On March 19th, HHS published a notice in the Federal Register that HHS intends to complete approximately 2500 surveys to assess public perception of Health Information Exchanges.[i] Public perception of the security of HIE’s is key to understanding how ONC will eventually regulate HIEs. On a macro level the National Health Information Network (NHIN) is a network of HIEs. At this time most states have received grants to implement an HIE. Recently, however, HHS has also announced a scaled down version of the Connect software to be used for limited transaction between providers. Generally, NHIN Connect software framework is designed to enable secure and interoperable electronic health information exchanges (HIE) with NHIN compliant organizations, including federal agencies, local-level health organizations, and healthcare participants in the private sector. However, the NHIN Direct initiative announced in January, 2010 may replace some HIEs that do not bring value added services to the market [...]
|
||||
|
By Robert Hudock, on March 25th, 2010
 Print This PostMarch 25th, 2010 | Tags: authorization, Connect Framework, consumer consent, DURSAm data sharing agreement, HIE, medical records, NHIN, NHIN Direct | Category: CCHIT, EMR, Federal Agencies, HIPAA Privacy, HIPAA Security, Health Information Exchange, Health Information Technology, Health and Humans Services (HHS), Office of the National Coordinator for Health Information Technology |
Leave a comment
Print This PostBy Robert Hudock, on March 23rd, 2010
Print This PostOn March 22nd http://www.healthreform.gov, an official U.S. Government Web site managed by the U.S. Department of Health & Human Services, announced “The passage of health insurance reform legislation represents a historic victory for the American people. America’s families and businesses will not only get relief from skyrocketing health care costs but will now have more control over their health care. No longer will the insurance companies get the final say when it comes to rates and rights. ” The Reconciliation Bill, ‘‘Health Care and Education Affordability Reconciliation http://docs.house.gov/rules/hr4872/111_hr4872_amndsub.pdf. This Bill was agreed to by both the Senate and House and will be signed into law by the President this week.[i] I am, probably like most Americans a little worried/ curious how things will evolved form here. Last winter when my wife had to wait in line for six hours at the Virginia Department of Public Health on two separate occasions, for our twin daughters 14 months old to receive their H1N1 vaccination, causes me to wonder what exactly health reform will mean for the quality and efficient health care. There are hidden costs of waiting in line for health care, these costs may be more then some of the more sick can endure. Health care is partly a supply and demand problem — with something like universal health care some thought should be given to where and how we can train many new caregivers at a reasonable cost. Forty-five thousand dollars per year for a physician (4 years), or for a physician assistant (2 years) is a large sum of [...] March 23rd, 2010 | Tags: Constitutional, Health Care, Health Care and Education Affordability Reconciliation Act, healthreform.gov, hr872, Obamacare, Reconciliation Bill, supply and demand, Supreme Court | Category: Health Care and Education Affordability Reconciliation Act, Health Reform, Health and Humans Services (HHS) |
Leave a comment
Print This PostBy Robert Hudock, on March 16th, 2010
Print This PostOne of the most common (and high risk) user installed software found on the enterprise desktop computer is P2P[i] file-sharing software. This software can be detected with networking scanning software like Nessus.[ii] Unlike, other software, P2P file-sharing software is very effective at circumventing an organization’s security perimeter. In most organizations measures in-place to prevent users from installing software are easily circumvented: (1) by installing and running the device from a USB key, (2) using the local Administrator account to install the software because the local Administrator account has not been set after the last re-image or the local administrator account password is known to users, or (3) IT installs the software at the request of a user. Recently, the Department of Health and Human Services (“HHS “)has been very proactive in getting the message out that portable media, laptops, and other similar devices that contain electronic protected health information (e-PHI) must be encrypted. However, despite numerous alleged disclosures of e-PHI on P2P networks, HHS is failing to inform patients, covered entities, and business associates of covered entities about the risks of peer-to-peer (P2P) file sharing and the inadvertent sharing of documents containing [...] March 16th, 2010 | Tags: Bittorent, e-donkey, FTC, GLB, Gnutella, Gramm-Leach-Bliley Act, limewire, p2p, Section 5 of the FTC Act, unfair methods of competition | Category: "Expectation of Privacy", Data Hemorrages, FTC Security Breach Notification, Federal Agencies, Federal Trade Commission (FTC), Gramm-Leach-Bliley Act, HIPAA Privacy, HIPAA Security, Health and Humans Services (HHS), Peer-2-Peer File Sharing, Privacy, Section 5 of the FTC Act |
