Critical Risk Management for Physicians Today

Posted on October 20, 2025 by Dr. David Edward Marcinko MBA MEd CMP™

More Difficult than Ever Before

By Brian J. Knabe MD, Certified Medical Planner

www.SavantCapital.com

Historically, the term “risk management” has brought to mind one subject for the practicing physician – medical malpractice. Unfortunately, physicians today face a multitude of other risks which may be more insidious and daunting than malpractice. It is important to recognize these risks, and to have the appropriate procedures and policies in place to mitigate the risks. These risks come from the federal government, state government, insurance companies, patients, employees, and even prospective employees. Some risks, many unique to small businesses and medical practices, include the following:

Medicare recoupment risk – challenges to coding and subsequent billing by the physician.
Medicare fraud. Numerous laws can be used by the federal government to go after the physician, including the Medicare and Medicaid Anti-Fraud and Abuse Statute, the RICO statute, and the Federal False Claims Act. The recently enacted Patient Protection & Affordable Care Act aims to save money by increasing funding for anti-fraud efforts.
Insurance fraud. An inquiry from Medicare to look for fraud in a physician’s practice is often followed by similar efforts by insurance companies.
The HIPPA Act of 1996 creates new definitions and penalties to use against the physician.
Self referral risks. Federal regulations in this area include the Medicare Anti-Fraud and Abuse Statute, the Medicare Safe Harbor Regulations, and the Stark Amendment.
Federal agency risks. These include regulations from the Occupational Health and Safety Agency (OSHA), Health and Human Services (HHS), the Drug Enforcement agency (DEA), and even the Environmental Protection Agency (EPA).
Anti-trust risks. The Department of Justice (DOJ) and Federal Trade Commission (FTC) formulate regulations in this arena.
Managed care contractual risks. Most managed care contracts require the individual physician rather than the professional corporation to sign the contract, thus placing the physician’s personal assets at risk.
Medical malpractice risks. Although the vast majority of claims are paid by the insurance carrier, there can be other adverse consequences for the physician. These include the risk of increased premiums, non-renewal of policies, and difficulty in getting replacement insurance.
Loss of income due to death or disability. Most physicians recognize the importance of life insurance, but the medical professional is actually much more likely to lose income due to disability at some point in his or her career.

http://www.amazon.com/Insurance-Management-Strategies-Physicians-Advisors/dp/0763733423/ref=sr_1_6?ie=UTF8&qid=1375149801&sr=8-6&keywords=marcinko+david

The practicing physician should seek the advice of professionals with expertise in these areas. Every practice should have an experienced attorney on retainer. It is very important to seek advice from fiduciaries – experts who have no conflicts of interest and who can therefore act in the best interest of the client. A Certified Medical Planner is such a fiduciary with training and expertise in these areas.

http://www.CertifiedMedicalPlanner.org

It can be particularly challenging to find an insurance advisor with no conflicts of interest, as this industry is built upon product sales and commissions. One such insurance advisor is Scott Witt, a fee-only insurance advisor with Witt Actuarial Services (www.wittactuarialservices.com).

Others can be found with an internet search for “fee only insurance advisor”.

Conclusion

Your comments on this ME-P are appreciated. How do you select an advisor? Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, be sure to subscribe. It is fast, free and secure.

Speaker: If you need a moderator or speaker for an upcoming event, Dr. David E. Marcinko; MBA – Publisher-in-Chief of the Medical Executive-Post – is available for seminar or speaking engagements. Contact: MarcinkoAdvisors@msn.com

Subscribe Now: Did you like this Medical Executive-Post, or find it helpful, interesting and informative? Want to get the latest ME-Ps delivered to your email box each morning? Just subscribe using the link below. You can unsubscribe at any time. Security is assured.

Sponsors Welcomed: And, credible sponsors and like-minded advertisers are always welcomed.

Link: https://healthcarefinancials.wordpress.com/2007/11/11/advertise

***

Filed under: CMP Program, Experts Invited, Op-Editorials, Practice Management, Risk Management | Tagged: brian knabe, CMS, DOJ, financial advisors, FTC, HHS, HIPAA, insurance agents, Marcinko, medicare, Medicare compliance, National Association of Personal Financial Advisors, OSHA, RICO, www.certifiedmedicalplanner.com | Leave a comment »

Why Many Doctors Struggle Financially: 5 Key Reasons

Posted on September 23, 2025 by Dr. David Edward Marcinko MBA MEd CMP™

By A.I. and Staff Reporters

SPONSOR: http://www.CertifiedMedicalPlanner.org

***

***

Despite their high salaries, not all doctors are wealthy, and some live paycheck to paycheck. Here are 5 reasons why many doctors today are broke, according to https://medschoolinsiders.com

1 | Believing They Are Universally Smart

The first reason so many doctors are broke is that many doctors believe they are universally smart. While most doctors have deep specialized knowledge, there’s a big difference between being smart in your profession and being smart with money. A physician’s schooling is quite thorough when it comes to the human body, but med school doesn’t include a prerequisite class on how to handle finances.

MORE: https://medicalexecutivepost.com/2022/11/18/what-is-the-dunning-kruger-effect/

Graduating medical school is a major feat and certainly demonstrates superior work ethic and cognitive abilities. But many new doctors believe these accomplishments transcend all aspects of life. If you’re smart enough to earn an MD, you’re certainly smart enough to handle your finances, but only once you properly and intentionally educate yourself.

The truth is doctors, especially traditional graduates, haven’t had an opportunity to manage large sums of money until they become fully trained attending physicians and start pulling in low to mid six figures in income. Prior to that, there was very little of it to manage.

Far too many aspiring doctors, and students in general, don’t take the time to learn financial basics, in part because it’s uncomfortable and seems like something they can figure out “later”, whenever that may be. Their poor spending habits and lack of investment knowledge carry over into their careers, causing many to make irresponsible decisions.

MORE: https://medicalexecutivepost.com/2025/07/17/doctors-and-lawyers-often-arent-millionaires/

2 | Overspending Too Soon

The second factor is overspending too soon, and this comes up at two points in training.

First, it’s natural to want to start spending more as soon as you get into residency and start making a little more money. After all, you’ve been a broke student for 8 or more years, and now you’re finally making a reasonable and reliable wage. But that’s where young doctors get into trouble. Residency pays, but not nearly as much as you will be making once you become an attending physician. The average resident makes about $60K a year, and if you begin spending all of that money right away, thinking you’ll handle your loans once you become an attending, you delay paying off your medical school debt, which means the compounding effect through your student loan interest rate works against you.

Now that $250,000 in student loans has ballooned to over $350,000 by the time you finish residency. The compounding effect, which can be one of your greatest allies in your financial life, becomes an equally powerful enemy when working against you through debt. But of course, pinching pennies is easier said than done, especially when you’re in residency and are surrounded by peers in different professions. They’ve been earning good money much longer than you have, and they can afford more luxurious lifestyles.

They may not be worried about indulging in fine dining or how much a hotel costs when traveling. Students in college and medical school are often confident they will resist the temptations, but the desire to keep up with your friends and family can be difficult to ignore, which causes many to overspend before they technically have the money to do so.

The same is true of attending physicians. As soon as those six-figure salaries come rolling in, many physicians go overboard with spending, trying to make up for lost time and to treat yourself.

Now, we are not suggesting you shouldn’t reward yourself for completing residency, but that reward shouldn’t be a Lamborghini. It’s best to continue living like a resident in your first few years after becoming an attending to pay off loans, put a down payment on a home, and get your financial foundation built before loosening the purse strings.

3 | Decreasing Salaries

Third, doctors continue to make less money than they did before. And this includes nearly all 44 medical specialties. For example, while physician compensation technically rose from $343k to $391k between 2017 and 2022, this rise does not keep up with inflation. The real average compensation in 2022 was less than $325k—a $20k decrease in purchasing power in only six years.

For doctors who are already spending to the limits of their salaries with huge mortgages, car payments, business costs, and other luxuries, a decreased salary can have a huge impact. You might be able to cut back by going on fewer vacations or eating out less frequently, but many accrued costs are locked in, such as a mortgage payment, car loan, or leased rental space for your practice.

4 | Increasing Costs of Private Practice

In the past, running a private practice was much simpler, but recent stricter guidelines and regulations have made it difficult for solo practices to keep up. While regulations like the Health Insurance Privacy and Portability Act, or HIPAA, and mandatory Electronic Medical Records, or EMRs, are necessary to protect patients, they make costs higher for physicians who run their own private practice. These physicians need to spend their own money to set up and maintain EMRs as well as invest in security to ensure patient data is protected.

With the steep rise of inflation we’ve seen over the past couple of years, everything is more expensive, which means costs, such as business space, equipment, and even office supplies, have gone up for private practice physicians while salaries have not. 2013 to 2020 saw an annual inflation rate of anywhere from 0.7% to 2.3%. This skyrocketed to an annual inflation rate of 7.0% in 2021 and another 6.5% in 2022. In fact, the cost of running a private practice has increased by almost 40% between 2001 and 2021.

These increased costs are exacerbated by another problem plaguing private practices; decreased reimbursement. While costs increased by almost 40%, Medicare reimbursement only increased by 11%. When doctors see patients who are insured, the insurance companies pay the physicians for their time. For Medicare, the new proposed rules for 2023 would cut reimbursement by around 5%. When adjusting for inflation, Medicare reimbursement decreased by 20% in the last 20 years.

These costs add up, making it extremely difficult for physicians to thrive financially while running a private practice.

5 | Tuition Debt

Lastly, we can’t talk about a doctor’s finances without mentioning the exorbitant debt so many graduating physicians are left with. It won’t shock you to hear that med school is expensive. Extremely expensive. The average cost of tuition for a single year is nearly $60k, with significant variance from school to school, and that’s before accounting for living expenses.

In-state applicants pay less than out-of-state applicants, and students at private schools typically pay more than students at public medical schools. The astronomical costs mean the vast majority of students can’t pay for medical school out of their own pockets. And unless your family is part of the 1%, even with your parents footing the bill, it’s difficult to cover tuition, let alone rent, groceries, transportation, tech, social activities, exam fees, and application costs.

The average total student debt after college and med school is over $250k. But keep in mind that’s the average, which includes 27% of students who graduate with no debt at all. This means the vast majority of students leave medical school owing much more than $250k.

For some perspective, in 1978, the average debt for graduating MDs was $13,500, which, when adjusted for inflation, is a little over $60,000. There are multiple ways to eventually repay these loans, but time and discipline are essential to ensure this money is paid off as quickly as possible.

MORE: https://medicalexecutivepost.com/2024/12/03/12-investing-mistakes-of-physicians/

THE FINANCIAL FIX

According to financial advisor Dr. David Edward Marcinko MEd MBA CMP™; consider the following:

Place a portion of your salary (15-20% or more) into a savings account, and another portion (10-20% or more) into wise investments [stocks, bonds, mutual funds, and/or ETFs].

Pay off your bills each month, and then use leftover spending money to purchase fun things like vacations and fancy dinners, within your means. Shop sales, buy used clothes, and use credit card points for travel.

Hire an excellent tax professional and meet with an investment advisor once or twice a year about your investment status and strategy. http://www.MarcinkoAssociates.com

COMMENTS APPRECIATED

EDUCATION: Books

SPEAKING: Dr. Marcinko will be speaking and lecturing, signing and opining, teaching and preaching, storming and performing at many locations throughout the USA this year! His tour of witty and serious pontifications may be scheduled on a planned or ad-hoc basis; for public or private meetings and gatherings; formally, informally, or over lunch or dinner. All medical societies, financial advisory firms or Broker-Dealers are encouraged to submit an RFP for speaking engagements: CONTACT: Ann Miller RN MHA at MarcinkoAdvisors@outlook.com -OR- http://www.MarcinkoAssociates.com

Like and Subscribe

***

Filed under: "Ask-an-Advisor", Accounting, Ask a Doctor, Career Development, CMP Program, economics, Experts Invited, finance, Financial Planning, Health Economics, Health Insurance, Health Law & Policy, Healthcare Finance, Investing, Marcinko Associates, Taxation | Tagged: broke physicians, CMP, DDS, DO, doctor, doctor debt, DPM, EMRs, health, healthcare, HIPAA, Marcinko, MD, medical school, medical school debt, medicine, physician debt, physicians | Leave a comment »

HIPAA COMPLIANCE: Securing Electronic Communications

Posted on September 18, 2025 by Dr. David Edward Marcinko MBA MEd CMP™

By Carol Miller RN MBA

***

New-Wave Technology

To help hospitals and health systems comply with Health Insurance Portability and Accountability Act regulations, best practices are emerging for securing all electronic communication – cloud, wireless, and texting – of protected health information. These new technologies will continually be evolving with hospitals, providers and patients move to new means of communication. Below is a description of how each are impacted by HIPAA.

Cloud Solutions. Cloud solutions are becoming a needed commodity in treating patients today but also present a risk to privacy and security violation. Despite the advantages of cloud computing, organizations are often hesitant to use it because of concerns about security and compliance. Specifically, they fear potential unauthorized access to patient data and the accompanying liability and reputation damage resulting from the need to report HIPAA breaches. While these concerns are understandable, a review of data on HIPAA breaches published by the HHS shows that these concerns are misplaced. In fact, by using a cloud-based service with an appropriate security and compliance infrastructure, a facility can significantly reduce its compliance risk.

Because HIPAA compliance involves stringent privacy and security protections for electronic health information (PHI), many cloud providers are balking at signing new Business-Associate agreements. Most cloud-technology providers, such as Box and Dropbox, do not include the built-in privacy protections that guarantee HIPAA compliance. Because many cloud storage companies store plaintext data on their servers, PHI is especially vulnerable to breaches and compliance violations.

HIPAA CLOUD: https://medicalexecutivepost.com/2016/11/22/hipaa-cloud-solutions/

Mobility Solutions. The recent launches of Apple Health and Google Fit have stirred a lot of interest in health application development. It is important that hospitals and providers understand the laws around PHI and HIPAA compliance for any healthcare-focused mobile application or software. While not all healthcare applications fall under HIPAA rules, those that collect, store, or share personally identifiable health information with covered entities (such as hospitals and providers) must be HIPAA-compliant.

For years, hospitals have wanted to bring computers into exam rooms, waiting rooms, and treatment rooms to eliminate hard-to-read patient charts, making sure everyone treating the patient was seeing the same information, assuring that everything was recorded as it occurred, and enabling doctors, nurses, and technicians to stay connected to vital information and services wherever they were throughout the hospital. Many hospitals have adopted Computer on Wheels (COWs) or tablets but many of these were hard to use, had poor touchscreen interface and did not last long on a battery. Ipads seem to be the logical replacement as long as the iPad can comply with HIPAA rules.

HIPAA was written nearly 30 years ago, before mobile health applications were ever envisioned. Because of this, some areas of the law make it hard to determine which applications must be HIPAA- compliant and which are exempt. Considering the numerous ways security breaches can occur with a mobile device, it is not wonder that HHS is very leery about how PHI is handled on smartphones, wearables, and portable devices.

If the applications are going to send or share health data to a hospital, doctor or other covered entity, it MUST be HIPAA-compliant. Adhering to the Privacy and Security Rules of HIPAA is essential, especially considering the dangers that come with handling protected health data on a device. Examples include:

Phones, tablets, and wearables can be easily stolen and lost, meaning PHI could be compromised
Social media and email are easily accessible by the device, making it easy for users to post information that breaches HIPAA privacy laws.
Push notifications and other user communications can violate HIPAA laws if they contain PHI
Users may intentionally or unintentionally share personally identifiable information, even if the application’s intended use doesn’t account for it
Not all users take advanage of the password-protected screen-lock feature, making data visible and accessible to anyone who comes in contact with the device
Devices like the iPhone do not include physical keyboards, so users are more likely to use basic passwords that are not as safe as complex options.

This protected health information can include everything from medical records and images to scheduled appointment dates. Regardless of the device, it is important to take all the steps possible to comply with HIPAA guidelines.

MOBILE HIPAA: https://medicalexecutivepost.com/2016/02/06/mobile-hipaa-solutions-for-hospital-health-systems/

Texting. Text (or SMS) messaging has become nearly ubiquitous on mobile devices. According to one survey, approximately 72 percent of mobile phone users send text messages. Clinical care is not immune from the trend, and in fact physicians appear to be embracing texting on par with the general population. Another survey found that 73 percent of physicians text other physicians about work.

(Source: Journal of AHIMA, “HIPAA Compliance for Clinician Texting”, by Adam Green, April 2012)

Texting can offer providers numerous advantages for clinical care. It may be the fastest and most efficient means of sending information in a given situation, especially with factors such as background noise, spotty wireless network coverage, lack of access to a desktop or laptop, and a flood of e-mails clogging inboxes. Further, texting is device neutral—it will work on personal or provider-supplied devices of all shapes and sizes. Because of these advantages, physicians may utilize texting to communicate clinical information, whether authorized to do so or not.

All forms of communication involve some level of risk. Text messaging merely represents a different set of risks that, like other communication technologies, needs to be managed appropriately to ensure both privacy and security of the information exchanged.

Text messages may reside on a mobile device indefinitely, where the information can be exposed to unauthorized third parties due to theft, loss, or recycling of the device. Text messages often can be accessed without any level of authentication, meaning that anyone who has access to the mobile phone may have access to all text messages on the device without the need to enter a password.

Texts also are generally not subject to central monitoring by the IT department. Although text messages communicated wirelessly are usually encrypted by the carrier, interception and decryption of such messages can be done with inexpensive equipment and freely available software (although a substantial level of sophistication is needed. If text messages are used to make decisions about patient care, then they may be subject to the rights of access and amendment. There is a risk of noncompliance with the privacy rule if the covered entity cannot provide patients with access to or amend such text messages.

According to 2012 data from CTIA–The Wireless Association, U.S. citizens alone exchange nearly 200 billion text messages every month. So it’s not surprising that an increasing number of clinicians are using text messaging to exchange clinical information, along with a wide range of other modes — smartphones, pagers, computerized physician order entry, emails, etc. Electronic communication is certainly faster, can be more efficient, enhances clinical collaboration and enables clinicians to focus on patient care. But with these benefits comes an increased risk of security breaches.

