Slashdot Mirror
Striving for HIPAA Compiance?
krisguy asks: "As a Oxygen Transfill Technician for a DME (Durable Medical Equipment - wheelchairs, oxygen, and such) company, my only regulatory problems have been with the FDA. Recently, due to good management of FDA regulations, I was appointed HIPAA security officer for my company. I looked at the 'helpful' compliance manual from our buying group, and realized that I have to try to get over twenty people who have 'limited knowledge of computers' (read: don't want to learn) to begin to use stuff like PGP, ANSI X12 codes, and having to write, train, and enforce procedure rules. To top this all off, I only have until April 14, 2003 to get most of this fully functional or forced to have the company shut down. I am wondering if any Slashdot readers in medical fields are feeling the pain of HIPAA like I am right now, and what ways can I get everyone to comply besides "You don't do it, you don't work here."?" Ask Slashdot last touched on HIPAA issues when this article which concerned itself with Windows 2000 and HIPAA issues. For those who have already hopped thru the rings that represent HIPAA compliance on an general basis, what did you have to insure was done?
Although it's another side of health care, why not take a look at the AMA's page on HIPAA? Much of the advice is geared toward small practitioners, and as such would be useful in helping you figure out where to start.
I thought this was about some new car club for cool people.
sig.
Don't just tell them you will fire them, Actually fire a couple. The rest shape up real quick.
When it is a matter of compliance, they don't have an option. The sooner they understand it, the better. If management isn't behind you, then ask to be reassigned.
--ST
http://www.theMediaBunker.com
You need the authority to say "you will follow these procedures, or you will work elsewhere; preferably in another industry."
Until you have THAT authority, you do not really have the job that you think you have.
-fb Everything not expressly forbidden is now mandatory.
I'm a web/database developer in a large healthcare organization, and the phrase "HIPPA compliance" has been thrown around quite a bit lately. Some of this makes quite a bit of sense, like not sending patient information over the Internet via e-mail. Others are much more fuzzy, and seem to do more harm than good.
For example, only the people who "need to know" should have access to the data. The catch is that I'm somehow supposed to magically determine who needs to know what. Do I get to tell my directors that they can't see something? How much do I really get to question someone else who knows their job better than I?
Plus there's the catch-22 situations. There's data on which physicians can perform what procedures. I personally think that everyone in our organization should see it, as I don't want any physician performing procedures they're not supposed to. The catch is that not everyone "needs to know", so that increases the chance that the information won't be seen.
From my work with HIPPA compliance, there are two important things to remember. One, there are no HIPPA police out there that will kill you and eat your children if your compliance comes into questions. Second, all they really want you to do is tell the thruth about the measures you have taken to secure patient or other sensitive data. For example, if you say your data is in a data safe, make sure it does. The problem you will have with lawsuits can only be brought up if you have not truly done what your compliance form says you did.
I currently have 3 seperate jobs (I'm a college student), and each one is affected by HIPAA in different ways... one is a branch of an insurance company, where I'm sure eventually all of our inter-company emails will have to be encrypted, reguardless of content, and we'll be very limited on what we can actually talk about on the phone (I'm in the phone cube all day)
the second is a hospital, where I work registration and transfers. Completely different setting, as I'm dealing with the patients face-to-face instead of over the phone, but there are lots of restrictions there, from where the monitors can be located (can't have a non-employee looking over your shoulder...) to how long the screen saver is set for (1 minute, and it's password protected, pain in the ass when you have to type that EVERY time you want to touch the computer)
for the third I work as a programmer for my college, we recently bid on a programming project to develop internet-based training for a very large hospice-based corporation. we'll be designing 20 modules to train volunteers and other very non-technical (i.e. retired, or first time workers) workers how to manage information correctly.
all of my jobs will be having INTENSIVE seminar type classes on what we need to stop doing so we don't get shut down. every one of them has taken a "do it or lose it" attitude about it because of the very short time frame to work with. There are still HIPAA mandates that are being changed, which means that nobody has even started creating the training, much less the training itself, and the compliance checks...
You could accelerate compliance by filling the office full of acrid smoke from a bad power supply, or making Friday 'Nitrous Oxide Day'.
HIPAA is being sorted through at my place of work, which happens to be a hospital. We are basically turning our MS shop into a Citrix shop due to the impossibility of configuring thousands of computers at the user level.
We use ICA protocol with 128 bit encryption and rotating passwords.. but with all of the applications that one employee has to access, it's becoming a major breaking point remembering all of the passwords.
The apps can only be accessed via login, and each app has a separate login and password. It's bordering on the rediculous to get work done for people that's skillsets are RN's or MD's. MD's tend to be more technically adept(aka AOL), but the rest are hapless technoweenies(to quote a cheese movie).
Things are moving toward http browser based access, and temernical serviced applications. These things come in waves, and HIPAA is accelerating that wave towards TS clients.
As this is done, I hope to then be in a position to kill off MS clients and servers one by one. We can then concentrate on getting some real work done, rather than worrying about how W2K SP3/WinZP SP1 is a HIPAA violation or if MS will sue us next week cause they aren't making their stock margins.
And after all of this, we will have some work cut out for us(not much)- but it's OUR work. And we get to reap the benefits of our labor. No more Jakob Fugger and his gateway tariff between east/west. If the government can't do it, then I surely can. And so, there you have it.
The unfortunate consequence is that the resulting guidelines are very general, and require a continuous lifecycle process for evaluation, iplementation, audit and compliance. The healthcare industry must now involve itself in a regieme of regulatory overhead analogous to that of Securities or banking.
I don't think this is bad, per se. There is no history here for an emergence of industry best practices, etc. Expect it to be messy for a while.
