Web-Tones

FREE WEBINAR: Preview of HHS Omnibus Rule

The HHS Omnibus Rule Webinar will continue our review of the proposed HHS Omnibus Rule ("OR") and discuss the marketplace impact that this comprehensive set of regulations is likely to have on the healthcare privacy and security regulatory landscape. Business associates are going to see an additional regulatory compliance burden as their subcontractors will now be treated as business associates. Covered entities can expect a number of changes including material changes to their Notice of Privacy Practices ("NOPP").

 

Date: February 9, 2012. 

Time: 2:00 to 3:30 EST. 

To register Click Here.  

 

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

 

 

HIPAA Compliance: MN AG Brings Suit Against a Business Associate

Minnesota attorney general brings the first formal enforcement action against a business associate, Accretive Health, Inc., for an alleged violation under HIPAA using her authority under the HITECH Act. 

via www.dwt.com

We have previously written that 2012 will be the year of HITECH Act enforcement and the year that State AGs will awaken and become more aggressive in their enforcement actions. The link above is a harbinger of things to come. Most business associates (BAs) do not realize that their compliance with the HITECH Act is "good law" today.

Forget business associate audits,

breach notification is the 800 pound

gorilla of the HITECH Act, because of

the costs, fines, and lawsuits that a

breach is likely to trigger. What is the

probability that a breach will occur?

High would be an understatement!

 

HHS has added to the confusion by slow walking the Omnibus Rule and given a grace period (understatement) for BAs to comply. However, as indicated in the link above, there is nothing preventing a State AG or the US Department of Justice from bring an action today.

What is likely to trigger an action? Although currently there is a small probability of a BAs being audited, given the fact that HHS has announced that BAs would not be targets of the first round of audits conducted by KPMG through the end of 2012, there is a high probability that a data breach will occur. Breach Notification is the 800 pound gorilla of the HITECH Act, not only because of the costs and the fines, but because of the lawsuits a breach is likely to trigger.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

HITECH / HIPAA Newsletter February 2012

This article explores the proposed HHS Omnibus Rule. The HHS Omnibus Rule ("OR") mostly concerns sections of the HITECH Act that went into effect on February 18, 2010. There was an NPRM that was issued on July 14, 2010 that contained the changes proposed for the final rule. It is quite evident that HHS has not broken any "land speed records" in finalizing the OR, but all indications are that it will be forthcoming "soon." The full text of the OR can be found here. 

To continuing reading the article subscribe to our FREE newsletter or read it in the archives.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

HSG Radio: Preview of HHS Omnibus Rule Part I.

Here's our 2/3/2012 episode.

You can follow our weekly show (and review a complete list of the archived episodes) here.

Listen to internet radio with cleyva on Blog Talk Radio

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

US v. EU Privacy Rights?

On Jan. 25, 2012, the European Commission released the final version of its proposed revisions to the European Union’s data protection framework. The package of changes represents a comprehensive reform of the EU’s 1995 data protection rules.

via www.privsecblog.com

The US is never likely to have the same strong privacy rights as those favored in the EU, but the fact that the EU is moving to expand privacy rights is a pretty good indication of the trend line. The world has changed with respect to privacy and security and many industries, especially healthcare, have been slow to catch the wave. In the US, two industries guaranteed to remain heavily regulated from a privacy and security perspective is healthcare and financial services.

The US is never likely to have the 

same strong privacy rights as those

favored in the EU, but the fact that

the EU is moving to expand privacy

rights is a pretty good indication of

the trend line.

The financial services industry, taken as a whole, started taking privacy and security seriously years ago. Yes there were some laggards, and not all players always implemented the latest in best practices, but as a whole the industry took significant steps to get its house in order. The same cannot be said for healthcare. Sure, the big players are on board, but there are large segments of the industry that still refuse to recognize the changing of the guard.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

 

Data Breaches: State AGs will become more agressive in 2012?