HIPAA TEXTING: https://medicalexecutivepost.com/2016/11/22/hipaa-cloud-solutions/

(Source: Clarifying the Confusion about HIPAA – Compliant Texting, by Megan Hardiman and Terry Edwards, May 2013)

Unfortunately, vendor hype about the Health Insurance Portability and Accountability Act is causing many hospitals and health systems to implement stop-gap measures that address part — but not all — of a problem. To identify all vulnerabilities, health care leaders need to consider not only text messaging, but all mechanisms by which protected health information in electronic form is transmitted — as well as the security of those mechanisms.

Mobile device-to-mobile device SMS text messages are generally not secure because they lack encryption. The sender does not know with certainty that his or her message is indeed received by the intended recipient. In addition, telecommunications vendor/wireless carrier may store the text messages. Recent HHS guidance indicates text messaging, as a means of communicating PHI, can be permissible under HIPAA depending in large part on the adequacy of the controls used. A hospital or provider may be approved for texting after performing a risk analysis or implementing a third-party messaging solution that incorporates measures to establish a secure communication platform that will allow texting on approved mobile devices.

A study reported in Computer World in May 2013 by the Ponemon Institute with 577 healthcare and It professional in facilities that ranged from fewer than 100 beds to over 500 beds stated that fifty-one percent of the respondents felt HIPAA compliance requirements can be a barrier to providing effective patient care. Specifically HIPAA reduces time available for patient care (85% of the respondents), makes access to electronic patient information difficult (79% of the respondents) and restricts the use of electronic mobile communications (56% of the respondents). The study stated “respondents agreed that the deficient communications tools currently in use decrease productivity and limit the time doctors have to spend with patients. “ They also stated “they recognized the value of implementing smartphones, text messaging and other modern forms of communications, but cited overly restrictive security policies as a primary reason why these technologies were not used.” Clinicians in the survey stated that only 45% of each workday is spent with patients; the remaining 55% is spent communicating and collaborating with other clinicians and using the electronic medical record and other clinical IT systems.

Several other statements made were:

Because of the need for security, hospitals and other healthcare organizations continue to use older, outdate technology such as pagers, email and facsimile machines. The use of older technology can also delay patient discharges – now taking an average of 102 minutes.
The Ponemon Institute estimated that the lengthy discharge process costs the U.S. hospital industry more than $3.189 billion a year in lost revenue, with another $5 billion lost through decrease doctor productivity and use of outdated technology. Secure text messaging could cut discharge time by 50 minutes.

(Source: Computer World, “HIPAA rules, outdate tech cost U.S. hospitals $3.38 B a year”, by Lucas Mearian, May, 2013)

Several suggestions offered for these preferred mobile devises are: 1) ensure encryption and access to individuals who need to have access; 2) use secure texting applications; and 3) even consider alerting employees with warnings before they send an email or share files that lets them know they are liable for the information sent.

COMMENTS APPRECIATED

EDUCATION: Books

Refer, Like and Subscribe

***

Filed under: iMBA, Inc. | Tagged: AHIMA, Box, Carol Miller, cell phopnes, cloud storager, Computer World, computers, CTIA, Cyber Security, cybersecurity, drop box, faxmachines, HIPAA, mobile services, PCs, PHI, security, SMS, tablerts, Technology, Texting | Leave a comment »

MEDICAL DEVICES: Special Considerations

Posted on April 6, 2025 by Dr. David Edward Marcinko MBA MEd CMP™

By Staff Reporters

***

INFORMATION TECHNOLOGY CONSIDERATIONS FOR MEDICAL DEVICES

In 2013, the Food and Drug Administration (FDA) issued its first cybersecurity safety communication, followed in 2014 by final guidance. It struck a reasonable balance between new regulations (almost none) and guidance (in the form of non-binding recommendations).

In 2015, the Federal Trade Commission (FTC) released a staff report entitled Internet of Things: Privacy & Security in a Connected World, in which it recommend that Internet of Things (IoT) style devices, which of course include medical and clinical devices, need to maintain a good security posture. It’s worth noting that the FDA, FTC, and other government regulators are centering on a few key guidelines. The following recommendations come directly from the FTC report.

Companies should build security into their devices at the outset, rather than as an afterthought. As part of the security by design process, companies should consider:

Conducting a privacy or security risk assessment
Minimizing the data they collect and retain
Testing their security measures before launching their products
Companies should train all employees about good security, and ensure that security issues are addressed at the appropriate level of responsibility within the organization
Companies should retain service providers that are capable of maintaining reasonable security and provide reasonable oversight for these service providers.
When companies identify significant risks within their systems, they should implement a defense-in-depth approach, in which they consider implementing security measures at several levels.
Companies should consider implementing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or even the consumer’s network.
Companies should continue to monitor products throughout the life cycle and, to the extent feasible, patch known vulnerabilities

According to colleague Shahid N. Shah MS, the FTC report and FDA guidelines are remarkably consistent. When thinking of cybersecurity and data privacy, engineers tend to think about authentication, authorization, and encryption. Those are the relatively easy topics. For safety-critical devices, however, things are much more difficult and need to encompass a larger surface of questions, including but not limited to:

Asset Inventory: Is the device discoverable, and can it associate itself with standard IT inventory systems so that revision management, software updates, and monitoring can be automated?
Cyber Insurance: Does the device have enough security documentation to allow it to be insured by standard cyber insurance riders?
Patching: How is the firmware, operating system (OS), or application going to be patched by IT staff within hospitals (or the home for remote devices)?
Internal Threats: Has the device been designed to circumvent insider (hospital staff, network participants, etc.) threats?
External Threats: Has the device been designed to lock down the device from external threats?
Embedded OS Security: Is the device sufficiently hardened at the operating system level, such that no extraneous software components, which increase the attack surface, are present?
Firmware and Hardware Security: Are the firmware and hardware components sourced from reputable suppliers and free of state-sponsored spying?
Application Security: Is the Microsoft Security Development Lifecycle (SDL) or similar software security assurance process integrated into the engineering process?
Network Security: Have all network protocols not in use by the device been turned off so that they are not broadcasting?
Data Privacy: What data segmentation, logging, and auditing is being done to ensure appropriate data privacy?
HIPAA Compliance: Have proper steps been followed to ensure Health Insurance Portability and Accountability Act (HIPAA) compliance?
FISMA Compliance: If you’re selling to the federal government, have proper steps, such as use of Federal Information Processing Standard (FIPS) certified encryption, been followed to ensure Federal Information Security Management Act (FISMA) compliance?
Data Loss Prevention (DLP): Is there monitoring in place to ensure data leakage outside of the device doesn’t occur?
Vulnerabilities: Have common vulnerabilities such as the Open Web Application Security Project (OWASP) Top 10 been reviewed?
Data Sharing: Are proper data sharing agreements in place to allow sharing of data across devices and networks?
Password Management: Are passwords hardcoded into the device or made configurable?
Configuration Protection: Are configuration files properly check-summed and protected against malicious changes?

ASSESSMENT

It is vital to perform a security assessment on a healthcare practice to understand the environment, identify risks and perform risk mitigation. A one-time security assessment with risk mitigation is not sufficient in 2025. This is a continuous process that needs to be performed religiously to maintain a secure and compliant practice.

COMMENTS APPRECIATED

Refer, Like and Subscribe

***

Filed under: "Ask-an-Advisor", Experts Invited, Funding Basics, Glossary Terms, Health Law & Policy, Information Technology, Insurance Matters, Research & Development | Tagged: AI, asset inventory, cyber insurance, Cyber Security, cybersecurity, data, data privacy, DLP, FDA, FIDMA, FIPS, firmware, FISMA, FTC, Health Information and Management Systems Society, HIPAA, HIT, Information Technology, internal threats, IoT, IT, Medical Devices, operating system, OS, OWASP, Password, password management, patching, risk mitigation, SDL, security, Shahid N. Shah MS, software, Technology | Leave a comment »

DAILY UPDATE: Tesla, PBMs, Medicare Part C and the Hot Stock Markets

Posted on July 11, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

MEDICAL EXECUTIVE-POST – TODAY’S NEWSLETTER BRIEFING

***

Essays, Opinions and Curated News in Health Economics, Investing, Business, Management and Financial Planning for Physician Entrepreneurs and their Savvy Advisors and Consultants

“Serving Almost One Million Doctors, Financial Advisors and Medical Management Consultants Daily“

A Partner of the Institute of Medical Business Advisors , Inc.

http://www.MedicalBusinessAdvisors.com

SPONSORED BY: Marcinko & Associates, Inc.

***

http://www.MarcinkoAssociates.com

Daily Update Provided By Staff Reporters Since 2007.
How May We Serve You?

REFER A COLLEAGUE: MarcinkoAdvisors@msn.com

SPONSORSHIPS AVAILABLE: https://medicalexecutivepost.com/sponsors/

ADVERTISE ON THE ME-P: https://tinyurl.com/ytb5955z

***

A day before the June CPI report, major indexes extended their rally amid growing demand for semiconductors and rate cut hopes.

The S&P 500 rose above 5,600 for the first time ever, only a few short days after breaking above 5,500, with the index hitting a new record for the last seven straight trading sessions. The NASDAQ also enjoyed a solid day as well thanks to strong performances by tech stocks, while even the Dow got in on the action and ended the session in the green.
Bond yields stayed almost right where they’ve been all week as investors hold their breath ahead of tomorrow’s key CPI reading.
Gold rose as investors hope for a strong CPI report to point the Fed toward more rate cuts, while oil rose as well thanks to a stronger-than-expected outlook on global demand from OPEC.

***

The Centers for Medicare & Medicaid Services (CMS) announced in June it would recalculate 2024 Medicare Advantage (MA) star ratings for all plans after two court rulings called into question the agency’s method for determining this year’s ratings. The decision is estimated to cost the federal agency roughly $1 billion in additional bonus payments for insurers, according to healthcare analytics firm Cotiviti. The move comes after several large insurers laid off employees in late 2023 after their star ratings decreased.

HIPAA: Some groups are disputing a proposed federal rule that would require hospitals to report cybersecurity incidents, saying they want it to also include insurers and third-party vendors. (Healthcare Dive)

CITE: https://www.r2library.com/Resource

What’s up

Taiwan Semiconductor rose 3.54% after it reported that its June revenue fell 10% month over month, but its sales rose roughly 33% year over year.
Advanced Micro Devices popped 3.87% on the news it is acquiring Silo AI, the largest private artificial intelligence lab in Europe, for $665 million.
Carvana drove 4.21% higher after Needham analysts upgraded the stock from “hold” to “buy” due in part to new features at checkout highlighting EVs. Competitor CarMax jumped 6.42% in sympathy.
Aehr Test Systems rocketed 24.01% after the semiconductor testing equipment maker raised earnings guidance thanks to strong AI demand.
Smart Global Holdings rose 26.27% thanks to earnings that beat Wall Street expectations in the third quarter and a strong outlook for the rest of the year.

What’s down

LegalZoom plummeted 25.35% to a new all-time low after the company cut its outlook and its CEO stepped down.
HubSpot sank 12.24% on a report that Alphabet is no longer interested in acquiring the company.
Intuit dropped 2.57% on the news that the tax prep company is cutting 10% of its workforce.
Deckers Outdoor fell 4.86% after M Science analysts published a note cautioning that sales for key brands UGG and HOKA fell in June.
Ziff Davis fell 10.32% after the digital media company tried to get ahead of the bad news and pre-announced that second-quarter earnings will fall below analyst expectations.
Fast-casual restaurant stocks continued to sink today as investors grow more concerned about lower consumer spending and higher valuations. CAVA Group fell 5.47%, Sweetgreen dropped 1.72%, and Dutch Bros fell 4.34%.

CITE: https://tinyurl.com/2h47urt5

Tesla’s US electric car market share fell below 50% in Q2 for the first time, according to estimates by the research firm Cox Automotive.

CITE: https://tinyurl.com/tj8smmes

In a scathing report, the Federal Trade Commission accused [PBMs] pharmacy benefit managers—the companies that act as go-betweens for drug makers and consumers—of jacking up drug prices

COMMENTS APPRECIATED

PLEASE SUBSCRIBE: MarcinkoAdvisors@msn.com

Thank You

***

EDUCATIONAL TEXTBOOKS: https://tinyurl.com/4zdxuuwf

***

Filed under: "Ask-an-Advisor", Breaking News, Drugs and Pharma, Ethics, Experts Invited, Financial Planning, Health Economics, Healthcare Finance, Information Technology, Investing, Marcinko Associates, Recommended Books, Sponsors | Tagged: bonds, CBOE, cybersecurity, DJIA, gold, healthcare fraud, HIPAA, IT, Marcinko, Medicare Advantage, NASDAQ, opioids, Part C, PBMs, S&P 500, Tesla, textbooks, TNX, VIX, WSJ | Leave a comment »

A DENTAL INDUSTRY SECRET: No One Wants to Share!

Posted on June 7, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

By Darrell Pruitt DDS

***

***

Ransomware is getting worse, not better.

One doesn’t see this in dental literature, but ransomware is not going away. It is getting worse. “Ransomware Victim Count Increased by 75% in 2023” By Steve Alder for The HIPAA Journal, Jun 4, 2024. https://www.hipaajournal.com/ransomware-victim-count-increased-by-75-in-2023/

A new report from the Google-owned cybersecurity firm Mandiant suggests several reasons for the increase in attacks. “First, there has been a resetting of the cybe rcriminal ecosystem after a tumultuous year in 2022, an influx of new actors conducting attacks, new partnerships between existing groups, and members of disrupted, prolific ransomware groups such as Conti starting up their own RaaS operations. While the attacks in 2023 largely followed the same patterns as the previous year, there were some notable changes with several groups trialing new tactics, techniques, and procedures.

For example, to increase the pressure on victims to pay, attacks on healthcare providers saw extortion demands issued to patients whose data were stolen, threatening to publish their medical data if they did not personally pay a ransom. The ALPHV group created a searchable database to make stolen data more accessible, and threats were issued to report attacks on publicly traded companies to the Securities and Exchange Commission (SEC).”

Imagine how ransomware would affect your practice if the extortion scheme bypassed you to directly threaten your patients – and blamed you for not paying the “reasonable” ransom demand.

COMMENTS APPRECIATED

Thank You

***

Filed under: "Doctors Only", Career Development, Experts Invited, Information Technology, Pruitt's Platform | Tagged: ALPHV, Conti, cyber attack, Darrell Pruitt, DDS, dental industry, dental industry secret, dental secret, HIPAA, HIPAA Journal, HIT, IT, Mandiant, Pruitt, RaaS, RansomWare, SEC | Leave a comment »

Medical [Dental] Anti-Defamation Contracts and Doctor Accountability

Posted on April 27, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

Was the ADA Complicit?

By D. Kellus Pruitt DDS

If you were to walk into my dental office with a toothache, and I told you that before I relieve your pain, you have to agree not to say bad things about me on the internet, how badly would the tooth have to be hurting to keep you from walking out the door?

The article, “Toothache lawsuit may stifle medical gag orders against online rants”, by JoNel Aleccia, was posted on MSN.com years ago.

[Robert Lee, 42] who had a bad toothache has filed a class-action lawsuit against his New York dentist after she required him to sign a contract promising not to trash-talk her online — and then fined him thousands of dollars trying to enforce it.”

Aleccia adds: “[Dr. Stacy Makhnevich] was among hundreds of medical professionals nationwide in recent years who refused to care for patients unless they signed anti-defamation contracts. In the contracts, the doctors and dentists promised not to evade federal patient privacy protections in exchange for patients’ agreeing not to post public comments about them.”

The Dentist

Other than its obvious ineffectiveness for this particular Manhattan dentist, whose practice is on the 69 th. floor of the Chrysler Building, Lexington Avenue at East 42St., (212) 697-4400, what’s wrong with this business plan?

First of all, aside from the insult, if a dentist required you to sign a contract forfeiting your right to express your opinion about the quality of care even before being seen, how confident would it make you feel about the doctor’s abilities?

The HIPAA Question

Then there’s HIPAA. It’s sad that healthcare providers on the 69th. floor of the Chrysler Building would take advantage of vulnerable Americans who don’t understand that their right to privacy isn’t something that can be withheld – even as part of a twisted “copyright” deal intended to enable a dentist to dodge accountability. It seems to me like the Office of Civil Rights as well as the Attorney General should be alerted. How is threatening a patient’s privacy in return for direly-needed treatment different than extortion?

The Gotcha!

Mr. Lee had forgotten the contract until months later when he allegedly discovered that Dr. Makhnevich had overcharged him by about $4,000, improperly filed the insurance and then refused to provide him with the documents he needed to file the claim himself. That’s when he started posting rants on sites like Yelp and DoctorBase, such as, “Avoid at all cost! Scamming their customers!” and “Honestly, how do you live with yourself? Just try being a decent human being.”

“Within days, Makhnevich demanded that the sites remove the comments and threatened to sue Lee. She also said he was infringing on her copyright provisions and started sending invoices for fines of $100 a day. By October, the total topped $4,600, he said.”

The Service

Since the dentist purchased the right to use Medical Justice Inc. anti-defamation contracts to prevent complaints from dis-satisfied customers from being discussed on the internet, I say she is due a refund. What’s more, if she’s given any trouble about it, she should get on the internet and complain – if she didn’t forfeit that right as part of the agreement.

The ADA

So where did Dr. Stacy Makhnevich learn about Medical Justice Inc.’s ineffective, unethical and probably illegal anti-defamation contract service? Of all places, it may well have been in ADA Headquarters, 211 E. Chicago Ave., Chicago, (312) 440-2500

Dr. Jeffrey Segal [MD, JD], the neurosurgeon and founder of Medical Justice Services Inc. which sold providers like Dr. Makhnevich the right to use his company’s contracts, was a featured speaker at the American Dental Association’s [ADA] annual Benefits Conference last year.

The ADA leadership’s decision to invite Dr. Segal to advertise his product at a benefits conference (?) reveals the old timers’ underlying paranoia that makes them prefer silence from members as well as their own dental patients.

