Article Highlights Risks of Social Media in Medicine

Dr. Alexandra Thran was fired from Westerly Hospital in Rhode Island after posting information about a patient on a social media website. Dr. Thran did not mention the patient by name, but had provided details that could be used to identify the patient.

In addition to being fired, Dr. Thran was also reprimanded by the state medical board and fined $500.

The increase in communication through social media has led to the blurring of patient privacy boundaries. Some healthcare professionals have faced stiffer penalties under HIPAA for posting pictures of, or discussing patients over social media outlets. The best piece of advice for those who use social media and work in the healthcare setting may be to keep your professional life separate from your personal life -- especially online.


Source: Boston.com
http://articles.boston.com/2011-04-20/lifestyle/29451939_1_social-media-patient-emergency-room

URAC Releases Revised HIPAA Privacy and Security Standards

URAC has released revised HIPAA privacy and security standards to align with provisions in the American Reinvestment and Recovery Act (ARRA) and Health Information Technology for Economic and Clinical Health (HITECH) Act.

The revisions recognize the movement toward the patient-centered medical home and use of the electronic health record. The revisions include:

• HIPAA Privacy Business Associate and Covered Entity programs have been combined into one URAC HIPAA Privacy Standards accreditation program.
• The background and training needed to assume the responsibilities of a “Privacy Official” have been clarified.
• New standard language has been added requiring that organizations offer individuals an electronic copy of their health information contained within a designated record set or to have that information forwarded to a third party of their choice.
• The background and training needed to assume the responsibilities of a “Security Official” have been clarified.
• Clarification around the need to update policies and procedures prior to the effective date of changes to the Security Rule and law or regulation affecting the Security Rule, as well as application for accreditation.
• Applicant organization must maintain an archive of superseded policies and procedures for at least six (6) years, which is the same for privacy documentation.

To read the full announcement, click here:
http://www.urac.org/press/cmsDocument.aspx?id=741

HHS Issues $4.3 Million Fine for HIPAA Violations

The Department of Health and Human Services (HHS) has imposed $4.3 million in fines against Cignet Health of Prince George's County, Maryland for violations of the HIPAA Privacy Rule.

The HHS Office of Civil Rights found that 41 patients were denied access to their medical records. The HIPAA Privacy Rule requires that this information be provided to patients within 30 days of the request.

To read more, click here:
http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/cignetcmpresolution.html


Source: U.S. Department of Health and Human Services

Are You HIPAA Compliant?

Has your organization conducted a risk analysis to ensure effective and appropriate administrative, physical and technical safeguards to secure electronic protected health information (e-PHI)? If not, every year, the Department of Health and Human Services Office of Civil Rights (OCR) develops guidance to help organizations comply with HIPAA privacy rules.

One recommendation from OCR's May 2010 guidance asks organizations if they have performed an analysis of possible risks and threats to health information. As technology has developed, so has the risk of committing a HIPAA violation, whether intentional or accidental. For example, social networking has made it easier for healthcare professionals to "vent" about a problem patient, and physicians are even starting to request that patient information be sent to them via text message. While not all of these may be HIPAA violations, the flow of patient information can certainly make employers and healthcare entities nervous.

For tips and guidelines on how to perform a risk analysis, see the following guidance and make sure that your employees and colleagues know the ins and outs of HIPAA: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf


Source: HHS

Sixteen Houston Hospital Workers Fired for HIPAA Violation

Sixteen employees of the Harris County Hospital District were terminated last month after accessing the medical records of a first-year medical resident who had become a patient.

The employees had accessed the records of Stephanie Wuest, a doctor who had been admitted after being shot in a supermarket parking lot on October 29. One terminated employee stated that the records were accessed out of concern for the colleague, and that they were just trying to locate Wuest.

HIPAA requires that a hospital issue "appropriate sanctions" when an employee violates the law. The Harris County situation is one example of employers setting a firm rule against access to medical records without the consent of the patient or patient's guardian.

