Tag Archive for Final

HIPAA final rule brings changes to marketing, fundraising

January 25, 2013 admin No comments


The HIPAA Privacy and Security Omnibus final rule should bring some long-awaited clarification and certainty to marketing, fundraising and other aspects of safeguarding and using health information.


Previously, consumers had a different viewpoint of what they were looking for in the interpretation of the regulation’s language and what industry was hoping for, according to Deven McGraw, director of health privacy project at the Center for Democracy and Technology and a member of the federal advisory Health IT Policy Committee.


“The initial set of rules was tilted toward meeting the needs of the industry. That appears to have significantly changed in the final rule,” she said in comments to Government Health IT.


In the final rule (PDF), the Health and Human Services Department said that communications subsidized by the manufacturer of a product or service is marketing, and the only exception is for communications about drugs and biologics that a patient is being treated with, including generics. The area in question had been marketing around population-based purposes. 


“It’s a very good development for consumers, who when you survey them about their privacy concerns, marketing issues about their data is always really high on the list,” McGraw said.


“It is very unnerving for people to get email or mail that indicates that someone knows what medication they are taking. Your threshold of what is sensitive to you is preserved in this rule because you have the right to opt in for communications if you want to get them,” she said.


The final rule, released Jan. 17, fills in gaps, clarifies and finalizes some changes to safeguard the privacy, security and enforcement of patient information. The modifications are in response to the 2009 HITECH Act in the stimulus law, which strengthened the Health Insurance Portability and Accountability Act (HIPAA). HHS’ Office of Civil Rights enforces HIPAA and oversees health information privacy.


Adam Greene, partner, Davis Wright Tremaine LLP, and former senior health IT and privacy adviser in the Office for Civil Rights, said that fundraising is one of the major changes in the final rule for providers and other covered entities, who will have a greater ability to use protected information for fundraising purposes, such as being able to consider outcomes.


“So if a person had a negative outcome, you’re not sending them a fundraising request,” he said. Or, “If you have a new cancer center, you can potentially focus on oncology department patients,” Greene said.


Under the previous HIPAA privacy rule, a hospital could only use limited demographic information about its patients for fundraising purposes, according to Bob Belfort, partner in the healthcare practice at Manatt, Phelps & Phillips.


“Many of my hospital clients have had an interest in targeting fundraising based on the nature of the services a patient received or who their doctor was, and having doctors make personal appeals to the patients, or targeting, say, cancer fundraising at people who had been treated for cancer. They really were not permitted to do that under the prior rule,” he said.


Now that’s been loosened so that information about the type of department a patient was in within the hospital and who their physician was can be used for fundraising.


“It will be interesting to see what, if anything, the patient reaction is. Right now patients shouldn’t be getting fundraising solicitation where they can see they’ve been targeted based on the nature of the services they got. I don’t know whether patients will have a negative reaction to getting solicitations that indicate fundraisers have looked at their data in more detail,” Belfort said.


Patients have the right to opt-out, and hospitals will have to include a notice on all fundraising communications that the patient has the right to opt-out of solicitations “so it may be that more patients exercise that right when they see that their information’s being looked at more carefully for fundraising purposes,” he said.  


Greene added that a “significant” change in the final rule had to do with flexibility around research. It was not in language of the regulation but in the preamble that HHS is changing its interpretation. “A covered entity can rely on an authorization with respect to future research studies that have not yet been created, which represents a huge impact for the research community,” he said.


Overall, consumers will have greater privacy and security protections with the final rule. “The HIPAA protections travel along with the information a lot more than in the past in that business associates or subcontractors are subject to HIPAA. And we have certain restrictions, such as on the sale of protected health information,” Greene said.


“But,” he added, “I’m not going to suggest that on a day-to-day basis that this will have a huge impact on individuals. There is a lot here that are clarifications, like electronic access to information. With the clarification, it may be helpful for them to get an electronic copy of their information.”

Healthcare Data Mining , , , , ,

Q&A: On remaining ambiguities in the final HIPAA rule

January 25, 2013 admin No comments


The so-called omnibus HIPAA Privacy and Security final rule that HHS issued on Thursday answered some questions, provided necessary guidance in certain areas — but some of the thorniest issues, data breach notification among those, are still cryptic enough that lawyers and privacy officers will still face difficult judgment calls every time a laptop is lost or stolen.


Bob Belfort is one such lawyer. As a partner in in the healthcare practice at Manatt, Phelps & Phillips, Belfort works with states and providers on health IT and related public policy issues, and frequently helps clients craft breach notifications. Government Health IT Editor Tom Sullivan spoke with Belfort after HHS posted the final rule about changes to data breach notification, alterations to patient privacy when it comes to fundraising practices, the lack of a bright line test, what the rule means for business associates of covered entities, and why the common lost laptop scenario is not going be any easier.