"Flyin' in just a sweet place,
Never been known to fail..."
BS7799 is the British Standard for Data Protection. We had to have a paper free desk and shred everything. Despite having a double sided laser printer, all the damn staff still printed single. Everyone is a lot greener back in Australia.
Anyway, moral from that successful drive is... get in early. Twenty something staff? That's nothing. Push it through now. What came across most was that the accreditations make sure you have 'Systems' in place. New staff come in knowing the system. Old staff, well they're not going to be easy.
Read Peopleware under the section 'Believers But Questioners' and work towards that. At least then you get to read a darn good book on company time.
[% slash_sig_val.text %]
That's pretty much the only way on Earth you're going to force people who don't want to learn anything to get up to speed. One way to make the process smoother however, would be to lay out a simple series of steps they need to follow, and write it up into a little instruction sheet for them to refer to until they get the hang of it. It sounds like you'll be writing something like that, but remember simple and clear whenever possible. Golden rules in documentation writing.
Another point which will help (at least it would help ME in such a position) would be to explain to them in detail why these procedures are a good thing and what bad stuff might happen (besides being shut down) if they aren't followed. People may be less resistant to the changes if they know that said changes aren't just time wasting BS.
I guess that doesn't really help you if the people really don't want to learn, period. Then it's back to the "or else" stuff. But you can try to make them at least willing to do it by making them part of the "in the know" crowd who understand why these changes are made. You might find some of them will even support the improvements! So I guess I'd say try to change them from unwilling to willing, which lord knows is easier said than done.
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
Yes, many of us who are in the industry, or in tangentally related ones, such as myself, are feeling the frustration from HIPAA. Here's the survival guide as I've seen it:
.ppt presentation)
1) File for any and all extensions you can. A lot of this policy is BS and will probably get softened, but filing for extensions is probably the easiest way to stick it back to the man, at least for a little while.
2) There are a few companies that provide HIPAA compliance insurance, especially for software products developed to support medical information systems. MD Online, LLC (no web site but phone at: 703-450-0331) has VPN security products designed for medical users that might be helpful. (No relation to them other than having heard about their products in a
3) Solve the problem with vendor pressure. No software provider in the industry wants to admit they're not HIPAA compliant, so grill them on it. They know it's a priority and should (hopefully) be releasing software that will accomodate the new rules.
4) Solve as much of the problem as you can technically. If you're the vendor of the products you use (in house software), redouble your efforts to make as much of the compliance transparent as possible. As you've outlined, most people in the industry do NOT want to deal with the technical aspect of computers, they just use them to get their jobs done. Putting all of the encryption / security management stuff in plain view is only going to make the learning curve more difficult and allow more room for human error (which equates to HIPAA violations and fines for your employer).
5) (this is very much not to be interpreted as legal advice) Patch the big holes first. If you know you can't meet HIPAA by the deadlines, patch the big problems, and the things that will be obvious violations and noticable by people inside and outside the company. There are zillions of possible violations, but if you show due diligence any fines you do receive will hopefully be tempered by the fact that you've done as much as possible to accomodate the law.
-Dan
hehe - the irony.
I work for a medical billing software vendor.... the worst part about HIPAA is listening to our clients call in and ask and complain about when we're gonna be hipaa complaint. We had to basically fill out over 200 HIPAA extention forms for them because we knew they wouldn't know what to do... ...but it's not that bad for software vendors right now. All we have to do (because all the changes of HIPAA aren't even set yet.... they don't have their act together) is change some code for the electronic transmission...
It's nothing but more government interference in private business that chains capitalism
Fine - let's have EVERY bit of your medical history made poublic please, and given to every insurrer, loan company or employer to whom you apply.
That's a great idea.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
I work for a company with 2 medical practice management software packages. These packages each sell for big bucks... a single installation can be $100,000, with annual fees on top of that.
HIPAA isn't new news. We've known about HIPAA for a long time, and only now, as the deadline stares us in the face, are we beginning to make our software HIPAA compliant.
This late action comes from a long stem of procrastination. Updating expensive software to be HIPAA compliant is a time consuming task... from the standpoint of a software manager (an incompetent one), why make the software HIPAA compliant today, when today could be used to implement a new requested feature?
After pushing off HIPAA compliancy day after day after day, we're now finally getting around to implementing the mandated changes. This isn't easy for other people in the healthcare industry, namely people working at the practices that need to teach HIPAA to billing clerks.
The delays of software authors cause delays at the practice, which causes healthcare costs to rise.
Don't thank me, thank my managers. Only a few days ago I enlightened my Technical Operations Manager that "HIPAA" isn't spelled "HIPPA". I guess he didn't get the memo yet.
Skiers and Riders -- http://www.snowjournal.com
If possible handle encryption at the mail server... there are smime based email encryption servers that will handle encryption/decryption... if this is not satisfactory then at a minimum put up an email policy server that will verify that any email going out is encrypted... if the users aren't willing encrypt thier messages, then don't let them email... below are examples of email encryption and policy enforcement servers (btw I belive tumbleweed can do policy enforcement as well)
l utions/ma il.html
x .htm
Email encryption server:
http://www.tumbleweed.com/en/products/so
Policy enforcement server:
http://www.ciphertrust.com/ironmail/inde
It breaks down like this : the regs have been so loosened to be almost ineffectual.
You (as an individual and as an institution) only get jail time and big time fines if you get a proveable financial gain from violating hipaa regs, i.e. you sell a bunch of kidney transplant patient info to a dialysis machine company, and someone can produce records to prove this happened.
