DigitalCare, Inc.™
Health Care Information Technology Services

Jan. 16, 2003

ZDNet reports two Massachusetts Institute of Technology (MIT) graduate students have uncovered a treasure trove of personal and corporate information on used disk drives. The students at MIT’s Laboratory of Computer Science bought 158 disk drives for less than $1,000 on the Web and at swap meets. Scavenging through the drives, they found more than 5,000 credit card numbers, medical reports, and detailed personal and corporate financial information. Their findings, titled "Remembrance of Data Passed: A Study of Disk Sanitation," are being published in the January/February 2003 issue of IEEE Security and Privacy, a journal published by the IEEE Computer Society.

Jan. 15, 2003

HHS' Office of Civil Rights (OCR), charged with overseeing HIPAA Privacy Rule compliance, is looking to hire Privacy Program Specialists to provide outreach and education. The Privacy Specialists, working out of 11 Regional Offices, will fan out across the country to increase awareness of covered entities' responsibilities and the public's rights under the Rule.

As part of their duties, the regional Privacy Specialists will:

• help conduct investigations;
• respond to phone and written inquiries about the Privacy Rule from covered
  entities and the public;
• present the Rule's requirements in meetings, conferences, seminars, and
  workshops; and
• serve as subject matter experts on the HIPAA Privacy Rule.

Applications are being accepted online until the closing date of February 4,
2003.

Jan. 14, 2003

AHANews reports the Joint Commission on Accreditation of Health Care Organizations (JCAHO) has released its revised business associate agreement that hospitals must sign as part of the application process for a JCAHO survey to make the agreement workable and acceptable to hospitals and compliant with HIPAA. The American Hospital Association (AHA) says the revised agreement appropriately addresses hospital concerns about an earlier version that was posted on JCAHO's web site just before the holidays.

Jan. 14, 2003

AHANews reports the Joint Commission on Accreditation of Health Care Organizations (JCAHO) has released its revised business associate agreement that hospitals must sign as part of the application process for a JCAHO survey to make the agreement workable and acceptable to hospitals and compliant with HIPAA. The American Hospital Association (AHA) says the revised agreement appropriately addresses hospital concerns about an earlier version that was posted on JCAHO's web site just before the holidays.

Jan. 14, 2003

The Final Rules on the "HIPAA Security Standards" and "Modification to Standards for Electronic Transactions and Code Sets" were received by the White House Office of Management & Budget, Office of Information and Regulatory Affairs (OMB/OIRA) yesterday for review. Final clearance takes between two weeks and 90 days, at which point, the final version of the regulations are placed on display at the Government Printing Office (GPO) in Washington, DC, and then published in the Federal Register.

Jan. 14, 2003

HHS will be holding four national one-day conferences, two in February and two in March, on the HIPAA Privacy Rule. The conferences are designed to provide an opportunity to hear from and interact with officials who developed the Privacy Rule and will be responsible for interpreting and enforcing the rule. The HHS Office for Civil Rights (OCR) will provide an expert faculty who will answer questions from attendees during question-and-answer sessions following their presentations.

The conferences will go over:

• The principles underlying the Privacy Rule.
• How the preemption rules create a national floor of privacy protections.
• Who is a covered health care provider.
• The implications of being an affiliated covered entity, a hybrid, or in an
  organized health care arrangement.
• * "Business associate" issues.
• What type of information is protected under the HIPAA Privacy Rule and what is meant by the terms "use," "disclosure," "minimum necessary," and "incidental disclosures."
• The Notice of Privacy Practices requirement.
• When it is necessary to obtain an authorization to use or disclose PHI and what constitutes a valid authorization.
• The right of patient to access, amend, and obtain an accounting of disclosures of patient health information.
• When to use an authorization for research and when research may be conducted without an authorization.
• How research authorizations pre-dating the compliance date are treated.
• Appropriate administrative, technical and physical safeguards.
• The requirements to train the workforce on covered entity policies and procedures.
• The OCR complaint investigation and compliance review authority.

