Better Health: Smart Health Commentary Better Health (TM): smart health commentary

Article Comments

Security Of Patient Records: The Weakest Link

The Queen of Soul famously wailed about being a link in a “chain of fools.” The lead story in the August 13th Boston Globe tells us about another sort of link in the chain — the weakest link in the chain of custody of patient records.

In brief, a pathology billing service bought out by another service apparently dumped all records more than a year old in a town dump. A Globe photographer taking out his own trash noticed that the paper records (which he was looking at because he thought they ought to be recycled rather than dumped) had identifiable patient data and represented at least four hospitals from across Eastern Massachusetts. Clearly, these records ought to have been shredded or otherwise destroyed before disposal.

Assuming they had some airtight contracts in place, the hospitals involved may well be looking to the seller of the billing service in this case to reimburse them for costs of:

- Identifying the patients involved in this data breach

- Notifying affected patients of the breach

- Providing credit monitoring services to affected patients

- Any damages incurred by patients

- Any fines incurred by the hospitals

Under the HITECH Act’s “Son of HIPAA” rules, the hospitals could be on the hook to the federales for up to $1.5 million in fines each as a result of this incident, and the state AG could get in on the action as well, filing suit on behalf of the affected Massachusetts residents and seeking to ensue that proper procedures are in place.  There may also be a violation of the state data security law here as well.  Massachusetts has a particularly stringent data security law on the books that took effect within the past year, and not all affected businesses have come into compliance.  The AG may be on the prowl for a few high-profile cases, like this one, in which to levy substantial fines and convince the laggards that compliance would be more than worth their while.

The natural question to ask, given the facts of this case, is: What would a meaningful user do?

With the ink barely dry on the meaningful use final rule, and the usual suspects lined up for and against the proliferation of EHRs, it seems clear that the use of electronic health records would have eliminated the problem of plain text paper records flapping in the wind at the Georgetown town dump.  However, their use would not have eliminated the problem of covered entity and contractor bad judgment, if that is in fact the issue in this case.

Digitizing records does not eliminate covered entities’ responsibilities with respect to the operation of their business associates and subcontractors.  As we all know, the latest and greatest laws and regs make covered entities fully responsible for the deeds and misdeeds of their business associates and subcontractors.  (True even if the breach notification final rule is on ice for a while.)  Thus, it becomes imperative for covered entities to have a much better handle on their associates’ understanding of applicable law, on their policies and procedures, and on the actual implementation of their policies and procedures.

Auditing business associate and subcontractor compliance with HIPAA and other privacy laws is probably worth the expense. The costs saved include being called out on page one, above the fold.

*This blog post was originally published at HealthBlawg :: David Harlow's Health Care Law Blog*


You may also like these posts

Read comments »


Comments are closed.

Return to article »

Latest Interviews

IDEA Labs: Medical Students Take The Lead In Healthcare Innovation

It’s no secret that doctors are disappointed with the way that the U.S. healthcare system is evolving. Most feel helpless about improving their work conditions or solving technical problems in patient care. Fortunately one young medical student was undeterred by the mountain of disappointment carried by his senior clinician mentors…

Read more »

How To Be A Successful Patient: Young Doctors Offer Some Advice

I am proud to be a part of the American Resident Project an initiative that promotes the writing of medical students residents and new physicians as they explore ideas for transforming American health care delivery. I recently had the opportunity to interview three of the writing fellows about how to…

Read more »

See all interviews »

Latest Cartoon

See all cartoons »

Latest Book Reviews

Book Review: Is Empathy Learned By Faking It Till It’s Real?

I m often asked to do book reviews on my blog and I rarely agree to them. This is because it takes me a long time to read a book and then if I don t enjoy it I figure the author would rather me remain silent than publish my…

Read more »

The Spirit Of The Place: Samuel Shem’s New Book May Depress You

When I was in medical school I read Samuel Shem s House Of God as a right of passage. At the time I found it to be a cynical yet eerily accurate portrayal of the underbelly of academic medicine. I gained comfort from its gallows humor and it made me…

Read more »

Eat To Save Your Life: Another Half-True Diet Book

I am hesitant to review diet books because they are so often a tangled mess of fact and fiction. Teasing out their truth from falsehood is about as exhausting as delousing a long-haired elementary school student. However after being approached by the authors’ PR agency with the promise of a…

Read more »

See all book reviews »