Every healthcare and HR professional in the US knows about HIPAA. Its that difficult piece of legislation that says you can't treat an individual's protected health information in the same lax way that organizations do every other aspect of an individual's 'private' data - you can't leak it, share it, sell it, or generally let it out of your sight. The problem is, although everyone knew about the legislation and new at a high-level what it meant, at many levels it lacked any real threat to make people pay attention.

The penalties from the legislation itself appeared to be more like "we expect you to screw up and release a bunch of personal information, so if you do we'll scold you a little, and we know you'll do it again anyway, so we won't penalize you too much", than a real deterrent. The fact that HIPAA worked at all in healthcare appeared to me to be that the bad press that would come from a failure. For example, the Seattle health system, Providence, was finally hit with a $100k fine, but this took repeated offenses and the loss of healthcare records of 386,000 people. According to Anne Zieger on FierceHealthIT:

The fine that will be paid by Providence is actually fairly unusual, as very few HIPAA fines have actually been imposed to date. However, its security issues are also unique. While many health organizations have lost a single laptop or backup tape to theft or disorganization in recent years, I haven't encountered any that have actually had to report multiple losses. That might explain why federal monitors took a particular interest in this organization's troubles.

As I looked through the backlog of news I had been avoiding reading this week, I started to see more stories about the Health Information Technology for Economic and Clinical Health (HITECH) Act. At a time when the government is pushing electronic medical records (welcome to the 20th century US healthcare), someone is also thinking about how badly companies are likely to implement their systems. This story jumped out at me: HIPAA Enforcement Gets More Teeth:

Prior to the HITECH Act, the maximum penalty was $100 for each violation or $25,000 for all identical violations of the same provision. A covered healthcare provider, health plan, or clearinghouse could also avoid the imposition of a fine by demonstrating that it did not know that it violated the HIPAA rules.

The HITECH Act strengthened the enforcement program by establishing tiered ranges of increasing minimum penalty amounts, with a maximum penalty of $1.5 million for all violations of an identical provision. In addition, a covered entity can no longer prevent the imposition of a fine for an unknown violation unless it corrects the violation within 30 days of discovery.

The provisions for the hefty fines appear to only apply to health care providers, clearinghouses and health plans. Since HR does not fall into these categories, all the HR professionals are wondering why they were suffering HIPAA fatigue back in 2005 when the security regulations started to really hit them. The problem for HR is that they pass protected health information (often referred to as PHI) to the three types of "covered entity", therefore they fall under HIPAA security rules.

There is a a great article that talks about the role of HIPAA security in HR back in 2005: "HR's Role in HIPAA Security Compliance" By Philip L. Gordon of Littler Mendelson, P.C. As the article states, HR passed the data security issue to IT, "because that's what IT does, right?".

You do not have flash or javascript support.

Average (0 votes)

Reply