Assessment

Since the ADA effectively put its stamp of approval on Medical Justice’s anti-defamation contracts, don’t you think the ADA News should at least post a warning about the liability to members who attended Dr. Segal’s presentation in ADA Headquarters? Let’s watch dentistry’s leaders ignore the abysmal results of yet another half-baked blunder caused by people too proud to listen.

Conclusion

Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Ethics, Op-Editorials, Practice Management, Professional Liability, Pruitt's Platform, Risk Management | Tagged: ADA, anti-defamation contracts, D. Kellus Pruitt DDS, Dr. Jeffrey Segal, Dr. Stacy Makhnevich], HIPAA, Medical Justice Inc, OCR | 11 Comments »

HIT & PHI: The Designated Medical Record Set

Posted on April 2, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

By Staff Reporters

***

What is HIPAA? Importance of HIPAA Compliance

How to Mitigate Protected Health Information Risks

***

The Designated Medical Record Set [DMRS]: Contains medical and billing records and any other records that a physician, hospital, clinic and/or medical practice utilizes for making decisions about a patient; a hospital, emerging healthcare organization, or other healthcare organization. It serves to define which set of information comprises “protected health information” and which set does not; or contains medical or mixed billing records, and any other information that a physician and/or medical practice utilizes for making decisions about a patient.

It is up to the hospital or healthcare organization to define which set of information comprises “protected health information” and which does not though logically this should not differ from locale to locale. The patient has the right to know who in the lengthy data chain has seen their Protected Health Information. This sets up an audit challenge for the medical organization, especially if the accountability is programmed, and other examiners view the document without cause.

***

COMMENTS APPRECIATED

Thank You

***

Filed under: "Doctors Only", Career Development, Glossary Terms, Information Technology | Tagged: designated medical record set, dmrs, eHR, eMR, HIPAA, HIT, IT, PHI, protected health information | Leave a comment »

About [Health] Information Data Protection

Posted on April 2, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

What’s Your Back-up Plan – Doctor?

As per a recent study, 32% of data is lost by human errors. However hardware, software, hacks and smack-downs are responsible for remaining 68% data loss.

Data protection gains major importance in data loss. It can be achieved by implementing data management successfully.

***

Source: dell.com

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: "Doctors Only", Career Development, Information Technology, Risk Management | Tagged: data protection, data security, Health Data Protection, HIPAA, HIT, IT, Medical Data Protection, PHI, protected health information | 4 Comments »

HEALTHCARE: Cyber Security and Amazon’s Iora Healthcare Quality Down?

Posted on March 10, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

By Staff Reporters

***

***

Stat: According to HIPPA, and the cyberattack on Change Healthcare, there were 725 “large” reported healthcare security breaches in the US last year. Experts say health organizations suffer from a lack of basic security measures, and are being targeted by “increasingly sophisticated cyberattacks.” (The HIPAA Journal)

CITE: https://www.r2library.com/Resource

Quote: “Having a [doctor] who can coordinate your healthcare and is willing to do so on a personal basis was very important to me. And I really feel like that is completely gone, and I feel like it happened overnight.”—Deborah Wood, an older adult patient at primary care provider Iora Health, where some patients say care quality has worsened after Amazon acquired its parent company One Medical in 2022 (the Washington Post)

COMMENTS APPRECIATED

Thank you

***

Filed under: "Doctors Only", Breaking News, Drugs and Pharma, Ethics, Experts Invited, Health Economics, Health Insurance, Health Law & Policy, Healthcare Finance, Op-Editorials, Quality Initiatives | Tagged: Amazon Health, Change Healthcare, Health Insurance Portability and Accountability Act, HIPAA, Iora Health, One Medical | Leave a comment »

HEALTHCARE: Under Cyber Attack

Posted on March 1, 2024 by Dr. David Edward Marcinko MBA MEd CMP™

By Staff Reporters

***

***

Cyber villains have struck again, and they’re going after the US health system. Pharmacies and hospitals nationwide are coping with a debilitating cyberattack against the prescription processor Change Healthcare, owned by America’s biggest health insurer, UnitedHealth.

The health tech company noticed the breach last week and rushed to disconnect its systems, throwing a wrench into pharmacies’ ability to dispense pills. Change Healthcare said some of its services were still on pause, and it’s unclear if any patient info was stolen.

COMMENTS APPRECIATED

Thank You

***

Filed under: "Doctors Only", Alerts Sign-Up, Experts Invited, Health Insurance, Health Law & Policy, Information Technology, Insurance Matters | Tagged: Change Healthcare, cyber attack, cyber attacks, eHR, eMR, healthcare cyber attacks, HIPAA, HIT, Information Technology, IT, patinet data, United Health UHC | Leave a comment »

DAILY UPDATE: Norton Healthcare Hacked – Pharma Chains Give Health Data to Police and the Stock Markets Climb

Posted on December 13, 2023 by Dr. David Edward Marcinko MBA MEd CMP™

By Staff Reporters

***

SPONSOR: http://www.MarcinkoAssociates.com

***

Kentucky-based healthcare provider Norton Healthcare has confirmed that it has suffered a significant ransomware attack that may have put the data of millions of its patients at risk. In a filing to the Maine Attorney General on December 8th, the healthcare giant said that 2.5 million individuals had been affected by the breach.

***

Meanwhile, the nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy. Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.

The policy was revealed in a letter sent to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.).

HIPAA anyone?

***

Here’s where the major benchmarks ended:

The S&P 500 index was up 21.26 points (0.5%) at 4,643.70; the Dow Jones Industrial Average®(DJI) was up 173.01 points (0.5%) at 36,577.94; the NASDAQ Composite® (COMP) was up 100.91 points (0.7%) at 14,533.40.
The 10-year Treasury note yield (TNX) was down about 3 basis points at 4.206%.
The CBOE® Volatility Index (VIX) was down 0.56 at 12.07.

Technology shares were among Tuesday’s strongest performers despite a 12% drop in Oracle (ORCL), which plunged after reporting lighter-than-expected quarterly revenue late Monday. The Philadelphia Semiconductor Index (SOX) posted its highest close since January 2022.

Financial shares were also firm. Energy shares were under pressure because WTI Crude Oil futures (/CL) extended a slump below $70 per barrel and settled at its lowest price since late June.

Here is where the major benchmarks ended:

CITE: https://www.r2library.com/Resource

COMMENTS APPRECIATED

Refer a Colleague: MarcinkoAdvisors@msn.com

Your referral Count: 0

Thank You

***

Filed under: Alternative Investments, Financial Planning, Funding Basics, Glossary Terms, Information Technology, Investing, Touring with Marcinko | Tagged: banks, COMP, crude, DHHS, DJIAm, EHRs, electronic medical records, EMRs, energy, gold, HIPAA, HIT, inflation, iol, IT, Marcinko, markets, medical records, metals, NASDAQ, norton, norton hacked, oil, ORCL, Pramila Jayapal, real-estate, Ron Wyden, Russell Index 2000, RUT, S&P 500, Sara Jacobs, SOX, stock markets, TNX, utilities, WTI, Xavier Becerra | Leave a comment »

DAILY UPDATE: HIPPA Web-Tracker Lawsuit and Bank Deposits Delayed as Markets Jump Again!

Posted on November 4, 2023 by Dr. David Edward Marcinko MBA MEd CMP™

“FALL BACK WEEKEND”

By Staff Reporters

***

***

The biggest U.S. hospital lobbying group just sued the Biden administration over new guidance barring hospitals and other medical providers from using trackers to monitor users on their websites. The American Hospital Association (AHA), along with the Texas Hospital Association and two nonprofit Texas health systems, filed a lawsuit against the U.S. Department of Health and Human Services (HHS) in federal court in Fort Worth, Texas. The lawsuit accuses the agency of overstepping its authority when it issued the guidance in December, 2022.

***

Bank of America customers have been warned of delays to deposits following an unspecified issue that is affecting “multiple financial institutions”. The company reassured customers on Friday that their accounts remained “secure” and that no action was needed. A statement appearing on customer phone applications read: “Some deposits from 11/3 may be temporarily delayed due to an issue impacting multiple financial institutions.

Wells Fargo and Chase just reported similar situations.

***

Here is where the major benchmarks ended:

The S&P 500 Index was up 40.56 points (0.9%) at 4,358.34; the Dow Jones Industrial Average (DJI) was up 222.24 points (0.7%) at 34,061.32, up 5.1% for the week; the NASDAQ Composite (COMP) was up 184.09 points (1.4%) at 13,478.28, up 6.6% for the week.
The 10-year Treasury note yield was down about 9 basis points at 4.577%.
CBOE’s Volatility Index (VIX) was down 0.75 at 14.91.

Banks and other financial companies led Friday’s gainers, on hopes easing Treasury yields will relieve some pressure on lenders’ balance sheets. The KBW Regional Banking Index (KRX) surged 3.3% to end at a seven-week high, while Goldman Sachs Group (GS) shares jumped 4.4% to lead Dow gainers.

Retailer shares were also strong, as were small-caps in general, as the Russell 2000 Index (RUT) posted a gain of 7.6% for the week.

CITE: https://www.r2library.com/Resource

COMMENTS APPRECIATED

Thank You

***

Filed under: Alternative Investments, Experts Invited, Financial Planning, Funding Basics, Glossary Terms, Information Technology, Investing | Tagged: AHA, American Hospital Association, Bank America, banks, BoA, Chase, cookie script, DJIA, energy, gold, GS, HHS, HIPAA, inflation, KRX, markets, NASDAQ, oil, Russell 2000, Russell Index 2000, RUT, S&P 500, Texas Hospital Association, web trackers, Wells Fargo | Leave a comment »

ASPEN DENTAL: Cyber Attack with Data Breach

Posted on May 18, 2023 by Dr. David Edward Marcinko MBA MEd CMP™

By Darrell Pruitt DDS

***

***

Aspen Dental has been hit by a cyber attack. Aspen has over a thousand dental offices across the nation, and even though their official website says there are no signs of patient information being compromised, the American Dental Association is calling it a “breach,” since the attack involved ransomware.

If Aspen Practices each maintain dental records on 10,000 patients, and there are over a thousand Aspen locations, that would mean more than 10 million patients’ records were potentially breached. Texas has 58 Aspen locations – second only to Florida which has 124. (There are three Aspen locations near me in the Dallas-Fort Worth metroplex).

Last of all, history has shown that businesses which suffer one ransomware attack are likely to be targeted a second or even third time. It never ends. And then there are the HIPAA violations and remediation … This is bad for Aspen Dental.

***

COMMENTS APPRECIATED

Thank You

***

Filed under: "Doctors Only", Information Technology, Op-Editorials, Pruitt's Platform | Tagged: ADA, American Dental Associaion, Aspen Dental, Darrell Pruitt, dental data breach, HIPAA, RansomWare | 2 Comments »

Understanding the Mental Healthcare Regulatory Environment

Posted on October 5, 2022 by Dr. David Edward Marcinko MBA MEd CMP™

Appreciating the Rules

[By Carol Miller; RN, MBA]

Local counties and municipalities are the primary providers of state mental healthcare for patients who lack private insurance coverage for such care.

Both children and adults may be eligible to receive assistance.

These counties provide a wide range of psychiatric and counseling services to the residents in their community as well as other types of assistance such as:

treatment services related to substance abuse;
housing;
employment services;
information and education service;
referrals;
consultative services to schools, courts and other agencies;
after-care services; and other related activities.

Rules and Regulations

Accordingly, regulations from federal, state, and county governments have an impact on the day-to-day operations, procedures and processes of a county mental health center. Traditionally, there are three main types of regulations.

Federal Regulations — The United States healthcare system is guided by programs such as those established under the Centers for Medicare and Medicaid (in the case of county mental health programs, Medicaid is especially important), Americans with Disabilities Act (ADA), Occupational Safety and Health Administration (OSHA), Health Insurance Portability and Accountability Act (HIPAA), and others.

State Regulations — These include general legislative guidelines, state management of benefits and reimbursement of the Medicaid program, and state allocations of budgets, which impact the centers’ operations.

County Regulations — Each county defines its own County Mental Health Program and decides which services will be provided or excluded.

Assessment

County facilities generally include outpatient clinics, county mental health programs, short-term psychiatric facilities, day-care centers, de-toxification centers, residential rehabilitation centers for substance abuse, long-term care psychiatric facilities, and Veterans Affairs (VA) psychiatric centers. The county centers may be co-located with other county services such as social services, occupational rehabilitation services, information technology services, human resources, maintenance services, and others or may be independently located.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: CMP Program, Health Insurance, Health Law & Policy, Practice Management | Tagged: ADA, Americans with Disabilities Act, CMS, County Mental Health Program, Health Insurance Portability and Accountability, HIPAA, Medicaid, medicare, mental health, occupational rehabilitation services, Occupational Safety and Health Administration, OSHA, psychiatric centers, social services, VA, Veterans Affairs | 2 Comments »

PODCAST: Deborah C. Peel MD on Patient Privacy

Posted on September 20, 2022 by Dr. David Edward Marcinko MBA MEd CMP™

An Audio-Video Presentation

[Submitted via Darrell Pruitt DDS]

***

Conclusion

Book Marcinko: https://medicalexecutivepost.com/dr-david-marcinkos-bookings/

Subscribe: MEDICAL EXECUTIVE POST for curated news, essays, opinions and analysis from the public health, economics, finance, marketing, IT, business and policy management ecosystem.

HOSPITALS:

“Financial Management Strategies for Hospitals” https://tinyurl.com/yagu567d

“Operational Strategies for Clinics and Hospitals” https://tinyurl.com/y9avbrq5

***

Filed under: Experts Invited, Practice Management, Pruitt's Platform | Tagged: Deborah Peel MD, HIPAA, Patient Privacy | 1 Comment »

PODCAST: Hospitals to Sell De-Identified Patient Data

Posted on January 31, 2022 by Dr. David Edward Marcinko MBA MEd CMP™

TRUVETA

http://www.Truveta.com

By Eric Bricker MD

***

Data Platform: Their health provider members care for tens of millions of people and operate thousands of care facilities, providing more than 15% of all care in the United States. Clinical data from this care is de-identified daily and brought together in the Truveta platform to advance patient care and accelerate development of new therapies.

***

COMMENTS APPRECIATED

Thank You

Subscribe to the Medical Executive-Post

***

DICTIONARY: https://www.amazon.com/Dictionary-Health-Information-Technology-Security/dp/0826149952/ref=sr_1_5?ie=UTF8&s=books&qid=1254413315&sr=1-5

***

HOSPITALS: https://www.amazon.com/Financial-Management-Strategies-Healthcare-Organizations/dp/1466558733/ref=sr_1_3?ie=UTF8&qid=1380743521&sr=8-3&keywords=david+marcinko

***

Filed under: Career Development, Drugs and Pharma, Ethics, Experts Invited, Health Insurance, Insurance Matters, Videos | Tagged: Dartmouth Atlas of Health Care, De-identification, Eric Bricker MD, HIPAA, patient data, Truveta | Leave a comment »

TELE-MEDICINE Fraud, Abuse and New Barriers!

Posted on January 18, 2022 by Dr. David Edward Marcinko MBA MEd CMP™

Telemedicine: Fraud and Abuse During the COVID Pandemic

By Susan Walberg

The COVID-19 pandemic has brought with it huge challenges for people all over the world; not only the obvious health-related concerns but also shutdowns, unemployment, financial difficulties, and a variety of lifestyle changes as a result.

When the COVID pandemic struck, CMS quickly recognized that access to care would be an issue, with healthcare resources strained and many providers or suppliers shutting down their offices or drastically limiting availability. Patients who needed routine care or follow-up visits were at risk for not receiving services during a time when healthcare providers were scrambling to enhance infection control measures and implement other new safety standards to protect patients and healthcare workers.

The Centers for Medicare and Medicaid Services (CMS) has responded by easing restrictions and regulatory burdens in order to allow patients to receive the healthcare services they need without undue access challenges. One key area that has changed is the restrictions related to telehealth services, which were previously only paid by Medicare under certain circumstances, such as patients living in remote areas.

Among the changes and waivers CMS has offered, telemedicine reimbursement is among the more significant. Telemedicine services, which includes office visits and ‘check ins’ are now allowed and reimbursed by Medicare. In addition to reimbursement changes, CMS has also relaxed the HIPAA privacy and information security enforcement standards, paving the way for providers to adopt a new model of providing services electronically.

TELE-HEALTH BARRIERS: https://www.statnews.com/2021/07/13/telehealth-provisions-emergency-patients/

MORE: https://medicalexecutivepost.com/2021/05/18/fraud-schemes-of-few-medical-providers/

Your thoughts are appreciated.

THANK YOU

***

Filed under: Experts Invited, Health Insurance, Information Technology, Research & Development | Tagged: CMS, covid, fraud, HIPAA, Susan Walberg, Tele-Health, tele-medicine, telehealth abuse, telemedicine fraud | 1 Comment »

Cyber Insurance for Dentists?

Posted on September 8, 2021 by Dr. David Edward Marcinko MBA MEd CMP™

Are we de-facto targets?

By D. Kellus Pruitt DDS

Have you purchased cyber insurance yet, Doc?

If you are a HIPAA covered entity, you’re going to need it.

Press release: “AIG among insurers seeking more sales as small firms get hacked” (no byline).

“Smaller companies [including dental offices] are learning that, as more data is shared online, they, too, can be targets for the kinds of attacks that larger firms endure. American International Group Inc. and Travelers Cos. are among insurers tailoring cybersecurity products to those customers.”

http://www.delawareonline.com/article/20130322/BUSINESS09/303220034/AIG-among-insurers-seeking-more-sales-small-firms-get-hacked

The Expert Speaks

Bob Parisi, network security and privacy practice leader at the insurance brokerage of Marsh & McLennan tells DelawareOnline that small and mid-size companies are “where we’re going to see some of the most aggressive growth in the next couple of years, because it’s been a part of the market that was ignored.”