Leave a comment
Print This PostBy Robert Hudock, on March 12th, 2010
Print This PostHIMSS is the largest health care technology conference in the United States. This year the conference was held in Atlanta, the conference brought $25 million to Atlanta. The tone of HIMSS 2010 was cautiously optimistic in light of the uncertainty surrounding threatened Governments legislative actions. Vendors are working hard to meet recently promulgated regulatory requirements for EHR systems; some of legislated requirements for EHRs are not essential or likely to be used by most physicians. The government is positioned as the primary funding source for EHR and HIE technology. Grants for HIE implementation total almost 400 million dollars, with a promise of more grants to come. Implementation models for state HIE’s vary from a federated model to states with loosely associated local HIE’s. Thus far a strong centralized structure seems to be the most effective implementation [...] March 12th, 2010 | Tags: Google Health, Health Vault, HIMSS, HIMSS 2010, Interoperability, ownership, patients, proprietary formats, rights | Category: American Recovery and Reinvestment Act, HIMSS, HIPAA Security, HL-7, Health Information Technology, Health Reform, Health and Humans Services (HHS), Interoperability, NIST |
Leave a comment
Print This PostBy Robert Hudock, on March 1st, 2010
Print This PostUnder the HITECH breach notification requirements, covered entities must notify HHS of all reportable breaches. HHS recently released a list of breaches, including the covered entity, the business associate, number of individuals affected, and the location of the information lost. More than 35 HIPAA covered entities have reported breaches involving more than 500 individuals’ PHI since September 2009. The theft/loss of laptops, desktop and portable media by far represent the majority of the security breaches reported thus far. A summary of breaches reported thus far appears [...] March 1st, 2010 | Tags: Department of Health and Human Services, Freedom of Information Act, health information, HIPAA, HITECH Act, security breach | Category: HITECH Act, Health Information Technology, Health Reform, Health and Humans Services (HHS), Office of Civil Rights, unsecured protected health information |
Leave a comment
Print This PostBy Robert Hudock, on December 10th, 2009
Print This PostOn December 1st, 2009 the Office of the Secretary of the Office of the National Coordinator (ONC) for Health Information Technology announced the creation of a new Chief Privacy Office and the Office of Economic Modeling and Analysis (among three others including the Office of Chief Scientist, Deputy National Coordinator for Programs & Policy, and Deputy National Coordinator for Operations). The New Chief Privacy Officer is a necessary creation under the ARRA (and the HITECH Act). This role is different from the other positions that seem to be a re-organization of roles and responsibilities that already existed to some extent just with more specificity around functions and duties. Aside from the Chief Privacy Officer the New Economic Modeling and Analysis Position seems like a timely creation given recent articles discussing whether Health Information Technology and more specifically Electronic Health Record Systems (EHRs) actually reduce the cost of care and/or increase the quality of care. Also of note, the new Office of the Deputy National Coordinator for Programs and Policy will be responsible for the open source Connect initiative and the National Health Information [...] December 10th, 2009 | Tags: ARB, ARC, ARD, ARF, ARRA, HITECT, Office of Economic Modeling and Analysis, Office of the Chief Privacy Officer, Office of the Chief Scientist, Office of the Deputy National Coordinator for Programs & Policy, ONC | Category: American Recovery and Reinvestment Act, HIPAA Privacy, HIPAA Security, HITECH Act, Health Information Technology, Health and Humans Services (HHS), Interoperability, Office of the National Coordinator for Health Information Technology |
Leave a comment
Print This PostBy Robert Hudock, on November 29th, 2009
