National eHealth Collaborative (NeHC) CEO Kate Berry was recently interviewed by FierceEMR about her views on the changing national HIE landscape. The article, written by contributing editor Marla Durben Hirsch, provided a summary of the recent NeHC University roundtable Implications of a Shifting National HIE Architecture and shared Berry's views the topic.
Click here to read the article.
Source: NeHC News Release
Thursday, March 15, 2012
Tuesday, March 13, 2012
HHS settles HIPAA case with BCBST for $1.5 million
Blue Cross Blue Shield of Tennessee (BCBST) has agreed to pay the U.S. Department of Health and Human Services (HHS) $1,500,000 to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, Leon Rodriguez, Director of the HHS Office for Civil Rights (OCR), announced today. BCBST has also agreed to a corrective action plan to address gaps in its HIPAA compliance program. The enforcement action is the first resulting from a breach report required by the Health Information Technology for Economic and Clinical Health (HITECH) Act Breach Notification Rule.
The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.
“This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program,” said OCR Director Leon Rodriguez. “The HITECH Breach Notification Rule is an important enforcement tool and OCR will continue to vigorously protect patients’ right to private and secure health information.”
In addition to the $1,500,000 settlement, the agreement requires BCBST to review, revise, and maintain its Privacy and Security policies and procedures, to conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA, and to perform monitor reviews to ensure BCBST compliance with the corrective action plan.
HHS Office for Civil Rights enforces the HIPAA Privacy and Security Rules. The HIPAA Privacy Rule gives individuals rights over their protected health information and sets rules and limits on who can look at and receive that health information. The HIPAA Security Rule protects health information in electronic form by requiring entities covered by HIPAA to use physical, technical, and administrative safeguards to ensure that electronic protected health information remains private and secure.
The HITECH Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to HHS and the media. Smaller breaches affecting less than 500 individuals must be reported to the secretary on an annual basis.
Individuals who believe that a covered entity has violated their (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy or Security
Rule may file a complaint with OCR at: http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.
The HHS Resolution Agreement can be found at http://www.hhs.gov/ocr/civilrights/activities/agreements/index.html
Additional information about OCR’s enforcement activities can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.
Source: HHS News Release
The investigation followed a notice submitted by BCBST to HHS reporting that 57 unencrypted computer hard drives were stolen from a leased facility in Tennessee. The drives contained the protected health information (PHI) of over 1 million individuals, including member names, social security numbers, diagnosis codes, dates of birth, and health plan identification numbers. OCR’s investigation indicated BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.
“This settlement sends an important message that OCR expects health plans and health care providers to have in place a carefully designed, delivered, and monitored HIPAA compliance program,” said OCR Director Leon Rodriguez. “The HITECH Breach Notification Rule is an important enforcement tool and OCR will continue to vigorously protect patients’ right to private and secure health information.”
In addition to the $1,500,000 settlement, the agreement requires BCBST to review, revise, and maintain its Privacy and Security policies and procedures, to conduct regular and robust trainings for all BCBST employees covering employee responsibilities under HIPAA, and to perform monitor reviews to ensure BCBST compliance with the corrective action plan.
HHS Office for Civil Rights enforces the HIPAA Privacy and Security Rules. The HIPAA Privacy Rule gives individuals rights over their protected health information and sets rules and limits on who can look at and receive that health information. The HIPAA Security Rule protects health information in electronic form by requiring entities covered by HIPAA to use physical, technical, and administrative safeguards to ensure that electronic protected health information remains private and secure.
The HITECH Breach Notification Rule requires covered entities to report an impermissible use or disclosure of protected health information, or a “breach,” of 500 individuals or more to HHS and the media. Smaller breaches affecting less than 500 individuals must be reported to the secretary on an annual basis.
Individuals who believe that a covered entity has violated their (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy or Security
Rule may file a complaint with OCR at: http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.
The HHS Resolution Agreement can be found at http://www.hhs.gov/ocr/civilrights/activities/agreements/index.html
Additional information about OCR’s enforcement activities can be found at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.
