HHS Publishes Ransomware Guidance
HHS Publishes Ransomware Guidance HHS has...
Moving Forward with Meaningful Use Stage 3 and MACRA
Moving Forward with Meaningful Use Stage 3 and...
Terms and Conditions May Apply: Consequences of Email-Provider Email Scanning
Terms and Conditions May Apply: Consequences of...
CMS Releases Guidance on Stage 2 Summary of Care Measure
CMS Releases Guidance on Stage 2 Summary of Care...
8 Things to Know about the Next Evolution of Meaningful Use
8 Things to Know about the Next Evolution of...
“Top 10” List for Security Law Compliance
“Top 10” List for Security Law Compliance As we...
CMS Extends Hospital Deadline for Meaningful Use Attestation
CMS Extends Hospital Deadline for Meaningful Use...
CMS Releases Final Meaningful Use CEHRT Extension Rule
CMS Releases Final Meaningful Use CEHRT...
SAMHSA Public Session to Discuss Part 2 Regulations & HIE
SAMHSA Public Session to Discuss Part 2...
Reminder: Hospital Hardship Applications Due September 1 for Medicare Promoting Interoperability Program
The extended deadline for hospitals to submit their hardship applications for the Medicare Promoting Interoperability Program is approaching. Hospitals have until September 1 to file for a hardship for the 2019 reporting period and avoid negative payment adjustments in 2021.
Moving Forward after Privacy Shield’s Invalidation
On July 16, the Court of Justice of the European Union (“CJEU”) invalidated the Privacy Shield, one of the primary mechanisms used by companies to lawfully transfer personal data outside of the European Union under the GDPR. Despite a prior adequacy determination in 2016, the CJEU found that shortcomings in the Privacy Shield, particularly U.S. security and surveillance laws and an ineffective Ombudsperson program, resulted in a failure to provide essentially equivalent protections to those afforded to individuals within the European Union.
Looks Like the FTC Is Ramping up for Enforcement of Health Apps
This past Tuesday the FTC hosted its 5th annual PrivacyCon. It was a GREAT event! The full-day event covered a wide-range of cutting edge and titillating issues concerning the privacy of data in this day and age of rapidly accelerating technology. However, it was the morning session which covered Health Apps that interested me the most. In his opening remarks, the Director of FTC’s Bureau of Consumer Protection, Andrew Smith, came out-of-the-gate pointing out that earlier this year HHS issued rules that will make it easier for consumers to access their medical records through the app of their choice, and while this expanded access to health information can be an enormous benefit to consumers – wherever data flow opportunities increase, the opportunities for data compromise increase as well. Director Smith concluded his opening remarks by stating “We at the FTC will not hesitate to take action when companies misrepresent what they are doing with consumers’ health information or otherwise put health data at undue risk . . .” Here is what I learned from the four-person panel of experts who discussed the ins-and-outs of Health Apps and potential direction of the FTC will take with enforcement.
Mind your Breach Insurance and Vendor Contracts
A preliminary class action data breach settlement involving UnityPoint Health should prompt health care organizations to take a second look at their breach insurance coverage as well as their contracts with vendors who process data on their behalf. Adequate cyber and breach insurance coverage is paramount and should be commensurate with the health care organization’s size, operations. Additionally, health care organizations should pay close attention to their vendor contracts, particularly limitation of liability clauses, hold harmless provisions and indemnification provisions in health IT and other contracts.
Don’t Wait to Understand How “FHIR” Will Transform Health Information Exchange, or You’ll Feel the Heat When it Ignites!
CMS & ONC have promulgated their Final Rules to implement the 21st Century Cures Act. A main goal is to accelerate the access, exchange and use of electronic health information (EHI). One way this is being accomplished is to require certain entities and actors to provide Application Programming Interfaces (APIs) that use a new standard for data access and exchange called Fast Healthcare Interoperability Resources (aka “FHIR”). These new standards for adopting FHIR for information exchange is expected to exponentially accelerate individuals ability to access and share EHI through mobile apps, as well as allow any third-party adopting such FHIR standards to obtain access to such EHI. Especially for HIPAA Privacy Officers, Security Officers, Compliance Officers and attorneys who have for years focused on ensuring that their organizations do not make the mistake of releasing protected health information to a third-party in violation of federal or state privacy and security laws, I feel your pain on FHIR!
You Should Know Your Affirmative Defenses if OCR Investigates You for HIPAA Violations
The HIPAA Enforcement Rule prevents the Secretary/OCR from assessing civil monetary penalties (CMP) against a covered entity or business associate if an Affirmative Defense can be established. A HIPAA violation that is corrected within 30 days of discovery can potentially insulate an organization from CMPs, provided certain requirements are met. But an organization has to make sure that it fits squarely within the requirements of these regulatory defenses to be fully insulated.
Subscribe & Survive the onslaught of new healthcare regulations requiring updates to affected compliance programs.
Get access to exclusive subscription-only access to resources, tools, industry analysis and other valuable solutions.