Web-Tones

Healthcare & Data Security: Still the "Red Headed" Step Child?

This article, based on a Ponemon Institute survey, fairly summarizes what many of us know through anecdotal evidence to be the state of privacy & security within the healthcare industry. Simply put, it remains dismal, almost five years after the HITECH Act.

Part of the reason is cultural. Healthcare has been, and remains, the most insular and myopic industry in the U.S., bar none. Based on a million and one false assumptions, the culture within healthcare has been "we are SO different than everyone else" and therefore the same rules don't apply. Those illusions (and delusions) are in the process of being significantly disrupted. However old ways of thinking die hard!

I once had a Chief Medical

Officer of a major hospital tell me that

he would rather retire and move to

Mexico than comply with the HITECH

Act...

We may literally have to wait for a generation of old docs (mostly men) to retire before we see real progress in healthcare, and not just regarding privacy & security. All the change that the healthcare industry is currently struggling with is destroying the "world view" of a generation that refuses to believe this kind of disruption is possible. Change is hard for everyone, BUT for a few that were once so privileged it may be devastating, and just too much to handle.

Healthcare and Social Media: Go Big or Go Home?

WASHINGTON – In an effort to engage with returning veterans at the local level, the Department of Veterans Affairs (VA) has set up Facebook pages for each of its medical centers nationwide.

via www.healthcareitnews.com

The Veterans Administration ("VA") continues to "Go Big" with its social media strategy. Although not directly mentioned in this article, you can bet that the VA has a social media policy in place that guide staff with respect to HIPAA compliance. Here's the money quote from the article:

“Veterans of all eras are depending on us to get the right information to the right person at the right time,” said Brandon Friedman, VA’s director of online communications, and a veteran of the wars in Iraq and Afghanistan. “With more troops returning home, we also have a responsibility to connect with the thousands of service members who have been – and will be – entering our system. They’re using social media, so that’s where we need to be. Facebook helps us do that.”

Why go on Facebook? Because that is where the Vets are, it is a simple as that. It is not suprising that the VA is taking a leadership role here. It has taken a leadership role in many aspects of healthcare, including EHRs, and I expect that it will continue to do so.

Social media in healthcare, like any

other industry, does not lend itself to

a "toe in the water" approach. Sure you

can start there, but eventually you have

to "go big or go home" to get the ROI.

 Here's an excellent summary of the current state of healthcare and social media, including  a discussion of HIPAA and other challenges covered entities face as they make the move online.

 

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

HIPAA Compliance: Patient's Bill of Rights (PBR)?

Our view is that the HIPAA Privacy Rule can be broken down into the categories illustrated below:

This posts discuss what we refer to as the Privacy Rule's Patient's Bill of Rights (PBR) which are contained in Section 164.520 through 164.528. Although the PBR has been part of the HIPAA Privacy Rule since the very beginning (circa 2004) the number of patients that have taken advantage of what it provides is quite small. Cignet Health went rogue and violated the PBR in an egregious manner and got whacked with a $4.3M fine.

 

Cignet Health went rogue and 

violated the PBR in an egregious 

manner and got whacked with a $4.3M

fine.

 

Let's walk through the major components of the PBR in order to provide a sense of what a patient is entitled to. To see why the PBR will become increasingly more important read David Harlow's excellent piece on the proposed expansion of the PBR related to lab data.

 

Right to Notice found in §164.520 

§164.520 (a): right to notice for U&D of PHI with some exceptions for group health plans and inmates:

Nothing new here regarding covered entities (CE) providing notice, CE's have been complying with this provision since 2004.

§164.520 (b): content of notice

Likewise CEs clearly understand that certain language must be included in the notice. However, most CE's do not realize that if they run a website then their privacy notice must be prominently displayed electronically.

§164.520 (c): provision of notice

Notice differs depending on the type of CE (e.g health plans versus CEs that provide direct treatment.