Q: What are the main points you were looking for in the final rule?
A: The one that will probably get the most attention is the definition of a breach. There’s been a lot of controversy over the risk of harm standard. In the proposed rule there would be no breach unless there was significant risk of harm to the individual. [HHS] announced a while ago that they were rethinking that standard and in this rule they back off the risk of harm standard and replaced with an assessment of whether the improper disclosure compromised the privacy and security of protected health information so basically the burden is on the covered entity to show that there’s a low probability that the information has been compromised.


[Related: Omnibus HIPAA rule's impact on data breach notification]


There are two changes there. First, the focus of the assessment is no longer on the harm to the patient but whether the information has been compromised and, second, the burden of proof is clearly on the covered entity so if that can’t be determined pretty clearly that there is a low probability the information has been compromised, the covered entity has to treat it as a breach.


HHS tried to navigate a middle ground between privacy advocates who were arguing that any improper disclosure should be treated as a breach and opponents in the industry who were basically okay with the risk of harm standard and wanted to retain that and HHS staked that middle ground between those two. So I think that’s going to have a big impact on how incidents are assessed for breach notification purposes.


Q: What other privacy changes are important to your clients?
A: An area that hasn’t gotten as much attention in the past but I know is a big one for my hospital clients is the change to the fundraising rule. Under the previous HIPAA privacy rule, a hospital could only use limited demographic information about its patients for fundraising purposes. Many of my hospital clients have had an interest in targeting fundraising based on the nature of the services a patient received or who their doctor was, and having doctors make personal appeals to the patients, or targeting, say, cancer fundraising at people who had been treated for cancer. They really were not permitted to do that under the prior rule.


[See also: Final HIPAA rule brings changes to fundraising, marketing of PHI]


Now that’s been loosened so that information about the type of department a patient was in within the hospital and who their physician was can be used to target fundraising. So I think that’s going to make a lot of the hospitals happy as it gives them more opportunity to target their fundraising.


Q: And what about those patients? Are they likely to appreciate that alteration to the rule?
A: It will be interesting to see what, if anything, the patient reaction is. Right now patients shouldn’t be getting fundraising solicitation that they can see they’ve been targeted based on the nature of the services they got. And I don’t know whether patients will have a negative reaction to getting solicitations that indicate fundraisers have looked at their data in more detail. They do have the right to opt-out and hospitals will have to include a notice on all fundraising communications that the patient has the right to opt-out of solicitations, so it may be that more patients exercise that right when they see that their information is being looked at more carefully for fundraising purposes.  


Q: You mentioned that the burden of determining whether the information has actually been compromised is now on covered entities. How can they prove that?
A: It’s a somewhat ambiguous concept about what it means for information to be compromised. What the government has in mind, the focus is supposed to be on the risk that the information will be misused in some way or used for improper purpose, rather than focusing on what the impact of that would be on the patient. One of the challenges in the risk of harm standard and why there’s been so much concern about it is that whatever the nature is of your risk assessment, whether you’re evaluating risk of harm to the patient or risk that the data has been compromised, these are all judgment calls and there are factors the rule identifies that you’re supposed to consider in making that determination like the nature of the information that was disclosed, who received it, what your capacity to mitigate the improper disclosure. But at the end of the day there’s no bright line test so there is still going to be a need for privacy officers and lawyers and other people involved in the breach notification process to make difficult judgment calls about whether there’s enough information to conclude that the probability is low that the information will be compromised. The rule provides an example that would fall into that category where someone faxes information to the wrong doctor and they contact the covered entity and say ‘this isn’t my patient, I’m sending this back to you.’ At that point you can probably conclude that the risk that the information could be misused or has been misused is very, very low. But those are the easy cases. There are a fair number of more ambiguous situations where reaching the conclusion that there’s a low probability of risk is a difficult thing and reasonable people might differ about that.


Q: So the lost laptop or other portable media containing thousands or millions of patient records that we keep seeing — that particular scenario is not going to get easier, is it?
A: I don’t think there’s a rule that’s going to change that situation. If you can retrieve the laptop or the device and assess forensically that nobody has accessed the information, I think you can probably conclude that there’s no breach, both under the prior rule and the new rule, but if you can’t get the laptop back you’re pretty much stuck having to treat it as a breach. So I don’t think that’s going to change and the best defense against breaches involving portable devices continues to be encryption, which still is a basis for not having to do breach notification.


