Do We Have A False Sense of HIT Security?

Data Breaches More Common than Realized

By Darrell K. Pruitt; DDS

Here is an article titled “Report: Healthcare Organizations may have a False Sense of Data Security,” written by Neil Versel for FierceHealthIT.

http://www.fiercehealthit.com/story/report-healthcare-organizations-may-have-false-sense-data-security/2010-04-12?sms_ss=twitter#ixzz0kzNS6lq

Versel describes the results of a study commissioned by Nashville, Tenn-based Kroll Fraud Solutions. Kroll estimates that 19% of healthcare organizations in the nation suffered a data breach in the last 12 months. That number is up from 13% a year ago. It is based on this information that I estimate that in the last year, at least 24 million dental patients in the nation have been unknowingly exposed to the danger of identity theft. Everyone agrees that the only ethical thing for a dentist to do if he or she knows that patients’ identities have been exposed is to notify the patients and HHS. The shameful fact is, data breaches in dentistry are not being reported.

Enter the Dentists  

But, who can blame American dentists for underreporting breaches without first blaming the heavy-handed, stakeholder-friendly system that forces honest professionals to be dishonest? If a dentist self-reports a breach of 500 or more patients’ Protected Health Information (PHI) it can easily bankrupt a practice. The harm to one’s reputation in the community is just too great a disincentive for even the best of us, even without the added expense of patient notification, subsequent fines and lawsuits. It’s ugly, but that’s the hard, hidden truth about HITECH-HIPAA in dentistry – a piece of lame, one-sided “feel good” legislation that rather than preventing data breaches in dentists’ offices, it drives them underground. As healthcare providers, we should have warned our patients about the growing danger from electronic dental records long ago. Besides me, there are no practicing dentists discussing the topic. Why?

Accepting Ownership of the Dilemma  

Would anyone like to argue that the bi-partisan federal mandate for an interoperable, national eHR system relieves dentists of their obligations to the Hippocratic Oath? Let’s face it: Dentists’ computers continue to threaten up to 20% of dental patients in the nation. We cannot ignore it any longer, doctors.  Once we finally accept ownership of our problem, what are we going to do about it? I’ve suggested that we use common sense and simply remove the dangerous information from dental patients’ files. Anyone see any problem with this idea? Anyone have a better solution?

Assessment 

So what do the leaders of the ADA think of de-identification?

 

Conclusion

And so, your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, be sure to subscribe. It is fast, free and secure.

Get our Widget: Get this widget!

Our Other Print Books and Related Information Sources:

Practice Management: http://www.springerpub.com/prod.aspx?prod_id=23759

Physician Financial Planning: http://www.jbpub.com/catalog/0763745790

Medical Risk Management: http://www.jbpub.com/catalog/9780763733421

Healthcare Organizations: www.HealthcareFinancials.com

Health Administration Terms: www.HealthDictionarySeries.com

Physician Advisors: www.CertifiedMedicalPlanner.com

Subscribe Now: Did you like this Medical Executive-Post, or find it helpful, interesting and informative? Want to get the latest ME-Ps delivered to your email box each morning? Just subscribe using the link below. You can unsubscribe at any time. Security is assured.

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Sponsors Welcomed

And, credible sponsors and like-minded advertisers are always welcomed.

Link: https://healthcarefinancials.wordpress.com/2007/11/11/advertise

7 Responses

  1. Do we Have a False Sense of Costs, too?

    Darrell, President Barack Obama’s new healthcare reform law will increase the nation’s health care tab instead of bringing costs down, government economic forecasters now conclude in a sobering assessment of the sweeping legislation.

    Report: Health overhaul will raise tab

    http://www.msnbc.msn.com/id/36726295/ns/politics-health_care_reform

    Health and Human Services experts say the plan falls short of controlling costs; and is a possible threat to medical care for seniors.

    Is anyone with a brain surprised?

    Mike

    Like

  2. HIPAA liabilities the ADA won’t reveal

    Do you think becoming a HIPAA-covered entity on the recommendation of American Dental Association leaders will be any cheaper or safer for ADA members a year from now?

    If you answered yes, then you haven’t read the 2000 or so pages of healthcare reform that was recently signed into law. Don’t feel bad. The law was never designed to withstand debate with those who actually provide care. When the worst mistake in US history was finally voted in, more than half of Washington was far too giddy to care about the nation’s dental patients, and as usual, the ADA’s lobbyists were so hobbled by their wishy-washy bosses in Chicago that they simply couldn’t compete.

    So as usual for the ADA, our shy officers will again leave it to me to warn members about the new disclosure requirements that dentists with computers will find aggravating if it is not stopped: “Covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle F– Administrative Simplification, Public Law 104-191, 110 Stat. 2021, are currently required by the HIPAA Privacy Rule at 45 CFR 164.528 to make available to an individual upon request an accounting of certain disclosures of the individual’s protected health information over the past six years.” – Federal Register: May 3, 2010 (Volume 75, Number 84, Proposed Rules, Page 23214-23216 From the Federal Register Online via GPO Access [wais.access.gpo.gov]

    [DOCID:fr03my10-14].