The ad describes how a California-based online print shop was targeted by hackers who exposed clients’ names, addresses and credit-card numbers last year. Much like dentists whose EDRs are hacked, after discovering the breach, business owner David Handmaker had to notify affected customers. The Ponemon Institute predicts that 20% or more of the customers notified will instantly become former customers.

“We’re just much, much more aware of the fact that being a small company” makes us more of a target,” Handmaker tells DelawareOnline. He adds that larger businesses have “more resources, and so I think their security practices are maybe a little more evolved.”

Assessment

Small businesses such as print shops and dental practices have become de-facto targets – and according to security experts, easy pickings. I’m not wrong. I’m early.

More

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
BLOG: www.MedicalExecutivePost.com
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors

***

MEDICAL RISK MANAGEMENT: https://www.routledge.com/Risk-Management-Liability-Insurance-and-Asset-Protection-Strategies-for/Marcinko-Hetico/p/book/9781498725989

***

Filed under: Information Technology, Insurance Matters, Pruitt's Platform | Tagged: AIG, American International Group, Bob Parisi, Cyber Insurance for Dentists, Darrell Pruitt, HIPAA, Marsh & McLennan, Travelers Cos | 8 Comments »

Identity Management is a Challenge Health Plans Must Meet

Posted on December 6, 2017 by Dr. David Edward Marcinko MBA MEd CMP™

Is your organization ready?

http://www.MCOL. com

***

Conclusion

Book Marcinko: https://medicalexecutivepost.com/dr-david-marcinkos-bookings/

Subscribe: MEDICAL EXECUTIVE POST for curated news, essays, opinions and analysis from the public health, economics, finance, marketing, IT, business and policy management ecosystem.

***

Filed under: Information Technology | Tagged: HIPAA, Identity Management, medical privacy | Leave a comment »

The PRIME Act

Posted on October 9, 2016 by Dr. David Edward Marcinko MBA MEd CMP™

Preventing and Reducing Improper Medicare and Medicaid Expenditures Act

By Dr. David Edward Marcinko MBA

http://www.CertifiedMedicalPlanner.org

This Act was introduced into congress in 2013 and contains a number of provisions that would increase rewards and incentives for those who uncover healthcare fraud, as well as heighten penalties for those who commit it.

The PRIME Act

The PRIME Act would enact stronger penalties for Medicare and Medicaid fraud; curb improper or mistaken payments made by Medicare and Medicaid; establish stronger fraud and waste prevention strategies with Medicare and Medicaid to help phase out the practice of “pay and chase” (i.e., recouping monies already erroneously paid to providers instead of detecting problems on the front end); curb the theft of physician identities; expand the fraud identification and reporting work of the Senior Medicare patrol; take steps to help states identify and prevent Medicaid overpayments; and improve the sharing of fraud data across state and federal agencies and programs.

Assessment

The law directs the Secretary to develop a plan to revise the incentive program under HIPAA for the reporting of fraud and abuse to encourage greater participation by individuals reporting Medicare fraud and abuse.

And, it also requires the plan to include certain recommendations for ways to enhance rewards for individuals reporting and an extension of the incentive program to the Medicaid program.

MORE: Ten Ways to Prevent Fraud [Consumer]

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

***

Filed under: Ethics, Risk Management | Tagged: David E. Marcinko, HIPAA, Medicare and Medicaid, Medicare fraud, PRIME Act | Leave a comment »

PHI RansomWare Just Went Up!

Posted on July 26, 2016 by Dr. David Edward Marcinko MBA MEd CMP™

[By Darrell K. Pruitt DDS]

Expect malware entrepreneurs to charge what the market will bear, again and again.

“OCR Releases Guidance on Ransomware: ‘Your Money or Your PHI’”. By Dianne J. Bourque for The National Law Review,” July 12, 2016

http://www.natlawreview.com/article/ocr-releases-guidance-ransomware-your-money-or-your-phi

Bourque: “A key component of the guidance provides a ransomware attack that encrypts a Covered Entity’s ePHI is presumed to be a breach. As ransomware can infect a Covered Entity’s entire system, this presumption may lead to enormous breach notification obligations.”

Bourque adds: “OCR indicates that when ePHI is encrypted as a result of a ransomware attack, a breach has occurred because the ePHI encrypted by the ransomware was acquired (i.e., unauthorized individuals took possession of the information) and is thus a ‘disclosure’ not permitted under the HIPAA Privacy Rule has occurred.”

When patients are notified of data breaches – for any reason – many will quietly change providers. According to The Ponemon Institute, loss of future income is the most costly result of lawfully reporting data breaches…. and ransomware attacks are at “epidemic” levels. I have heard dentists are paying the ransom quickly.

The disincentives to do the right thing were overwhelming providers even before the OCR’s recent ruling. Such is the ugly nature of extortion.

Assessment

Cha-ching!

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

***

Filed under: iMBA, Inc., Information Technology, Pruitt's Platform | Tagged: D. Kellus Pruitt DDS, Dianne J. Bourque, HIPAA, malware entrepreneurs, OCR, PHI, RansomWare | Leave a comment »

Protect Privacy – DO NOT Use EMRs!

Posted on March 30, 2016 by Dr. David Edward Marcinko MBA MEd CMP™

OCR pays its own way

Submitted By‏ Darrell Pruitt DDS

“OCR unleashes second wave of HIPAA audits, but will it diminish patients’ privacy and security expectations?

Healthcare entities should expect the Office for Civil Rights to levy fines that help fund the program. And until OCR delivers a draft audit protocol breaches will continue at patients’ expense.”

By Tom Sullivan for HealthcareIT News

[March 23, 2016]

http://www.healthcareitnews.com/news/ocr-unleashes-second-wave-hipaa-audits-will-it-diminish-patients-privacy-and-security

Sullivan: “Here come the HIPAA audits. And even though OCR has yet to clearly outline what healthcare providers should expect exactly, one thing to anticipate is plenty of financial penalties.”

And David Harlow, a health lawyer, consultant and founder of The Harlow Group, tells HealthcareIT News,

“Who loses out as a result? Patients. The breaches continue, free credit monitoring services are offered, and we all move forward with a diminished expectation of privacy and security.”

***

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

***

Filed under: Information Technology, Pruitt's Platform | Tagged: David Harlow, EHR privacy, EMRs, HealthcareIT News, HIPAA, OCR, Office for Civil Rights, Tom Sullivan | 2 Comments »

Update on HIPAA Cloud Solutions for Hospitals and Health Systems

Posted on February 5, 2016 by Dr. David Edward Marcinko MBA MEd CMP™

New-Wave Technology and PHI

[By Carol Miller RN MBA]

To help hospitals and health systems comply with Health Insurance Portability and Accountability Act regulations, best practices are emerging for securing all electronic cloud communication of protected health information.

These new technologies will continually be evolving with hospitals, providers and patients move to new means of communication.

Cloud Solutions

Cloud solutions are becoming a needed commodity in treating patients today but also present a risk to privacy and security violation. Despite the advantages of cloud computing, organizations are often hesitant to use it because of concerns about security and compliance.

Specifically, they fear potential unauthorized access to patient data and the accompanying liability and reputation damage resulting from the need to report HIPAA breaches. While these concerns are understandable, a review of data on HIPAA breaches published by the HHS shows that these concerns are misplaced.

In fact, by using a cloud-based service with an appropriate security and compliance infrastructure, a facility can significantly reduce its compliance risk.

***

But, because HIPAA compliance involves stringent privacy and security protections for electronic protected health information (PHI), many cloud providers are balking at signing new Business-Associate Agreements.

Most cloud-technology providers, such as Box and Dropbox, do not include the built-in privacy protections that guarantee HIPAA compliance. Because many cloud storage companies store plain-text data on their servers, PHI is especially vulnerable to breaches and compliance violations.

HIPAA Not Aging Well

HIPAA was written nearly 20 years ago, before cloud health applications were even envisioned. Because of this, some areas of the law make it hard to determine which applications must be HIPAA- compliant and which are exempt. Considering the numerous ways security breaches can occur with a cloud solution, it is no wonder that HHS is very leery about how PHI is handled on server farms in the cloud.

Assessment

Regardless of the storage modality – it is important to take all the steps possible to comply with HIPAA guidelines.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

***

Filed under: Health Law & Policy, Information Technology | Tagged: Carol Miller RN MBA, cloud storage, Dropbox, HIPAA, PHI, protected health information, server farms | Leave a comment »

More on Texting in Medicine and HIPAA

Posted on December 9, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

Clarifying the Confusion about HIPAA

A Special ME-P Report

[By Carol S. Miller RN MBA PMP]

millerconsultgroup@gmail.com

Texting is Ubiquitous

Text Messing (or SMS) Messaging has become nearly ubiquitous on mobile devices. According to one survey, approximately 72 percent of mobile phone users send text messages. Clinical care is not immune from the trend, and in fact physicians appear to be embracing texting on par with the general population. Another survey found that 73 percent of physicians text other physicians about work.

(Source: Journal of AHIMA, “HIPAA Compliance for Clinician Texting”, by Adam Green, April 2012)

Risk Levels

(Source: Clarifying the Confusion about HIPAA – Compliant Texting, by Megan Hardiman and Terry Edwards, May 2013)

***

Hype over the Health Insurance Portability and Accountability Act

The study stated “respondents agreed that the deficient communications tools currently in use decrease productivity and limit the time doctors have to spend with patients. “ They also stated “they recognized the value of implementing smartphones, text messaging and other modern forms of communications, but cited overly restrictive security policies as a primary reason why these technologies were not used.” Clinicians in the survey stated that only 45% of each workday is spent with patients; the remaining 55% is spent communicating and collaborating with other clinicians and using the electronic medical record and other clinical IT systems.

Several other statements:

Because of the need for security, hospitals and other healthcare organizations continue to use older, outdate technology such as pagers, email and facsimile machines. The use of older technology can also delay patient discharges – now taking an average of 102 minutes.
The Ponemon Institute estimated that the lengthy discharge process costs the U.S. hospital industry more than $3.189 billion a year in lost revenue, with another $5 billion lost through decrease doctor productivity and use of outdated technology. Secure text messaging could cut discharge time by 50 minutes.

(Source: Computer World, “HIPAA rules, outdate tech cost U.S. hospitals $3.38 B a year”, by Lucas Mearian, May, 2013)

***

Suggestions

More:

About

Ms. Carol S. Miller has an extensive healthcare background in operations, business development and capture in both the public and private sector. Over the last 10 years she has provided management support to projects in the Department of Health and Human Services, Veterans Affairs, and Department of Defense medical programs. In most recent years, Carol has served as Vice President and Senior Account Executive for NCI Information Systems, Inc., Assistant Vice President at SAIC, and Program Manager at MITRE. She has led the successful capture of large IDIQ/GWAC programs, managed the operations of multiple government contracts, interacted with many government key executives, and increased the new account portfolios for each firm she supported. She earned her MBA from Marymount University; BS in Business from Saint Joseph’s College, and BS in Nursing from the University of Pittsburgh. She is a Certified PMI Project Management Professional (PMP) (PMI PMP) and a Certified HIPAA Professional (CHP), with Top Secret Security clearance issued by the DoD in 2006. Ms. Miller is also a HIMSS Fellow.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

[PHYSICIAN FOCUSED FINANCIAL PLANNING AND RISK MANAGEMENT COMPANION TEXTBOOK SET]

***

Filed under: Information Technology, Risk Management | Tagged: Carol S. Miller RN, Computer World, HIPAA, Ponemon Institute, texting and HIPAA, texting in medicine, The Wireless Association | 1 Comment »

The Preventing and Reducing Improper Medicare and Medicaid Expenditures Act

Posted on May 20, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

The PRIME Act

[By Carol Miller RN MBA PMP]

First there was Amazon PRIME; now there is another PRIME.

The Act

What it is

***

HIPAA

Assessment

The law also requires the plan to include certain recommendations for ways to enhance rewards for individuals reporting and an extension of the incentive program to the Medicaid program.

Conclusion

ABOUT

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Health Law & Policy, Risk Management | Tagged: Carol Miller RN MBA, HIPAA, Medicare and Medicaid fraud, PRIME Act | 4 Comments »

How Secure Is Your Password – Doctor?

Posted on April 28, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

Tips on using strong passwords

[Securing yourself from a world of hackers]

By Shahid N. Shah MS

What is at Risk?

Here are some specific tools, gadgets, cloud servers, EHRs and other reasons you should secure your PWs:

Fax Server – a fax server allows you to centrally manage all incoming and outgoing faxes. Since most medical practices live on fax, this is one of the fastest investments you can recoup.
Shared drives – start using shared drives either using your existing software or you can purchase inexpensive “network disks” for a few hundred dollars to share business forms, online directories, reports, scanned charts, and many other files.
Online backups and Internet PACS storage – there are online tools like JungleDisk.com that allow you to store gigabytes of encrypted data into the Internet “cloud” for just a few dollars a month.
E-mail (beware of HIPAA, though) – internal office messaging and email is a great place to start. If you haven’t started your office automation journey here you should. If you’re going to use it for patient communications you’ll need to make sure you have patient approvals and appropriate encryption. If you’re on Gmail today and you want to have customers immediately be able to communicate with you on Gmail, that’s generally HIPAA compliant because communications between two Gmail accounts stays within the Google data center and is not sent unencrypted over the Internet.
E-Prescribing – e-prescribing is a great place to start your automation journey because it’s a fast way to realize how much slower the digital process is in capturing clinical data. If e-prescribing alone makes you slower in your job, EMRs will likely affect you even more. If you’re productive with e-prescribing then EMRs in general will make you more productive too.
Office Online and Google Apps (scheduling, document sharing) – Google and Microsoft® have some very nice online tools for managing contacts (your patients are contacts), scheduling (appointments), dirt simple document management, and getting everyone in the office “on the same page”. Before you jump into full-fledged EMRs see if these basic free tools can do the job for you.
Modular clinical groupware – this is a new category of software that allows you to collaborate with colleagues on your most time-consuming or most-needy patients and leave the remainder of them as-is. By automating what’s taking the most of your time you don’t worry about the majority of patients who aren’t.
Patient registry and CCR bulletin boards – if you’re just looking for basic patient population management and not detailed office automation then patient registries and CCR databases are a great start. These don’t help with workflow but they do manage patient summaries.
Document imaging – scanning and storing your paper documents is something that affects everyone; all scanners come with some basic imaging software that you can use for free. Once you’re good at scanning and paper digitization you can move to “medical grade” document managements that can improve productivity even more.

Clinical content repository (CMS) – open source systems like DrupalModules.com and Joomla.org do a great job of content management and they can be adapted to do clinical content management.
Electronic lab reporting – if labs are taking up most of your time, you can automate that pretty easily with web-based lab reporting systems.
Electronic transcription – if clinical note taking is taking most of your time, you can automate that by using electronic transcribing.
Speech recognition – another “point solution” to helping with capturing clinical notes; you can get a system up and running for under $250.
Instant Messaging (IM) – IM gives you the ability to connect directly with multiple rooms within your office using free software; if you want, you can also connect with patients and other physicians during work hours.

How to avoid the most common and dangerous passwords?

***

More:

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Information Technology | Tagged: clinical groupware, E-Prescribing, Electronic lab reporting, EMRs, HIPAA, Instant Messaging, Password, Speech recognition | 3 Comments »

Emerging New-Wave Cloud Technology for HIPAA

Posted on April 4, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

Securing Electronic Communication in the Cloud

[By Carol S. Miller BSN MBA PMP]

To help hospitals and health systems comply with burdens of the Health Insurance Portability and Accountability Act [HIPAA] regulations, best practices are emerging for securing all electronic communication – cloud, wireless, and texting – of protected health information.

These new technologies will continually be evolving with hospitals, providers and patients move to new means of communication.

And so, below is a very brief description of one: cloud solutions.

Cloud Solutions

In fact, by using a cloud-based service with an appropriate security and compliance infrastructure, a facility can significantly reduce its compliance risk.

***

[A.I. and the “SINGULARITY”]*

***

Because HIPAA compliance involves stringent privacy and security protections for electronic protected health information (PHI), many cloud providers are balking at signing new Business-Associate agreements.

Most cloud-technology providers, such as Box and Dropbox, do not include the built-in privacy protections that guarantee HIPAA compliance. Because many cloud storage companies store plaintext data on their servers, PHI is especially vulnerable to breaches and compliance violations.

Note:

The SINGULARITY is that hypothetical moment in time when Artificial Intelligence [AI] will have progressed to the point of a greater-than-human intelligence.

Channel Surfing the ME-P

Have you visited our other topic channels? Established to facilitate idea exchange and link our community together, the value of these topics is dependent upon your input. Please take a minute to visit. And, to prevent that annoying spam, we ask that you register. It is fast, free and secure.

ABOUT THE AUTHOR

Carol S. Miller; BSN, MBA, PMP
ACT IAC Executive Committee Vice Chair at-Large
HIMSS NCA Board Member
President – Miller Consulting Group
7344 Hooking Road
McLean, VA 22101
Phone: 703-407-4704
Fax: 703-790-3257
email: millerconsultgroup@gmail.com

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Health Law & Policy, Information Technology, Risk Management | Tagged: Box, Carol Miller RN, cloud computing, Dropbox, HIPAA, PHI, protected health information | 1 Comment »

The Impact of Medical Identity Theft on Health Care

Posted on March 15, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

Health Plan Related Breaches Since 2009

By http://www.MCOL.com

Channel Surfing the ME-P

More:

Conclusion

How does this relate to emails? Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Health Law & Policy, Information Technology, Risk Management | Tagged: health data breaches, HIPAA, identity theft, Medical Identity Theft | 3 Comments »

On Physicians Texting [SMS]

Posted on March 11, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

Some Technical Considerations

By Carol Miller BSN RN MBA PMP [Miller Consulting]

Text (SMS = Short Message Service) Messaging has become nearly ubiquitous on mobile devices. According to one survey, approximately 72 percent of mobile phone users send text messages (TMs).

Clinical medical care is not immune from the trend, and in fact physicians appear to be embracing texting on par with the general population. Another survey found that 73 percent of physicians text other physicians about work.