§164.520 (d): joint notice by separate CEs allowed under certain conditions

§164.520 (e): notice documentation (see §164.530(j)) (e.g. notices and good faith efforts to obtain must be retained)

 

Right to Request Privacy of PHI found in §164.522 

§164.522 (a): restrictions of U&D 

CE must allow a patient to request certain restrictions althought the CE need not honor all of them.

164.522 (b): confidential communications CE must allow patients to request alternate means of confidential communications. 

 

Right to Access PHI found in §164.524 

164.524(a): access to PHI

Patient has an undisputed right to access their PHI with certain minor exceptions. If CE denies access then it must be well document. Patient can normally request a review "third party review" and said review must be granted. This PBR provision has not been widely used heretofore but you can expect that to change. This provision is what got Cignet Health whacked. 

§164.524(b): Request for access and timely action

Generally the CE has 30 days to respond but can ask for a 30 day extension in writing. The fees charged for providing access are regulated.

§164.524(d): Denial of access

As mentioned above if access is denied then CE must document carefully and a patient generally has a right to request review of the denial.    

 

Right to Amend PHI found in §164.526 

Generally a patient has an undisputed right to amend PHI, with certain exceptions, and the CE must follow a procedural process similar the the access process (e.g. documentation).

 

Accounting for Disclosures requirements found in §164.528 

This is where the PAIN FACTOR for CEs may increase dramatically if patients en masse start asking for disclosures.

§164.528(a): Right to an accounting of disclosures of PHI within six years prior to date of request

Yes indeed, and under HITECH disclosures for treatment, payment and operations are no longer 

§164.528(b): Content of the accounting; 

The required elements mandated by the regulations.

§164.528(c): Provisioning of disclosure

Disclosure must be provide no longer than sixty (60) days.

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Are you for an Internet Lawyer with HITECH /HIPAA experience?

 

Health 2.0: Top 10 Doctor Blogs?

We write quite often about HITECH / HIPAA compliance on this blog and in our newsletter, but have not paid all that much attention to the intersection of HIPAA and social media.

The growth of social media is obviously exploding and hospitals are clearly getting in on the act. The intersection of HIPAA and social media is clearly a space that deserves more of our attention. We begin by featuring some of the top blogs from the docs:

If you want to figure out what

is going on in the healthcare

trenches then this is a great place

to start.

 

1) John Halamka, MD: Life as a Healthcare CIO.

Blog Summary (from the blog): Every day I experience life in the world of healthcare IT, supporting 3000 doctors, 18000 faculty, and 3 million patients. In this blog I record my experiences with infrastructure, applications, policies, management and govnerance as well as muse on such topics as reducing our carbon footprint, standardizing data in healthcare and living life to the fullest. 

2) Kevin Pho, MD: KevinMD.

Blog Summary (from the blog): The Wall Street Journal calls KevinMD.com a “punchy, prolific blog that chronicles America’s often dysfunctional health care system through the prism of a primary care provider,” while others have noted that “a lively comment stream on one of Kevin Pho’s posts provides more insight on the day-to-day realities of health care than any piece of journalism can ever hope to impart.”

3) Mike Sevilla, MD: Family Medicine Rocks.

Blog Summary (from the blog): Even though there is a new name of the blog and the podcast, my goal remains the same. I still want to talk about interesting things in medicine and social media. I also still want to talk to interesting people in medicine and social media (not necessarily in Family Medicine). What you'll see below are some articles and sites where I have been featured. Enjoy!

4) Howard J. Luks, MD: Musings of a Patient Centric Orthopedist

Blog Summary (from About Me): In the end… my presence online is to support the spread of meaningful, trustworthy, evidence based (when available), actionable information and guidance to patients and consumers from around the world. I feel that physicians have a moral obligation to fill Google’s servers with quality content to drown out the commercialized nonsense that exists online today...The information on this site is for the most part, evidence-based. That means that I spend an awful lot of time reading and incorporating into my practice the scientific literature regarding state of the art treatments for shoulder, knee, elbow and ankle disorders. Unfortunately, not all recommendations can be evidenced based — simply because the evidence doesn’t exist. When *eminence* based decisions are necessary I fall back on my 14 years of experience at a Level 1 trauma center and a tertiary referral center.