Jan. 6, 2003

TechRepublic reported last month on Gartner's 6th HIPAA panel study, to assess how the healthcare industry is responding to current and impending HIPAA-compliance regulations. The survey, finished in August 2002, looks at how healthcare organizations are responding to the challenges of HIPAA over time by studying a representative sample of 172 randomly-selected providers and payers. The survey found for the first time that most have embarked on tasks such as assigned privacy and security officers, testing systems, identifying formal employee training methods, and implementing privacy and security policies and procedures.

Most respondents are working on privacy; 85 percent report having at least started developing revised policies and procedures. Although almost 70 percent of respondents report that they have begun implementing the transactions standards, organizations are largely at the mercy of their software vendors, most of whom are still working on their compliance upgrades. For this reason, HIPAA.org launched last October an online directory of software products and what HIPAA transactions that product supports now.

Dec. 27, 2002

Comments are being requested on a proposed project of the Office for Civil Rights (OCR) to automate its forms for discrimination and medical privacy complaints. Effective April 14, 2003, OCR has jurisdiction over certain health plans, health clearinghouses and healthcare providers with respect to enforcement of the standards for privacy of individually identifiable health information rule issued pursuant to HIPAA. OCR wants to develop an automated complaint submittal process for individuals to file written complaints with OCR when they believe that on or after April 14, 2003, their right to the privacy of protected health information has been violated. OCR estimates that there will be approximately 21,710 complaints concerning medical privacy (16,283 burden hours annually).

Send comments, which should be received within 60 days of this notice, via email to Geerie.Jones@HHS.gov or mail to:

Dec. 27, 2002

Under the auspices of URAC (also known as the American Accreditation HealthCare Commission) and the National Institute of Standards and Technology (NIST), the Security Healthcare Certification and Accreditation Workgroup will bring together members of the public and private sectors to develop a uniform approach to the identification and implementation of best practices in healthcare information security. The Workgroup intends to serve as a resource for the healthcare community by developing white papers, drafting crosswalks, and participating in educational programs. Ultimately, the Workgroup hopes to promulgate a common set of healthcare security standards that will cover security policies, procedures, controls, and auditing practices.

The Workgroup will have its next meeting on January 10, 2003 at NIST in Gaithersburg, MD, where the Workgroup will facilitate a healthcare sector review of the recently released draft NIST Special Publication 800-37, Guidelines for the Security Certification and Accreditation of Federal Information Technology Systems.

Dec. 26, 2002

According to the WEDI SNIP X12N Insurance Subcommittee, most of the draft X12N implementation guides currently available for public review were posted without meeting one of the process requirements. As a result, these implementation guides will not be brought forward for a publication vote at the February 2003 X12 trimester meeting in Denver, as previously expected. Instead, X12N will finalize the necessary changes at the February meeting, then by April 2003, revised drafts will be made available for another public review period. It is expected that the impacted guides will then be moved forward for a publication vote at the June 2003 X12 trimester meeting.

The affected implementation guides, some of which are missing Appendix D, commonly referred to as the Change Log, are:

• 834, Benefit Enrollment and Maintenance (004050X125)
• 820, Payroll Deducted and Other Group Premium Payment for Insurance Products (004050X137)
• 270/271, Health Care Eligibility/Benefit Inquiry and Information Response (004050X138)
• 276/277, Health Care Claim Status Request and Response (004050X139)
• 278/278, Health Care Services Request for Review and Response (004050X140)
• 837, Health Care Claim: Institutional (004050X141)
• 837, Health Care Claim: Dental (004050X142)
• 837, Health Care Claim: Professional (004050X143)
• 277, Health Care Claim Acknowledgment (004040X167)

The current online conferences for these guides will be kept open and comments received during this period may be considered in the development of the next draft. The deadline for comments has been extended by one week for all implementation guides to January 8, 2003 except for the X167 – Health Care Claim Acknowledgement. The end date for the X167 guide public review will remain January 13, 2003.