    Whenever one reads the phrase “administrative simplification” in a government document, one should start scribbling detailed notes on a tablet of paper really fast. What the disclosure law means is, if your practice is a HIPAA-covered entity like more than 9 out of 10 dental practices, each time you email patient information to an insurer, a specialist, a patient’s new dentist or others, HHS must be notified. No kidding. On the other hand, if a dentist did not follow the ADA’s advice, and never computerized his or her practice, HHS is not interested in the data. Healthcare information technology provides low-tech dentists a market advantage that will only get better as more digital stakeholders pile on – welcomed by our ADA leaders.

    For more information, see “OCR Wants Guidance On HITECH EHR Disclosure Rule” by Dom Nicastro, for HealthLeaders Media, May 3, 2010.

    http://www.healthleadersmedia.com/content/TEC-250484/OCR-Wants-Guidance-On-HITECH-EHR-Disclosure-Rule##

    Can you think of why the ADA hasn’t already encouraged members to submit comments about this proposal to the HHS before the public comment opportunity closes? It’s because such transparency is incompatible with the ADA’s command and control business model. Until ADA leaders become more accessible to dentists who actually treat patients than through the slow-moving ADA MSCpassword portal (that I personally developed out of urgent necessity), inadequately represented dental patients will always lose out in legislative emergencies like this. What’s more, as HHS moves through the first thousand or so pages the need for quick, coordinated independent comments from dentists will become more and more necessary for us to protect those who depend on us. I don’t care what you think of me. We have a problem and I’ll force a solution one way or another, with or without you.

    I just wonder if as they read this, a handful of ADA officers are oh so thankful to me for currently refraining from naming names. You know who you are, you good-looking good ol’ boys. And you also know that if I wanted to, this article could have not only had your name in the title, but for some of you, it could have been your first hit on a googlesearch. If you don’t quit dodging the accountability you signed on for, I promise you I’ll reach in and pull you out into the open by your ear.

    Tell me, TDA. Is that similar to the kind of unprofessional words that someone complained about? Well then, bite me.

    D. Kellus Pruitt; DDS

    Like

  3. Who owns your medical records?

    When it comes to Health Care, do you feel isolated and out of control? You are suffering from Disassociated Patient Symptom, an all too common symptom that impacts Patients and Medical Professionals alike.

    Here is a short video posted recently on YouTube that tries to encourage patients and consumers to take charge of their health information data.

    http://bit.ly/fightDPS

    It’s about the patient. Join HealthCamp and combat PDS today (Soundtrack by Scrimshire). Put the patient/consumer at the center of healthcare … Cheers!

    Griswald

    Like

  4. Laptops plague government health data keepers

    Dr. Pruitt,

    There were two instances of health data breaches recently which served as a stark reminder that the wayward laptop — and not the hacked database — might be the more insidious information security threat to government healthcare organizations and their beneficiaries.

    http://www.govhealthit.com/newsitem.aspx?nid=73745

    The Department of Veterans Affairs said that a laptop stolen from an unspecified contractor’s car April 22nd contained unencrypted, personally identifiable information of about 644 veterans. And, New Mexico’s Health and Human Services Department reported last week that an employee of West Monroe Partners, a subcontractor that processes dental claims for Medicaid enrollees, had an unencrypted computer in the trunk of a car stolen in Chicago March 20th 2010.

    http://www.fiercemobilehealthcare.com/story/laptops-stolen-veterans-affairs-n-m-medicaid-contractors-were-unencrypted/2010-05-18?utm_medium=nl&utm_source=internal

    Who says eMRs, internet banking and e-commerce are safe.

    The e-Skeptic

    Like

  5. Invoice Mailing Machine Data Breach

    Darrell, do you think that protected health information data breaches involve only eHRs or human errors? Well, think again!

    For example, The Democrat and Chronicle recently reported that out of 2,500 patient bills sent out by Strong Memorial Hospital in Rochester, NY on April 19th, almost half went to the wrong patients due to a malfunctioning automated billing machine

    http://www.democratandchronicle.com/article/20100521/NEWS01/5210341/Strong-hospital-sends-bills-to-wrong-patients&referrer=NEWSFRONTCAROUSEL

    Now, we cad add mechanical breakdown to the list of causes.

    Donna

    Like

  6. The easier it becomes to share PHI, the more it will be shared accidentally.
    D. Kellus Pruitt; DDS

    Like

  7. EHR Fraud and Abuse Targeted in OIG Survey

    The fraud squad of the US Department of Health and Human Services (HHS) has mailed out a 54-question survey that digs into widespread allegations of Medicare overbilling committed with electronic health records (EHRs).

    The Office of Inspector General (OIG) sent the survey recently to hospitals that received a federal bonus from January 1, 2011 to March 31, 2012, for meaningful use of EHRs, as reported by the American Hospital Association on its website. Most of the questions focus on data security features of the hospital’s EHR system, but several pertain to how clinicians document and code their services — one more warning of an impending crackdown on EHR abuse.

    Source: Robert Lowes, Medscape News [10/25/12]

    Like

Leave a comment