Privacy & Security
The omnibus HIPAA Privacy and Security final rule released by HHS on Jan. 17 answered some questions, provided necessary guidance in certain areas -- but some of the thorniest issues, data breach notification among those, are still cryptic enough that lawyers and privacy officers will still face difficult judgment calls every time a laptop is lost or stolen.
The enhanced set of protections finalized in the omnibus HIPAA privacy and security rule released Jan.17 now becomes the new baseline for anyone who handles health information. It doesn't change meaningful use requirements, but combined, the two may drive more providers to protect patient data, according to privacy and security experts.
The most eagerly awaited -- if not anxiety-laden -- set of regulations in the healthcare spectrum arrived January 17: HHS issued modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules. The man charged with enforcing the rules said they represent "sweeping changes."
Despite the amazing potential of mobile healthcare, many concerns still remain over the issues of privacy and security.
Deborah Peel, MD, was trained as a Freudian psychoanalyst and worked as a psychiatrist in Austin, Texas, for nearly three decades before becoming a privacy activist, founding the group Patient Privacy Rights in 2006 after being appalled by HIPAA's evolution into what she sees as a weak baseline for privacy and security.
Employers who ignore or are only partially compliant with healthcare privacy issues could face greater government scrutiny and fines, says Philadelphia attorney Christopher Ezold.
Approximately 4,000 patients at the University of Michigan Health System (UMHS) have been notified this December that their personal health information has been compromised after an unencrypted device containing patient medical data was stolen from the car of an Omnicell employee.
For the coming new year, healthcare groups and their business associates need to get their privacy and security houses in order, as they will be facing new audits and more monetary enforcement surrounding data breaches -- this according to Leon Rodriguez, director of the Office of Civil Rights (OCR) at the Department of Health and Human Services.
The National eHealth Collaborative's Health Information Exchange Learning Network has recommendations for tackling some of the most challenging HIE issues.
In 2011, Micky Tripathi, founder and CEO of Massachusetts eHealth Collaborative (MAeHC) and health IT industry expert, found himself in unfamiliar territory after an unencrypted MAeHC laptop containing 14,475 patient medical records was stolen from an employee's locked car. After working to rectify the situation transparently, Tripathi said no one is immune from data breaches.