Ignorance or other non-compliance (if reported) only gets the institution (not you as a worker) fined $1000 per incident max, and the total fines can only be up to $25,000 a year. So in many cases it's cheaper to be non-hipaa compliant than it is to upgrade everything to be hipaa compliant.
Then there's the extension you can file to get another 6 months on your deadline to be hipaa compliant. If you file that you get until October 2002 or something like that. There will probably be more options to file extensions for even later than that if October is too soon for you.
Don't worry kids. HIPAA, much like 911, is a joke.
It's been said before, but ...
In the end, the timetable set for HIPAA compliance will be pushed back further and further.
Some of the stuff they're asking for is just unreasonable. I don't remember a lot of it, but I'm just glad to be out of the world of health care.
I too am in charge of tons of HIPAAA stuff for my company. I've been to some seminars and such and have even read the PROPOSED regulations. My best advice, don't file an extension, don't panic, don't worry. HIPAAA is a typical unfunded mandate. Ask yourself who is going to enforce this? (Answer: NOBODY) Are the regulations even 100% absolute yet. (Answer: Hell No)
:)
Don't sweat this stuff, get a template package or a nifty little book, (e-mail me for my recs, I'm not going to past advertisements for the "consultants") and don't panic! If you use industry standard best practices you should be pretty darn close to compliant anyway, if you don't use best practices, well maybe its time to panic.
Rule of Life Number 2: Remember, it can all go to hell at any minute. --Jimmy Buffet
I love Slashdot, I read and post here all the time. I am also a database programmer who works in a research hospital. I would love to show some of my co-workers this article and some of the comments in it to get them thinking about HIPAA and free software.
But when the editors spell the regulations "HIPAAA" in big white letters at the top of the article, I can't share this with anyone who I want to respect me.
C'mon Cliff, and whoever (if anyone) is checking your work. It's not HIPPA, HIPPO, HIPAAA, HIPSTER or HIPAAPATAMAS. It's HIPAA, as krisguy manages to note 5 times in his writeup.
Hopefully the headline will be changed soon and this comment will eventually be modded away as offtopic, but basic spelling, grammar and usage are important to the community that makes your website worth reading.
ps- I'm sure someone will point out that the average slashdot post is worse than the Slashdot editorial crew, but to that I can only say that they will be equally culpable when they are paid for posting.
microsoftword.mp3 - it doesn't care that they're not words...
- Make sure email apps do the official encryption automatically to ALL emails
- Put the database servers behind a nice firewall
- Write up some policy on sensitive operations
Granted, the management end isn't so simple, but when people realize that they could face fines or jail time for violations, they'll go along, even if they think it's stupid. The hardest part seems to be training people on a new email app.-- Hamster
All we got was a packet of 30 pages of fluff then just locked off a section of our warehouse with a digital key lock and just store everything in there now. Electronically we are not doing anything different than before. This is the most half-assed effort I have ever seen. Of course that fits right in with standard operational procedure. Jimmy rig it so it just barely works then when shit breaks, scream at your already depressed/frustrated tech workers and tell them, "You need to fix it and make it work so this never happens again.... in 1 day"
ZERO ZERO ONE ZERO ONE ZERO ONE ONE! Just brushing up for my next big invention: Ethernet over Voice (EoV)
By involving employees, you will at not only free yourself from a lot of grunt-work, but you will also avoid becoming the nasty HIPAA police everyone ignores and hates. And you will probably also get a bit of enthusiasm from at least some of the co-workers. This is the right approach, because what you are after is mostly a culture-change, not a technical change. Besides, management will love you...
I work with Radiation Therapy, and HIPAA is causing quite a bit of concern. All of the patients that come through there for treatment have nice binders with their name on the spine. We've got warning stickers when two patients may have similar names. This makes it easy when you set them down on the table for the radiation treatment, that you're looking at Nancy Johnson's chart, and you don't get it confused with somebody else.
However, under HIPAA, all names that are viewable by any public must be removed. Those names on the binders -- they've got to be replaced with some ID number. The names on the whiteboards of the patients must also be removed. QA is _much_ harder when to confirm that you've got the right chart, you somehow have to verify you're looking at the right ID number, instead of just asking, "Are you Nancy Johnson?"
Federal compliance has been delayed before for some of these same problems, and there is any indication that it will be delayed again. Our director is moving towards HIPAA compliance, but not at the expense of care and safety.
This also has all of the earmarks of a Software Engineering windfall -- all of the medical systems have to be modified to remove names from public places. That's a lot of work!
Since you don't like government interference in your business, I hope that your health care firm will give up access to funding in the form of Medicare, Medicaid, NIH research funds, etc. It would be terrible if you were to behave hypocritically by taking lots of government money and then turn around and complain about government regulations.
There's no point in questioning authority if you aren't going to listen to the answers.
Okay, I know this sounds wierd, but my HIPAA expert tells me that Privacy and Security are totally different things according to HIPAA. You have *much* less to worry about by next spring than it seems like you might.
:)
(From an IT perspective, one wonders what good privacy without security? For us, if it ain't secure, it's silly to call it private. But HIPAA was not written from an IT perspective...)
The Privacy portion of the rules take effect next spring, and you will have to deal with that. HOWEVER, the privacy rules deal with how you decide who is allowed to see the data, *not* how you protect the data... that's the Security portion of the HIPAA standard. Privacy is about rules and procedures for intentional data disclosure, and data security is NOT within the scope of the Privacy rules.
(So, for instance, HIPAA considers an e-mail over the public internet *private*, so long as you're sure the person you addressed it to is authorized to see the information it contains. Bonkers, but true.)