(Source: Journal of AHIMA, “HIPAA Compliance for Clinician Texting”, by Adam Green, April 2012)

Advantages

Further, texting is device neutral—it will work on personal or provider-supplied devices of all shapes and sizes. Because of these advantages, physicians may utilize texting to communicate clinical information, whether authorized to do so or not.

Risks

Text messages, like all digital data, may reside on a mobile device indefinitely, where the information can be exposed to unauthorized third parties due to theft, loss, or recycling of the device. Text messages often can be accessed without any level of authentication, meaning that anyone who has access to the mobile phone may have access to all text messages on the device without the need to enter a password.

***

If text messages are used to make decisions about patient care, then they may be subject to the rights of access and amendment. There is a risk of noncompliance with the privacy rule if the covered entity cannot provide patients with access to or amend such text messages.

The Wireless Association

(Source: Clarifying the Confusion about HIPAA – Compliant Texting, by Megan Hardiman and Terry Edwards, May 2013)

Unfortunately, vendor hype about the Health Insurance Portability and Accountability Act [HIPAA] is causing many hospitals and health systems to implement stop-gap measures that address part — but not all — of a problem. To identify all vulnerabilities, health care leaders need to consider not only text messaging, but all mechanisms by which protected health information in electronic form is transmitted — as well as the security of those mechanisms.

Recent HHS guidance indicates text messaging, as a means of communicating PHI, can be permissible under HIPAA depending in large part on the adequacy of the controls used. A hospital or provider may be approved for texting after performing a risk analysis or implementing a third-party messaging solution that incorporates measures to establish a secure communication platform that will allow texting on approved mobile devices.

***

The Ponemon Institute

Specifically HIPAA reduces time available for patient care (85% of the respondents), makes access to electronic patient information difficult (79% of the respondents) and restricts the use of electronic mobile communications (56% of the respondents).

Clinicians in the survey stated that only 45% of each workday is spent with patients; the remaining 55% is spent communicating and collaborating with other clinicians and using the electronic medical record and other clinical IT systems.

Several other statements made were:

Because of the need for security, hospitals and other healthcare organizations continue to use older, outdate technology such as pagers, email and facsimile machines. The use of older technology can also delay patient discharges – now taking an average of 102 minutes.
The Ponemon Institute estimated that the lengthy discharge process costs the U.S. hospital industry more than $3.189 billion a year in lost revenue, with another $5 billion lost through decrease doctor productivity and use of outdated technology. Secure text messaging could cut discharge time by 50 minutes.

(Source: Computer World, “HIPAA rules, outdate tech cost U.S. hospitals $3.38 B a year”, by Lucas Mearian, May, 2013)

***

Assessment

Channel Surfing the ME-P

ABOUT CAROL MILLER; BSN, MBA, PMP millerconsultgroup@gmail.com ACT IAC Executive Committee Vice Chairwoman at-Large HIMSS NCA Board Member [President – Miller Consulting Group] Phone: 703-407-4704 and Fax: 703-790-3257

Conclusion

How does this relate to emails? Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Career Development, Information Technology, Risk Management | Tagged: Carol Miller RN, Computer World, HHS, HIPAA, PHI, Ponemon Institute, SMS, The Wireless Association | Leave a comment »

Dentists for De-Identification

Posted on February 10, 2015 by Dr. David Edward Marcinko MBA MEd CMP™

A Start-Up Idea

[By Darrell K. Pruitt DDS]

An early, shoestring proposal for a non-profit dedicated to common sense security solutions.

Why? if patients’ identities are unavailable, they cannot be hacked.

Recently, I’ve considered starting a non-profit dedicated to keeping patients’ identities off of dentists’ computers where they are far too easily fumbled thousands at a time. I think I might call it “Dentists for De-identification.” What do you think?

My son Ryan and I have discussed putting together an educational YouTube cartoon – comparing the cost, convenience and security of encrypted Protected Health Information (PHI), to storing PHI, including medical information, only on paper in bulky metal filing cabinets – leaving only nameless, unencrypted dental records on the computer. De-identification is the “other” HIPAA Safe Harbor, meaning if patients’ de-identified dental information is stolen or hacked, nobody has to be notified. And, since the patients’ nameless dental records remain unencrypted, de-ID should not slow down work flow like encryption does.

***

One could call employing in-house reference numbers to re-connect patients’ digital dental information to paper-based PHI a hybrid solution to an otherwise intractable security problem. The solution is nothing new, and has a long history of success. For decades, police departments have been substituting in-house reference numbers for citizens’ names to protect the owners. I see no reason it cannot work for dental radiographs as well.

Depending on staff’s familiarity with the alphabet, pulling a patient’s thin paper record from a loud filing cabinet might even take less time than correctly typing in an encryption key (on the first try). What’s more, since there is a limit to the number of patients even the fastest dentists can treat in one day, 4000 or so active patients per dentist is a reasonable estimate of the number of records in a busy dental practice – which is probably one third of the records in the average physician’s practice. Since the dental information remains digital and only a couple of sheets of paper are needed to reveal the patients’ reference number along with a brief medical history, very little filing space should be needed.

The problems with encryption don’t end with correctly entering the key. Once permitted access to encrypted ePHI, it will take much more time to de-crypt one radiograph than it takes to open a manila folder. Depending on the number of radiographs and other digital images – including complex cone-beam radiographs – a patients’ encrypted diagnostic history could require several minutes to view.

I would want to witness the De-ID non-profit professionally investigate whether de-identification indeed offers a cheaper and more secure solution to data breaches from dental offices. I think we all know by now that full disk encryption will never be the answer.

***

Assessment

Still too soon? Give it time. The FBI assures us that more massive data breaches are just around the corner.

Channel Surfing the ME-P

More:

Encrypt or De-identify PHI

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Information Technology, Practice Management, Pruitt's Platform | Tagged: Darrell Pruitt DDS, de-ID, dental eHRs, Dentists for De-Identification, ePHI, HIPAA, PHI | 3 Comments »

Understanding “Meaningful Use” Attestation Numbers for 2014

Posted on December 13, 2014 by Dr. David Edward Marcinko MBA MEd CMP™

Providers versus Hospitals

By CMS

Assessment

So, what do the hospitals know – that the doctors do not?

Channel Surfing the ME-P

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Information Technology | Tagged: CMS, EHRs, HIPAA, HIT, meaningful use | 6 Comments »

There’s a New HIPAA Sheriff in Town

Posted on July 23, 2014 by Dr. David Edward Marcinko MBA MEd CMP™

On OCR Director Jocelyn Samuels

[By D. Kellus Pruitt DDS]

When the explosions of breaches of patients’ medical identities occur – as predicted by the FBI and others – will the new OCR Director Jocelyn Samuels continue to be as sympathetic and forgiving as Leon Rodriguez has been?

Or; will she take on the role of bad cop?

The Replacement

Samuels, who is tying up loose ends in her current position with the civil rights division at the Department of Justice, has replaced Rodriguez as the new head of the HHS’ Office for Civil Rights – which prosecutes HIPAA violations. Many are wondering about her level of enthusiasm for enforcement, especially since data breaches are only getting worse, not better.

Privacy and security attorney Adam Greene, who once served as a member of the OCR staff, tells GovInfo that the challenge for Samuels is “to strike the balance where HIPAA is seen as having ‘teeth’ but covered entities and business associates can still count on OCR as being reasonable when there are areas of ambiguity or privacy or security issues occur despite good efforts at compliance.”

(See: “Impact of New HIPAA Enforcement Leader – Are New Strategies, Directions on the Horizon?” by Marianne Kolbasuk McGee for GovInfoSecurity.com, July 11, 2014).

http://www.govinfosecurity.com/impact-new-hipaa-enforcement-leader-a-7049/op-1

Healthcare Harm

Principals in healthcare – providers and patients – continue to be harmed by EHRs designed to satisfy third-parties’ questionable Meaningful Use requirements rather than principals’ needs. For example, on April 8, the FBI warned that EHRs are becoming increasingly vulnerable to hackers. (See: “Health Care Systems and Medical Devices at Risk for Increased Cyber Intrusions for Financial Gain”).

http://www.illuminweb.com/wp-content/uploads/ill-mo-uploads/103/2418/health-systems-cyber-intrusions.pdf

Under Rodriguez, OCR has arguably spared the rod (mostly), choosing instead to discuss and correct HIPAA violations in an informal, private, non-punitive manner. I think both Rodriguez and Secretary Sebelius backed off of more aggressive enforcement because they recognized that without cooperation from doctors and patients, EHRs are certain to fail – mandate or no mandate. Nevertheless, it has proven to be far too easy for stakeholders who cannot be held accountable to patients, to marginalize their needs.

[New OCR Director Jocelyn Samuels]

Example

Rodriguez did his best to appease all sides. For example, it was under his watch that the name of the HHS website listing breaches of 500 or more patients’ identities was changed from “Wall of Shame” to the more benign “HHS Breach Reporting Tool.”

For hapless providers whose data breaches were unavoidable, the name change eliminates some of the shame associated with being nationally recognized as a careless doctor who cannot keep thieves from stealing patients’ identities.

Assessment

As long as there is nothing holding down the cost and liability of HIPAA compliance, there will always be room for more regulation, and the cost of healthcare will never be cheaper.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians
and Advisors

Filed under: Pruitt's Platform, Risk Management | Tagged: Darrell K. Pruitt DDS, HIPAA, Jocelyn Samuels, Leon Rodriguez, OCR | 5 Comments »

FOR SALE: Physician E-mail Lists with NPI Numbers

Posted on June 23, 2014 by Dr. David Edward Marcinko MBA MEd CMP™

Sensitive Data for Sale

[By Dr. David Edward Marcinko MBA]

I received this email recently. Are you as incensed over it, as I? OR, am I being overly sensitive? Feel free to call or email John Edward, the sender, to tell him what you think: pro or con?

Hi ME-P,

I’m writing to check if you would be interested in reaching Physicians or Healthcare Executives?

We at AccurateB2Blist maintain a permission passed email list for physician practitioners with NPI numbers.

Our Lists

Below given are few additional lists we maintain within Medical Industry

Nurses
Dentists
Veterinarians
Healthcare Executives Email List
Physicians – Offices and Clinics of Doctors of Medicine
Physicians – Offices and Clinics of Doctors of Osteopathy
Doctors, Physicians and Surgeons Email List with NPI Number

Healthcare executives: 518,900 out of which 123,200 contacts are senior management level contacts.

Assessment

Please let me know if you would like to discuss further on your target audience? Looking forward to hearing from you. And, please do not print this email unless it is absolutely necessary. To opt out reply with ‘Leave out’ in the subject line!

By John Edward [Business Development Executive] AccurateB2Blist

+1951-373-6718

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Information Technology, Risk Management | Tagged: AccurateB2Blist, HIPAA, John Edward, NPI Numbers, Physicians Email Lists, Risk Management | 1 Comment »

Can Politically-Correct Names Save Obamacare?

Posted on March 19, 2014 by Dr. David Edward Marcinko MBA MEd CMP™

Saving Electronic Health Record Interoperability?

By D. Kellus Pruitt DDS

If HHS successfully persuades Americans to use happy names for its bad ideas, will the cheap trick save electronic health record interoperability which is critical to the success of Obamacare?

Healthcare Lexicon

According to the government’s modernized healthcare lexicon, doctors have been demoted to “providers,” insurance companies, including Medicare/Medicaid, have been promoted to “payers,” and patients’ position in the hierarchy has diminished from “principals” to “stakeholders” – a rank on par with 3rd parties such as insurers, HHS and other unaccountable parasites.

Wall of Shame

Ominously, HHS recently changed the contentious name “Wall of Shame” to a more innocuous“ breach reporting tool,” to describe the public list of data breaches involving the medical records of more than 500 patients. It turns out that the growing list of major data breaches is unexpectedly shaming far too many providers and payers – including Medicare/Medicaid. Imagine that!

In fact, since Americans’ growing disgust with privacy breaches threatens the very success of Obamacare, there is evidence that HHS has turned to betraying its lawful obligation to the nation by hiding breaches from those who are most vulnerable – Americans.

HIPAA Failure

The half-baked plan to shame providers who experience data breaches – perhaps through no fault of their own – is not working out like HHS had hoped. Due to HIPAA’s abysmal failure to halt data breaches, the Wall of Shame has become a national embarrassment and an obstacle to EHR adoption. I expect the public listing of major breaches to be quietly scrapped soon in favor of keeping patients in the dark concerning their risks of identity theft.

Dentistry

In dentistry, on the other hand, common sense as well as market resistance evidently caused HHS and other stakeholders to give up trying to prohibit use of the 8 syllable “electronic dental records” in favor of the 14 syllable “electronic health records for dental practices.”

Nevertheless, holdouts (including Dissent Doe) still occasionally feel it is important to correct this dentists when I use “EDR” instead of “EHR.” You got to love ‘em.

Assessment

Transparent silliness suggests that HHS is failing in its duties. Due to lack of accountability, we can expect EHRs and EDRs to become even more expensive and more dangerous, possibly bringing an end to Obamacare.

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

Filed under: Information Technology, Pruitt's Platform | Tagged: ACA, Darrell K. Pruitt DDS, dental records, Dissent Doe, eDRs, EHRs, electronic dental records, electronic medical records, HIPAA, ObamaCare, PP-ACA | 23 Comments »

Are Dentists Satisfied with their EDRs?

Posted on February 13, 2014 by Dr. David Edward Marcinko MBA MEd CMP™

Major Discontent With EHR Adoption

[By D. Kellus Pruitt DDS]

Unlike physicians, dentists never complain. That means they are probably 100% satisfied with their electronic dental records.

What do you think, Doc?

MarketWatch

Recently, the Wall Street Journal’s MarketWatch posted a press release titled, “Physicians Cite Major Discontent With Adoption And Use of Electronic Health Record Systems, Despite Government’s $27 Billion Incentive Program”

http://www.marketwatch.com/story/physicians-cite-major-discontent-with-adoption-and-use-of-electronic-health-record-systems-despite-governments-27-billion-incentive-program-2014-02-07

“CLEVELAND, Feb. 7, 2014 /PRNewswire/ — The $27 billion government experiment to incentivize physicians to convert to electronic health records (EHRs) has not been worth it, according to nearly 70% of physicians surveyed.

Medical Economics

***

In fact, a national [Medical Economics] survey of nearly 1,000 physicians, set for release on February 10, 2014, shows widespread dissatisfaction related to the functionality and cost of these patient record systems. About 45% of physicians believe patient care is actually worse as a result of adopting EHR technology, two-thirds would not purchase their current EHR system again, and 43% of physicians say these systems have resulted in significant financial losses.

In addition, the current state of technology has not improved the coordination of care with hospitals, physicians say.”

***

It is probably better for HHS that very few dentists were able to participate in the ARRA stimulus giveaway. Otherwise, tax-paying citizens might have learned about the wastefulness of Meaningful Use requirements for dentists – which nobody has the guts to reveal. That pretty much rules out brilliant Meaningful Use ideas.

Those who might patriotically defend the benefits of the tasks would do so, if they were idiots.

So how do dentists feel about their electronic dental records? It’s hard to tell. Over 96% of them are HIPAA-covered entities, making them vulnerable to audits, which can be “random” now. As one can imagine, very few dentists openly discuss EDRs. Do you think the silence is more likely to improve or harm patient care?

Even though thousands of physicians have participated in dozens of national surveys like Medical Economics’ over the last few years, as far as I know, not one survey of dentists’ opinions has ever been published. Perhaps someone can prove me wrong. I doubt it.

The Survey

The results from the Medical Economics survey include:

67% say that system functionality influences their decisions to purchase or switch systems.
48% say that cost is influencing their decisions to purchase or switch systems.
Nearly half of physicians say that implementation of EHR systems has made the quality of patient care worse.
69% of respondents say that coordination of care with hospitals has not improved.
45% say they have spent more than $100,000 on an EHR
77% of the largest practices (more than 10 physicians) spent more than $200,000 on an EHR.
38% doubt their systems will still be viable in 5 years.

Assessment

Not long ago, Wisconsin became the first state to outlaw paper dental records, which are both cheaper and safer than digital.

So, is it still too soon for dentists and patients demand more transparency in dentistry? When costs and danger are hidden in dental care, it is always the last in line who suffer the most – clueless, trusting dental patients.

Am I right, Doc?

More:

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

Filed under: Information Technology, Pruitt's Platform | Tagged: Are Dentists Satisfied with their EDRs?, D. Kellus Pruitt DDS, eDRs, EHRs, HIPAA, meaningful use, Medical Economics | 9 Comments »

On the Notice of Privacy Practices

Posted on September 24, 2013 by Dr. David Edward Marcinko MBA MEd CMP™

Encryption and HHS are Taking Hits

[By D. Kellus Pruitt DDS]

It is bad politics for the President’s Department of Health and Human Services to get caught deceiving voters.

Word gets around much faster than it did before transparency sucked the power from the entrenched.

The NoPP

You know those Notice of Privacy Practices (NoPP) forms we are asked to sign in doctors’ offices? Since it makes no difference to anyone whether patients sign them or not, why needlessly waste everyone’s time? The NoPP is not an agreement, and just because virtually everyone is tricked into signing it, does not mean anyone reads it. HIPAA has become a source of danger to patients, with no redeeming value.

HHS Estimates

According to the US Department of Health and Human Services own recent estimate:

“… many centuries of time—nearly 35 centuries, in fact, or just short of 30.7 million hours—will be devoted each year by healthcare providers and patients for the dissemination to patients and their acknowledgement of HIPAA notices of privacy practices [NoPP] for protected healthcare information, HHS estimates. Even at just 3 minutes apiece, with 613 million of these routine privacy notices to be delivered, signed and stored, the time adds up…”

-Joseph Conn

… “HHS estimates 32.8 million hours of interaction required to comply with privacy, security rules” …

-ModernHealtcare.com [September 5, 2013]

http://www.modernhealthcare.com/article/20130904/BLOG/309049995?AllowView=VW8xUmo5Q21TcWJOb1gzb0tNN3RLZ0h0MWg5SVgra3NZRzROR3l0WWRMWGJYZjBGRWxyd01qUzMyWmVpNTNnWUpiV2s=&utm_source=link-20130904-BLOG-309049995&utm_medium=email&utm_campaign=hits

Censorship Concerns?