5) Jeffrey Parks, MD: The Buckeye Surgeon

Blog Summary (from the blog): Ruminations by a non-academic general surgeon from the heart of the rust belt.

6) Katherine Chretien, MD: Mothers in Medicine

Blog Summary (from About Us): Katherine Chretien, KC, founded Mothers in Medicine in May 2008, hoping that a community built around telling our stories as physician-mothers could be a vehicle for support not otherwise found online or IRL (in real life.) She is an internist, clinician-educator, mother to three (born in 2005, 2008, 2011), and married to a brilliant public health servant who was her medical school classmate. She loves her job, being a mother, and writing. This site is her labor of love.

7) Westby G. Fisher, MD: Dr. Wes

Blog Summary (from the blog):Musings in the life of an internist, cardiologist and cardiac electrophysiologist.

8) Mike Magee, MD: Health Commentary

Blog Summary (from the blog):“Health Commentary with Dr. Mike Magee” is a blogsite hosted by veteran health care leader and advocate Mike Magee, MD. The site brings the concept of “health populism” to the web—that is, the idea that health care should not be in the hands of an elite “few,” but that ALL of America’s citizens have a voice and a stake in the health care debate and should express their opinions and ideas online.

9) Val Jones, MD: Dr. Val and the Voice of Reason

Blog Summary (from the blog): My take on health, medicine, and the pursuit of happiness. No information in this blog is intended to diagnose or treat any condition. The opinions expressed here are Val's and do not necessarily reflect those of Revolution Health. 

10) Dr. Jan Gurley: Posts from an Insane Healthcare System

 Blog Summary (from About Me): Doc Gurley’s motto when it comes to health writing is: Just A Spoonful of Humor Helps The…well, even without Julie Andrews breaking into song, you get the idea.

Doc Gurley’s health writing has appeared in Salon, The San Francisco Chronicle, the Chronicle Sunday magazine, and The L.A. Times. Passionate about the quality of health reporting, she’s even had skewering letters in such diverse platforms as the Washington Post and UK’s Daily Telegraph. Her research has appeared in academic publications including the New England Journal of Medicine.

Summary

Are these docs writing about compliance? Mostly not, but if it begins to make its presence felt in their practices you can be sure they will be writing about it. You can also tell from reading these blogs that the docs are careful not to cross HIPAA boundaries. If you want to learn about what is going on in the healthcare trenches then this is a great place to start!

Do NOT read anyting into the order. The order was randomly selected. These are all unique blogs with unique voices (as you might expect).

 

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience? 

 

HIPAA Compliance: Culture of Compliance as a Governance Model?

The healthcare industry ("Industry") is in desperate need of a new compliance governance model. The reality is that, for all intents and purposes, the old governance model (as discussed below) was largely pure fiction, because HIPAA prior to HITECH was a paper tiger (i.e. un-enforced legislation). The Industry clearly understood that this was the case. Sure it paid lip service to the Privacy Rule, but that response can hardly be construed as a governance model. Therefore, the challenge that the Industry now faces, across stakeholders of all sizes, is to invent a compliance governance model from whole cloth, with all the cultural and organizational challenges associated with same.

 

The DOA Governance Model

Governance, risk management and compliance (“GRC”) is a useful umbrella concept that many compliance professionals have adopted. The basic premise is that any compliance initiative is a response to organizational risk. A governance model is an organizational risk management approach designed to mitigate the negative consequences of non-compliance. This is certainly the dominant view wherein compliance is perceived as a “necessary evil.” Under this world view the risks associated with non-compliance must be contained. To the degree that the healthcare industry (en masse) adopted any HIPAA governance model, it almost certainly was based on the GRC approach. The critical question, in the vernacular was “what do we need to keep from getting whacked by the government?” Under the old HHS enforcement regime the answer was “not much.”

