Category:

PHI Breach Penalty Dollars Rolling in for Healthcare Enforcement

November 1st, 2018 by

PHI BreachBy: Dave Davidson

It has been a busy autumn for the enforcement of health care privacy rights.  Recent activities range from settling the claim for the largest HIPAA violation in US history, to penalties imposed for filming TV shows, to actions initiated by state governments.  All of these actions confirm the serious position taken by regulators nationwide to protect the privacy of protected health information (PHI).

The Big One

On October 15, 2018, Anthem, Inc., an independent licensee of Blue Cross, paid $16 million to settle its claim with the HHS Office of Civil Rights (OCR), for a breach that compromised the PHI of 79 million people.  This was the largest reported breach in history.  The PHI breach occurred in 2015, when hackers initiated a “spearfishing” attack via fraudulent emails.  The government found that Anthem lacked appropriate information system procedures to identify and respond to security breaches, and minimum access controls to stop these kinds of attacks.

In addition to the financial penalty, Anthem agreed to a corrective action plan, in which it agreed to perform a risk analysis, and incorporate the results of the analysis into its existing processes, in order to achieve a “reasonable and appropriate level” of HIPAA compliance.

This settlement is in addition to the $115 million settlement Anthem reached last year with the victims of the breach. read more

Expanding the Reach of your Medical Practice through Telemedicine

June 19th, 2017 by

“Wherever the art of Medicine is loved, there is also a love of Humanity.” ― Hippocrates

telemedicine lawBy: Shobha Lizaso

The need for healthcare services is growing at an exponential rate throughout the US and across the world while the number of healthcare providers is dwindling in comparison which paves the perfect way for telemedicine. The ease of healthcare access should be standard for all people, but many go without healthcare because of their geographic location or lack of funds. From these circumstances, technology has risen as the new champion for the provision of healthcare; technology is building necessary connections between healthcare providers and patients through telemedicine. The field of telemedicine complements traditional medical care in various ways already, and it is expected to continue to expand through the healthcare industry. Some current uses are as follows: read more

HIPAA Security Basics: Keeping your Medical Web-Based Business Compliant

May 16th, 2017 by

By: Shobha Lizaso

Medical web-based businesses have been on the rise, while the number of HIPAA enforcement actions by the US Department of Health and Human Services (HHS) has risen exponentially as well. Since the beginning of this year, HHS has announced several large settlements with companies that failed to comply with HIPAA Compliance requirements. For example, in January, HHS announced a $2.2 million settlement with a health insurance company when a breach resulted from a stolen portable USB device containing PHI. Also, In February, HHS announced a penalty of $3.2 million against a medical center for a breach that arose from a theft of an unencrypted laptop containing PHI. This enforcement activity is becoming the norm, so it is best to ensure that your medical website is legally compliant.

If you are handling any PHI on or through your website, you must ensure that your website is up to speed with HIPAA compliance. Here are some recommendations to address the security and privacy of PHI that your website may manage (please note that this is not a comprehensive list): read more

HIPAA Compliance: Docs, You’ve Been Hacked. What’s Next?

August 11th, 2016 by

HIPAABy: Jacqueline Bain

Healthcare providers have heard the HIPAA disaster stories: a laptop containing patient information is left on the counter at the coffee shop; a thumb drive with patient files goes missing; a rogue employee accesses patient information she has no business accessing; hackers get into a practice’s server and hold the patient information for ransom.

HIPAA is a federal law designed for safe disclosure of patient’s protected health information.  The news headlines showcase giant penalties for violations.  However, Florida healthcare providers should also know that Florida has its own consumer protection statute, called the Florida Information Protection Act.  So while you’re busy worrying about your HIPAA exposure in any of these situations, remember that there is potential State exposure as well.

So what should a healthcare provider do if it believes there has been a hack or some other unauthorized disclosure?  Responses vary based on the situation presented, but below is a good jumping off point: read more

Physician Communications: Considerations for Using Text Messages and Social Media

March 6th, 2015 by

doctors textingBy: Jackie Bain

It is becoming easier and easier for physicians to communicate with each other and their patients.  And although open communication is generally thought of as positive, the medical profession should proceed with caution.  Patients and consulting physicians rely heavily on their communications with their treating physicians.  Thus, communications which do not require the thought of focus that a physician would otherwise give to a situation may result in disaster. While there are many potential ways a physician might use text messaging and social media both professionally and personally, we will focus generally on physician interactions with other physicians, and physician interactions with patients.