I tried to bring attention to this absurdity over a year ago – back when HHS was still keeping unfavorable news about EHRs hidden from voters using censorship:

… “Put another way, the ONLY reason for a doctor to ask patients if they feel like signing the NoPP is to protect already busy doctors from a HIPAA fine. How is that not senseless, yet admittedly humorous bureaucratic waste?” …

On July 3, 2012, my opinion of the waste that HHS recently confirmed was censored by an HHS employee from the taxpayer-supported Linkedin site, Health IT and Electronic Health Records. If that is not against federal law, it damn sure should be.

http://www.linkedin.com/groups/IT-in-Healthcare-Why-Building-3993178.S.216432610?qid=bafac2e5-fb9c-4a39-8348-5a3074abff67&trk=groups_items_see_more-0-b-ttl

Among the items that HHS requires providers include in Notices of Privacy Practice is a one-sentence statement addressing data breaches:

…“We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information [unless it is encrypted]”…

http://www.hhs.gov/ocr/privacy/hipaa/npp_booklet_hc_provider.pdf

Now that it is widely known that encryption is no longer acceptably secure, protection from accountability is encryption vendors’ only remaining selling point. HIPAA stipulates that if breached patient information is encrypted according to standards set forth by the National Institute of Standards and Technology (NIST), doctors are freed from the tremendous cost of notifying (former) patients – even though patients’ privacy and security have been nevertheless compromised.

For example, two weeks ago, the NIST abandoned the very encryption standards that HIPAA demands. Oops! (See: “Government Standards Agency ‘Strongly’ Suggests Dropping its Own Encryption Standard,” by Jeff Larson and Justin Elliott, ProPublica, September 13, 2013).

http://www.propublica.org/article/standards-agency-strongly-suggests-dropping-its-own-encryption-standard

###

NSA Secrets

US spy agency NSA’s secret success at decrypting previously impenetrable codes – which was revealed by former NSA contractor Edward Snowden – proves that today’s best encryption is tomorrow’s crossword puzzle. What’s more, once an individual’s medical identity is lost in the cloud, it can never be reeled back in.

And, when DNA records are included, a breach today could put the welfare of generations of Americans at risk.

A Gut-Check

The ultimate gut-check: If your encrypted identity were fumbled, wouldn’t you want to be notified? Of course you would.

Assessment

In my opinion, the HIPAA Rule should be immediately amended to demand notification of all individuals involved in all data breaches unless they allow opt out. Who knows? Some might prefer not to be bothered.

What is your opinion; doctor, patient and/or consultant?

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Information Technology, Op-Editorials, Pruitt's Platform, Risk Management | Tagged: D. Kellus Pruitt DDS, DHHS, HIPAA, Jeff Larson, Joseph Conn, National Institute of Standards and Technology, notice of privacy practices, NSA, US Department of Health and Human Services | 3 Comments »

How I Lost my Battle Against the NPI

Posted on January 24, 2013 by Dr. David Edward Marcinko MBA MEd CMP™

Refusing a National Provider Identifier Number

By Darrell K. Pruitt DDS

I can no longer refuse to apply for a National Provider Identifier (NPI). I lost that long battle. Anyone rejoicing?

I’m spent. My leverage has vanished. Telling insurers “I have no NPI” held much more inherent power than “I have an NPI but I won’t share it with you on principle.” Far too many words. My profession has become dominated by unresponsive, unaccountable 3rd parties that dental leaders in the ADA welcome as policy. Working together, they promote and commandeer the technology dentists purchase and clueless patients pay for in increased fees. I have painfully learned that principles are only for dentists who can still afford them, and it’s a bad economy for luxuries.

Non-HIPAA Entity

Since I am not a HIPAA-covered entity and therefore not required by law to adopt an NPI, my capitulation to extortion disappoints me as an American citizen. I still find it hard to believe that an anti-consumer HIPAA rule enthusiastically enforced by the dental benefits industry could force me to “volunteer” for a PERMANENT identifier. As I and 96% of dentists become jerked around by our NPIs, I hope dental historians note that I am the ONLY dentist who publicly asked “Why?” instead of “Why not?” After 6 years, I’m still awaiting an answer to that question from leaders who continue to promote the NPI to dentists while ignoring their questions.

Dental Benefits Providers

I was able to hold out up until Aetna, Delta Dental and other dental benefits providers deprived my office of access to details of patients’ dental benefits unless I have an NPI. I’m waiting for someone – anyone – to tell me how the identifier can possibly improve the dental care of those who pay Aetna and Delta Dental premiums, especially if their benefits are intentionally kept secret from their dentists. I am certain that if the nation’s employers who purchase dental benefits were aware of the transparent nonsense, they would never purchase such products. Where’s the US Chamber of Commerce? Where’s the FTC? How about the US Constitution?

This is exactly why there needs to be more openness in our profession, Doc. The cockroaches who were invited to quietly overrun dentistry cannot withstand transparency, yet I don’t know how much longer I can fight for it without further risking the health of my practice.

As anyone can understand – and as anticipated by corporate executives in the insurance industry as well as by those with vested interests in the ADA Department of Dental Informatics – to have to explain to new patients why I cannot estimate how much they will owe for treatment would destroy my practice. Outside the US, other societies deem it unethical to deny patients informed consent to treatment for any reason. The NPI is such an egregious blunder that I never expect those who promoted to accept ownership.

###

Assessment

If I lost the battle, who won? Do EDR enthusiasts in the ADA call this a glorious victory and a likely source of ADA pride for decades to come? Or is it much more shameful? Since I lost freedom, I want to know who won?

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Our Other Print Books and Related Information Sources:

Health Dictionary Series: http://www.springerpub.com/Search/marcinko

Practice Management: http://www.springerpub.com/product/9780826105752

Physician Financial Planning: http://www.jbpub.com/catalog/0763745790

Medical Risk Management: http://www.jbpub.com/catalog/9780763733421

Hospitals: http://www.crcpress.com/product/isbn/9781439879900

Physician Advisors: www.CertifiedMedicalPlanner.org

Filed under: "Doctors Only", Information Technology, Practice Management, Pruitt's Platform | Tagged: ADA, Aetna, Battle against the NPI, Darrell K. Pruitt DDS, delta dental, eDR, EHRs, electronic dental records, electronic health records, electronic medical records, FTC, HIPAA, National Provider Identifier Number | 1 Comment »

Protecting Patient Privacy

Posted on January 6, 2013 by Dr. David Edward Marcinko MBA MEd CMP™

How Important Is It – Really?

By Dr. David Edward Marcinko MBA

By Matthew Pelletier [safety consultant]

The U.S. Health Insurance Portability and Accountability Act (HIPAA) is the federal law protecting the privacy and security of patients’ health information and was enacted in 1996.

HIPAA laws also protect electronically communicated information. Understanding the significance and importance of HIPAA laws is vital to all medical and health organizations. Companies are required to follow HIPAA laws and protect patient privacy.

Share and Share Alike – NOT!

The privacy rule is an important aspect of HIPAA and makes it illegal for patient’s private health information to be shared by health professionals unless the patient consents. This encompasses patient information which is written, verbal or electronically communicated. Many health care and medical organizations use healthcare training videos in order to educate their workforce on the importance of patient privacy laws.

###

Review

As the infographic above illustrates, patient privacy is very important and the cost in breach of privacy can be costly:

• With 60% of hospitals having a minimum of 2 breaches in privacy the cost per hospital is estimated at $2 billion dollars.
• The average number of records which are lost or stolen in each violation of privacy is 1,769.
• The main causes of electronic patient information breaches is due to employees, portable electronic devices and third-party errors.
• 7 out of 10 hospitals don’t view patient privacy as a priority though it costs them money if breached.

With 38% of hospitals choosing not to inform anyone of patient privacy breaches while over 40% of breaches are only reported by the patients themselves, HIPAA violations can result in being very costly to medical and healthcare organizations, not just hospitals. HIPAA training videos are a solution to help the workforce understand the importance of patient privacy laws.

Assessment

Conclusion

Your thoughts and comments on this ME-P are appreciated. And, are these issues a moral equivalency? Does privacy even exist anymore in an era of social media, the Internet, Google Earth and Google Maps, etc.

Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Portfolio Management, Risk Management | Tagged: David E. Marcinko, HIPAA, Matthew Pelletier, Protecting Patient Privacy | 5 Comments »

The Horrific Waste & Dangers of Paper Medical Records?

Posted on November 9, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

Will that be Paper or Electrons?

[By Staff Reporters]

Paper medical records continue to be a serious waste and posses potential HIPAA violations as paper charts are vulnerable to being lost, stolen, or destroyed.

According to some reports, managing paper charts, from transcriptions to labor needed to pull and re-file charts, costs medical practices $116,375 a year on average.

Taking a Look

The waste & dangers of paper medical records infographic shown below created by IBX Vault takes deep look into the administrative, physical, and technical safeguards required by covered entities and business associates per the HIPAA privacy rule to secure patient data. The visualization also compares the potential security risks of paper medical records vs. EMRs stating that only 7 out of 479 breaches were related to EMRs.

Privacy and Treatments

While it is important to note that the adoption of EMRs present some security risks of its own as many critics have cited potential privacy concerns that may lead to expensive medical treatments.

Assessment

Additionally, it is imperative to note the tremendous financial harm that implementing an EMR does to a hospital’s bottom-line.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Information Technology | Tagged: EHRs, eMTs, HIPAA, paper medical records | 5 Comments »

Our Healthcare Referral System is Broken

Posted on October 22, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

About the Management Process

[By Staff Reporters]

Our healthcare referral system is broken, according to Referral MD. The firm reviews some of the key factors that contribute to this system.

The Paper Trail

The following infographic highlights a key pain point in the healthcare referral system management process that despite healthcare providers adopting an EMR system, they are still utilizing paper.

A large percentage of processes in healthcare involve documents and forms that must be scanned and stored outside their existing EMR system such as records from referring physicians, patient consent forms, patient instructions, insurance authorization, etc.

Assessment

With so much paper still floating around, opportunities for HIPAA violations increase with as high as 86% of mistakes made in the healthcare industry stem from administrative activities.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: iMBA, Practice Management | Tagged: eHR, Healthcare Referral System, HIPAA, Referral MD | Leave a comment »

EHRs – Still Not Ready For Prime Time

Posted on April 24, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

At Least … Not Yet!

By David K. Luke MIM, Certified Medical Planner™ candidate

www.CertifiedMedicalPlanner.org

Since Feb 17, 2009 when President Obama signed into legislation the Health Information Technology for Economic and Clinical Health Act (HITECH) as a part of the 2009 stimulus package, the incentives were promised for the adoption in health care practices of Electronic Health Records (EHRs).

The Carrot and the Stick

The incentives payments for “meaningful use” range from $63,750 over 6 years by Medicaid to maximum payments of $44,000 over 5 years for Medicare. The penalty for not adopting by Medicare will be 1% of Medicare payments in 2015, increasing to 3% over 3 years. Stimulus money is granted based on meaningful use of an EHR system.

The Reality

Stories are rolling in by early adopters now that give cause for a prudent physician to rethink implementation anytime soon of an EHR for his/her practice. Here is a sampling:

EHRs can be hacked and doctors will be held accountable. A total of 385 breaches of protected health information affecting over 19 million records have been reported since August 2009 (Redspin Breach Report 2011). Redspin also reports that industry estimates have put the value of a stolen health record on the black market at about $50 per record. For me, this is the biggest red flag for implementing an EHR now. Vendors are offering solutions in the form of data “masking”, but this could increase the cost of the systems.
EHRs have stringent audit requirements under the HITECH Act. Health care organizations are expected to monitor for breaches of PHI. Audit logs must be kept. Audit strategy, process, and implementation tools must be used to meet stage 1 meaningful use criteria. Sanctions to employees for not following protocol. Healthcare facilities leave themselves vulnerable to individual and class action lawsuits when they do not have a strong enforcement and audit program in place for their EHR.
EHRs are expensive to implement, both in terms of money and in terms of time. Dollar costs range from free (Practicefusion) to $50,000+ for such EHR vendors as Allscripts or eClinicalWorks + ongoing maintenance costs. But don’t’ forget the time investment. Even small EHR systems can take 2 years to implement. I have just witnessed a client’s large pediatric practice literally crippled with the initial time investment required for staff and physicians to learn the system. Half staffing the front desk and other areas so employees can go to training has caused a drain on both patient and employee morale.
Legal concerns are still unanswered regarding EHRs. Currently the debate is still on about who owns the electronic data. The EHR vendor will tell you that you do. HIPPA gives the patient the right to see their record or chart, and the right to have a physical copy of their record based on a reasonably cost for copying and postage. Typically doctors share medical records with other health care providers as a professional courtesy. Empowered patients think they own their records. According to a reference regarding an HIMSS white paper, a patient owns the data in a Continuity of Care Document and has the ability to input and access that information.
Obtaining meaningful use stimulus payments is not a given. I met with a physician owner client a few months ago in Arizona that has implemented an EHR for their pediatric practice and was hoping to receive the stimulus payment for stage one by completing the 20 criteria needed. After plowing through the 31-page “Arizona Medicaid EHR Incentive Program” guide provided by The Arizona Health Care Cost Containment System Administration or AHCCCS, which is the Arizona arm of Medicaid he turned in his application, which was denied. His initial reaction was that the program did not have the funding in Arizona, but that seems not to be the case as a number of large payments have been made now in the state. Banner Healthcare, which operates the largest hospital system in the state with thirteen inpatient facilities, reported a total of $12.4 million in Medicaid booty for implementation of its NextGen Healthcare EMR systems in 2011. It appears that there is a learning curve involved here and the smaller practices will catch up while the hospitals currently seem to have better systems in place to capture the stimulus money. An entire MU industry has emerged to help physicians such as my client perfect their stimulus applications.

Risk vs. Reward

In the investment world I am always comparing risk vs. return when managing my client’s portfolios. At times in the marketplace, for various reasons, it just does not make economic sense to make certain investments as the possible risks far outweigh the potential return. An easy example now is the investment in “safe” longer-term treasury bonds. With a near 40-year low in interest rates, the 30-year treasury today yields 3.18 %. Yet if interest rates rise 1% in the marketplace, that 30-year treasury can drop 12%. A 2% rise can result in a fall of 22% in value. It would take 7 years accumulating 3.18% to offset the loss in value caused by a 2% rise in rates. I do not think rates are going up 2% tomorrow, but I just do not like the risk/reward spectrum here. Likewise, the biggest concern currently I have with EHRs is data breeches, as mentioned above, and the stiff penalties involved currently. Paper systems look a whole lot cheaper and safer when considering the ease at which a data breech can occur with electronic data. Fines, criminal sentencing, and disciplinary action by licensing boards are risks not worth taking considering current history on data breeches. Losing your license or your business or personal freedom because of an employee’s careless actions is not worth it. Lest you think I exaggerate, consider the following examples from the past few years enforced by the Office for Civil Rights (OCR), the enforcement side of the US Department of Health and Human Services that enforces HIPAA, and by employers and licensing boards:

Incident: A terminated researcher at UCLA School of Medicine retaliated by accessing UCLA patient records (many celebrities) 323 total times over the next four weeks.

Penalty: 4 years in prison for the terminated researcher for violating HIPAA Privacy Rules

Incident: Thirteen staff members at UCLA hospital accessed Britney Spears’ medical records without authorization.

Penalty: UCLA fired the 13 individuals, suspended another six.

Incident: A doctor and two hospital employees accessed the medical records of a slain Arkansas TV reporter. Details were leaked to the press of her attack.

Penalty: All pled guilty to misdemeanors for violating HIPAA privacy rules and were sentenced to one-year probation. The three all were curious about the case and “peeked” at the patient’s record as employees of the hospital, even though she was not their patient. The doctor’s privileges were suspended by the hospital for two weeks; he was fined $5,000 and ordered to perform 50 hours of community service by speaking to medical workers about the importance of patient privacy. The two other employees were terminated.

Incident: Cignet denied 41 patients, on separate occasions, access to their medical records when requested.

Penalty: Initial violation was $1.3 million. OCR concluded that Cignet committed willful neglect to comply with the Privacy Rule and fined an additional $3 million.

Incident: 57 unencrypted computer hard discs containing PHI of more than one million people was stolen from a storage locker leased by Blue Cross Blue Shield of Tennessee (BCBST).

Penalty: OCR fined BCBST $1.5 million in settlement. The fact that BCBST secured the information in a leased data closet that was secured by biometric and keycard scan in a building with additional security was not enough. BCBST also spent $17 million in investigation, notification and protection efforts and had increased future compliance costs.

Incident: Health Net discovered that nine portable hard drives that contained PHI and personal financial information of approximately 1.5 million people were missing. The hard drives in question went missing from an IBM-operated datacenter in Rancho Cordova, California.

Penalty: The complaint alleged violations of HIPAA. Connecticut Insurance Commissioner wins a $375,000 fine for failing to protect member information and not reporting in a timely manner just months after the Connecticut AG won a $250,000 settlement for the breach. Vermont’s AG jumps in and gets a settlement of $55,000 to the State because 525 Vermonters were on the lost drive.

Incident: WellPoint / Anthem Blue Cross became aware that its customers’ health applications and information website, which contained up to 470,000 applicant’s information, was potentially publicly accessible when an applicant alerted the company that altered URLS after an upgraded authentication code could allow access to other people’s information.

Penalty: WellPoint / Anthem agreed to the terms of a class action lawsuit filed in California that will provide $1.5 million in general settlement, with an additional donation of $250,000 to two non-profit organizations aimed at protecting consumer’s rights, $150,000 donated to Consumer Action and $100,000 donated to the Public Law Center in Orange County. WellPoint / Anthem also agree to pay $100,000 to the state of Indiana for the data breach that exposed 32,000 state residents. A 2009 Indiana law requires companies to notify the state of certain data breaches within a certain period that was not met.

An Investment?