Our view of GRC with respect to HIPAA compliance is that it is necessary but not sufficient. Why? Because implicit in the GRC model, standing alone, is the hidden premise of “containment.” Although risk management will remain a critical component of any governance model, it is our view that real compliance success under the new HHS enforcement regime can only be achieved by incorporating privacy and security as essential parts of an organization’s value proposition (i.e. an essential component of the products and services a provider delivers to the marketplace) as manifested in its day-to-day operations.

Consider what security means to the online banking industry: is it simply something to be contained or an essential mission critical aspect of the service it delivers to the marketplace? The differences between the two approaches are like night and day. Security for online banking is a “bet the company organization-wide imperative,” certainly not something “bolted on” after the fact. Now, we don't mean to suggest that the healthcare industry should immediately assign the same weight to privacy and security as the banking industry. The healthcare industry is not only inordinately complex but has a completely different set of unique marketplace challenges (i.e. the analogy only stretches so far).

That notwithstanding, the comparison is useful as an illustration of why the GRC approach for healthcare is not enough. Our view is that the emerging healthcare marketplace will demand that privacy and security be an important part of a provider’s value proposition and that in turn will drive the approach that the industry should take with respect to a compliance governance model. In addition, although clearly small providers will not have the same governance model as large hospitals, it is nonetheless important for all stakeholders to understand the distinction in approaches. Small providers are increasingly being aggregated into healthcare ecosystems of larger players. This trend will continue. The privacy and security imperative will become an industry imperative, driven as much from the inside as by external agents such as state and federal governments and patients.

A Proposed Governance Model

Compliance is a set of processes and not a onetime event. In fact, our compliance continuum “build a good story” metaphor suggests that persistent iteration in process improvement over time is the only practical methodology for achieving the objective of “full compliance” (an aspirational goal that may never be reached in fact). The compliance governance model you select must incorporate this iterative philosophy into your organization’s day-to-day operations or you run the risk of having your compliance initiative being nothing more than “lipstick on a pig,” dressed up for a time but remaining ugly nonetheless (See Five Compliance Strategies Gauranteed to Fail).

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

 

 

HIPAA Compliance Software: Who needs it?

The answer to this question in the past was probably no one. Why? Because HIPAA prior to the HITECH Act was a dead letter, a law that was on the books but essentially not enforced Although HHS' enforcement efforts under HITECH has not been very agressive to date (understatement) that is something that is likely to change. The U.S. government will be handing out millions (if not billions) of dollars in EHR incentives and simpy cannot afford to look the other way regarding privacy and security.

Cybersecurity is becoming a big deal in Washington and the recent attacks will likely add fuel to the fire. In short, in the 21st century privacy and security are consumer issues that refuse to go away. The healthcare industry has largely gotten a pass so far, but there is no way that this status quo can be maintained.

So who needs HIPAA Compliance Software? The answer to this question now is all business associates and covered entities. There is simply no way that legacy manual methods of tracking HIPAA Compliance will suffice. Spreadsheets and other documents standing alone will also not get the job done. The bottom line is that HIPAA Compliance Software, like a high quality EHR, will become a cost of doing business. Taking an ostrich approach to the problem will only defer the pain.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

Clinical Groupware?

Clinical Groupware is a no brainer! Whatever this category of software service is eventually labeled, it is likely to have a major impact on the healthcare industry going forward. Contrary to what is stated in the link, we believe there are "enabling horizontal" examples of this category alive and well today, being used by millions in production environment across the globe. Google Apps is a great example.

Why horizontal? Because these platforms can be customized to work for any industry. They were built with this concept as a foundational principle. The videos below illustrate how Google Apps is currently being used in healthcare.

---

The video below illustrates how Genentech uses Google Apps for email and other collaborative activities.

The video below illustrates how  SF Bay Pediatrics, a group of Board Certified Pediatricians who are dedicated to the care and well being of children, uses Google Apps as core collaborative infrastructure component for their practice.

In the video below the CIO of Essilor, a worldwide leader in the design and manufacture of lenses, discusses the power of Google Apps for a global enterprise. 

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Healthcare, Technology & Innovation?