Some have argued that incidents of mistake, or access to records out of concern for a colleague should not be considered severe enough to warrant termination. Others argue that the privacy risk to the patient is too great and that hospitals should punishing HIPAA violations with a firm hand, especially if employees are provided sufficient education in the law and in what constitutes a violation.

This incident serves as a reminder that when it comes to HIPAA, make sure your colleagues and members of the medical staff know the law and are aware of the consequences enforced at your facility.


Source: Houston Chronicle

New Hampshire Attorney General Investigating Alleged HIPAA Violation

The New Hampshire Attorney General's Consumer Protection and Antitrust Bureau announced that they are investigating an alleged breach of 1,500 patient records at Wentworth-Douglass Hospital in Dover, NH.

Two doctors at the facility reported the violation, saying that a former employee altered the records between 2006 and 2007. The doctors, Cheryl Moore and Glenn Littell, also claim that for reporting the violations, the hospital retaliated against them by ending their contract with their pathology practice.

The Attorney General's office is expected to spend a few weeks investigating the claim before determining if any additional action is required.

Arkansas Doctor and Hospital Employees Plead Guilty to HIPAA Violations

A doctor and two hospital employees at St. Vincent Infirmary Medical Center in Arkansas face a maximum penalty of one year in prison and/or a fine of up to $50,000 because of their curiosity. All three parties have pled guilty to unrelated misdemeanor violations of HIPAA laws.

Dr. Jay Holland admitted to accessing a patient's record after seeing a news report. Dr. Holland accessed the record in order to determine if the news report was true. His privileges were suspended for two weeks and was required to complete on-line HIPAA training.

Sarah Elizabeth Miller, a former account representative at St. Vincent, admitted to accessing a patient's records 12 times. Miller, who had received HIPAA training, was fired after admitting that curiosity was the reason why she had accessed the records.

Canada Griffin, an emergency room unit coordinator, was asked to set up an alias for a patient. After the patient was moved the the ICU, Griffin was curious about the patient and looked up the patient's medical charts. Griffin was also fired from St. Vincent.

All three situations show how simple curiosity can turn into a serious HIPAA violation that can compromise your employment. Make sure that the members of your medical staff and staff in your medical services office are well-trained in HIPAA to prevent violations in your facility.


Source: Federal Bureau of Investigation, Little Rock
http://littlerock.fbi.gov/dojpressrel/pressrel09/lr072009.htm

FTC Delays Physician "Red Flag" Rules

The Federal Trade Commission (FTC) has delayed the May 1 implementation deadline of the "red flag" rules for physicians, setting a new compliance deadline of August 1, 2009. The red flag rules require creditors to have written policies for preventing and handing cases of identity theft. Physicians fall under the act because they receive deferred payment through insurers.

The American Medical Association (AMA) and other groups claim that the red flag rules place an unnecessary burden on physicians, especially small practice groups. They also claim that the protections intended under the FTC rules are already addressed under HIPAA.

Source: AMNews
http://www.ama-assn.org/amednews/2009/05/11/gvl10511.htm

HHS Inspector General Says CMS HIPAA Oversight Is Ineffective

An October 27 report from the Department of Health and Human Services Inspector General states that “limited actions” by CMS have “not provided effective oversight or encouraged enforcement of the HIPAA Security Rule by covered entities.”

The main concern of the report is that CMS relies on complaints in order to identify organizations to investigate for failure to comply with HIPAA regulations.

The HHS Inspector General admits that the audit cited in the report was performed in 2007, before CMS signed a contract in January 2008 with PriceWaterhouseCoopers to assist with compliance reviews. However, it still stands behind its recommendation that CMS take a more proactive approach to identifying HIPAA compliance issues.

CMS disagrees with the report. While compliance reviews would be beneficial, CMS believes that the complaint-driven system encourages voluntary compliance. It also stated that the Inspector General's report fails to highlight other steps taken by CMS to improve HIPAA compliance such as industry outreach, education, and complaint investigation and resolution.

Source: Government Health IT
http://www.govhealthit.com/online/news/350651-1.html

Click here to view the HHS Inspector General's report:
http://oig.hhs.gov/oas/reports/region4/40705064.pdf