I bring up these examples to make a point. The EHR vendor will talk about your EHR being an “investment”. You cannot have an ROI if you lose money. Notice that most cases were due to careless, innocent lapses of judgment. Also in many cases actual damages either did not occur or were hard to prove. The new HITECH act extends HIPAA to allow the states’ attorney general to also bring actions, which adds more salt to the wound. Some of these cases do not appear to be done yet either as far as the lawyers are concerned. Also, notice that even when the health care provider regarding storing the data exercised extreme care (BCBST with biometric, keyscan leased lockers and Health Net employing IBM’s “secure” datacenter), the health provider was sued and fined. Smaller medical practices I believe are even more susceptible to EHR data breaches, where bad password management practices and website maintenance problems are more common and often protocols and training are not firmly in place.

Assessment

The widespread use and integrated implementation of EHRs are going to happen, no doubt. Your practice will eventually have one. 2015 is still a few years off before the first 1% Medicare penalties hit. Tell the EHR vendor to call back in 2014 once the kinks are worked out. Waiting two more years may not prevent a costly incident due to the vengeful fired employee or due to a careless slip in protocol. Those landmines will always be there.

But, two more years will allow the EHR stakeholders more time to improve their product, namely the security and encryption of the data in case of a breach, and two more years will allow the OCR and the state AG’s to fill up on the low hanging fruit and make their point.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: CMP Program, Information Technology | Tagged: CMP, Continuity of Care Document, david luke, EHRs, EHRs - Not Yet Ready For Prime Time, EMRs, HIPAA, HITECH Act, medical records, OCR, www.CertifiedfMedicalPlanner.org | 21 Comments »

Enter the HIPAA Fear Mongers

Posted on April 16, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

Fear of HIPAA Sells

[By Darrelkl K. Pruitt DDS]

“The HHS Office for Civil Rights (OCR) can show up at your door and ask to perform an audit on short notice, and your organization will need to be ready, or face fines of up to $50,000 per day for each regulatory provision violated.”

– Gene Kraemer [Customer Relationship Director at The Coding Institute]

http://www.audioeducator.com/hipaa-audits-and-enforcement-042412.html?utm_medium=email&utm_source=E99NAGAJ&utm_campaign=E99NAGAJ

The most successful of opportunistic HIPAA consultants are the scariest

As a dentist for almost 30 years, I’ve noticed that along with even rumors of mandate enforcement, ambitious compliance consultants’ fear-inspiring ads start interrupting happier thoughts. It happened with OSHA’s push into dentistry 20 years ago and we clearly see the aggressive sales pitches with HIPAA as well.

The scariest part of Gene Kraemer’s description of HIPAA’s tedious requirements and bankruptcy-level liabilities is that he is simply telling the truth. So if you are a HIPAA covered dentist, be scared.

On the other hand, if you don’t store or send your patients’ digital PHI – choosing instead to use the US Mail – you are increasingly fortunate in the dentistry market. For one thing, our patients are fed up with identity thefts, and paper dental records are the gold standard in security. In addition, nothing is holding down your competitors’ costs for HIPAA compliance and it is increasing much faster than the cost of postage.

De-identify now or lose computerization, Doc. If your patients’ PHI is not present it simply cannot be hacked by an identity thief. Guaranteed more secure than Cloud. Arguably more secure than even paper dental records.

Or … You can hire The Coding Institute.

You can bet Gene Kraemer isn’t someone who would hold down the cost of compliance.

From: Gene_Kraemer@mail.vresp.com

Subject: HIPAA Audits & Enforcement: New Penalties & Push for Compliance – Final Notice!

Good Morning,

The US Department of Health and Human Services (HHS) is currently implementing audits to meet requirements in the HITECH Act in the American Recovery and Reinvestment Act of 2009 (ARRA) for performing periodic audits of compliance with the HIPAA Privacy and Security Rules, and up to 150 random HIPAA compliance audits will be performed by the end of 2012. While in the past, audits had been performed only at entities that had had a complaint filed against them, the new rule calls for audits whether or not there is a complaint. This means, the HHS Office for Civil Rights (OCR) can show up at your door and ask to perform an audit on short notice, and your organization will need to be ready, or face fines of up to $50,000 per day for each regulatory provision violated.

Join us for this live audio conference on Tuesday, April 24, 2012 at 1 pm ET | 12 pm CT | 11 am MT | 10 am PT. This conference is being presented by Jim Sheldon-Dean, the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to health care firms and businesses throughout the Northeast and nationally. He serves on the HIMSS Information Systems Security Workgroup, the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and co-chairs the WEDI HIPAA Updates sub-workgroup. Sheldon-Dean is a participating member of the advisory board of Vermont Information Technology Leaders (VITL), and has participated in VITL’s Vermont Health Information Technology Plan working group, VITL’s Physician EMR adoption project, and the Security Workgroup of the New Hampshire/Vermont Strategic HIPAA Implementation Plan (NHVSHIP).

Highlights of the session :

• Fines and penalties for violations of the HIPAA regulations have been significantly increased and now include mandatory fines for willful negligence that begin at $10,000 minimum.

• HIPAA Audits have been few and far between in the past, but that’s now changing – the HHS will be auditing HIPAA covered entities and business associates even if there have been no complaints or problems reported.

• What HHS OCR is likely to ask you if you are selected for an audit, and what you’ll have to have prepared already when they do.

• The rules are that you need to comply with will be explained. Learn about the policies you can adopt that can help you come into compliance and be prepared for an audit.

• How the HIPAA rules have changed and how you may need to change. How you work to keep up with them.

• How having a good compliance process can help you stay compliant and respond to audits more easily.

• The documentation needed to survive an audit and avoid fines will be described.

• A discussion on what you’ll need to think about to deal with current and future threats to the security of patient information.

If interested, please click the following link to register and get your early bird discount : –

http://www.audioeducator.com/hipaa-audits-and-enforcement-042412.html?utm_medium=email&utm_source=E99NAGAJ&utm_campaign=E99NAGAJ

Please apply discount code “GENE20” at checkout to get your $20 discount on early registration.

Looking forward to having you onboard here.

Thanks,

Gene Kraemer

Customer Relationship Director

The Coding Institute LLC

2222 Sedwick Drive,

Durham, NC 27713

************************************************************************************8*************************

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Health Law & Policy, Information Technology, Op-Editorials, Practice Management, Pruitt's Platform, Quality Initiatives | Tagged: eDRs, EHRs, Enter the HIPAA Fear Mongers, Gene Kraemer, HHS, HIPAA, OCR, PHI, The Coding Institute LLC | 16 Comments »

Challenging the NPI Requirement of Blue Cross Blue Shield of Texas Again

Posted on March 4, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

How Far Can They be Pushed?

By D. Kellus Pruitt DDS

Command-and-control organizations like BCBSTX find Facebook difficult to control. Even a small nidus of a complaint posted by a client named Mark about poor service can attract a huge bolus of payback by a dentist, and nobody respects anonymous gatekeepers for huge, unresponsive companies like BCBSTX anyway:

https://www.facebook.com/bluecrossblueshieldoftexas

Mark, as a dentist, I’m very familiar with BCBSTX’s inconsiderate behavior in our communities. At least the anonymous moderator invited your feedback. When I sincerely asked her on Wednesday what federal employees are told about BCBSTX’s NPI requirement, she acted as if the absurd policy hadn’t already wasted enough of my time that day when she provided me an irrelevant link to nowhere – just to get rid of me.

Secret Requirement?

I would actually love to treat federal employees who have BCBSTX insurance because they are some of the nicest people I’ve met. But, BCBSTX’s secret requirement that their clients see only dentists with arbitrary NPI identification numbers (not required by law) makes their employment benefit purchased with taxpayer money worthless if they receive treatment in my office. My office has been told that it has become impossible for paper claims to enter BCBSTX’s modern, computerized system without NPI numbers, and nothing humanly possible can be done to correct the unfortunate problem for dentists who choose not to be HIPAA covered entities.

Evasion?

The moderator’s evasion confirms that even though BCBSTX’s federal customers are led to believe that they can use their dental benefits to help pay for treatment at any licensed dentist’s office, they are not being informed of the NPI requirement, and if they pay the dental bill in full for work done by a dentist without an NPI number, BCBXTX pockets the reimbursement. It just cannot be helped. That’s technology. Tough-luck!

BCBSTX executives naturally prefer that my office manager tell their clients about the obscure restrictions of the dental plans they sell. She catches most federal employees before blocking out time in our schedule to treat them, but nevertheless, one got through on Wednesday morning. It wasted my time as well as the federal employee’s.

Congressional Action?

It’s troublesome to know that the government callously encourages such waste of small business owner’s time and money, not to mention the inconvenience to patients. I’m simply fed up with open appointments for uninformed BCBSTX clients. What’s it take to force BCBSTX to take some responsibility in the community and warn their customers about the limitations of their dental policy before they call my office? Congressional action?

Assessment

I do hope the anonymous BCBSTX employee doesn’t choose to delete this post. Since it seems obvious that their windfall profit is a powerful disincentive for BCBSTX to warn their clients about the NPI restriction any time soon, the more federal employees I can ethically warn through BCBSTX Facebook, the fewer open appointments I’ll have, and less taxpayer money will be wasted on silliness.

cc: Senator John Cornyn

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Ethics, Health Insurance, Information Technology, Practice Management, Pruitt's Platform | Tagged: Blue Cross, Blue Shield, Challenging Blue Cross Blue Shield of Texas Again, D. Kellus Pruitt DDS, Facebook, HIPAA, NPI Number, NPI requirement, Senator John Cornyn | 8 Comments »

Don’t Co-operate with eDR Vendors, Doc!

Posted on February 5, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

My Opinion of eDRs and eDR Vendors

By D. Kellus Pruitt DDS

Don’t cooperate with those you don’t trust, Doc.

eDR Stakeholders

If you allow Dentrix, the W. K. Kellogg Foundation, the ADA and other ambitious EDR stakeholders talk you into switching from paper dental records to digital before 2014, it will be the most regrettable business decision you have ever made.

PHI Breaches

Regardless if a data breach of your patients’ Protected Health Information (PHI) is your fault or not, it can easily cause bankruptcy, and the odds aren’t in your favor. According to a recent Redspin study, the number of breaches doubled between 2010 and 2011. (See “Health data breaches up 97% in 2011” by Diana Manos in Healthcare IT News, February 1, 2012).

http://www.healthcareitnews.com/news/health-data-breaches-97-percent-2011

Procrastination and Late Adopters

So even if unlike Americans who enjoy freedom, professionalism keeps you from publicly expressing an opinion, there’s never been a better time to drag your feet in our usual way. Besides, what have you got to lose by waiting? If consumers prefer EDRs, don’t you think we would see dentists touting their safety in their ads?

RedSpin

Daniel W. Berger, President and CEO of Redspin, is quoted in Diana Manos’ article: “Information security breach is the Achilles’ heel of PHI. Without further protective measures, data breaches will continue to increase and could derail the implementation, adoption and usage of electronic health records.” So why allow selfish EDR stakeholders who cannot be held accountable for harming your patients rush you into buying their favorite technology?

Note that the ineffective “further protective measures” will make EDRs even more expensive compared to paper dental records – allowing paper dentists to charge less than paperless practices, while still making more profit. Indeed, Doc. What have you got to lose by waiting?

Over the last 6 years, virtually all of my predictions about HIPAA have been right, and following the recent Redspin report, I feel even stronger about this one: The national failure of HIPAA will become noticeable in dentistry first.

OCR Culture

Not only is the Rule ineffective at protecting dental patients’ identities, but the tedious, mostly worthless compliancy requirements are so unreasonably time consuming and costly that no dentist can ever be 100% compliant. What’s more, eager HIPAA auditors working on commission to enforce the Office of Civil Rights’ “culture of compliance,” can find a dentist “willfully negligent.” Is that not subjective? The fines for such an auditor’s opinion are obscene. If you unfortunately experience a data breach, you don’t want to lose even more sleep over an audit that you cannot win, do you? Dentists don’t have to take this.

Dentistry Is Billing Simple

Unlike the complex administrative tasks in physicians’ offices, the business of dentistry is simple: Billing involves ten times fewer patients and CDT codes cover fees for procedures only involving the lower third of patients’ faces. Ledger cards, pegboards and lots of carbon paper have functioned adequately and safely for busy dental practices for decades. Besides, computers still haven’t shortened the time it takes to do a technique-sensitive filling in a squirmy kid’s mouth. If the front desk is the bottleneck rather than the speed of the dentist’s hands, someone needs to brush up on their alphabet skills.

If you think you might miss your computer, now is a perfect time to encourage dentistry’s leaders to consider de-identifying EDRs… Or if like me, you aren’t a HIPAA covered entity, we could wait a little longer if you’d like. Within a year, Americans will be noticeably seeking dentists who don’t put their PHI on computers.

Assessment

The hope for miracle discoveries derived from safely data-mining interoperable dental data doesn’t have to end like this, but I certainly don’t mind the windfall profits that expensive HIPAA regulations and patients’ fear of identity theft will bring to my practice.

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

Filed under: Information Technology, Pruitt's Platform | Tagged: ADA, D. Kellus Pruitt DDS, Dentrix, Diana Manos, Doc!, Don't cooperate with eDR Vendors, health data breaches, HIPAA, PHI, protected health information, Redspin, W. K. Kellogg Foundation | 25 Comments »

Clarifying Some NPI Number Mis-Understandings

Posted on January 29, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

The NPI Number: What is is – How it works?

By Carol S. Miller RN, MBA

The National Provider Identifier (NPI) is a HIPAA Administrative Simplification Standard that provides a unique identification for covered health care providers, all health plans and health care clearinghouses. The NPI must be used in administrative and financial transactions adopted under HIPAA and with one identifying number will simplify security and allow greater protection or encryption of the provider number. The NPI can be used to identify the health care provider on prescriptions, COB between health care plans, inpatient medical record systems, program integrity files, and other areas.

Dependent on his/her medical practice, the provider can obtain an individual or group NPI; however, there are situations where an individual NPI number is required such as with the submission of pharmacy and lab claims. The NPI remains with the provider regardless of job or location change. NPI will eventually be the standard identifier for all e-prescribing under Medicare Part D.

A Ten Digit Number

The NPI is a ten digit, intelligence-free numeric identifier with a check digit in the last position to help detect keying errors. If there is a security breach, the number in itself cannot identify the protected health organization. The use of one identifier with a check digit simplifies encryption of this number when transmitted electronically and thereby enhances security.

On HIPPA

HIPAA also requires that employers have standard national numbers that identify them on standard transactions. The Employer Identification Number (EIN), issued by the Internal Revenue Service (IRS) was selected as the identifier for employers. This number is used as a Federal tax identification number for the means of identifying any business entity and for the purpose of reporting employment taxes. The EIN number should be protected as a social security number is.

ITL and NIST

Both the Information Technology Laboratory (ITL) and the National Institute of Standards and Technology (NIST) are involved in the development of technical, physical, administrative, and management standards and guidelines for cost-effective security and privacy of sensitive unclassified information in federal computer systems. These standards and guidelines can be applied to the management of medical IT.

Assessment

Additional reference material for NPI can be found at: www.cms.gov/nationalprovidentstand.

Conclusion

And so, your thoughts and comments on this ME-P are appreciated. Please review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Our Other Print Books and Related Information Sources:

Health Dictionary Series: http://www.springerpub.com/Search/marcinko

Practice Management: http://www.springerpub.com/product/9780826105752

Physician Financial Planning: http://www.jbpub.com/catalog/0763745790

Medical Risk Management: http://www.jbpub.com/catalog/9780763733421

Healthcare Organizations: www.HealthcareFinancials.com

Physician Advisors: www.CertifiedMedicalPlanner.com

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Sponsors Welcomed: And, credible sponsors and like-minded advertisers are always welcomed.

Link: https://healthcarefinancials.wordpress.com/2007/11/11/advertise

PRE-ORDER HERE

http://www.crcpress.com/product/isbn/9781439879900

Filed under: Information Technology, Practice Management, Recommended Books | Tagged: carol s. miller, EIN, HIPAA, Hospitals and Healthcare Organizations, Information Technology Laboratory, ITL, Medicare Part D, National Institute of Standards and Technology, National Provider Identifier Number, NIST, NPI | 3 Comments »

On e-Claim Only Dental Plans

Posted on January 18, 2012 by Dr. David Edward Marcinko MBA MEd CMP™

About their Hidden Costs – I’m Talking PHI Breaches

By D. Kellus Pruitt DDS

If the rumor is true about Bluebell Ice Cream’s “e-claim-only” dental benefit plan that is to go into effect in March, how many in the east-central Texas town of Brenham (pop. 16,000) will be properly warned about the danger to themselves, their families and Bluebell officials’ reputations because of reckless policy?

Transmissions Risks

Each time their dentists send an electronic dental claim (e-claim) over the internet to insurance employees in Chicago as a favor to a patient – and especially the insurer – the Bluebell employee’s digital medical identity which is worth fifty bucks on the black market, rides along to destinations unknown. It’s my guess that very few Bluebell employees are yet aware of the increasing risk of medical identity theft from dentists’ e-claims – much less given the opportunity to opt out of the risk by simply visiting a dentist who still uses the telephone, fax and US Mail.

Security Risks Growing

It certainly won’t improve my popularity with 9 out of 10 dentists for saying this, but risks of identity theft from HIPAA-covered dental offices are climbing daily. In the introduction to a recent interview with Larry Ponemon, chairman and founder of the Ponemon Institute, GovernmentIT.com editor Tom Sullivan ominously described the ever-increasing risk of a massive “data spill” of perhaps millions of patients’ protected health information (PHI):

“The street value of health information is 50 times greater than that of other data types. Even worse, the healthcare industry is among the weakest at protecting such information. With organized criminals trying to steal medical IDs, sloppy mistakes becoming more commonplace, mobile devices serving as single sign-on gateways to records and even bioterrorism now a factor, healthcare is ripe for some a wake-up call – one that just might come in the form a damaging ‘data spill.’” (See: “Q&A: How a health ‘data spill’ could be more damaging than what BP did to the Gulf.”