• Providers, including institutional and professional;
• Hospitals, clinical labs, long term care and SNFs, clinics, pharmacy, medical groups, physicians, pharmacists, nurses, lab technicians, podiatrists, certified nurse midwives, doctors of osteopathy, nurse practitioners, speech therapists, physical therapists, occupational therapists, physician assistants;
• Health plans;
• Third party administrators and utilization review organizations;
• Business associates and other downstream users: PBMs, device manufacturers, eHealth entities, underwriters;
• Researchers; and
• Hospitals, medical colleges, teaching hospitals, pharmaceutical and biotech, medical technology companies.

The analysis is expected to be made available online as soon as February 2003. The tool will allow users to select the states and types of entities covered under the analysis and to subscribe just to the information pertinent to their organization. Updates will be provided annually.

The Privacy Rule Standards addressed are:

• Incidental Uses and Disclosures
• Minimum Necessary
• Personal Representatives
• Business Associates
• Uses and Disclosures for Treatment, Payment, and Health Care Operations
• Marketing
• Public Health
• Research
• Workers’ Compensation Laws
• Notice
• Government Access
• Miscellaneous FAQs

Formidable foreign policy and privacy hurdles remain before any prototype becomes operational. In order to deploy such a system, new legislation would be needed, some of which has been proposed in the Homeland Security bill that was approved by Congress yesterday and which is expected to soon pass the Senate. That legislation would amend the Privacy Act of 1974, which was intended to limit what government agencies could do with private information.

The Final HIPAA X12N Addenda for the nine May 2000 X12N Implementation Guides have now been published. These should be incorporated by reference into the new final addenda rule to be published December 27. The May 2000 X12N Implementation Guides and their associated October 2002 X12N Addenda
are available from the Washington Publishing Company.

Modern Physician reports CMS officials say the more than 1 million covered entities that missed the October 15 deadline to apply for the ASCA extension will not be actively pursued and may not have to pay fines at first. Karen Trudel, director of the HIPAA project staff at CMS, says fines for noncompliance can be as high as $100 per offense, with a maximum of $25,000 per year, but they "are not going to automatically be imposed on anyone," and enforcement will be "complaint driven." CMS' HIPAA FAQ states that a covered entity that did not submit an extension request should come into compliance as soon as possible, and should be prepared to submit a corrective action plan in the event a complaint is filed against them.

With the return of a Republican majority in the Senate, Judd Gregg of (R-NH) will take over from Kennedy as the HELP Committee Chairman. The New York Times reports "the new lineup, which must be approved by Republican senators next week, would considerably alter the approach of the various panels."

Read the NIST Security draft guidelines.

The bill, called the Stop Taking Our Health Privacy Act, was introduced by Reps. Ed Markey (D-MA), John Dingell (D-MI), Henry Waxman (D-CA), Howard Berman (D-CA) and Michael Capuano (D-MA).

Meanwhile Montgomery County, MD officials said it is too early to know what long-term changes could be made to improve public security, such as expanding Montgomery's state-of-the-art network of traffic cameras or lobbying for a new national fingerprint database, reports the Montgomery Gazette.

• monitoring and auditing,
• staff compliance training,
• compliance program effectiveness,
• and of course, HIPAA compliance.

According to the survey results, the trend is clear that compliance programs are an accepted part of the health care organization’s framework. The survey also includes data on compensation, benefits, staff size and other issues.

Read the survey results (PDF).

The witnesses at the Boston hearing expressed widespread support for the goals of the Privacy Rule. Some providers, especially larger ones, reported making progress toward compliance. There was also praise for the guidance provided by the Office for Civil Rights (OCR) in July 2001.

