Healthcare IT Update

OCR May Expand Accounting of Disclosures under HIPAA

HITECH Act requires use of EHRs as tools to inform about disclosures under Privacy Rule. Health care organizations and providers thought they dodged a bullet long ago when they convinced HHS to exclude disclosures of patient data used in the process of treatment and payments from the HIPAA privacy rules. But now, thanks to the HITECH Act, HHS is back, wondering what would be so terrible about requiring an accounting of such disclosures now. Through a request for information issued in early May titled HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act (75 Fed Reg 23214 May 3, 2010), the HHS Office for Civil Rights says it expects to learn more about the interests of individuals, and the administrative burden on covered entities as well as business associates, concerning accounting for such disclosures. Under current standards of the…

Continue reading...

HHS Online Data Breach List Thrives

Many reported cases involve electronic systems, but paper records are still a security threat. Theft, loss, unauthorized access, or hacking. Whatever the breach is, HHS encourages people to turn to their computers and report it online. HHS then reports the specifics of breaches of security that affect 500 or more individuals. Presently,  64 cases are posted online, which allegedly affected about 1.2 million individuals.

Continue reading...

HIT: Just in Time to Cure the Recession?

Despite the promise of new jobs, EHR errors are still causing publicity and concern. By now we know the feds are handing out money – to colleges and non-profits, mostly – to jumpstart the adoption and meaningful use of electronic health records. But what’s recently become clear, too, is the role health information technology is playing in jumpstarting the still-saggy U.S. economy – if it will just work right. Read on to find out how the feds are promoting HIT as the source of new jobs while concurrently making major CYA moves to deal with reports of EHR errors.

Continue reading...

HHS Pumps More Money into HIT Adoption Efforts

Big schools, little schools and all kinds of lucky non-profits will get ARRA money. Under the gun to get its “meaningful use” definition straight in order to meet the deadlines of October 2010 for hospitals and January 2011 for eligible providers, the Department of Health & Human Services is getting serious about HIT adoption, and the serious American Recovery and Reinvestment Act of 2009 money is starting to roll out. In April 2010, the agency announced close to half a billion dollars in grants to schools and non-profits relating to the goal of establishing widespread and meaningful use of electronic health records by 2014.

Continue reading...

Use Walkthroughs to Nip Security Problems in the Bud

Use inspections to keep your security compliance plan in shape. Does your security compliance program need a checkup? If so, now is the time to begin monitoring your staff so you can knock out compliance violations before they occur. Read on to discover three steps that will help you get started:

Continue reading...

OCR to Offer Guidance (Someday) on De-Identifying PHI

While no one – including HHS – seems to know yet what de-identification of PHI under the HIPAA Privacy Rule is, one good rule of thumb at this point is to be careful what you post publicly now because it might provide a way to reverse engineer de-identified PHI later. Last week, we noted that the HHS OCR held a workshop on de-identifying protected health information under the HIPAA Privacy Rule. If you de-identify PHI, as we also recently noted, the Privacy Rule and its penalties for disclosure don’t apply – you can enter a “safe harbor” if you remove the 18 identifiers in PHI or use a “statistical standard” to de-identify your patient data. Avoiding HIPAA penalties sounds pretty good…but how exactly do you go about de-identifying PHI? HHS OCR, which is responsible for enforcing the Privacy Rule, is not sure yet. Under ARRA, HHS is required to…

Continue reading...