Tom Sullivan – Editor [December 05, 2011]

http://govhealthit.com/news/qa-how-health-data-spill-could-be-worse-what-bp-did-gulf?page=0,0

According to Dr. Ponemon:

“The basic issue, when you think about data theft not data loss – because it’s hard to know whether that lost data ultimately ends up in the hands of the cybercriminal and all of these bad things occur – but in the case of identity theft, the end goal has been historically to steal a person’s identity, and just like getting a financial record, getting a health record probably has your credit card, debit card, and payment information contained in that record.”

Of Credit Cards … and More!

But that’s not all. Credit cards are just chump change. He continues:

“The financial records are actually lucrative for the bad guy, but the health record is actually much, much more valuable item because it not only gives you the financial information but it also contains the health credential, and it’s very hard to detect a medical identity theft. What we’ve found in our studies is that medical identity theft is likely to be on the rise and, of course, there’s an awareness within the healthcare organizations that participate in our study that they’re starting to see this as more of a medical identity theft crime. It’s not just about stealing credit cards and buying goodies, it’s about stealing who you are, possibly getting medical treatment and, therefore, messing up your medical record.”

Dr. Ponemon suggests that the victim may not know about the theft until he or she “stumbles on something that alerts them their medical identity was stolen.” Perhaps something like death following anaphylactic shock from a medication that was once digitally highlighted as “Allergic to.” Understandably, Ponemon adds that respondents recognized altered medical histories as an emerging threat they believed was affecting the patients in their organizations. Such danger for dental patients is almost non-existent if their dentists simply don’t put PHI on office computers.

Should a data breach of Bluebell Ice Cream employees’ identities occur in Brenham or Chicago, which is more likely than not, the fact that electronic dental records do nothing to improve the quality of dental care won’t make Brenham citizens any happier with local Bluebell officials.

Conclusion

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Our Other Print Books and Related Information Sources:

Health Dictionary Series: http://www.springerpub.com/Search/marcinko

Practice Management: http://www.springerpub.com/product/9780826105752

Physician Financial Planning: http://www.jbpub.com/catalog/0763745790

Medical Risk Management: http://www.jbpub.com/catalog/9780763733421

Healthcare Organizations: www.HealthcareFinancials.com

Physician Advisors: www.CertifiedMedicalPlanner.com

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Sponsors Welcomed: And, credible sponsors and like-minded advertisers are always welcomed.

Link: https://healthcarefinancials.wordpress.com/2007/11/11/advertise

Filed under: Health Insurance, Health Law & Policy, Information Technology, Practice Management, Pruitt's Platform | Tagged: D. Kellus Pruitt DDS, eDRs, EMRs, HIPAA, PHI, Ponemon Institute, protected health information | 1 Comment »

Medical Identity Theft on the Rise

Posted on December 30, 2011 by Dr. David Edward Marcinko MBA MEd CMP™

Open Up Dentists – and Physicians, Too!

[By D. Kellus Pruitt DDS]

If I tell you that your patients’ insurance identities can be sold for $50 each, how much will you trust your employees on Monday, Doc?

The Experts Speak

According to a panel of cyber-security experts at a recent Digital Health Conference, medical identity theft has become one of the most lucrative forms of identity theft. “DHC: EHR Data Target for Identity Thieves” by MedPage Today Associate Staff Writer Cole Petrochko, was posted last week

http://www.medpagetoday.com/PracticeManagement/InformationTechnology/30074

“Presentations at the Digital Health Conference here indicated that a single patient’s electronic health records can fetch $50 on the black market — a much fatter target than more familiar forms of identity theft, such as Social Security numbers ($3), credit card information ($1.50), date of birth ($3), or mother’s maiden name ($6).”

eMRs Not Like Credit-Cards

“And, unlike a credit card number, patients’ healthcare records cannot be cancelled or changed to prevent stolen data from being used by criminals”, said John DeLuca, of EMC Corp., an information technology company.

The Street Value of eDRs

What do you want to bet that medical identities downloaded from dentists’ computers bring $50; as well. I’d like to share a special, visceral sentiment with my shy, HIPAA covered colleagues:

I warned you, damn it! And, I assume, just like virtually all other silent dentists in the nation, you’ve done NOTHING to safeguard your patients’ identities. Even if you don’t like truth served bluntly, this dentist has your reputation in mind when I warn that if your practice experiences a reportable data breach of over 500 records, and your patients’ identities aren’t encrypted, those who choose to remain with your practice will never trust you as much as they do today – even if you properly report the breach. Of the estimated 20% who will never return, many will probably look for a gentle dentist who doesn’t store patients’ Protected Health Information (PHI) on computers …. Like me. (Yea, that was a sales pitch. As one might expect, I certainly welcome discussion of it with anyone).

ADA Laggards

After 5 years of awaiting responses from unaccountable leaders inside and outside the American Dental Association concerning HIPAA and EDRs, It feels really good to aggravate 9 out of 10 dentists still reading this – challenging those who normally take offense with professional stoicism to loosen up and share their feelings with everyone for once … God help me, I do love this so.

More About the Black Market

The black market price for EHRs has increased ten-fold in the last 5 years. In 2006, I warned in a guest column on WTN that it only takes one dishonest employee needing a couple of thousand quick dollars to potentially bankrupt a practice almost without risk of being caught. Back then, the black market price for a stolen medical identity was estimated at only $5 (See: “Careful with that electronic health record, Mr. Leavitt,” WTN News, October 18, 2006).

http://wtnnews.com/articles/3407/

It’s no secret that reticent ADA officials like President-elect Dr. Robert Faiella have suspiciously failed in their duty to be transparent with dues-paying members about the liabilities of the EHRs – even as they continue to recklessly promote paperless practices. The result: Almost all dentists in theUSstill maintain patients’ unencrypted medical identities on their office computers – often guarded by a flimsy password that is still cute a decade later. (Did I hear a gasp?).

Consider This!

Consider this, Doc! If a practice has 3000 active patients with identities worth $150,000, all one dishonest employee needs for dreams to come true is a flash drive and private time with your computer.

Assessment

Show me a dentist who thinks the benefits of EHRs to dental patients still outweigh the liabilities and I’ll show you a dangerously naive healthcare provider who probably doesn’t know about KPMG Auditors. Let’s face the facts bravely, Doc. Now would be a terrible time to invest in an EDR system – even cloud based. The proven, avoidable danger EDRs bring to American dental patients is unacceptable and only getting worse. Give it a year or so.

Channel Surfing the ME-P

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
FINANCE: Financial Planning for Physicians and Advisors
INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
Dictionary of Health Economics and Finance
Dictionary of Health Information Technology and Security
Dictionary of Health Insurance and Managed Care

Filed under: Information Technology, Pruitt's Platform, Risk Management | Tagged: ADA, Cole Petrochko, Darrell Pruitt DDS, Digital Health Conference, Dr. Robert Faiella, eDRs, EMRs, HIPAA, John DeLuca, Medical Identity Theft on the Rise, protected health information | 12 Comments »

The Texas Dental Association Board Must Face the Truth

Posted on December 23, 2011 by Dr. David Edward Marcinko MBA MEd CMP™

More on NPI Numbers

[By D. Kellus Pruitt DDS]

Dear Past TDA Board Members

I have some questions similar to the ones that got me suspended from the TDA a year ago: Who among you can defend your decision to persuade trusting TDA members to volunteer for National Provider Identifier (NPI) numbers?

And, why did you give up on the effort while BCBSTX continues to unfairly force dentists who aren’t even HIPAA covered entities to adopt the identifiers?

If you’re still unaware that everyone can see TDA leaders allowed themselves to be manipulated by stakeholders like BCBSTX, prepare yourself. It won’t be long before at least a few TDA members blame you personally for the bad things I warned would come to dentists with NPI numbers. Since the identifier does nothing to improve the quality of care, its promotion cannot be reconciled with the mission statement of the TDA, leaders. I hope angry dentists throughout the state seek the names of those of you who misled them.

A Non-Profit

BCBSTX is a non-profit whose handsome profits are paid by taxpayers. The healthcare parasite sells dental insurance to theUSgovernment for federal employees. In their letter to me that I’ve attached, you can see for yourself that along with BCBSTX’s stated refusal to process any of their clients’ dental claims that come from my office, it says in capital letters, “DO NOT FORWARD THIS NOTIFICATION TO THE MEMBER!” How proud does it make you feel to know BCBSTX defines your level of ethics, TDA Board? Two years ago, your Director of Membership censored from the TDA Facebook this dentist’s criticism of BCBSTX’s NPI demands. Sometimes, you bozos are idiots.

I have no contractual relationship with BCBSTX, so as soon as could, I defied BCBSTX’s order and sent their client the letter – making sure to point out that BCBSTX ordered me to keep it secret from her. As you might expect, she’s pissed at BCBSTX! I hope she looks into a class action lawsuit. I bet BCBSTX has been secretly extorting their customers’ dentists by the thousands … but then, do you even care, TDA? What did BCBSTX offer the TDA that caused you to betray dentists and patients who used to have faith in your honesty?

BCBSTX is a Tyrant, and the TDA is an Enabler

There’s more: As a favor to our patients, my office has traditionally called their insurers for coverage information so that those who purchased the dental benefits will know how much of the bill they are responsible for before we start treatment. It’s called transparency.

Today, my office manager informed me that according to alerts she has received from insurers, if I don’t “volunteer” for a National Provider Identifier (NPI) number by 2012, my office will be deprived of the right to product information about BCBSTX’s plans. How does that help anyone, TDA?

Assessment

Were you aware that this was the purpose of the NPI number when you pushed TDA members to sign up? Do you even care? Because of your silence inTexas’ dental community, it’s really hard to tell.

Conclusion

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

DICTIONARIES: http://www.springerpub.com/Search/marcinko
PHYSICIANS: www.MedicalBusinessAdvisors.com
PRACTICES: www.BusinessofMedicalPractice.com
HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
CLINICS: http://www.crcpress.com/product/isbn/9781439879900
ADVISORS: www.CertifiedMedicalPlanner.org
BLOG: www.MedicalExecutivePost.com
FINANCE:Financial Planning for Physicians and Advisors
INSURANCE:Risk Management and Insurance Strategies for Physicians and Advisors

Filed under: Health Law & Policy, Information Technology, Pruitt's Platform | Tagged: ADA, BCBSTX, D. Kellus Pruitt, HIPAA, National Provider Identifier, NPI, TDA | 6 Comments »

Newt Gingrich has his Way with the ADA

Posted on November 21, 2011 by Dr. David Edward Marcinko MBA MEd CMP™

Dentists should be furious with Gingrich for commandeering the ADA

By D. Kellus Pruitt DDS

On This Week roundtable discussion this morning [Sunday], George Will began his comments about Newt Gingrich, now a frontrunner, by saying that he “embodies everything disagreeable about modern Washington.”

Dentists should be furious with not only Gingrich, but with our inattentive dental leaders as well.

Why?

A couple of days ago, Steve Chapman posted “Gingrich’s corruption” on the ChicagoTribune.com.

http://www.chicagotribune.com/news/opinion/chapman/chi-gingrichs-corruption-20111118,0,4581968.story

Chapman writes:

“Conservatives may be able to forgive Newt Gingrich for being an adulterer and for his flip-flops on climate change and mandatory health insurance. They are willing to put those aside because they think he’s shown a fierce attachment to their cause. But, the latest revelations will be harder to digest, because they suggest that his allegiance is for sale.”

He punctuates the condemnation with a quote from USA Today:

http://www.usatoday.com/news/politics/story/2011-11-16/newt-gingrich-think-tank-opeds/51246512/1

“In a series of op-eds stretching over several years, Gingrich repeatedly advocated for various health-care related issues, including electronic health care records, ways to improve the health care sector, and medical malpractice reform without acknowledging the issues were directly connected to members of the Center for Health Transformation, a for-profit think tank he founded in 2003.”

Newt, for a Freddie Mac historian, you’re pretty sly!

According to information that Center for Health Transformation [CHT] spokeswoman Susan Meyers provided USA Today, healthcare stakeholders participating in Gingrich’s “think tank” can expect to pay Gingrich between $5,000 and $200,000, “depending on how many employees attend the center’s meetings and use other services.”

Wouldn’t you just love to ask Ms. Meyers if Gingrich’s think tank members are more likely to realize a return on their investment than their software offers dentists?

I suggested to the editor of the Chicago Tribune to specifically ask ADA President-elect Dr. Robert Faiella questions about the cost and safety of EHRs in dentistry. Then I followed the comment with,

“And, be sure to tell Dr. Faiella that D. Kellus Pruitt DDS referred you to him. Though we’ve never met, he knows who I am. If you get around to it, you might ask him how much HIPAA compliance raises the cost of dentistry. There are thousands of dentists who would find the President-elect’s answer to that question truly enlightening.”

I Do Find this Fun

Psst…! Chicago Tribune Editor; want a hot tip? I know of a local but far-reaching lead concerning the malignant, corporate corruption described by Steve Chapman in his article. A reporter wouldn’t have to travel far to aggravate employees of a secretive, command and control organization. The ADA National Headquarters is just down the street at 211 East Chicago Avenue. In 2004, the widely-overlooked, not-for-profit’s lack of transparency made it especially vulnerable to Gingrich’s deceptive selling points!

ADA Officials

I think everyone agrees that asking ADA officials reasonable questions about the cost and safety of any high-tech dental product they recommend – including electronic dental record systems – is not unreasonable.

In fact, now that Steve Chapman has shown Newt Gingrich’s profit motives for misleading our dental leaders, caution seems prudent.

This could be ornery-fun if, like me, someone on your staff gets a kick out of asking shy good ol’ boys questions they are hardly ready to answer. I wish the Tribune luck getting past anonymous, unaccountable gatekeepers who shield ADA officials from accountability. I suggest sending your questions to Dr. Robert Faiella. He is not only the unresponsive Chair of the ADA Electronic Health Record Workgroup, but he is the ADA’s latest insensitive President-elect.

Dentists should be furious with Newt Gingrich for commandeering the ADA

Psst…! Chicago Tribune Editor! You interested in another hot tip? I know of a local but potentially far-reaching lead concerning the malignant, corporate corruption described by Steve Chapman in his article exposing Newt Gingrich’s poor manners.

Should you choose to do so, you won’t have to travel far to aggravate employees of a stoic, command and control organization. The national headquarters for the American Dental Association is just down the street at 211 East Chicago Avenue. The widely-forgotten, not-for-profit’s traditional lack of transparency made it especially vulnerable to Gingrich’s deception back in 2004.

I think everyone agrees that asking ADA leaders reasonable questions about the cost and safety of any high-tech dental product they recommend – including electronic dental record systems – is not unreasonable.

In fact, now that Steve Chapman has shown us Newt Gingrich’s motives for misleading our dental leaders, caution seems prudent.

This could be ornery-fun if someone on your staff gets a kick out of asking shy good ol’ boys questions they are not yet ready to answer.

Nevertheless, the ADA will refuse to respond to questions, Editor. Even while I was still a member of the professional organization up until a year ago, it clearly aggravated dental leaders when I repeatedly questioned the cost and safety of EDRs on local, state and national levels of the organization.

I always find evasion intriguing. Maybe you will have better luck getting past anonymous, unaccountable gatekeepers who shield the good ol’ boys from transparency.

Assessment

Here’s the official to whom I suggest you futileyly address your questions: Dr. Robert Faiella. He is not only the unresponsive Chair of the ADA Electronic Health Record Workgroup, but he is theADA’s latest insensitive President-elect.

Conclusion

And so, your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Our Other Print Books and Related Information Sources:

Health Dictionary Series: http://www.springerpub.com/Search/marcinko

Practice Management: http://www.springerpub.com/product/9780826105752

Physician Financial Planning: http://www.jbpub.com/catalog/0763745790

Medical Risk Management: http://www.jbpub.com/catalog/9780763733421

Healthcare Organizations: www.HealthcareFinancials.com

Physician Advisors: www.CertifiedMedicalPlanner.com

Link: http://feeds.feedburner.com/HealthcareFinancialsthePostForcxos

Sponsors Welcomed: And, credible sponsors and like-minded advertisers are always welcomed.

Link: https://healthcarefinancials.wordpress.com/2007/11/11/advertise

Filed under: Health Insurance, Health Law & Policy, Information Technology, Pruitt's Platform | Tagged: ADA, ADA Electronic Health Record Workgroup, Center for Health Transformation, Chicago Tibune, D. Kellus Pruitt, eDRs, George Will, HIPAA, Newt Gingrich, Robert Faiella, Steve Chapman, Susan Meyers, USA Today | 10 Comments »

Subscribe MEDICAL EXECUTIVE-POST?

Member Statistics

ME-P Information & Content Channels

Ann Miller RN MHA [Managing Editor]

CERTIFIED MEDICAL PLANNER® program

Most Recent ME-Ps

PodiatryPrep.org

ME-P Free Advertising Consultation

Medical & Surgical e-Consent Forms

iMBA Inc., OFFICES

ME-P Publishing

SEEKING INDUSTRY INFO PARTNERS?

Reader Comments, Quips, Opinions, News & Updates

Start-Up Advice for Businesses, DRs and Entrepreneurs

Up-Trending ME-Ps

Capitalism and Free Enterprise Advocacy

OIG Fraud Warnings

More Difficult than Ever Before

Share this:

1 | Believing They Are Universally Smart

2 | Overspending Too Soon

3 | Decreasing Salaries

4 | Increasing Costs of Private Practice

5 | Tuition Debt

Share this:

Share this:

Share this:

What’s up

What’s down

CITE: https://tinyurl.com/2h47urt5

Share this:

Share this:

Was the ADA Complicit?

Share this:

Share this:

What’s Your Back-up Plan – Doctor?

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Clarifying the Confusion about HIPAA

A Special ME-P Report

[By Carol S. Miller RN MBA PMP]

[PHYSICIAN FOCUSED FINANCIAL PLANNING AND RISK MANAGEMENT COMPANION TEXTBOOK SET]

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

PRE-ORDER HERE

Share this:

Share this: