Header graphic for print
Privacy Law Blog

Category Archives: Medical Privacy

Subscribe to Medical Privacy RSS Feed

A $1.2 Million Photocopier Mistake: Health Plan Settles with HHS in HIPAA Breach Case

Posted in Data Breaches, HIPAA, Identity Theft, Medical Privacy

We have heard the well-publicized stories of stolen laptops and resulting violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and we generally recognize the inherent security risks and potential for breach of unsecured electronic protected health information posed by computer hard drives. We remember to “wipe” the personal data off of… Continue Reading

Rise of the Genome

Posted in Medical Privacy, Workplace Privacy

We pack tons of personal and sensitive information in our DNA.  While the human genome has been mapped for a decade, legal issues of genetic privacy are just beginning to rise.  Earlier this month, the U.S. Supreme Court decided what Justice Alito described as “perhaps the most important criminal procedure case that this court has heard… Continue Reading

HHS Empowers Consumers to Know (and Enforce) their Rights Under HIPAA

Posted in Electronic Communications, HIPAA, Medical Privacy

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published on its website a series of factsheets designed to educate consumers unfamiliar with their rights under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.  These four factsheets are described in detail below and are available in… Continue Reading

Massachusetts AGO Enters Into Another Settlement For Data Security Violations

Posted in Data Breaches, Data Privacy Laws, HIPAA, Medical Privacy

For the fourth time since the Massachusetts data security regulations took effect in March 2010, the Massachusetts Attorney General’s Office (“AGO”) has settled allegations that Massachusetts-based entities violated the regulations.  On January 7, 2013, Suffolk Superior Court approved consent judgments pursuant to which five entities agreed to collectively pay $140,000 to settle allegations that they… Continue Reading

HHS Announces New Patient Privacy and Security Protections

Posted in HIPAA, Medical Privacy, Mobile Privacy, Privacy Litigation, Security Breach Notification Laws, Uncategorized

On January 17, 2013, U.S. Department of Health and Human Services Secretary Kathleen Sebelius announced the final omnibus rule that among other things (1) increases patient privacy protections; (2) provides individuals with new rights to receive a copy of their electronic medical record in an electronic form;  and (3) provides individuals with the right to… Continue Reading

Keep An Eye On Those Shiny, New Mobile Devices!

Posted in Data Breaches, HIPAA, Medical Privacy, Mobile Privacy, Workplace Privacy

As physicians, nurses, therapists and health care providers continue to utilize new smart phones, tablets, and laptops in caring for patients, the Department of Health and Human Services (“HHS”) has responded with educational videos, worksheets and guidance to help health care providers  create a “culture of compliance and awareness” and to protect patients’ Protected Health… Continue Reading

OCR Issues Guidance On HIPAA Privacy Rule’s De-Identification Standard

Posted in HIPAA, Medical Privacy

On November 26, 2012, the Department of Health and Human Services Office for Civil Rights (“OCR”) published a thirty-two page document titled “Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule” (“De-Identification Guidance”).  OCR described the guidance document as a culmination of two… Continue Reading

HIPAA Privacy In The Aftermath Of Sandy: Be Prepared For The Next Emergency

Posted in HIPAA, Medical Privacy, Miscellaneous, Mobile Privacy, Workplace Privacy

As health care providers, patients, family members, friends, and disaster relief agencies such as the American Red Cross continue to grapple with the aftermath of Hurricane Sandy it is important to be mindful of privacy regulations and to prepare in advance for the next emergency. The Health Insurance Portability and Accountability Act  of 1996 (“HIPAA”… Continue Reading

Governing the Code of Life

Posted in Medical Privacy

What if the story of your life was written at birth- a “future diary” available for someone to read? The decoding of the human genome over a decade ago held the promise of defying our genetic destiny, but it also foreshadowed some significant ethical issues on the horizon. This month, California legislators addressed some of… Continue Reading

New York Court Finds Clinic Not Liable for Employee’s Disclosure of PHI

Posted in Medical Privacy

A federal district court dismissed an action against an employer alleging vicarious liability for an employee’s dissemination of a patient’s protected health information (PHI) related to treatment for a sexually transmitted disease (STD). Specifically, the court found that the employer, a private New York medical clinic, was not vicariously liable for the actions of the employee because the employee was acting in a personal capacity which was beyond the scope of her employment.