Why yes, of course. Don't believe that healthcare innovation is real then read this interview where David Harlowe has a great discussion with John Glaser CIO of Partners. Here's one of many money quotes from the interview:

So there are a lot of demands on the systems, there are a lot of demands on the implementation process and the workflow change process and there are a lot of demands on support, and obviously there are a lot of demands on the practice who goes through this.  Nonetheless once you get through that we have never had any clinician of any form say I wish I could go back to paper.. 

Sure, once an organization goes through the pain and starts to see the gains then you NEVER hear providers saying "give me back my paper." It is only the "pain part" that providers want to avoid and there is simply no avoiding it. Everyone wants painless change and change doesn't work that way.

Here's another money quote regarding the ROI argument, and it is directly on point:

So I think we will see a return broadly speaking - realizing how tangible or intangible, how dollarizable or not dollarizable it is, to the sort of settings in which it’s delivered.  I think at the end of the day it is one of those things which you say listen, this is a given.  It is hard to imagine that we would sit here today and say if ten years from now we ran our health care system on paper that would be okay or a good thing.

Electronic records are just the way healthcare will be done in the 21st century. It's a cost of doing business. The ROI will be real (and significant) in the mid to long run. This return will be manifested in a number of ways, not the least of which will be a gain in market share? Why? Because providers that choose to go through the pain now will be (much) better positioned to use the technology in ways they can't even imagine today. This is true across industries and healthcare will be no different.

---

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Healthcare Moves to the Cloud?

CareCloud Raises $2.3 Million For Web-Based Physician Practice Software Suite. I don't know that much about CareCloud, but I do wish them well because this is going to be a super competitive field. The big EHR vendors are all (probably ) preparing cloud based solutions of their offerings and there may be some (additional) high profile big name gorillas that decide to enter this space soon.

In short, billions of dollars are going to be flowing into healthcare and currently many of the big boys have caught the smell of money. The sense is that not only is healthcare on the cloud a huge market, but many of the incumbents may be vulnerable to well-heeled competitors with both the technical and financial muscle to achieve dominance in what has historically been a somewhat protected market.

Looking for a best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?

 

Health 2.0 is coming to a theatre near you?

This is an article that Esther Dyson wrote a couple of years ago (September 2007) after attending a Health 2.0 conference. A lot has changed since then, but many things will take time (lots), innovation (good 'ole American ingenuity), and a significant amount of hard work by smart and dedicated people, before we can claim anything like progress. Here's the money quote from the article:

In the same way, the companies here are empowering consumers (or patients) giving them the tools to talk to one another, to question their doctors, to monitor their own conditions... But they can't simply dissolve a hairball, as someone described the health care system earlier in the day. They need to take on the calcified mess at the bottom of the drain - or to be more anatomical about it, they are clearing the capillaries and buffing the nerve endings, but at the center of everything there's a calcified heart pumping blood/information/money in the wrong direction through a tangled mass of arteries that misdirects resources to tumors and useless vestigial organs.

The hairball is being dissolved as we speak. We will get health reform in the U.S. because some of our best and brightest are working on the problem, and they're not in it just for the money. These are people that want to see an improved healthcare system in the U.S,.because if we don't get one we are all going to die a death of a thousand cuts. At 16% of GDP, healthcare costs are out of control and U.S. healthcare quality lags, in general, the rest of the developed world. 

It is a matter of economic survival in a world economy wherein a sick America won't otherwise be able to compete. It is the right thing to do as well. It is a legacy that we owe our children and grandchildren. It is as basic as the First Amendment, the right to vote, and equal protection under the law. Our healthcare system, as it exists today, is un-American, a relic of days long past. It is time for people of good conscious, across the political spectrum, to stand up and be counted.

Electronic health records are a step in the right direction. Health 2.0 depends, to a large degree, in moving our healthcare system to the twenty first century. But that won't be enough, the industry is going to need lots of help if the vision is to be realized. Given those on the front lines some relief from absurdly priced malpractice insurance is also a must have requirement. We are collectively asking a lot of our providers, we should be prepared to give them something of significance in return.

Looking for a best of breed HIPAA Compliance Software?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH / HIPAA experience?