Overall, however, the NCVHS was both surprised and disturbed at the low level of implementation and the high levels of confusion and frustration. Some covered entities decided to wait until the final Privacy Rule amendments were published in August 2002, and only now are beginning to think about their compliance duties. Many physicians, dentists, and other health care providers, especially those in small towns and rural areas, have never even heard of HIPAA, do not think it applies to them, or are confused by the various standards. State and local governments reported lacking the budget or personnel to draft their own HIPAA documents and design training programs to comply with the Privacy Rule. NCVHS goes on to state, "The failure of the OCR to make available sample forms, model language, and practical guidance has left covered entities at the mercy of an army of vendors and consultants, some of whose expertise appears limited to misinformation, baseless guarantees, and scare tactics."

“Americans deserve to know how government regulations will impact their personal privacy, and this legislation reforms the regulatory process make sure that occurs,” Barr said today. “This bill will not only make the federal government more accountable to the American people, but it will also serve to slow the growing erosion of citizens’ privacy rights.”

The HIPAA Transactions Rule applies to all healthcare providers, plans and “healthcare clearinghouses” as well as their third-party “business associates.” According to the Department of Health and Human Services (HHS), banks could be considered “healthcare clearinghouses” if they process certain payments (e.g., provide lockbox services) or other transactions for doctors, pharmacies, hospitals, etc. that include personally identifiable “protected health information” (PHI).

HHS has not yet determined whether certain bank payment processing activities make banks subject to the HIPAA rule. Nonetheless, the compliance deadline for the HIPAA Transactions Rule of October 16, 2002 is looming, and HHS expects banks to take action.

According to iHealthBeat, CongressDaily reports Sen. Edward Kennedy (D-MA) and House Democrats are considering a legislative response to the final HIPAA privacy rule. Democratic members of Congress have criticized the Bush administration's changes to the final privacy rule, particularly the elimination of the prior consent requirement, which would have required patients' written consent for use or disclosure of personal health information before treatment, payment or health care operations.

The American Hospital Association (AHA) is recommending several changes to the Joint Commission on Accreditation of Healthcare Organization's proposed business associate agreement, reports AHANews. Under the HIPAA privacy rule, JCAHO cannot receive protected health information from a hospital it is surveying for accreditation unless it enters into a business associate agreement with the hospital. JCAHO has proposed adding such an agreement as a uniform addendum to its accreditation agreements for all health care organizations. However, according to AHA, some of the proposed provisions in the JCAHO model associate agreement are outside the scope of privacy rule requirements and "would impose unwarranted burdens and needless liabilities in hospitals." AHA also expressed concern that pending final changes to the privacy rule may impact the rule's business associate agreement requirements. It urged JCAHO to reexamine the model agreement and revise it with those final changes in mind.

According to the Washington Post, the final HIPAA privacy rule issued Friday offers weaker safeguards than those sought by consumer advocates. The final regulations omit a requirement that patients' written consent must be obtained before their personal health information can be handled by doctors, hospitals, pharmacies and insurance plans -- a protection that lawmakers and two White Houses have contemplated for years.

The rules go further than the administration previously considered to rein in the use of medical information for the marketing of products, particularly prescription drugs, by companies that gain entree into individuals' records. Critics in Congress and elsewhere said, however, substantial marketing loopholes remain.

Final Privacy Rule Filed

The final HIPAA Privacy Rule 400-page document was filed at 2:00 PM today at the National Archives; the "Privacy Standards for Individually Identifiable Health Information" are scheduled for publication in the Federal Register on Wednesday, August 14. By law, the rule had to appear in the Federal Register by Wednesday, eight months ahead of the April 14, 2003, HIPAA privacy compliance date.

Read the final changes to the Privacy Rule on HIPAAdvisory:

• MS Word document
  
   
• Adobe Acrobat PDF

Read the HHS Press Release and Fact Sheet.

The University Health Network of Toronto, Canada plans to take extra efforts to protect patient confidentiality after staffers were caught earlier this year looking at the private medical records of former Canadian prime minister Brian Mulroney and Toronto Maple Leafs coach Pat Quinn. The Province of Ontario's Information and Privacy Commissioner, Ann Cavoukian, conducted an independent assessment of the hospital's privacy protections after the "two well-known individuals" had their privacy breached last May.