[3 minute podcast: Micky Tripathi, CEO of the Massachusetts eHealth Collaborative explains the compelling reasons all hospitals should encrypt their data.  PlayPlay in a new window]


The percentage of organizations effectively encrypting their portable devices is growing but it’s still not at the level where it should be. I frankly continue to wonder why encryption is still addressable at least with respect to portable devices but it was not addressed in the proposed rule or in HITECH so the landscape on that issue is still basically the same.


Q: It sounds as if the omnibus rule will not make your job all that much easier…
A: No, I don’t think so. It really just changes the nature of some of the analysis that needs to be done. But there’s still the ambiguity in the rule, which I think is unavoidable when you don’t have a bright line test on notification. And I understand the government’s decision not to impose a bright line test because the only bright line test you could really impose would be to say every time there’s a disclosure not permitted by the rule you have to notify and I don’t think that’s the right standard because you’ll end up getting huge numbers of notifications about innocuous situations. That’s not good for the industry of for consumers, who I think will start to tune it out if they believe that most of these notices are not situations that really threaten them. So I understand and agree with the decision not to impose a bright line standard but as long as you don’t have one there will be judgment calls and that’s going to continue to be the case.


Q: In some ways that alert notification fatigue you referenced might already be happening as breaches are at something of a fever pitch. Now, do you anticipate an uptick in OCR audits and fines?
A: Yes. We’re already seeing the beginning of more aggressive enforcement and stiffer penalties, more frequent penalties. It’s routine for OCR to investigate when breaches are reported, particularly when there are 500 or more individuals. In all of those cases, they’re following up with questions and making a decision about whether some more intensive investigation is warranted so that’s already in progress. And I think that trend will definitely accelerate.


This was true in the proposed rule as well. One of the really significant provisions of the rule is extension of privacy and security obligations on business associates whereas before HITECH the security rule didn’t clearly apply to business associates and the government didn’t have clear authority to put penalties on business associates. And now those things have changed. Business associates should now really be looking at their own compliance programs and deciding whether they need to be enhanced because their risk is really escalating under this rule. All the vendors out there that took comfort in the fact that they weren’t covered entities are now in very much the same position as the covered entities and need to have very strong security and privacy programs.

Healthcare Data Mining , , ,

How HIPAA final rule and meaningful use could drive data security

January 25, 2013 admin No comments

The enhanced set of protections finalized in the omnibus HIPAA privacy and security rule now becomes the new baseline for anyone who handles health information.


It doesn’t change meaningful use requirements, but combined, the two may drive more providers to protect patient data, according to privacy and security experts.


The clear and comprehensive view of privacy, security and enforcement that comprise the final rule now was missing at the dawn of the meaningful use program as physicians and hospitals began to adopt electronic health records (EHRs).


To make up for that, some privacy and security experts were inclined to think that the meaningful use rule should include additional protections, according to Deven McGraw, director of health privacy project at Center for Democracy and Technology and a member of the federal advisory Health IT Policy Committee. 


“Meaningful use is meant to incentivize behavior above an expected baseline. The privacy rule should be the baseline, and not a set of additional hoops that only people who are getting federal incentive dollars should have to jump through,” she said.


Meaningful use became a vehicle that had the potential to do more because there wasn’t clarity in the privacy rule for everybody, McGraw said. On the other hand, getting providers to implement EHRs in a meaningful way is a voluntary program.


“There is a lot that we are asking of people for meaningful use. To sort of load up additional privacy and security regulations on that is problematic for a lot of reasons. For one, it would only reach a certain population, and it might tip the scale for providers not to participate. The reality is that the privacy rule should be required of everyone,” she said.


In meaningful use stage 2, providers have two security requirements: Perform a security risk assessment and attest to that and explicitly address encryption, said Lisa Gallagher, director of privacy and security for HIMSS.


“Those things are not affected by any changes in HIPAA. The security rule remains structurally the same. It’s risk-based,” she said.


To protect consumers in an era of growing exchange of health information, the final rule is by and large what was in the draft rule, including patient rights to access their own data, but “it’s definitely moving in that direction,” Gallagher said. 


The increased enforcement in the final rule, including audits, increased penalties and the expansion to business associates to comply like covered entities, along with the surge in reported data breaches may send a message to the industry that it’s time to comply.


According to the most recent HIMSS survey, “we did see an uptick in the number of organization doing a risk assessment,” Gallagher said.


The combination of the “tone set by the draft rule and the changes to the enforcement rule, along with having it required in meaningful use” may push more providers to conduct a risk assessment.


“If they want to do the attestation, they have to do the risk assessment. So you have both of those lining up together,” she said. 


McGraw said the final omnibus rule is “a good start” for protecting patients in an era of more health information exchange.


The more that breach notifications occur and reports show how costly they are to the institutions that experience them, “the more we’re going to see entities encrypt data, mostly data at rest and then most certainly the protocols for exchange to encrypt data in transit,” McGraw said. 


