Welcome to EMR and HIPAA

I found a website that listed a number of Privacy Violations. The page is quite outdated since it’s latest case was in 2002, but I thought that many of the examples could just as easily apply today. In fact, with computers it makes many of the cases much easier to accomplish and easier to track misdoing. Does that mean we are going to have more HIPAA lawsuits coming? I think it’s only just a matter of time.

Does EMR affect this? Probably not directly, but indirectly many of these cases could be related to your use of an EMR system.

Here’s 2 examples that I found quite interesting from the HIPAA privacy violations article:

# A psychiatrist from New Hampshire was fined $1,000 for repeatedly looking at the medical records of an acquaintance without permission. Because there was no state law making it a crime to breach the confidentiality of medical records, the case was brought under a law against misusing a computer. (”Psychiatrist Convicted of Snooping in Records,” The Associated Press State & Local Wire, May 5, 1999)

# A jury in Waukesha, Wisconsin, found that an emergency medical technician (EMT) invaded the privacy of an overdose patient when she told the patient’s co-worker about the overdose. The co-worker then told nurses at West Allis Memorial Hospital, where both she and the patient were nurses. The EMT claimed that she called the patient’s co-worker out of concern for the patient. The jury, however, found that regardless of her intentions, the EMT had no right to disclose confidential and sensitive medical information, and directed the EMT and her employer to pay $3,000 for the invasion of privacy. (L. Sink, “Jurors Decide Patient Privacy Was Invaded,” Milwaukee Journal Sentinel, May 9, 2002)

My biggest comfort with HIPAA is that it doesn’t seem like they are really out headhunting. If you are an honest person who makes a bad choice then HIPAA is kinder to you then those that blatantly misuse the information. However, in our sue happy world that might be changing.

Not too long ago I ran accross an article that talked about Ohio University’s server being hacked and in a hackers hands for a long period of time. I honestly don’t think this is really all that common. In fact, after working with a friend of mine in college who was excellent at hacking I think this happens a lot more than we ever realize and definitely more than ever gets published. Not that the practices of this article are acceptable, but I don’t think we should be naive.

Many may be wondering what a University getting hacked is doing on an EMR and HIPAA blog. Well, read this quote from the article:

How a server could be left open to intruders is still under investigation. But this much is known: A server supporting the alumni relations department was supposed to be offline, Sams said. The people responsible for shutting it down thought they had done so. The server continued to be connected to the Internet but didn’t receive security updates. It was the equivalent of leaving a backdoor open for thieves to walk in and seize what they wanted.

The culprits who broke into the other two servers made off with health records belonging to students treated at the university’s health center, as well as Social Security numbers of an additional 60,000 people.

Does this really make sense to any rational person? What is a student’s health record doing on a server supportint the alumni relations department? Not to mention on a server that someone isn’t updating. At the rate that Windows puts out updates I think we are all guilty of sometimes being a bit lazy in our updating policy. However, to forget about the machine and think it is shutdown is ridiculous. That has HIPAA violation and HIPAA lawsuit written all over it.

The HIPAA enforcement rule is published.

Rick Brady mentioned that “HIPAA has no teeth.” I agree in principle. Martin Jensen mentioned that he used to agree with it not having teeth until he had a conversation with one of the regulators.

I think there are really a few important points. The penalties really are rather small and incosequential compared to the costs of compliancy. Every good business has to weigh those two factors. However, the more difficult concept to calculate is the shame of a HIPAA violation. I can tell you now that this is something for which people are very interested. The most often google search I get is for HIPAA Lawsuits. People are scared of this possibility and want to know who is going to take the fall at HIPAA’s hands. I really feel like I’m stuck between a rock and a hard place. HIPAA compliancy and budgeting.

My only relief is in the following excerpt:

[A] civil money penalty may not be imposed ‘‘if it is established to the satisfaction of the Secretary that the person liable for the penalty did not know, and by exercising reasonable diligence would not have known, that such person violated the provision’’,…if the failure to comply was due ‘‘to reasonable cause and not to willful neglect’’ and is corrected within a certain time, [and] a civil money penalty may be reduced or entirely waived ‘‘to the extent that the payment of such penalty would be excessive relative to the compliance failure involved.’’

I had been getting some searches on the site for HIPAA Lawsuits or HIPAA cases and it started me thinking about what might be out there. Sure enough I found some interesting info in another HIPAA Blog.

Here’s the 2 points I took from these 2 HIPAA cases:
there’s no private cause of action against a covered entity for a HIPAA violation
This is good for those organizations to know that they can’t be sued for one person’s carelessness(or direct violation). At least that’s my understanding from what was written. It did say that Rite Aid could have a breach of privacy and negligence claim brought against them. I think this is what we are really mostly wondering about. I guess we’ll have to see how the courts work it out.

The second point was a parent trying to get a child’s counseling records. Essentially they weren’t able to do that. It looked like there good be a few state loopholes so that might be something of concern, but overall it seems like the court upheld the privacy of the patient from the parent. While I think it’s appropriate it is sad to think that so many parents would need to go to these extremes to get information on the child(pardon the social commentary).

I must admit that reading this information makes me glad I’m not a lawyer and confirms my current opinion that HIPAA is a necessary evil.

My desire is to post things I find of importance related to HIPAA and EMR. My personal experience is in College Health so I will focus on posting items related more specifically to College Health. However, I will try to incorporate any aspects of EMR and HIPAA because I think best practices across the industry are important to know. Please feel free to post all you want if you find some good information that I haven’t seen and correct me if I’m wrong. This is my best knowledge from my research and is not guaranteed in anyway.

EMR BLOG