Share this ARTICLE with your colleagues on LinkedIn .
Although many of us have been spending a great deal of time signing all types of documents (usually served on clipboards) from our healthcare professionals regarding our right to expect
confidentiality of our medical and health-related records, we live in an age where records are transmitted via internet and faxed from location to location, with many individual employees of many companies handling and having access to it.
Candidly, the handling of our accumulated historical medical records is subject to a combination of some of the worst aspects of human nature (data theft, identity theft and other mischief), and high-technology (data losses, and misdirected transmittals). Your medical records are not secure, so you must be prepared for the 'occasional' breach, hack or theft and disclosure.
Regardless of what the intention of the lawmakers may be in terms of such legislation as HIPAA, and regardless of the precautions which our healthcare providers, hospitals, processing laboratories and local pharmacies take to comply with the letter and intent of the law,
there will continue to be breaches.
What reality forces us to do is to anticipate the possible breach of confidentiality somewhere along the chain of data transmittal, and to be prepared to be confronted with (or embarrassed by) the truth. Aside from the possibility of humiliation, we have to be completely candid on all insurance and other forms and questionnaires upon which certain service providers will depend in order to determine the pricing of their services to us...or even if they are going to provide services to us.
HIPAA does not assure us of the security and confidentiality of our health histories and information. But it does increase the likelihood of our being caught in a lie and punished. Where there can be true no guarantee of privacy or secrecy, we are obligated to use some common-sense self-defense:
1) Tell the truth;
2) Be prepared to explain the circumstances or to answer any questions about your healthcare that you might be forced to address.
Yes, ladies and gents -- it's another case of "hope for the best, but prepare for the worst."
Following is a
Press Release from the U.S. Department Of Health And Human Services which came out earlier today (March 13th, 2012). Expect more like it. Sadly, the hidden message is that by the time the breach is caught and damage control is undertaken, it will always be too late:
FOR IMMEDIATE RELEASE
March 13, 2012 |
Contact: HHS Press Office
(202) 690-6343 |
HHS settles HIPAA case with BCBST for $1.5 million
First enforcement action resulting from HITECH Breach Notification Rule
Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the
U.S. Department of Health and Human Services (HHS) $1,500,000 to settle potential violations of the
Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, Leon Rodriguez, Director of the HHS Office for Civil Rights (OCR), announced today. BCBST has also agreed to a corrective action plan to address gaps in its HIPAA compliance program.
The enforcement action is the first resulting from a breach report required by the Health
Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.
The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the
protected health information (PHI) of over 1 million individuals, including member names,
social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes.
In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility
access controls; both of these safeguards are required by the HIPAA Security Rule.
“This settlement sends an important message that OCR expects health plans and
health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program,” said OCR Director Leon Rodriguez. “The HITECH Breach Notification Rule is an important enforcement tool and OCR will continue to vigorously protect patients’ right to private and secure health information.” {
continued}.
####
I wish I had better news, but I don't. In fact, I went into my neighborhood pharmacy to refill a prescription, and I was asked to sign a list, visible to every customer who came to pick a prescription up that day, where I signed my name, and a printed label detailing my prescription appeared, as well as similar information for another nine individuals. I tried not to look at the information regarding all of the customers who had come in before I had, but it was awfully tempting.
Sometimes the best defense is self-defense.
Stay
Healthy,
Douglas E. Castle
[
http://aboutDouglasCastle.blogspot.com]