The HIPAA Security standard will address how you protect your data. It will address security issues from encrypting e-mail in transit to physical security of your data storage. These rules have not yet been published, although they are due at any moment. Once published, we'll have two years to comply... so not before October 2004 will they be in effect.
I advise you to get in touch with your state's medical association and attend their training seminars on HIPAA right away. Make sure to take along the office manager or medical records guru. It's information you WILL need.
Oh, and don't panic.
With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
I work in the healthcare industry too. I believe there are certian circumstances where you can apply for an extension to the April 2003 date. Look more carefully at the law itself and not what your buying group gave you.
I worked as a HIPAA compliance consultant and have contributed a chapter to a CIO-level book to discuss HIPAA compliance.
If you can read and have a general understanding of the healthcare industry, you can easily understand HIPAA.
First, and foremost, you MUST read the *actual* HIPAA regulations (Privacy and Security) in order to properly understand the HIPAA requirements. They are NOT difficult to read--they just look intimidating, but are actually VERY well written, generally easy to understand, and are accompanied by a ton of background and explanations. Do NOT, under any circumstances, rely on the claims of vendors or any other "HIPAA Analyst" etc. regarding HIPAA compliance issues unless you have read the regs and can validate the claims, and ensure that they are even relevant to your organization. Educate yourself and you will be amazed at how much simpler HIPAA becomes. (If you need to implement HIPAA transactions, there is very little to read--just the transaction specs.)
Second, after you have personally read and understand the requirements, put them in the context of your organization. I believe that you will find that the reality of HIPAA compliance is relatively simple, and consists primarily of policies, procedures, and general best practices. Any time you hear someone saying "You HAVE to do X, Y, and Z" to be compliant, and those steps sound unreasonable or very difficult, you should be skeptical and verify that 1) that interpretation of the requirements is valid, and 2) they actually apply to your organization.
After doing these two things, you will be in control of your HIPAA compliance effort. There may still be some hot items with short deadlines depending on which rules (Transactions, Privacy, and/or Security) apply to you, but it should not be a crisis.
I no longer do HIPAA compliance consulting, but if you want some URLs to start with or general recommendations, feel free to e-mail me at leftism11@yahoo.com.
You can start here by downloading the PDFs of the Privacy and Security HIPAA regs:
http://aspe.hhs.gov/admnsimp/
A site to check for updates and HIPAA news is:
http://www.hipaadvisory.com/
(They have good news updates, but again, use your knowlege of HIPAA and understanding of your organization to filter any opinions you get from their site.)
Then this will never happen, pure and simple, unless cracktivism is legalized (cracking inscured systems to publically disgrace the company into bolting thiings down).
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
As far as I'm aware (I do some coding for a small medical company, I've had to deal breifly with HIPAA), there's not actually any set-in-stone rules for what makes up HIPAA compliance. It boils down to you coming up with a HIPAA plan that describes how you will effectively secure patient information and sending it in and having it approved. Your plan might include PGP for email and SSL for web apps if that's where patient information flows at. Or you might devise your own schemes to protect it.
I guess what I'm saying is that all you have to do is treat patient records like you would your root password, follow good security practices, document them, and send them in for approval, and all should be ok.
11*43+456^2
Anyone know of any email gatewways capable of looking for any non-PGP content in the body of an email and then rejecting non-compliant emails?
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
First, if you are a 'security officer' means you are a VP level or better. Are you paid for this? As an officer, you have the authority to tell people to do what you want, you also have the authority to hire and fire as needed, etc....
Look, I work for a pharmacy benefits company, and we've been dealing with HIPAA regulations for about 3 years now... the fact your organization chose to wait until 6 months before the mandatory date just says they are ill prepared to be in business. HIPAA is not something that showed up overnight... it's been known about for a few years now, and any decent company would have already arranged for the changes to be put into place.
Also, referring to my first statement, if you are an "officier" of the company, it means you COULD go to jail if you break the law (e.g. like not being HIPAA compliant), so I would be VERY careful about accepting that title. Maybe they made you the fall guy?
Soon there will only be ONE giant MEGA corp health care provider, and they can share your data with "umbrella companies" no matter what you say or want.
errr....umm...*whooosh* *whoosh* Is this thing on ?
While HIPAA compliance is serious, no one is going to shut you down if you aren't compliant by April. First of all, the privacy rule just was finalized a few weeks ago, and the security rules haven't even been finalized yet. This isn't Y2K - the deadlines are artificial, and, as was done for the transaction deadline, extensions no doubt will be offered.
The key though is this:
The first step you must take now is build a compliance plan! This is important because you will need it to get an extension. It is also the only way to make HIPAA compliance manageable.
Keep in mind, as well, that HIPAA is mostly about best practices regarding security and privacy. Even if HIPAA didn't exist you should be doing it. Not just you. Everyone out there. HIPAA is just a stick.
So
1. Look at your organization
2. Build a plan
3. Educate your employees why this is important
4. Implement the plan
5. Educate your employees how this will be done
6. Test the plan
7. Educate your employees what needs to be done
I think you get the picture. And don't feel pressured. Just do it right, step by step.
I've mainly been dealing with the effect of the HIPAA regulations on email. The organization I work for primarily communications with other health care organizations, not patients directly. We will probably implement a mix of solutions and make the option available to the other organization of what they want to use. You only need to worry about encrypting email that contains PHI (patient health information).
1. STARTTLS - Implement it in you mail server or border mail gateway, and you email gets encrypted on the fly without requiring any user intervention. Works great only a couple of things you need to look out for. An informal agreement with the other organization will help iron these out. (a) You need to ensure that the other mail server (the one in the MX record) is the last hop across public networks. You don't want that server forwarding on the message unencrypted after you send it encrypted. (b) You need to enforce the use of TLS for some domains. Postfix allows this and I'm sure others do. (c) Signed SSL certificates by a proper CA (not self-signed) help prevent man in the middle style attacks.