There is a growing acceptance of the importance to getting to the level of security that most other industries have adopted as a matter of course.


Security professionals, however, don’t exist throughout much of the healthcare provider community, which is significantly made up of small practices. As a result, “they’re highly dependent upon their vendors to tell them what to do, and that partly adds to the challenge,” she said.


It’s difficult for the healthcare industry to step up “when it’s largely run by people who are amateurs in security. And that’s not going to change,” she added. “Doctors are trained to take care of patients, not to take care of data, but we need them to take care of data.”

Healthcare Data Mining , , , , ,

CMS circulates final 2014 MU clinical quality measures

November 3, 2012 admin No comments

The Centers for Medicare & Medicaid Services (CMS) has published the final 2014 clinical quality measures (CQMs) for eligible professionals and eligible hospitals seeking to attest for meaningful use.

Beginning in 2014, the reporting of clinical quality measures will change for all providers. Electronic health record (EHR) technology that has been certified to the 2014 standards and capabilities will contain new CQM criteria.

Eligible professionals (EPs), eligible hospitals and critical access hospitals will report using their respective new 2014 criteria – regardless of whether they’re taking part in participating in Stage 1 or Stage 2 meaningful use.

[At Government Health IT Virtual Breifing: CMS officials offer snapshot of recent MU Progress, $7.7 billion paid out]

In addition to these quality measures, CMS has published the specifications for electronic reporting and access to the related data elements and value sets.

The value sets define clinical concepts, providing a list of numerical values – such as code values from ICD-9 and SNOMED CT – and individual descriptions for the clinical concepts (diabetes, clinical visit, etc.) used to define the quality measures. Each clinical concept referenced in a clinical quality measure is represented by a set of code values (a value set) it may take on.

The value sets of the electronic specifications are the code values that the data elements (the clinical concepts) of the CQMs in an EHR may take on, CMS officials point out.

These sets allow providers to compute and export the measure results uniformly, and to report them in attestation. Vendors, EPs and eligible hospitals may access the value sets via the National Library of Medicine Value Set Authority Center (VSAC). The value sets are available to view and download via several file formats an APIs (application programming interface).

Additionally, the Data Element Catalog, which identifies data element names required for capture in EHR technology under the ONC certification program, are also available via the VSAC.

CMS has also posted Human Readable files of the e-specifications for EPs and eligible hospitals that explain the measure, measure sponsor, measure rationale and how the measure is calculated.

CMS has made several resources available to help providers and vendors navigate the new quality measures:

Certification of EHR technologies requires that software products and EHR modules be tested, as applicable, for their capabilities to accurately capture, calculate and report the CQM results. The ONC has commissioned the development of the open source Cypress certification tool, officials say.

Cypress has encoded the measure logic required in a software implementation; the process for submitting the Cypress tool for official approval to be used in the ONC Certification Program is currently under way. Visit healthit.gov/cypress for more information.

View the original article here

Healthcare Data Mining , , , ,

Final Fantasy XIII – 2 Academia -4XX AF- Fragments [1/2]

July 16, 2012 admin No comments

Quiz Answers: i6.photobucket.com i6.photobucket.com i6.photobucket.com i6.photobucket.com i6.photobucket.com In order to close Academia (4XX AF) youll need the "Promises" Gate Seal. This can be found in A Dying World (700 AF) It is in The Farseers Settlement, on the North West side behind a wall leading up towards The Farseers Relic region. Hope this helps. 11 Fragments to answer correctly for here. There are 9 Fragments obtained through Quiz challenges; of these 9, 4 will be from the static Brain Blast machines and the remaining 5 will come from Captain Cryptics Confounding Quiz challenges. Ive marked the locations on the map, so you should be able to find him. Keep a heads up on what Citizens say as you run by as they give clues to his general area. Something interesting to note is that all 4 Brain Blast Quiz machines have their own questions, as well as Captain Cryptic will have his personal set of questions as well. Your questions may differ from mine: Captain Cryptics Locations 12:40 Stoic Virtue Fragment Epicurean Song Fragment Lyceum Knowledge Fragment Academia Wisdom Fragment Quiz Rank: Private 400 CP Complete one correct answer. Quiz Rank: Sergeant 400 CP Complete two consecutive correct answers. Quiz Rank: Lieutenant 600 CP Complete three consecutive correct answers. Quiz Rank: Colonel 600 CP Complete four consecutive correct answers. Quiz Rank: General 1000 CP Complete five consecutive correct answers. 1 Fragment from Paradox Ending, this Fragment <b>…<b>

Academic Transcript , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
Page 1 of 212