One in 10 U.S. Residents Affected by Large Health Data Breaches

Monday, June 16, 2014

TOPIC ALERT:

• Privacy and Security

Click on topic to receive periodic emails.

More than 1,000 medical record breaches involving 500 or more people have been reported to HHS since federal reporting requirements took effect nearly five years ago, according to HHS,Modern Healthcare's "Vital Signs" reports (Conn, "Vital Signs,"Modern Healthcare, 6/13).

HHS has been tracking data breaches since September 2009, when the HIPAA breach notification rule went into effect. The agency reports health information breaches affecting more than 500 individuals on its "wall of shame" website (iHealthBeat, 4/1).

Since 2009, HHS has received:

• 1,026 reports of breaches involving 500 or more individuals; and
• More than 116,000 breach reports involving records of fewer than 500 individuals through March 1, 2013.

In total, large health data breaches reported by health care providers and their business associates have affected the medical records of about one in 10 U.S. residents, or 31.7 million people. 

Meanwhile, more than 32,600 HIPAA complaint cases have been investigated, with more than 22,500 of them closing with corrective action, according to HHS Office for Civil Rights spokesperson Rachel Seeger ("Vital Signs," Modern Healthcare, 6/13)

Privacy Penalties on the Rise

In related news, HHS Chief Regional Civil Rights Counsel Jerome Meites at an American Bar Association Conference last week said he expects penalties under HIPAA to increase drastically in the next year, The Hill reports.

Since June 2013, HHS has received more than $10 million for HIPAA violations, according toLaw360. However, Meites said, "I suspect that that number will be low compared [with] what's coming up" (Viebeck, The Hill, 6/13).

Many EMR and EHR services are cloud based, and dependent upon internet connectivity.  Despite HIPAA we can expect breaches from otherwise secure sites. It is important to notify patients when breaches occur.

Healtlh IT Tsunami

It is a bit overwhelming for physicians to maintain clinical competence, run a financially sound medical enterprise, solo or otherwise, and keep current on health information technology.

Physicians pride themselves on efficiency due to the current reimbursement method of volume based reimbursement. The government and some insurers are intent upon a value based system of reimbursement, however the mechanisms are still murky.  Staying current on health reform and health IT systems have become overwhelming, while most physicians would like to ignore the chaos focusing on patient matters the chaos and noise filter through daily activities.

Physicians are multi-taskers and there are some conventional non health related tools to help organize you days.

Our next series of articles will address solutions that may assist in organizing your projects and daily activities.

Some are content with reading blogs and social media and others are interested in the tools for social media.

This week’s focus is on productivity—a favorite topic of ours.

Here are some of the highlights:

What productivity tools do you use on a daily basis? - Part I

Here’s a list of some the apps mentioned during the chat (in no particular order):

• Lastpass
• Google Analytics URL Builder
• WeTransfer
• Buzzsumo
• Social Crawlytics
• GoogleApps
• Basecamp
• Slack
• GotoMeeting
• Microsoft One Note

My favorite is Laspass. This is a secure cloud based password manager. It can be accessed from any device on the internet.  Check it out.

GotoMeeting is disappointing since it will not work on Chrome, an operating system (browser) that many use due to it’s tight integration with all things Google, including Youtube, Drive, Gmail, and many others.  Chrome and chromebook as well as the new chromebox have become very popular. Chrome is now the most popular internet web browser.

Glass To Get HIPAA Compliance, Surgery Ready!

If you are a practicing physician, it woul be hard to miss all the changes due to EHR adoption, and Health Information Exchanges.

The HIT space is also being invaded by other applications and consumer hardware/software platforms easily adapted to medical practice.  Some innovator surgeons and medical physicians also have taken available platforms and adapting them to patient care.  HIPAA has prepared the innovators for security and privacy of patient medical information.

Google has many apps that can be used in a medical environment.

Google glass has been used by  some surgeons to teach and/or get consultations in real time.

Google Glass has been of interest to the healthcare industry for a while, and while performing surgery with Glass is nothing new, complying with HIPAA standards while doing it is. Video streaming software company CrowdOptic has teamed up with University of California, San Francisco (UCSF) to produce streaming software that lets surgeons share their live recording with others off site. But now they are looking to include a feature to that software that allows for HIPAA compliance.

The video shown here illustrates several real-time uses for google glass.  These are actual real-time uses for google glass. The system offers an effective user friendly interface of both video and audio communication 

Just five or less  years ago this would have been science fiction, or featured as a futuristic view of medical care.  How quickly things advance.  By the time many of these advances become published or well known...another new wave of innovation occurs.

We’ve heard of the uses of Glass within the hospital before, and the team at Beth Israel is part of a specific pilot program that uses heavily modified Google Glass units to help with scenarios like this one. The Google Glass units that the hospital uses for this program are tweaked by a company called Wearable Intelligence, which removes the stock Google Glass software from devices and puts a reworked version of the Android OS on the units. The software is completely locked down so the only use applications for Glass here is for Hospital purposes only. This is just one of the many different instances where Google Glass is being used in the workplace, and is part of the Glass at Work program that Google is driving heavily forward.

Vendor Interoperability Tensions Users must insist on interoperability for Systems to be purchased.

Ultimately potential users will control interoperability.  Vendors will comply is they want to sell their systems.

Interoperability is all about vendors of EHR systems for providers and hospitals.  The Office of the National Coordinator for Health IT  (ONC) developed as part of the executive office of the President (then George W. Bush) as part of the assessment for growth and planning for this decade in all aspects of the health and governmental systems.

Despite encouragement to develop interoperable systems, and incentives for using IT growth of a network has been sporadic and in silos. It’s progress has been slowed by the need for building a sustainable business model, despite the federal mandate of it being a requirement for meaningful use, Stage III.   The business model may require variations according to the user base.  Despite the potential for significant savings it requires capital to initiate and maintain. Several HIE’s have been successful thus far.  Initially there were many failures when grants expired without ongoing financial support.

According to a report from ONCHIT and West Health Institute. In the report they urge all buyers of healthcare IT, hospitals, practices and patients to insist that technology vendors make their products interoperable to work well with each other, share data, and support open standards.   In the same report Joseph Smith, M.D. , chief scientist and medical officer of West Health Wireless Institute, said HIT buyers have yet to make it clear they want interoperability.  Part of the mission is to make buyers aware that there is something to ask for and require in their product(s).

The audience was asked what were the barriers to vendor development of interoperability. The dominant answer was purposeful strategies to maintain market share and increase switching costs.  This amounted to a vendor driven reality, according to the audience at the one-day conference on healthcare IT interoperability in February.

When asking for interoperability an essential question to answer is to specifically name the systems which their system needs to connect with, or the standards the vendor needs to meet. This hard work has already been done by ONCHIT with it’s certification through the ANSI attestation process.  The standard and technology are ready to use.  Without the specific guiding standard to the vendor vendors will have an excuse to continue their ways. Vendors may simply say the calls for interoperability are too vague for realistic implementation

Medical Devices are a new player in the game, and face even greater challenges. Fortunately the FDA will have draft guidelines this year on medical device interoperability. However draft guidance is not the same as interoperability-far from it. Interoperability is a miexture of shared demand, technical sophistication,dogged testing, and a dollop of diktat.  The power of the stakeholder group plays a major role in convincing vendors to comply.

Health IT is set apart from other IT interoperability in that it is not sufficient to just transfer data. It is also necessary to integrate that data into the workflow of those who receive the data in a form that is transparent and appears in the recipient’s EHR without a major distraction from the user(s).

Attribution:

Healthleadersmedia.com and Scott Mace, online: www.healthleaders.com/Technology