2. S/MIME - Works, but you got to train the users on both ends. Put your S/MIME public keys up on your website so that users can download them.
3. PGP - Works, but same as S/MIME, you got to train the users on both ends. Put your PGP public keys up on your website so that users can download them.
4. A secure web mail contact form - Good for only one-way communication (them sending messages to you), but it works a lot easier than trying to train an AOL User/patient how to use S/MIME. Prevents them from broadcasting to the Internet their SSN, and health problems in clear text.
5. An S/MIME gateway - Most mail servers can act as STARTTLS servers, but most don't have the option of being an S/MIME gateways, so you have to add an additional commercial piece of software, and so do all the other organizations that you are communicating to. Also it only helps the organization to organization level, since AOL is running an S/MIME gateway, and neither is hotmail.
Personally I would like to see the HIPAA regulations jumpstart the use of STARTTLS enabled SMTP servers. S/MIME and PGP are difficult for users, and will probably not end up being used if it isn't easy.
I didn't know HIPAA dictated screen savers. Can someone point me to the legislation online somewhere?
creation science book
Actually HIPAA is a real pain for the growing number of medical researchers who use EMR (Electronic Medical Records) for academic research (like me). Many useful study designs in which patients are still completely anonymous will suddenly be in murky legal waters after April. For example, one of the (many) "identifiers" that must be removed to use EMR's without explicit consent is the date of any procedure. This restriction alone makes many otherwise useful datasets extremely limited and not worth spending resources on.
So it is good to protect EMR's from (e.g.) Pharmaceuticals trying to use sensitive information for marketing, but some of the shackles that HIPAA will put on researchers are not a good thing (TM). There are already many measures in place within academic research to protect the privacy of patients.
For the love of $DEITY, loose != not win!!!!!
It takes people like MS to make people like linux, just as it takes people like health insurers to make people like undertakers.
Hi guys,
I work in a company where HIPAA compliance has been mandated by our legal counsel for liability reasons. Here's what I've managed to synthesize from the requirements...
1. HIPAA is meant to protect the patient and their medical information from getting leaked out into the public.
2. HIPAA is good, and it requires organizations working with medical data to treat it as sensitive information. Medical data of patients should be kept safe like your own children (not the best example, but you get the point).
3. Protect the association between a paitient and their medical information. There is nothing wrong with having medical information less secure unless it is accompanied by anything traceable to a patient (like SSN, address, name, next-of-kin, etc.).
4. HIPAA demands that any time personal medical information is viewed or used, it needs to be tracked somehow to show the fingerprint trail.
5. Protect all information systems from unauthorized access, including computer systems, physical claims, etc. Your premises should be as secure as your network!
6. Read the HIPAA proposal, AND look for summaries on HIPAA. If the HIPAA proposal is too dense a read, then the summaries will help you get started.
7. Form a HIPAA committee... usually one person from each department or overseeing group to help make implementations possible.
8. Get your company audited for HIPAA compliance after you have implemented your measures. This way, you can have an "objective" 3rd-party evaluate your compliance and suggest remedies before the deadline.
9. Don't get caught up in "If they can't enforce it, why should I bother?" That's lazy... would you want your personal medical information left on the sidewalk for someone to pick up and use against you? These are peoples lives we're talking about!
Well I've said enough. I am NO expert on HIPAA, but I have our CIO's and Security Manager's ear. These few points are what I've managed to make sense of while discussing the topic with them.
Good luck on your own HIPAA compliance efforts.
CokoBWare
Go ahead and mod this guy down like he asked, he's confused as to what the truth is. The HIPAA legislation was passed in 1996, but the Final Rule version of the Privacy Rule was only promulgated this August, and only went into effect less than a week ago, which means it's definately not going to change again before the implementation date.
Up until then, anything could have changed in the Privacy Rule, otherwise known as a 12000 line set of government regulations.
The Security and Electronic Signature Rule is still in a proposal state. The Universal ID proposals are not really even being considered at this time and won't be until Democrats are back at the helm. The first proposed privacy rule was promulgated in 1998 and has gone through several substantial iterations. Just because Congress said, "do it," in 1996 doesn't mean this guy had any chance of getting started at that point. Maybe in 2001 he had a fair chance of getting the gist of the Privacy Rule, but he had no way of knowing what, if anything (or everything) would change until this August.
It only takes balls when you know what you're talking about - this isn't a set of tablets with 10 simple rules, Chuck.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The US is about as capatilist as the USSR was communist.
Free market means no loans/grants/tariffs etc, bye bye airlines, steel etc.
An investor should be able to see everything about a company, no more Enrons.
Without a common enemy America is finished, let's split up the assets and re-distriubte the wealth.
I'm willing to share my medical history to the world to protect medical insurers from the grinding influence of government.
THe only problem is when health care executives and medical specialists are unable to purchase porches and drink $2,000 bottles of wine, the entire universe will come to a halt.
Conformity is the jailer of freedom and enemy of growth. -JFK
If I get a prescription for some of my personal hygiene needs (for tax and insurance purposes), and go to a MegaMegaMart Pharmacy to buy them, and carry them to the cash register, and the checkout clerk gets on the public address and hollers "PRICE CHECK ON _use_your_imagination_here_, GIANT ECONOMY SIZE" again, can I sue?
Here is another link that might help.
http://www.vennix.com/hipaalibrary.php
[alk]
Man, you must be a criminal lawyer, or, more likely. a criminal.