The Illinois Personal Information Protection Act (PIPA) requires that any “data collector”, which includes businesses, universities, governmental agencies or any other entity that deals with personal information, notify Illinois residents in the event of a data security breach.     

via privacylaw.proskauer.com

We have written previously that 2012 will be the year of enforcement (see this post). It will also be the year of the data breach. In 2012 State AGs will awaken from their slumber and start going after companies on the wrong side of this issue. They have a statutory right to bring an action under the HITECH Act, and as the link above illustrates they may become increasingly more agressive in bringing actions under state law law well.

In 2012 State AGs will awaken from

their slumber and start going after

companies on the wrong side of 

this issue.

 

The States are starving for revenue and the time is right with cybersecurity now a front and center national issue. You don't need a crystal ball to understand that this is where we are headed in the short run. Therefore, covered entities and business associates are well advised to get their houses in order.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

HSG Radio Archive: Business Associates: That was Then, This is Now

Here's our 1/27/2012 episode.

You can follow our weekly show (and review a complete list of the archived episodes) here.

Listen to internet radio with cleyva on Blog Talk Radio

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

HIPAA Compliance: Is 2012 the year of enforcement (redux)?

Harsher data protection sanctions are coming - When Apollo wanted to stop Laokoon from warning the Trojans that there were Greek soldiers in the famous Trojan Horse, he sent two giant snakes to kill Laokoon and his sons. Talk about sanctions...

via peterfleischer.blogspot.com/

Peter Fleischer is Google's Privacy General Counsel. In the post above, he writes about increased data breach enforcement across the globe. We recently wrote about 2012 as the year of enforcement here. Peter is not writing specifically about the healthcare industry (i.e. especially since Google Health is no longer with us), but he does have a great perspective as someone who tracks these issues globally, and needless to say, for one of the most powerful corporations on the planet.

There will be blood...the healthcare

industry is well advised to wake-up

and smell the data breaches...2012

will be the year of enforcement.

 

Many socioeconomic phenomenon manifests themselves in repeatable patterns (e.g. the business cycle, elections, etc.). Right now there is little doubt that privacy is a "hot issue" and is likely to remain so in the foreseeable future. From a policy and enforcement perspective the pendulum is now swinging in the other direction. In other words "there will be blood." The healthcare industry is well advised to "wake-up and smell the data breaches."

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

Another day another PHI data breach lawsuit?

The consulting firm that lost a laptop computer with medical data on 23,500 Minnesotans last summer has been sued by Minnesota Attorney General Lori Swanson, who says it violated health privacy laws and state consumer protections.

via www.startribune.com

Many are asking whether 2012 is going to be the year of HITECH Act enforcement and I believe that there are many signs that point in that direction.

• The States are starving for revenue and suits against large covered entities and business associates could be used to fill up the coffers. Most of these cases will settle so state AG's may not even need to use significant resources to get the money. Nice work if you can get it.
• KPMG will continue its "mandatory audit" program under contract with HHS. Early findings may provide significant fodder for HHS to kickstart its virtual money machine (fines levied go into HHS coffers).
• We are going to continue to see high profile breaches and this will put additional pressure on HHS to "DO SOMETHING." Pressure is likely to come from Congress as they get sick of getting beat up by consumer advocacy groups.
• HHS will deliver the final version of the NPRM released in July 2010 (i.e. the "Omnibus Rule") which is likely to set the stage for enhanced enforcement (e.g. against business associates).

Everyone, including HHS, understands that HIPAA prior to the HITECH Act was unenforced. The HITECH Act was meant to send a message that there was new sheriff in town. In 2012 HHS will start to deliver the message.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

 

HIPAA Survival Guide Radio: Patient's Bill of Rights

Here's our kickoff episode.

Listen to internet radio with cleyva on Blog Talk Radio

You can follow our weekly show (and review a complete list of the archived episodes) here.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?