State Attorney General Action Under HITECH

Posted in HIPAA, Medical Privacy

On January 19, 2012, Minnesota Attorney General Lori Swanson exercised her authority under the HITECH Act by filing a lawsuit against a business associate for the failure to protect protected health information (PHI) and for the failure to disclose the extent to which PHI was utilized. The case alleges that Accretive Health, Inc., a debt collection… Continue Reading

HIPAA Privacy and Security Audit Pilot Program Takes Flight

Posted in Medical Privacy

On November 8, 2011, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced details of its HIPAA Privacy and Security Audit Program. The OCR pilot program calls for approximately 150 audits of covered entities, which audits are intended to address privacy and security compliance, and assist OCR in assessing and identifying best practices as well as risks and vulnerabilities for health care entities. Although the pilot program is expected to immediately impact a small number of covered entities, it appears that OCR is increasing its efforts to enforce HIPAA and the HITECH Act.

New HIPAA Cop: First AG Settlement for HIPAA Violations

Posted in Medical Privacy

Last week, the Connecticut Attorney General became the first state attorney general to enter into a settlement agreement for HIPAA violations, as a result of the new authority granted to attorneys general under the Health Information Technology for Economic and Clinical Health Act (HITECH Act).

HHS and FTC Announce New Breach Notification Rules for Unsecured Protected Health Information

Posted in Data Breaches, Medical Privacy, Security Breach Notification Laws

On August 24 and 25, 2009, the Department of Health and Human Services (“HHS”) and the Federal Trade Commission (“FTC”), respectively published rules on when and how covered entities regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and vendors of personal health records (“PHR”) must notify individuals of security breaches concerning… Continue Reading

The New Frontier: “Genetic Exceptionalism” and The Battle Over Newborns’ DNA

Posted in Medical Privacy

The popularity of crime dramas on primetime television schedules has made certain aspects of genetic testing commonplace and uncontroversial.  However, as science continues to advance at an exponential rate, and as technology and innovation have invaded the realm of individual privacy rights, individuals’ genetic make-up are likely the next frontier. At least 32 states have… Continue Reading

Decrypting HHS Guidance on Breach Notification and Security under the HITECH Act: NIST, FIPS, and More

Posted in Medical Privacy, Security Breach Notification Laws

Two months after Congress mandated notification for the breach of unsecured protected health information (PHI), the Secretary of Health and Human Services (HHS) defined what it means to be “unsecured.” As required by Section 13402 of the HITECH Act, H.R. 1, 111th Cong. (1st Sess. 2009) (which was part of the American Recovery and Reinvestment Act of 2009), the Secretary issued guidance and a request for comments on the technologies and methodologies rendering information unusable, unreadable or indecipherable. 74 Fed. Reg. 19006 (Apr. 27, 2009) (to be codified at 45 C.F.R. pts. 160, 164).

Red Flag Rules Leave Health Care Industry Wondering

Posted in Identity Theft, Medical Privacy

The health care industry has been waiting for resolution of the question: Do the Federal Trade Commission’s Identity Theft Red Flag Rules apply to health care providers? With the May 1st compliance deadline looming, health care providers need to know.  The answer seems to depend on whom you ask. The Federal Trade Commission (“FTC”) and… Continue Reading

Will Congress Enact Data Security Breach Provisions This Year – ? Guess What, It Already Has

Posted in Medical Privacy, Security Breach Notification Laws

By Jeffrey D. Neuburger and Sara Krauss Congress has been dithering over the adoption of a federal data security breach notice law for the last several years without coming to an agreement on a national standard for reporting breaches in the security of personal and financial data, but on February 17, data breach notice provisions… Continue Reading

HHS Enters Into First Monetary Settlement Under HIPAA

Posted in Medical Privacy

On July 15, 2008, the U.S. Department of Health & Human Services (“HHS”) entered into its first Resolution Agreement with a HIPAA-covered entity to settle alleged violations of the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Pursuant to the Resolution Agreement, a Seattle-based not-for-profit health system, Providence… Continue Reading

Prying Eyes Make Headlines

Posted in Medical Privacy

Proskauer on Privacy will never be confused with TMZ, but we would be remiss if we failed to report on the high profile privacy scandal unfolding in the backyard of our Los Angeles office. As we previously reported, California’s data breach notification law was amended effective January 1, 2008, to include breaches of medical and health insurance information. A number of recent incidents illustrate once again that it is not enough to have written policies and procedures in place for the handling of sensitive information – employee training is essential.