To start, physicians should be aware that, in 2011, the American Medical Association issued guidelines in its Code of Ethics for physicians who use social media: read more

Fall 2014 HIPAA Audits: Is Your Business Ready?

October 9th, 2014 by

hipaa-audits-imageFile-3-a-7296By: Jackie Bain

Section 13411 of the HITECH Act authorizes and requires the Department of Health & Human Services Office for Civil Rights (“OCR”) to provide for periodic audits to ensure that covered entities and business associates comply with the HIPAA Privacy and Security Rules. OCR conducted its first round of those audits in 2011 and 2012, and has announced that it will begin a second phase.  Unlike the first phase of audits, which were limited to covered entities, both covered entities and business associates are intended to be audited during this second phase.

How will audited businesses be selected?

This fall, OCR will deliver pre-audit surveys to between 550 and 800 covered entities.  OCR is attempting to obtain a fair snapshot of all covered entities, so these pre-audit surveys will be sent to health care providers, health plans, and health clearinghouses. Moreover, the audits will span the gamut of business sizes, from large corporations to solo practitioners. After pre-audit surveys are returned, OCR will randomly select 350 of those covered entities for a full audit.  As a part of these full audits, covered entities will be asked to identify their business associates.  OCR will then select 50 business associates to participate. read more

Federation's Model Telemedicine Policy is Well Timed

July 8th, 2014 by

??????????

Many health policy experts are betting on the expanded role of telemedicine as an essential cost-saving, quality (and access) enhancing tool.  Yet legal and policy issues have dogged the development of useful telemedicine guidelines, making it difficult to know what’s ok and what’s not.  What sort of licensure is required for physicians practicing telemedicine?  When is the physician “practicing medicine” vs. “merely consulting?”  When is a physician patient relationship established?  Is one even necessary?  The newly developed model policy developed by the Federation of State Medical Boards should help guide states in developing specific telemedicine standards.

read more

$800,000 HIPAA Settlement for Leaving Patient Records on Physician's Front Porch

June 23rd, 2014 by

HIPAAThe Department of Health and Human Services announced this morning that it has entered into a settlement agreement with Parkview Health System, Inc., an Indiana medical group caught up in HIPAA violation case.  Parkview was assisting a retiring physician to transition her patients to new providers.  Parkview was also considering purchasing some of the physician’s patient records.  When Parkview attempted to return between 5,000 and 8,000 patient records to the physician, she was not home to accept their return.  Parkview employees left cardboard boxes containing between 5,000 and 8,000 patient medical records outside of the physician’s home, and within twenty feet of a public road.  In settlement and release of HHS’ claims against Parkview for such a HIPAA violation, Parkview agreed to pay the Department of Health and Human Services $800,000 and enter into a Corrective Action Plan.  The entire Resolution Agreement between Parkview and HHS is available here.

Phoning It In – Florida's Brand New Telemedicine Law

March 12th, 2014 by

??????????By: Jackie Bain

Until recently, the State of Florida has successfully avoided regulating telemedicine to account for advancements in technology. In 2003, the State issued standards for telemedicine prescribing practice for medical doctors and doctors of osteopathy, but has not formally revisited its position in light of increasingly common telemedicine practice in several states – until now.

Florida’s forestalling has officially come to an end.  The State recently enacted new physician standards for telemedicine practice, and the State legislature is presently considering further regulation.  These new standards do not impinge upon the prior standards for telemedicine prescribing practice, but are issued in conjunction to it.  read more

Florida Clinical Labs Must Now Give Patients Direct Access to Their Laboratory Test Results

February 11th, 2014 by

lab testingBy: David Hirshfeld 

In an effort to help individuals access their health information so that they can become more actively involved in managing their own health care, several agencies within the Department of Health and Human Services promulgated a rule that modifies the Clinical Laboratory Improvement Amendments (“CLIA”) and the Health Insurance Portability and Accountability Act (“HIPAA”) in a way that supersedes Florida State laws governing the disclosure of laboratory test results directly to patients.

read more