On the Notice of Privacy Practices

Posted on September 24, 2013 by Dr. David Edward Marcinko MBA MEd CMP™

Join Our Mailing List 

Encryption and HHS are Taking Hits

[By D. Kellus Pruitt DDS]

1-darrellpruittIt is bad politics for the President’s Department of Health and Human Services to get caught deceiving voters.

Word gets around much faster than it did before transparency sucked the power from the entrenched.

The NoPP

You know those Notice of Privacy Practices (NoPP) forms we are asked to sign in doctors’ offices? Since it makes no difference to anyone whether patients sign them or not, why needlessly waste everyone’s time? The NoPP is not an agreement, and just because virtually everyone is tricked into signing it, does not mean anyone reads it. HIPAA has become a source of danger to patients, with no redeeming value.

HHS Estimates 

According to the US Department of Health and Human Services own recent estimate:

“… many centuries of time—nearly 35 centuries, in fact, or just short of 30.7 million hours—will be devoted each year by healthcare providers and patients for the dissemination to patients and their acknowledgement of HIPAA notices of privacy practices [NoPP] for protected healthcare information, HHS estimates. Even at just 3 minutes apiece, with 613 million of these routine privacy notices to be delivered, signed and stored, the time adds up…”

-Joseph Conn

… “HHS estimates 32.8 million hours of interaction required to comply with privacy, security rules” …

-ModernHealtcare.com [September 5, 2013]

http://www.modernhealthcare.com/article/20130904/BLOG/309049995?AllowView=VW8xUmo5Q21TcWJOb1gzb0tNN3RLZ0h0MWg5SVgra3NZRzROR3l0WWRMWGJYZjBGRWxyd01qUzMyWmVpNTNnWUpiV2s=&utm_source=link-20130904-BLOG-309049995&utm_medium=email&utm_campaign=hits

Censorship Concerns? 

I tried to bring attention to this absurdity over a year ago – back when HHS was still keeping unfavorable news about EHRs hidden from voters using censorship:

… “Put another way, the ONLY reason for a doctor to ask patients if they feel like signing the NoPP is to protect already busy doctors from a HIPAA fine. How is that not senseless, yet admittedly humorous bureaucratic waste?” …

On July 3, 2012, my opinion of the waste that HHS recently confirmed was censored by an HHS employee from the taxpayer-supported Linkedin site, Health IT and Electronic Health Records. If that is not against federal law, it damn sure should be.

http://www.linkedin.com/groups/IT-in-Healthcare-Why-Building-3993178.S.216432610?qid=bafac2e5-fb9c-4a39-8348-5a3074abff67&trk=groups_items_see_more-0-b-ttl

Among the items that HHS requires providers include in Notices of Privacy Practice is a one-sentence statement addressing data breaches:

…“We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information [unless it is encrypted]”…

http://www.hhs.gov/ocr/privacy/hipaa/npp_booklet_hc_provider.pdf

Now that it is widely known that encryption is no longer acceptably secure, protection from accountability is encryption vendors’ only remaining selling point. HIPAA stipulates that if breached patient information is encrypted according to standards set forth by the National Institute of Standards and Technology (NIST), doctors are freed from the tremendous cost of notifying (former) patients – even though patients’ privacy and security have been nevertheless compromised.

For example, two weeks ago, the NIST abandoned the very encryption standards that HIPAA demands. Oops! (See: “Government Standards Agency ‘Strongly’ Suggests Dropping its Own Encryption Standard,” by Jeff Larson and Justin Elliott, ProPublica, September 13, 2013).

http://www.propublica.org/article/standards-agency-strongly-suggests-dropping-its-own-encryption-standard

###

eMR Privacy

###

NSA Secrets 

US spy agency NSA’s secret success at decrypting previously impenetrable codes – which was revealed by former NSA contractor Edward Snowden – proves that today’s best encryption is tomorrow’s crossword puzzle. What’s more, once an individual’s medical identity is lost in the cloud, it can never be reeled back in.

And, when DNA records are included, a breach today could put the welfare of generations of Americans at risk.

A Gut-Check 

The ultimate gut-check: If your encrypted identity were fumbled, wouldn’t you want to be notified? Of course you would.

Assessment 

In my opinion, the HIPAA Rule should be immediately amended to demand notification of all individuals involved in all data breaches unless they allow opt out. Who knows? Some might prefer not to be bothered.

What is your opinion; doctor, patient and/or consultant?

Conclusion

Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Speaker: If you need a moderator or speaker for an upcoming event, Dr. David E. Marcinko; MBA – Publisher-in-Chief of the Medical Executive-Post – is available for seminar or speaking engagements. Contact: MarcinkoAdvisors@msn.com

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

Product DetailsProduct Details

Filed under: Information Technology, Op-Editorials, Pruitt's Platform, Risk Management | Tagged: , , , , , , , , | 3 Comments »

Notice of Healthcare Privacy Practices Explained

Posted on November 27, 2009 by Dr. David Edward Marcinko MBA MEd CMP™

Join Our Mailing List

NPP “Game Changer” Replaced Use of Consents

Dr. Mata

[By Richard J. Mata; MD, MS]

In its most visible change, the privacy regulations of HIPAA require covered health entities to provide patients with a Notice of Privacy Practices (NPP).

The NPP replaces the use of consents, which are now optional, although they are recommended.

The NPP outlines how PHI is to be regulated, which gives the patient far-reaching authority and ownership of their PHI, and must describe, in general terms, how organizations will protect health information.

THE NPP Specifics

The NPP specifies the patient’s right to the following:

  • gain access to and, if desired, obtain a copy of his or her own health records;
  • request corrections of errors that the patient finds (or include the patient’s statement of disagreement if the institution believes the information is correct);
  • receive an accounting of how their information has been used (including a list of the persons and institutions to whom/which it has been disclosed);
  • request limits on access to, and additional protections for, particularly sensitive information;
  • request confidential communications (by alternative means or at alternative locations) of particularly sensitive information;
  • complain to the facility’s Privacy Officer if there are problems; and
  • pursue the complaint with DHHS’s Office of Civil Rights if the problems are not satisfactorily resolved.

A copy of the NPP must be provided the first time a patient sees a direct treatment medical provider, and any time thereafter when requested or when the NPP is changed. On that first visit, treatment providers must also make a good faith effort to obtain a written acknowledgement, confirming that a copy of the NPP was obtained. Health plans and insurers must also provide periodic Notices to their customers, but do not need to secure any acknowledgement. Most Health Information Management departments that oversee the clinical coding of medical records also manage the NPP documentations and deadlines, but this may vary from hospital to hospital, or office to office.

Assessment

HIPAA requires no other documentation from the patient in order for information to be used or disclosed for basic functions, like treatment and payment, or for a broad range of other core healthcare operations. State laws may nonetheless require some kind of consent/authorization form from the patient for these purposes [It is common for institutions to claim, incorrectly, that HIPAA does].

Conclusion

Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Speaker: If you need a moderator or speaker for an upcoming event, Dr. David E. Marcinko; MBA – Publisher-in-Chief of the Medical Executive-Post – is available for seminar or speaking engagements. Contact: MarcinkoAdvisors@msn.com

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

Product DetailsProduct Details

Filed under: Health Law & Policy, Information Technology | Tagged: , , , , , , , , , , , | 1 Comment »