Tag: HIPAA

Categories
Health Law Highlights

The Role of Nursing Education in Ensuring HIPAA Compliance

Summary of article from The HIPAA Journal, by Dr. Randolf F. R. Rasch:

The escalating issue of HIPAA violations by nurses poses significant legal and financial risks for healthcare institutions. Despite mandatory annual training, many nurses are inadequately prepared for compliance due to gaps in both initial and ongoing education. A 2023 survey underscores these deficiencies, revealing that only 24% of healthcare organizations provide annual HIPAA training and fewer than 3% offer this crucial training solely during employee orientation. This lack of comprehensive and continuous education leaves nurses vulnerable to breaches in patient privacy and electronic health information integrity. Addressing these gaps through enhanced training and vigilant surveillance is essential for protecting both patient data and the institutions that employ healthcare professionals.

Categories
Health Law Highlights

Justice Department Unseals Documents in Texas Children’s HIPAA Violation Case

Summary of article from Becker’s Hospital Review, by Naomi Diaz:

The U.S. Justice Department unsealed documents concerning Dr. Eithan Haim, who is accused of violating the Health Insurance Portability and Accountability Act (HIPAA) by illegally accessing and leaking internal documents from Texas Children’s Hospital. The documents pertained to gender-affirming services and included patients’ personal health information. Dr. Haim allegedly obtained this information with the intent to cause harm to the hospital. He shared these documents with a senior fellow at the Manhattan Institute, in May 2023. If convicted, Dr. Haim could face a maximum of 10 years in federal prison and a fine of up to $250,000.

Categories
Health Law Highlights

Texas Children’s Hospital Whistleblower Doctor Indicted on Four Counts of Criminal HIPAA Violations

Summary of article from The HIPAA Journal, by Steve Adler:

Dr. Eithan Haim, a surgeon from Texas Children’s Hospital, has been indicted on four counts of violating the Health Insurance Portability and Accountability Act (HIPAA) by the Department of Justice. Dr. Haim allegedly leaked documents proving the hospital continued to provide gender-affirming care to minors, despite public claims to the contrary, following legal threats from Texas Governor Greg Abbott. The leaked documents, shared with reporter Christopher F. Rulo, indicated that treatments, including hormone-related therapies and implanted puberty blockers, were provided throughout 2022 and 2023. Dr. Haim, who admitted to being the whistleblower, is now facing prosecution, though he maintains that all sensitive patient information was redacted from the documents. This case follows a new law passed by the Texas Legislature banning gender-affirming interventions, which Texas Children’s Hospital has since complied with.

Categories
Health Law Highlights

Avoiding HIPAA Penalties: A Checklist for Covered Entities

Summary of article from Holland & Hart, by Kim Stanger:

The Health Insurance Portability and Accountability Act (HIPAA) applies to healthcare providers, healthcare clearinghouses, and health plans, enforcing rigorous privacy, security, and breach notification rules. Non-compliance can lead to severe civil and criminal penalties, with a tiered penalty structure based on the severity and nature of the violation. While there isn’t an explicit private cause of action for injured individuals under HIPAA, claims can be made under negligence or common law. To ensure compliance, entities should assign HIPAA responsibility, understand use and disclosure rules, implement and maintain written policies, execute appropriate business associate agreements, and stay updated with changes in regulations.

Categories
Health Law Highlights

Privacy Abuses Will Meet ‘Full Force of the Law’ From New Texas Unit, Attorney General Says

Summary of article from The Record, by Joe Warminsky:

Texas Attorney General Ken Paxton has announced the formation of a new data-privacy team within the consumer protection unit of his office. The team will enforce Texas privacy laws, focusing on data privacy and security, identity theft, data brokers, biometric information, consumer protection, and federal laws covering children’s privacy (COPPA) and healthcare information (HIPAA). The Texas Data Privacy and Security Act, a consumer-friendly law, will come into effect on July 1. Paxton has stated that companies exploiting consumer data will face legal consequences. This move is in line with several states, like Vermont, implementing broad privacy laws as federal regulation remains in limbo.