Your advice is about as morally reprehensible as the lawyers calculations that the settlement by people killed by having their hearts ripped out because they were impaled on solid steering columns would probably be less than the cost of replacing these with collapsible columns which would save their lives.
It never entered the lawyer's minds that people might rather pay a little extra for riding in a car that wouldn't FUCKIN' KILL EM LIKE BUGS ON PINS!!!
You are one sorry-ass son-of-a-bitch. It must suck to be you and HAVE to use an electric razor'cause you might slit your throat in knee-jerk remorse if you tried scraping the stubble with a straight-edge.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Including people without the means to stay adequately informed on the politics of the situation, in addition to finding/keeping a steady job to feed too many children.
Even if they had free Internet, they wouldn't have time to both read public opinion and legislative movements.
The closest they could come would be NPR, and then they'd have their resulting opinions fed to them.
(And it still wouldn't free them from needing medicare and medicaid to get by.)
What's this Submit thingy do?
Wait, it gets worse. Opened it with KWord. The only formats are bolds, centering, ?unicode?, and a few hyperlinks, that differ from normal html by only a few control characters which must only work for word. Why, oh why, would anyone use Word to publish something like that? Nothing different or useful was added by word. All word did was make it a little harder for me to read the thing presented.
I appreciate the effort, but please don't use Word. If you must use Word, save it as text or html. If word won't do that don't use word for things you want to share or cut and paste into another text editor that will do this. Remember that you yourself may not be able to read what you write in Word after the next "upgrade" and that most of your effort making the format just so will be wasted.
Friends don't help friends install M$ junk.
Everybody who had anything to do with HIPAA compliance went to at least one HIPAA workshop. HIPAA was the focus of many, many meetings. We had one person whose primary focus was HIPAA, and every manager was on board with the program. My advice is that you find a good HIPAA workshop, make sure your managers attend, and develop a coherent strategy together. If you don't take intelligent steps toward compliance, you risk becoming the fall guy.
At the workshop, the topic of jail time for non-compliance came up. We jokingly asked about how the jail time could be divided up, and whether a 90-day sentence could be turned into 45 2-day sentences to be shared among all employees. The response was, basically, that it'd have to be a pretty blatent violation to warrant jail time, and the people charged would probably those most responsible.
It's to your benefit to quickly determine whether management is informed and ready to make this a high priority. Asking them to attend a short workshop is a good way for you both get things started and get a feel for the situation, IMO. After that, you can decide whether to stay on or jump ship.
My heart goes out to all those poor, unbalconied people...
--Larry
Never attribute to malice that which is adequately explained by incompetence
Here in Boston. Take my advice- don't get sick next year.
HIPAA is not simple, companies are starting off way too late, like our dear poster here, and I'm sure the very first thing that he will be filling out is the extention form. The HMO that I work for started last year with the privacy questionnaire to all 2500 employees asking what data they released and if it was the min. needed to get the job done.
The fact that you are now just beinging scares the shit out of me, and let's face it, you're going to be closed down.
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
As a patient, the only things I've seen out of this are new outrageous consent forms. Read what you sign the next time you use insurance payments for a doctor's visit. Getting a pair of eyeglasses, I was confronted with "sign this or pay for yourself". The this there included disclosures to unamed partners and was essentially permission to tell anyone. I was told that I could not strike out the offending portion and the doctor herself was conerned. I was a great volunteer there.
I sure hope this set of laws gets more specific and makes such "voluntary" consent requirements to recieve insurance benifits illegal.
Friends don't help friends install M$ junk.
Comment removed based on user account deletion
Thank God I work for a financial services company where we don't get any (tangible) oversight at all.
I'm in a similar situation. Right now, there are four of us who are playing hot potato about who will be the compliance officer. Since I'm in the office least of us, I'll probably be stuck with it (since I won't be able to protest when the paper is sent in:) I suggest a simple method of dealing with the problem: get a job in another industry. I understand there are many openings for 'drug mule' listed in the Miami Papers.
Seriously though, trudge through it. There's no easy way. Threats of beatings and sacking is a good place to start (and yes, that's serious).
I read through many comments saying "why haven't you done this already" and "there's nothing to worry about." Bullshit. First, the regulations STILL aren't cast in stone. This is hitting a moving target. Second, there are things to worry about, both from patients, doctors, and affiliated companies (where I would place suppliers of DME). There are going to be a myriad of subtle changes. Our current reading of the regulations is that we can no longer call patients the day before an appointment to remind them. Well, we can call, but if they don't answer, tough shit. Can't leave it on the machine anymore. Similar with callbacks for lab results.
The 'privacy' improvements will be neglible, particularly compared to the extra hassles. Since I won't be able to say it at work, I'll say it here: folks, you asked for it. You begged your congresspeople to do something. Well, they did. And it sucks ass. I'm going to pay for it, and so are you. But when you bitch about all the hoops and extra forms you have to sign, just remember: you asked for it. When we have to raise prices (which won't help, since insurance, medicare, and medicaid won't pay any more) to pay for capital improvements, just remember: you asked for it.
A special note for the people who literally asked for it (HIPAA, that is): I hope you die, painfully, bleeding to death on the street, waiting for some medical info to get to your location, but it can't because of some form you didn't fill out properly.
I'm not a people person. I would have an awful bedside manner. That's why I'm in IT. That's why I get called in when HR has to do something shitty. Because I don't give a damn. I have seen the light, and it is the Scorched Earth Party.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
So what you're saying is that the government is a HIPAAAcrit ?
In Soviet America the banks rob you!
