Posts Tagged ‘HITECH’

TV Ratings Should Not Trump Patient Privacy

Saturday, January 3rd, 2015

Yesterday I read a news story about how a woman, Mrs. Anita Chanko, saw an episode of the Dr. Oz show “NY Med” that included video of her husband, who had died 16 months earlier, in the hospital receiving care after being hit by a truck while crossing the street. She did not know that such a video even existed.

The picture was blurred, but the woman knew it was her recently deceased husband because she recognized his voice when he spoke, the conversation topic, the hospital where the care was occurring, along with other visual indicators. She heard her husband ask about his wife; her. She then watched his last moments of life, and then his death on television. (more…)

Improve Information Security and Privacy Now!

Monday, December 22nd, 2014

Too many businesses have poor information security controls in place (e.g,. demonstrably Sony, Staples, and a seemingly infinite number of other companies) and are basically giving their intellectual property, and the personal information they are responsible for, away.

A recent Sailpoint survey reveals that: (more…)

This is Protected Health Information

Thursday, December 18th, 2014

Once or twice a week I get a question from an organization that is considered to be a healthcare covered entity (CE) or business associate (BA) under HIPAA (a U.S. regulation) asking about the types of information that is considered to be protected health information (PHI). Last week a medical devices manufacturer, that is also a BA, asked about this. I think it is a good time to post about this topic again.

If information can be (more…)

4 Privacy Predictions for 2015

Saturday, November 29th, 2014

It is that time of the year again…time for prognostications about the year ahead!

I was asked to provide a few predictions for 2015. Based upon not only what I’ve seen in 2014, but also foreshadowing from the past two-three decades, here are some realistic possibilities.  (more…)

Yes, You Still Need Policies for Your Outsourced Activities!

Friday, December 27th, 2013

Here’s a statement I’ve answered over 100 times (seriously!) in the past few years.

“We’ve outsourced that IT activity, so we don’t we don’t need a policy for it.”

The one word reply to this statement is, (more…)

If it was Intentional it is *NOT* Incidental

Wednesday, December 11th, 2013

In the past week I got the third question in a one month time-frame about the same topic. My unwritten, loosely followed rule is that if three different organizations ask me pretty much the same question in a month, then it is something worth writing about; why are so many (well, a handful) of the same questions occurring in such a short period of time? Is some vendor out there spreading horribly bad advice? Let’s consider the topic… (more…)

What You Need to Know for Retention Compliance

Wednesday, November 20th, 2013

One of the things I love about helping all my Compliance Helper (CH) clients with their information security and privacy compliance activities is that they often ask questions that most other small and mid-size organizations also have. So, I then have a great opportunity to share advice!  One of my recent conversations dealt with the challenges my mid-size client was having in trying to appropriately customize the data and records retention policy and procedure I provide through the CH service to fit his organization’s unique type of business associate service, while also meet compliance with the HIPAA retention requirements. The paraphrased questions below started our conversation after I advised that there are many types of documents that must be retained for at least 6 years to meet compliance: (more…)

If there’s a Shred of Evidence it’s Not Shredded

Monday, October 28th, 2013

“What’s the minimum shred size?”

Recently I got a great question from one of my Compliance Helper clients:

“This may seem like a silly question, but is there any type of HIPAA compliance requirements for shredder types?  For example, minimum shred size?”

Not a silly question at all! Of the organizations that shred their paper documents (there are still way too many that don’t), a large portion of them are not shredding their documents to a point that they are actually doing so effectively. Here are some points and tips (more…)

You Must Practice Daily Compliance Hygiene

Tuesday, October 22nd, 2013

Compliance, like much of life, takes ongoing effort

Okay, folks. Time for a reality check for what data protection compliance involves. 

You know what’s often tedious and hard? Well, a lot of things in life. (more…)

Use Encryption despite Your NSA Snooping Fears

Thursday, September 26th, 2013

I’ve received numerous questions from various news outlets, clients and colleagues since the published revelation that the NSA was getting the assistance of encryption vendors to decrypt messages throughout a very wide range of activities. A lot of folks are now throwing their hands in the air, claiming that encryption is now no longer effective, and planning to use something completely different.  Hmm…wait! Don’t throw out the encryption baby with the unsafe practices bathwater yet. Encryption is still an effective, and necessary, information security control to use. The following are (more…)