Categories
Health Law Highlights

Employers Must Keep Reproductive Health Information About Their Plan Participants Private Under New HIPAA Privacy Rule

Summary of article from Akerman LLP, by Beth Alcalde, Elizabeth Hodge:

The newly updated HIPAA Privacy Rule, effective June 25, 2024, provides enhanced protection for reproductive health care records, preventing their disclosure to state law enforcement agencies except under certain conditions. The definition of “reproductive health care” is broad, encompassing a wide range of male and female health services. There are strict restrictions on using such information for investigations, and health plan administrators and associated businesses have direct responsibility for compliance. Upon receiving a request for such information, a signed written attestation is required from the requester stating the intended use or disclosure is not for a prohibited purpose. Revisions to the Notice of Privacy Practices (NOPP) must be in place by February 16, 2026, and legal challenges to the Final Rule are expected.

Categories
Ask the Health Lawyer

The Colorado AI Act: What You Need to Know

Summary of article from IAPP, by Cobun Zweifel-Keegan:

The Colorado AI Act, the first U.S. cross-sector AI governance law, was signed into law on May 17, 2024, with key provisions effective from Feb. 2026. The law focuses on high-risk AI systems, defined as those making consequential decisions, and introduces stringent requirements to prevent algorithmic discrimination. The Act imposes responsibilities on both developers and deployers of AI systems, requiring them to use reasonable care to avoid algorithmic discrimination and mandating comprehensive documentation and impact assessments. The law also requires incident reporting, public disclosure of risk management, and direct consumer notifications. The law exempts entities covered by HIPAA if they provide AI-generated recommendations that require a health care provider to take action to implement that recommendation. Enforcement of the law, which treats violations as breaches of Colorado’s general consumer protection statute, will be carried out by the Colorado attorney general starting 1 Feb. 2026.

Categories
Health Law Highlights

OCR HIPAA Audit Program to Commence in 2024

Summary of article from The HIPAA Journal, by Steve Adler:

The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 mandates periodic audits of HIPAA-regulated entities by the Office for Civil Rights (OCR) to assess HIPAA compliance, with a focus on the HIPAA Security Rule. OCR has confirmed that audits will be conducted in 2024. The increasing rate and scale of data breaches suggest inadequate compliance with the HIPAA Security Rule among healthcare organizations. OCR aims to improve future audit programs and cybersecurity across the healthcare sector, with a particular focus on risk analysis and management provisions of the HIPAA Security Rule. OCR is working on an update to the HIPAA Security Rule, expected to be finalized by the end of the year, to reflect changes in technology and working practices, including the adoption of cloud technology, encryption, and multifactor authentication.

Categories
Health Law Highlights

HIPAA Privacy Final Rule: Landmark Changes Related to Reproductive Health Care Information

Summary of article from Polsinelli, by Hiba AI-Ramahi, Iliana Peters, Rebecca Frigy Romine:

The U.S. Department of Health and Human Services (HHS) and Office for Civil Rights (OCR) issued a “Final Rule” providing special protections and obligations related to Protected Health Information (PHI) about reproductive health care. The Rule applies to all HIPAA regulated entities and covers a broad range of reproductive health care services. It prohibits the use or disclosure of PHI for the purpose of conducting a criminal, civil, or administrative investigation into or imposing liability on any person for seeking, obtaining, providing, or facilitating reproductive health care. Regulated entities must obtain a signed, written attestation from the person or entity requesting the PHI that the intended use or disclosure of the requested PHI is not for one of the prohibited purposes. This Rule is effective on June 25, 2024, with regulated entities given 180 days for compliance and until February 16, 2026 for Notice of Privacy Practices (NPP) modification compliance.

Categories
Health Law Highlights

FTC Finalizes Expansion of Health Breach Notification Rule’s Broad Applicability to Unauthorized App Disclosures

Summary of article from Davis Wright Tremaine, by Adam H. Greene, Apurva Dharia:

The Federal Trade Commission (FTC) has finalized changes to the Health Breach Notification Rule (HBNR), expanding its scope to include virtually all health and wellness apps. The revised rule requires vendors of personal health records (PHRs) and related entities to notify individuals, the FTC, and, in some cases, the media of any unauthorized disclosure of identifiable health data. The updated rule also includes a broader definition of “health care services or supplies” and “breach of security,” and clarifies the role and responsibilities of PHR related entities. The FTC has also modernized the method of notice, expanded the content of the notice, and revised the timing of notice to the FTC. The changes signal the FTC’s increased prioritization of protecting consumers’ sensitive health information.