Trudel said, "It is probably going to be in the fall. It will be on the regs [publication] agenda for October. One of the things we are doing is making sure that privacy and security are linked. We definitely need to take another look at it, in light of the private rule modifications, before it goes out the door."

The South Carolina Medical Society, its Physicians Care Network PPO subsidiary, six individual South Carolina physicians and the Louisiana State Medical Society filed suit against the Department of Health and Human Services on July 16, 2001. No other plaintiffs have joined the suit, but many state medical societies and hundreds of physicians have expressed support, according to Richardson. He expects some societies to file supporting briefs at the appellate level.

The lawsuit, available at www.healthdatamanagement.com/html/news/compliant.doc, challenges the privacy rule on three grounds:

* Section 264 of the Health Insurance Portability and Accountability Act, under which Congress authorized HHS to promulgate privacy regulations if lawmakers did not enact a privacy law, violates the separation of powers clause of the U.S. Constitution, plaintiffs allege. “The statute allowed HHS, an executive agency, to act as federal legislators in drafting and enacting the executive regulations,” according to the suit. “As enacted by Congress, Section 264 contains no intelligible principle to guide or limit HHS in the drafting of the regulations.”

* The rule’s state preemption clause is so vague it violates the due process guarantee of the Fifth Amendment, according to the lawsuit. “As drafted, the preemption clause of Section 264 is impermissibly vague because a person of ordinary intelligence is unable to determine whether state privacy protections are ‘more stringent’ than the HHS Privacy Regulations,” the suit contends.

* Even if the Court upholds the constitutionality of Section 264, the regulations promulgated thereby are unconstitutional because HHS did not have the constitutional authority to expand the privacy rule to include all communications, not just electronic transactions governed under HIPAA, according to the suit.

The Privacy Job Opportunity Boards will be divided into three levels. The first, PJOBs, will advertise mid to high level positions relating to privacy including HIPAA administration, HR administration, database management, legal counsel, marketing, corporate communications, new product development, and information security. PJOBs Plus may be used to target those with the qualifications necessary of a high level privacy executive or CPO who is responsible for overseeing privacy for the entire organization. Companies may post listings on Ptemps to fill the need for temporary positions, such as consultants.

HHS officials recently said the department expects that month to publish the final data security rule along with proposed rules for a health plan identifier and claims attachment standard.

Two common misconceptions concerning the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) were clarified at the HIMSS' Summer Conference this week. Speaking at the conference, Richard Croteau, M.D., executive director for strategic initiatives at JCAHO, said that JCAHO will not enforce HIPAA requirements, despite what some attorneys and consultants have been purporting in recent years. "We will survey compliance with accreditation standards, not HIPAA regulations." Another misconception, according to Croteau, is that HIPAA and JCAHO requirements conflict with each other. "There are no contradictions between HIPAA and JCAHO standards," contends Croteau.

According to AHANews, more than 13,000 companies and organizations are seeking an additional year to comply with HHS' rule on electronic data interchange, Elizabeth Holland of HHS' Centers for Medicare & Medicaid Service told a regulation compliance conference this week. Affected entities have until Oct. 15 to submit a compliance plan or ask for an extension under the Administrative Simplification Compliance Act (ASCA).

The following three HIPAA regulations were published in the Federal Register today:

• Read the "Modifications to Standards for Electronic Transactions and Code Sets" NPRM adopting specifications for electronic retail pharmacy drug claims (PDF).
   
• Read the "Modifications to Standards for Electronic Transactions and Code Sets" NPRM proposing to adopt draft addenda (PDF).
   
• Read the "Standard Unique Employer Identifier" Final Rule (PDF).

The concurrent comment periods for the NPRM's are 30 (as opposed to the usual 60) days. The initial compliance date for the Employer Identifier will be approximately July 30, 2004 (July 30, 2005 for small health plans).