforcement statistics by OCR click over to Mike Cassidy's post at the Med Law Blog: HIPAA Criminal Verdict and Enforcement Statistics. The post also contains some stats on the number of matters reported to the DOJ for investigation.

The post includes a summary of United States v. Ferrer, S.D. Fla., No. 06-CR-60261-CR-Cohn, the first criminal HIPAA verdict entered in January 2007. The case involved the wrongful disclosure of individually identifiable health information and identity theft of 1,100 patients from the Cleveland Clinic which were used to fraudulently bill Medicare claims to the tune of $7M.

The Ying and Yang of Health Privacy

Christina's Considerations posts a quote by Dr. William Yasnoff from a recent New York Times article, Warnings Over Privacy of U.S. Health Network. The quote caught my eye because it highlights what I'll refer to as the ying and yang involved in the conversion to a more comprehensive interoperable health information system and how you and I as patients may react.

The quote reads:

"Anything you do to make information more accessible for good, laudable purposes will simultaneously make it more accessible for evil nefarious purposes. People intuitively understand that, and they are worried."

Those of us working on health privacy and e-health issues should regularly consider and reassess this principal as we move forward to transform the way health information is collected, stored, used, disclosed and aggregated. Over the years to come health lawyers will play an increasingly important role in the process of addressing legal issues that arise from the concept highlighted by the quote.

Tags: privacy, EMR, health information technology, health care

Bootstrapping HIPAA Into Breach of Privacy Claim

Jeff Drummond over at the HIPAA Blog reports on a recent North Carolina Court of Appeals decision in Acosta v. Byrum indicating that a private cause of action is not allowed under HIPAA, but that a HIPAA breach is evidence that the standard of care was not met in a common law claim for breach of privacy and negligent infliction of emotional distress.

The decision of the Court states:

. . . Plaintiff contends that no claim for an alleged HIPAA violation was made and therefore dismissal on the grounds that HIPAA does not grant an individual a private cause of action was improper. We agree.

In her complaint, plaintiff states that when Dr. Faber provided his medical access code to Byrum, Dr. Faber violated the rules and regulations established by HIPAA. This allegation does not state a cause of action under HIPAA. Rather, plaintiff cites to HIPAA as evidence of the appropriate standard of care, a necessary element of negligence. Since plaintiff made no HIPAA claim, HIPAA is inapplicable beyond providing evidence of the duty of care owed by Dr. Faber with regards to the privacy of plaintiff's medical records. . .

UPDATE: An interesting followup post on federal preemption under HIPAA and use of HIPAA in intentional infliction of emotional distress type cases prompted by a question from John Dascoli, a West Virginia attorney at The Segal Law Firm and fellow law school classmate of mine.
Tags: HIPAA, privacy, health care, law

HIPAA Security Guidance for Remote Use and Access to Electronic PHI

CMS has issued HIPAA Security Guidance (link to guidance document pdf) for HIPAA covered entities on the risks and possible mitigation strategies for remote use of and access to Protected Health Information (EPHI). The guidance sets forth CMS' minimal compliance expectations for covered entities seeking to safeguard EPHI that is accessed, stored or transported offsite.

This guidance should be useful for those health care facilities and providers to assess current policies and procedures used to maintain the confidentiality of health information.

Tags: HIPAA, privacy, security