"For those who have already hopped thru the rings that represent HIPAA compliance on an general basis, what did you have to insure was done? "
At my companie, we convarted all of the spel-checking staff into compliance ofisers to spede up the work.
------
Today's Top Deals
Hopefuly you will never be a manager of any kind. Idiotic macho talk like that is exactly the way companies are run into the ground.
How many billion dollar companies have you helped to create? I helped to build one with over a billion dollars in revenues.
Fear is a pretty useless method of motivating staff. The best people know their worth and will either leave or make sure that you fail and take the blame for it.
Believe it or not there are other options besides 'strident language', dismissals pay docking and all the rest of the stupid stuff you suggest. Every time you make a threat you make another enemy.
Don't count on the idiot in the Whitehouse keeing the unemloyment rate high enough to give you a disosable workforce. Not so long ago it could take twelve months to fill a position. Dilbert boss tactics will only mean that your staf will leave en-masse the minute things look up
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Quite a few interesting comments on HIPPA. As a physician in a small group practice, here's a few points to ponder:
1. Someone commented on HIPPA as an "unfunded mandate." That's a very apt characterization. I have seen estimates of the total cost for HIPPA implementation as high as 3 billion dollars. Where is that money going to come from? Basically, it comes from the operating budgets of physician's offices, hospitals, etc. Remember that healthcare deliverers (doctors, hospitals, etc) are essentially the only industry in which costs rise year by year, but revenues decline. If you look at the average physician's office (and mine is no exception), what you see is a shrinking margin between the cost of keeping the office operational and the monies collected. Since that margin represents a) doctor's salaries and b) monies for expansion, program development, etc, what you are seeing is a industry in decline. Adding an additional cost (HIPPA) had darn well be worth the financial (and time and labor) impact. I doubt that will be the case.
2. People often complain about like of privacy in medical records, and with good reason, because your records should be private. However, whatever goes on in your doctor's office, I feel confident that more of your medical information circulates outside the doctors' offices that within. Further, the harder is becomes to share information from your chart, the more your care may suffer. Example: It is routine in my practice (as we are largely consultants to other physicians) for us to get records sent over in advance of a new patient visit. Often, the records we request do not arrive in time, so my staff will call the referring physician's office when the patient arrives and get records faxed. Now, with HIPPA, said "electronic transmission" may not be feasible - meaning that crucial information may not be available, meaning a second visit once that information has been received - less convenient for all involved.
3. Given that HIPPA requires logging of all accesses to the medical record as to date, purpose, person, how can that be done efficiently (and reliably) with a paper chart? It can't. This has let some pundits to postulate that to become fully HIPPA compliant, ALL medical records will have to become electronic. Even assuming that there were available enough good EMR software packages to accomplish this, imagine the time and cost of doing so. (BTW: It is not clear to me from the regs that non-electronic charts MUST be converted to electronic, or that the access logging rules apply to non-electronic data. I've asked a number of "experts" on this and have not gotten any clear answer).
4. It is not unlikely that "HIPPA compliance" in many small practices will amount to little more than a "HIPPA compliance manual" stuff on a shelf, coupled with a bunch of letters from insurance companies, billing clearinghouses, and software vendors attesting to their HIPPA compliance. What a collosal waste of time and money once again.
Don't get me wrong: I fully believe that medical information should (and maybe can) be protected and that people's private and personal information should remain private. In fact, I am very concerned about the overall loss of privacy we all face (and yes, I do have a shredder which I use liberally before throwing things in the garbage). It infuriates me each time I get a letter from an insurance company advising me which of my patients (by name) are on drug A and advising me that I could (?must) switch to "equivalent" drug B which (of course) is cheaper for that company. And so on. I'm just not sure that an increasing paperwork burden on the small practitioner, hospital, or payor is going to do the job here.
Sure, that would be the case for informed, motivated patients. That probably accounts for, say, 1% of all patients. The rest will either be ignorant or apathetic or both (i.e., willfully ignorant) and won't "defect to a [better] company" unless they are led by the hand.
The typical consumer pays virtually zero attention to how their money (or information) is used once their purchase/transaction is complete. They're just focused on the immediate result. That's why massive corporations just keep on growing while small businesses that try to "compete" struggle until they collapse, and only those small businesses that find a niche unserved by the massive corporations can expect to survive and have a chance to thrive.
No Laughing Allowed!
Why did you stop consulting in the area of HIPAA compliance? Was there some overarching issue that made consulting in that area less than lucrative?
When you were in the business, did you hear any talk about doctor-to-patient email (and vice versa)? I'm curious about that area, but I haven't done any research on it aside from a few informal conversations. So far, most physicians seem pretty skeptical that it will catch on, ironically except for my own doctor, who encourages it.
The Health Insurance Portability and Accountability Act of 1996 will have extremely large ramificiations with the IT industry. Some have said that it'll be bigger than Y2k compliance.
The reason? HIPAA basically means that every single company out there that deals with the health care industry must meet standards to ensure that information can be transferred readily as well as securely. Think about it. That not only means hospitals and physician groups, but insurers, employers, welfare, Medicare, Medicaid, anybody that has anything to do with the health care industry.
If your company is only starting NOW, I feel sorry for you - the Act was signed back in 1996, and the compliance dates have already been pushed back a few times already. HIPAA-compliance involves programmatic and systematic changes in the way things are done. Ideally, someone would set up the back-end so that features like electronic security and data retrieval are handled without the people on the front-end having to worry about it too much.
My advice: learn how serious HIPAA-compliance is and translate that to the upper-level management. Maybe do a little research on what other entities are doing to achieve HIPAA-compliance. Take a look at HCFA, for instance, as a beginning. You need to make those people understand that HIPAA-compliance is a big deal, and their waiting this long to begin to get compliant spells doom. All of the employees are going to have to change their methodology, and a change like that can only come from the top.