Print This PostThis article discusses techniques for implementing the updated requirements of the HIPAA Security Rule, with particular focus on strategies for assessing the effectiveness of implemented security controls to support compliance and audit, as well as a covered entity’s (or business associate) overarching risk management program in the context of HIPAA Compliance. Covered entities are becoming more pro-active in monitoring their business associate compliance with HIPAA privacy and security regulations and the recent changes largely the product of the HITECH Act. In the past I have used a series of questions to ascertain the compliance status of business associates to comply with HIPAA privacy and security rules. I find it useful to map security controls to NIST Special Publication 800-53. The National Institute of Standards and Technology has collaborated with the military and intelligence communities to produce the first set of security controls for all government information systems, including national security systems. The controls are included in the final version of Special Publication 800-53, Revision 3 “Recommended Security Controls for Federal Information Systems and Organizations,” released in August of 2009. (Available at http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final.pdf). [...] November 29th, 2009 | Tags: 800-53, 800-66, compliance, HIPAA, HITECH Act, NIST, security controls | Category: American Recovery and Reinvestment Act, Data Hemorrages, Destruction, Encryption, FIPS 140-2, Federal Agencies, HIPAA Security, HITECH Act, Health Information Technology, Health Reform, Health and Humans Services (HHS), Individually identifiable health information, Interoperability, Meaningful Use, Media Sanitization, NIST, Office of Civil Rights, Privacy, SSL VPNs, anonymization, unsecured protected health information |
5 comments
Print This PostBy Robert Hudock, on November 17th, 2009
Print This PostNext year should be interesting. From Red Flag compliance, federal breach reporting requirements, significantly augmented HIPAA penalties, and HIPAA security standards that are based on NIST guidelines will change the traditional compliance model for Covered Entities and Business Associates. Hot topics for enforcement next year (based on recent CMS audits of their business partners) will likely be in the areas encryption of portable media devices, remote access by employees to protected health information, and failure to document a rational risk management [...] November 17th, 2009 | Tags: ARRA, breach, EHR, Encryption, enforcement actions, FISMA, HIPAA, Interoperability, NIST, OIG, security | Category: American Recovery and Reinvestment Act, EMR, Encryption, FIPS 140-2, HIPAA Security, HITECH Act, Health Information Technology, Health and Humans Services (HHS), Interoperability, Meaningful Use, NIST, unsecured protected health information |
2 comments
Print This PostBy Robert Hudock, on October 15th, 2009
Print This PostOn October 7, 2009 HHS announced proposed rulemaking to modify the HIPAA privacy rule to comply with Section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA) regarding the privacy and confidentiality of genetic information. Generally, the HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The HIPAA Privacy Rule requires a covered entity (and beginning next year Business Associates) to implement reasonable and appropriate administrative, technical and physical safeguards to protect the privacy of personal health information (PHI). The HIPAA privacy rule more generally sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request [...] October 15th, 2009 | Tags: genetic information, Genetic Information Nondiscrimination Act of 2008, gina, HIPAA, PHI | Category: Deidentified Health Information, Federal Agencies, Genetic Information Nondiscrimination Act of 2008, HIPAA Privacy, HITECH Act, Health and Humans Services (HHS), Office of Civil Rights, Privacy, Privacy Law, State Privacy and Computer Security Laws, anonymization |
Leave a comment
Print This PostImprove the web with Nofollow Reciprocity. |
||||
|
Copyright © 2010 Law Blog 2.0 - Robert Hudock, Esq., CISSP - All Rights Reserved - This Blog is a personal blog of Robert Hudock. |
||||
ONC 2nd Annoucement for HIE Grants and a Review of Program Requirements
On March 15, 2010, ONC completed the announcement of State Health Information (State HIE) Exchange Cooperative Agreement Program awardees. The first announcement of awards were on February 12th, 2010. These awards are meant as seed money for State HIE’s which are expected to reach financial independent within 2 to 4 years. The Awardees will be evaluated on various criteria over a four year period. The criteria are detailed in http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_10741_888442_0_0_18/FOA_State%20Health%20Information%20Exchange%20Cooperative%20Agreement%20Program_Sept3_updated%20funding%20formula.doc. A PDF of this same document is available here: FOA_State Health Information Exchange Cooperative Agreement Program_Sept3_updated funding formula. Generally, HIEs are intended to transmit healthcare information electronically across organizations within a region, community or hospital system. HIE generally allow for the movement of clinical information among disparate health systems. Various gateways and interface utilities are used to translate data from disparate information [...]