On October 10, 2011, there was a report in the Baltimore Sun, “Law firm loses hard drive with patient records: Attorneys represent St. Joseph cardiologist sued for malpractice.” I posted about the report to one of the LinkedIn groups I participate in, pointing out that this is yet one more example of Read the rest of this entry »
Do Subpoenas Trump HIPAA and/or Trample Security Of PHI?
December 10th, 2011Another HIPAA Proposed Rule: Patients’ Access to Test Reports
September 14th, 2011Yesterday the HHS proposed rules that would give patients (and their authorized representatives) direct access to their own laboratory test result reports… Read the rest of this entry »
Auditing Patient Records Survey Results
September 10th, 2011There are no specific requirements that the Department of Health and Human Services provide with regards to how often to perform patient records audits (understandably so, since it should be based upon an organization’s own risk environment), and so many healthcare providers wonder what others are doing, or what is “standard” practice. So, to help determine this, from mid- to late-August (two weeks) I posted a very short, completely unscientific, survey specifically to get a feel for what some other hospitals and clinics are doing with regard to auditing patient records access and disclosures, as required by HIPAA. Here are the results… Read the rest of this entry »
Request for Your Participation – SHORT Survey #2: Workstation Timeouts and Lost SSO Badges
September 2nd, 2011I’ve posted the 2nd in a series of SHORT and ANONYMOUS surveys to determine important HIPAA/HITECH compliance activities at hospitals and clinics. However, for this topic it would be good to have all types of organizations/industries participating… Read the rest of this entry »
SHORT Survey For HIPAA Compliance Activity Benchmarking
August 18th, 2011Those of you who work for healthcare providers… Read the rest of this entry »
HIPAA/HITECH Compliance Is All or Nothing
August 16th, 2011I’m seeing growing numbers of business associates, particularly those who do technology-based services, expressing the belief that they don’t need to worry about complying with most of HIPAA. I wrote a guest blog post for Credant about this misguided thinking that was published today. I welcome your feedback!
KPMG HIPAA Auditor Caused a Data Breach
August 9th, 2011A KPMG auditor caused a breach for New Jersey hospitals because he or she lost an unencrypted flash drive containing over 4,500 patient records. Read the rest of this entry »
UCLA Health System Pays $865K to Settle Celebrity Privacy HIPAA Violations
July 8th, 2011Here’s yet another HIPAA violations penalty to add to what seems to be a quickly growing list. In this case it was a violation of the minimum necessary access principle, in addition to providing the information to reporters, who then published the information. And, it is likely based upon the required actions that go beyond the fine, that the policies, procedures, training, awareness, and access logging processes was lacking as well. Read the rest of this entry »
10 Risk-Reducing Actions for Mobile HIPAA/HITECH Compliance
June 19th, 2011I’m giving a free webinar sponsored by Sophos this coming Wednesday, June 22: “10 Risk-Reducing Actions for Mobile HIPAA/HITECH Compliance.” Here is more information about it: Read the rest of this entry »
