HIMemo

HHS issues health IT privacy and security framework

Health and Human Services Secretary Mike Leavitt on Dec. 15 unveiled a national policy framework and “toolkit” for addressing privacy and security challenges related to electronic health information exchange. Among other things, the framework posits that custodians of personal health information should ensure the information is accurate and up-to-date, and be responsible for protecting the confidentiality, integrity and availability of personal identifiable information. Leavitt also released for comment a draft model for presenting consumers with information about their personal health records.

[ via AHA News Now ]

AHIMA provides ROI guidelines

The American Health Information Management Association (AHIMA) released an article aimed at helping health care providers meet state and federal (e.g., HIPAA) requirements regulating the release of information (ROI), according to a November 12 press release.

Included in the article, Management Practices for the Release of Information, published in the November/December issue of Journal of AHIMA are eight ways for covered entities to help stay compliant with ROI rules:

1. Have comprehensive facility-specific procedures that are documented, current and easily accessible to staff members

2. Provide access to appropriate state and federal regulation references

3. Hold training programs for new staff members

4. Continually educate current staff members

5. Regularly review work ensure staff members meet standards

6. Compile performance statistics

7. Provide routine feedback to individual ROI staff members regarding performance criteria

8. Solicit feedback from requestors

To read the full article, click here.

[ via HIPAA Weekly Advisor ]

GAO urges HHS to prioritize health IT privacy initiatives

The Department of Health and Human Services should develop a process to assess and prioritize the many initiatives to protect the privacy of electronic health information, the Government Accountability Office advised in a report recently. “In the absence of an overall approach that includes such a process, HHS faces the risk that privacy protection measures may not be consistently and effectively built into health IT programs, thus jeopardizing patient privacy as well as the public confidence and trust that are essential to the success of a future nationwide health information network,” GAO said.

Commenting in the report, HHS said it was pursuing a two-phased process for assessing and prioritizing privacy-related initiatives.

[ via AHA News Now ]

Both federal and state healthcare privacy laws conflict and confuse

The State Alliance for e-Health, a subset of the National Governors Association, is pushing state governments to reduce the variability of health care privacy requirements, and calls for the federal government to solve problems and ease confusion about the regulatory requirements for health information privacy, says FCW.com. The alliance noted that HIPAA, along with other federal laws regulating health information privacy for schools and other facilities, may inhibit work towards health information exchanges, and that resolving the differences among states' requirements is necessary for the successful implementation of health information technology.

Click here for more information.

[ via HIPAA Weekly Advisor ]

Health care privacy officers discuss trends

A new report from the American Health Information Management Association examines the evolving privacy and security landscape, and the role of the privacy officer based on a roundtable discussion with four of them. Topics include the federal Health Insurance Portability and Accountability Act, state privacy laws, health information exchange and protection of private health records.

For example, Nadia Fahim-Kostner, information privacy and security director at Gwinnett Health System in Lawrenceville, GA, said, "With advances in technology we've had to look more broadly than just HIPAA in terms of taking measures to secure data and ensure its privacy."

[ via AHA News Now ]

GAO: HHS health IT strategy lacks comprehensive approach to privacy

The Department of Health and Human Services is only in the early stages of efforts to identify solutions for protecting personal health information as the use of health information technology and networks for electronic health information exchange grow, the Government Accountability Office suggests in a new report. HHS and its Office of the National Coordinator for Health IT have yet to identify a comprehensive strategy for integrating numerous privacy-related initiatives, the report states.

"Until HHS defines an integration approach and milestones for completing these steps," the report concludes, "its overall approach for ensuring the privacy and protection of personal health information exchanged throughout a nationwide network will remain unclear." GAO recommends that HHS define and implement an overall privacy approach that establishes clear milestones for integrating outcomes of its initiatives, ensures that key privacy principles are incorporated, and focuses clearly on the challenges associated with a nationwide exchange of health information.

[ via AHA News Now ]

AHIC workgroup focuses on privacy

The American Health Information Community (AHIC) should create policies to require consumer authorization of each use of data from a personal health record (PHR) or electronic health record and develop guidelines for releasing data to third parties according to AHIC's Consumer Empowerment Workgroup. The group also recommends that the organization pilot an education campaign about PHR benefits and HIPAA privacy rights.

Other suggestions on the group's list of recommendations include the following:

• Work for legal/regulatory changes to remove interoperability barriers
• Conduct research on the functionality needed by consumers
• Create incentives for adoption by consumers, providers, purchasers, or payers

The workgroup’s mission is to make recommendations to AHIC with the goal of widespread adoption of a PHR that is easy-to-use, portable, longitudinal, affordable, and consumer-centered.

Click here for more information.

[ via HIPAA Weekly Advisor ]

How should we dispose of CD-ROMs and floppy disks that might have stored PHI?

Q: How should we dispose of CD-ROMs and floppy disks that might have stored PHI?

A: The security rule requires you to track all media that contains PHI when using it for purposes other than storing PHI and when disposing of media that has been used to store PHI. This means that you need a tracking procedure in addition to a good media-disposal method.

One of the best ways to dispose of CD-ROMs is to shred them. There are shredders on the market at a fairly reasonable price that accommodate this task. In the case of floppy disks, flash drives, jump drives, and the like, it is a good idea to format the media twice before disposing of it.

Another common way to dispose of magnetic media is by degaussing (this amounts to running a large magnet over the media several times). If you choose this method, make sure that the magnet creates a magnetic field strong enough to make the stored data unreadable.

Note: Chris Apgar, president of Portland, OR-based Apgar & Associates, LLC, answered this question. This is not legal advice. Consult your attorney for legal matters.

[ via HIPAA Weekly Advisor ]

Privacy experts recommend broader protection for information

Experts urged the federal government to couple plans for a national electronic health record (EHR) database with privacy protection that is broader than HIPAA's privacy provisions and affects all information handlers, reports United Press International (UPI).

"You have to establish privacy principles at the beginning," James Pyles, a Washington–based attorney told a government health subcommittee on March 16. "You can't retro-fit a system with privacy protections." Pyles and other privacy advocates noted that 17,000 privacy breach claims have been filed since HIPAA’s inception, but the OCR has taken only one enforcement action, according to UPI.

The U.S. House health subcommittee is considering several proposals aimed at promoting nationally accessible EHRs. Click here to read the UPI article.

[ via HIPAA Weekly Advisor ]