On October 7, 2009 HHS announced proposed rulemaking to modify the HIPAA privacy rule to comply with Section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA) regarding the privacy and confidentiality of genetic information. Generally, the HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The HIPAA Privacy Rule requires a covered entity (and beginning next year Business Associates) to implement reasonable and appropriate administrative, technical and physical safeguards to protect the privacy of personal health information (PHI). The HIPAA privacy rule more generally sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request [...]
|
|||||
|
By Robert Hudock, on October 15th, 2009
 Print This PostOctober 15th, 2009 | Tags: genetic information, Genetic Information Nondiscrimination Act of 2008, gina, HIPAA, PHI | Category: Deidentified Health Information, Federal Agencies, Genetic Information Nondiscrimination Act of 2008, HIPAA Privacy, HITECH Act, Health and Humans Services (HHS), Office of Civil Rights, Privacy, Privacy Law, State Privacy and Computer Security Laws, anonymization |
Leave a comment
Print This PostBy Robert Hudock, on September 22nd, 2009
Print This PostI am a little unclear as to why privacy advocates and security vendors believe that the harm standard, found within the new HHS regulations for security breaches, in any way hampers the HITECH Act’s security breach notice rule for covered entities and business associates. Many states use a similar risk based type analysis, in fact only seven states have a strict acquisition based standard, of those only a couple of these states link their definition of encryption to FIPS 140-2. In comparison to risk based states where one assesses the potential risk to a consumer resulting from theft of sensitive informatioin, the federal standard is more helpful in the sense that it highlights key criteria to be evaluated in assessing risk to consumers. [...] September 22nd, 2009 | Tags: fear mongering, FIPS 140-2, FISMA, harm standard, HIPAA, OMB, Risk Analysis, security incident | Category: Computer Security Law -- Federal, Data Hemorrages, Encryption, FIPS 140-2, HIPAA Privacy, HIPAA Security, HITECH Act, Health and Humans Services (HHS), Identity Theft, Individually identifiable health information, NIST, Privacy, State Security Breach Laws, unsecured protected health information |
One comment
Print This PostBy Kristen McDonald, on September 15th, 2009
Print This PostWhat happens if the offices of a covered entity are broken into and unsecured protected health information (PHI) of more than 500 individuals is stolen? With the enactment of the Health Information Technology for Economic and Clinical Health (HITECH) Act,1 the ramifications to the covered entity and potential liability stemming from such a breach2 are significant to say the least. Not only is the covered entity required to notify the affected individuals of the breach of unsecured PHI,3 but also the covered entity must notify the media and the Department of Health and Human Services Secretary (HHS Secretary) of potentially damaging information concerning the breach. The HITECH Act’s requirement to report details of a significant breach not only to the affected individuals but also to the media and the Secretary may negatively impact the covered entity’s goodwill in the community and cause a loss of business. Of particular concern to the covered entity’s litigation counsel, though, is the potential liability that the covered entity may face due to the [...] September 15th, 2009 | Tags: Damages, HHS, HIPAA, HITECH Act, litigation, PHI, security, significant breach, unsecured PHI | Category: Computer Security Law -- Federal, Damages, HIPAA Privacy, HIPAA Security, HITECH Act, Health and Humans Services (HHS), Identity Theft, Individually identifiable health information, Office of Civil Rights, unsecured protected health information |
One comment
Print This PostBy Robert Hudock, on September 11th, 2009
Print This PostSocial networking sites, efficient search tools (bing, dogpile, google, yahoo), blogs, cookies, mailing lists, message boards, active x controls/ embedded java script on websites and other databases make it easy to identify that new business prospect or easily cross-reference materials from multiple sources to yield unique insights into a matter of interest. However, these online repositories of data are making it much more difficult to maintain the anonymity of those whose confidential information has been de-identified. De-identified data has many useful purposes; the data can be used in its aggregate for tracking disease, flu outbreaks, tax purposes, etc. There is a darker use of these many data sources, where those in our society that are ethically challenged use these data sources for socially unproductive purposes. [...] September 11th, 2009 | Tags: adversary, auxiliary information, census data, cyber harrasment, cyber stalking, data fingerprint, de-identified, HIPAA, identify, PHI, PII, re0identified | Category: CMS, Computer Security Law -- Federal, Deidentified Health Information, HIPAA Privacy, Health and Humans Services (HHS), Identity Theft, Individually identifiable health information, Law and Technology, Privacy, Safe Harbor Method, unsecured protected health information |
Leave a comment
Print This PostBy Robert Hudock, on September 8th, 2009
Print This PostSecurity Incidents can be accidental incursions or deliberate attempts to break into systems and can be benign to malicious in purpose or consequence, each incident requires a careful response at a level commensurate with its potential impact to the security of individuals and your organization as a whole however few organizations have an appropriate security incident policy. The fundamental components of a security incident response plan include the following — [...] September 8th, 2009 | Tags: malicious hackers, malware, NIST, policy, Privacy, security, security incident | Category: Computer Security Law -- Federal, Data Hemorrages, FTC Security Breach Notification, Forensic Tools, HIPAA Privacy, HIPAA Security, Identity Theft, Law and Technology, Media Sanitization, NIST, Peer-2-Peer File Sharing, Privacy, State Privacy and Computer Security Laws, State Security Breach Laws |
2 comments
Print This PostBy Robert Hudock, on April 20th, 2009
Print This PostStimulus Update – HIPAA This alert provides a brief overview of privacy and security provisions included within “The American Recovery and Reinvestment Act of 2009” (H.R.1, S.1) (the “Stimulus”). The Stimulus also includes funding for health information technology (“HIT”) and funding for comparative effectiveness research. These provisions will be the subject of future alerts. Future [...] April 20th, 2009 | Tags: Attorney General, Business Associates, CMP, Culpability, HIPAA, HR 1, Security Breach Notification, SR 1, Stimulus, The American Recovery and Reinvestment Act of 2009 | Category: American Recovery and Reinvestment Act, HIPAA Privacy, HIPAA Security, HITECH Act, Health Information Technology, Health Reform, Privacy Law |
Leave a comment
Print This PostImprove the web with Nofollow Reciprocity. |
|||||
|
Copyright © 2010 Law Blog 2.0 - Robert Hudock, Esq., CISSP - All Rights Reserved - This Blog is a personal blog of Robert Hudock. |
|||||
Office of the National Coordinator — Time to Reorganize.
On December 1st, 2009 the Office of the Secretary of the Office of the National Coordinator (ONC) for Health Information Technology announced the creation of a new Chief Privacy Office and the Office of Economic Modeling and Analysis (among three others including the Office of Chief Scientist, Deputy National Coordinator for Programs & Policy, and Deputy National Coordinator for Operations). The New Chief Privacy Officer is a necessary creation under the ARRA (and the HITECH Act). This role is different from the other positions that seem to be a re-organization of roles and responsibilities that already existed to some extent just with more specificity around functions and duties. Aside from the Chief Privacy Officer the New Economic Modeling and Analysis Position seems like a timely creation given recent articles discussing whether Health Information Technology and more specifically Electronic Health Record Systems (EHRs) actually reduce the cost of care and/or increase the quality of care. Also of note, the new Office of the Deputy National Coordinator for Programs and Policy will be responsible for the open source Connect initiative and the National Health Information [...]