Where the wind blows, the tumbleweed goes.
You're a Oxygen Transfill Technician and you're ALSO the HIPAA Compliance Officer?
Are you being given authority (as the guy said, "FOLLOW THESE RULES OR FIND ANOTHER INDUSTRY TO WORK IN!) and budget for consultants, including legal and software and clerical assistance to help you get your company up to speed on this? Have you gotten a pay raise? Are you now at VP level at your company?
If not, you might as well get used to an unofficial job title of "Company Fall Guy"... they have no intention of getting into compliance until they are forced to. I suggest you document your activities CAREFULLY (start with your initial assignment... names, dates, places) in the likely event that you're going to wind up in court... with the company blaming YOU for incompetence.
And start putting out resumes NOW for another gig in the field of Oxygen Transfill Technician, you need another job a lot closer to your training and experience. The real skill set that fit your assignment are a combination of law and system administration... the minimum set would be a telecommunications lawyer who understands the underlying technology or at least enough of it to work with an IT pro to figure out what this really means to your organization... or IT pro with IMMEDIATE access to HIPAA-qualified legal counsel.
Your immediate responsibility to yourself is to get some legal advice... which I suspect strongly will be along the lines I suggested.
There is some very good advice on compliance and technology here, but if you don't have authority and budget, get your ass out of there... you probably ought to get out of there even if you do, because if anything goes wrong, you will be blamed.
Tech Public Policy stuff
Much as I hate to say it, PGP is not a good choice if you're (a) a company with deep pockets doing business-related stuff, and (b) have lots of people that aren't interested in understanding what's going on.
The good parts of PGP are anonymity and zero cost. Both of these points are much less valueable in a business setting.
The bad: the only good UI I've seen for PGP is mutt+gpg, where unknown keys are automatically fetched, defaults are set, the password is cached for a short period of time, verification is automatically done... Outlook's PGP interface is lame. Also, a lot of users seem to not get the whole "web of trust" concept, and tend to break it by trusting everyone.
May we never see th
A few items that are of note here:
1. The HIPAA mandates have been in place for about 3 years. The final date for compliance has been similarly known by all who need to be aware and compliant with HIPAA. There are no excuses.
2. For those who don't know what HIPAA is, it essentially mandates that anyone who handles personal medical information must insure the confidentiality of that personal medical information, ESPECIALLY when it is placed on-line or when it is sent anywhere electronically. As in YOUR RIGHTS ONLINE sort of personal confidentiality. As in securing personal data so it won't be viewed, handled, or sold by unauthorized people. This is not a trivial issue.
3. Just as I have no patience with companies that collect, mishandle, and/or sell my personal data, I have little patience for people or companies who, having known about this for over 3 YEARS, have done nothing to get into compliance with the securing of patient data. Your medical data.
Would you like your medical information passed out around like any old text file or even sold to the highest bidder, like your credit card info has been? It's happening and HIPAA is meant to stop it. I think this is a good thing.
Thank you.
Al Dunlap? Is that you?
Ahh you have 'talked to experts'.
I have yet to read a management book that does anything other than argue against what you suggest. So much for your 'experts'.
As for 'too many managers' not behaving like tin pot tyrants, nah exactly the opposite.
When I see a company being run like that I consider it a potential short. The Tyco/Enron/Worldcom school of management just went out of fashion.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Latanya Sweeney at CMU is working on a notion called k-anonymity. Should be another paper coming out sometime, from what I hear. Anyways, "completely" anonymous doesn't really mean that in a lot of cases. They've had great sucess identifying people by linking differnt sets of information. But in any case, I doubt that the regs right now do anything useful anyways. Hopefully they'll get changed if something provably good comes up.
Lea
If the computer controlling your brain electrodes is networked in any way, other than one way send to a monitoring station, I'd say that they NEED to send more voltage through said nodes.
Vintage computer games and RPG books available. Email me if you're interested.
If databases really are so scary to HIPAA, then how can these "cheap Viagra" online pharmacies get away with it? These e-commerce sites are often backed by databases which hold the data that customers type into the online forms used to grant or deny the prescription. These forms include medical details such as allergies, past surgeries, various medical conditions such as Herpes, misc cardiovascular problems, etc.
Say no to software patents.
I have been in the Financial, Banking, and logistics industries. In ALL those industries, I have seen many government mandates, and they all seem like how you present HIPAA. At first. Then one day the government says "Its final, no more extensions." When you complain they pull out a stack of paper and say "You've been given many extensions now get in line. oh buy the way, since you filed for extensions, we no longer have the appropriet confidence in your complients,please prove to us your complien, you have 15 days."
Then they goernment releases some document, in some Journal that says how happy they are the following companies are complient." if you are a medium or larger sized company, and you are not on there compliance list, you will loose a lot of money because you can bet your ass the people who buy your product and sell you products, and conduct "high level businss" with your company read that list, and they will go away.
so you see, the government knows how to get compliences with out "complience police". I have seen banks have a severe decline in stock value just for not being on preliminary list of complience for some new regulations.
OTOH, maybe business in the medical world is that radically different, but I doubt it.
The Kruger Dunning explains most post on
I get paid 150 an hour to get my cutomers complien cause it needs to be done, real fast.
Just like I got paid 150 an hour to build web pages, and 150 an hour to "fix" the Y2K thing.
so I reall get 150 an hour for the next 2 year, minimum. Daddies gettin a new 'Vet!
The Kruger Dunning explains most post on