More Lost Patient Data: How Can We Prevent This From Happening?
The Wall of Shame welcomes Sutter Health. Another computer with unencrypted protected health information on over 4 million patients – gone. Now, those guys are pretty smart, so why don’t they encrypt all computers with PHI? One of life’s persistent questions. I mean, I can accept the fact that a health plan operator like Cignet Health might have issues with getting a grip on HIPAA compliance, but Sutter Health? What were they thinking? Can’t happen here? Encryption is a drag? It’s an easy way to avoid major egg-on-face and to avoid spending significant coin on PR, credit reporting services, and potentially on court judgments — all in addition to significant administrative fines payable to HHS and state regulators.
So the federales are piloting the HIPAA audit program. I know it’s required by the HITECH Act, but who believes that it will motivate behavior change? Anyone? Sutter Health was clearly not motivated to seek a safe harbor that would have made the loss of 4 million patient records a non-event. I know encryption can be a drag, but I’m not a techie. If you are, I invite you to educate me (and the other non-techies out there) on the question of how miserable it really is to have to deal with encrypted data; if you’re really a techie, write a program to enable light-touch encryption that doesn’t interfere with use of data.
Whether or not encryption is miserable, we should be asking: Read more »
*This blog post was originally published at HealthBlawg :: David Harlow's Health Care Law Blog*