Source: HHS News Release
New Report Calls for Enhanced Security to Safeguard Protected Health Information
A new report, The Financial Impact of Breached Protected Health Information: A Business Case for Enhanced PHI Security, provides health care organizations with a new method to evaluate the “at risk” value of protected health information (PHI) that will enable them to make a business case for appropriate investments to better protect PHI.
This report was created through the “PHI Project” – a collaboration of the American National Standards Institute (ANSI), via its Identity Theft Prevention and Identity Management Standards Panel (IDSP), in partnership with The Santa Fe Group/Shared Assessments Program Healthcare Working Group, and the Internet Security Alliance (ISA) – that involved a cross-section of more than 100 health care industry leaders from over 70 organizations.
Representatives from Utica College and the Center for Identity Management and Information Protection (CIMIP) traveled to Washington to take part in a congressional briefing to unveil the Protected Health Information (PHI) Project report.
The survey responses revealed that the majority of participants want to comply and secure PHI, but they believe that budgetary constraints and the lack of executive commitment, leadership, and accountability, as well as the evolving nature of threats and the technologies available to protect PHI, combine to make real protection of health information extremely challenging.
Seventy-five percent believed their organization possesses effective policies to protect PHI and takes effective steps to protect PHI. But almost 40% did not believe that their organizational management views privacy and security as a priority, and 54% did not feel that their organization possesses sufficient resources to ensure protection requirements are currently being effectively protected. When asked about the complexity of the laws and the ease of compliance, only 12% felt the laws were “easy to understand” and only 14% thought the laws were “not difficult at all” to comply with. When asked to identify the most significant impediments their organization faces to achieving a strong privacy and data security posture with respect to how PHI is collected, used, and retained the most common impediment was seen as “lack of funding”(59%) and followed by insufficient time, lack of senior executive support,” and lack of accountability and leadership.”
Responses showed that more than 85.3 % of participants stated that the accidental or inadvertent exposure from an insider was the “most likely” or “very likely” threat to protected data. More than 50 % believed that some type of security threat was likely adversely affecting their organizations now.
The report is available for free download at webstore.ansi.org/phi.
Source: ANSI News Release
This report was created through the “PHI Project” – a collaboration of the American National Standards Institute (ANSI), via its Identity Theft Prevention and Identity Management Standards Panel (IDSP), in partnership with The Santa Fe Group/Shared Assessments Program Healthcare Working Group, and the Internet Security Alliance (ISA) – that involved a cross-section of more than 100 health care industry leaders from over 70 organizations.
Representatives from Utica College and the Center for Identity Management and Information Protection (CIMIP) traveled to Washington to take part in a congressional briefing to unveil the Protected Health Information (PHI) Project report.
The survey responses revealed that the majority of participants want to comply and secure PHI, but they believe that budgetary constraints and the lack of executive commitment, leadership, and accountability, as well as the evolving nature of threats and the technologies available to protect PHI, combine to make real protection of health information extremely challenging.
Seventy-five percent believed their organization possesses effective policies to protect PHI and takes effective steps to protect PHI. But almost 40% did not believe that their organizational management views privacy and security as a priority, and 54% did not feel that their organization possesses sufficient resources to ensure protection requirements are currently being effectively protected. When asked about the complexity of the laws and the ease of compliance, only 12% felt the laws were “easy to understand” and only 14% thought the laws were “not difficult at all” to comply with. When asked to identify the most significant impediments their organization faces to achieving a strong privacy and data security posture with respect to how PHI is collected, used, and retained the most common impediment was seen as “lack of funding”(59%) and followed by insufficient time, lack of senior executive support,” and lack of accountability and leadership.”
Responses showed that more than 85.3 % of participants stated that the accidental or inadvertent exposure from an insider was the “most likely” or “very likely” threat to protected data. More than 50 % believed that some type of security threat was likely adversely affecting their organizations now.
The report is available for free download at webstore.ansi.org/phi.
Source: ANSI News Release
Walgreens Uses e-Delivery of Patient Info to Physicians
Walgreens announced that it will use Surescripts’ Clinical Interoperability services to electronically deliver patient data directly to primary care providers to improve the coordination of care. In the coming months, all of the 7,800 Walgreens and Duane Reade pharmacies and 350 Take Care Clinics nationwide will use the Surescripts network to deliver immunization records to the patient’s primary care provider. Later this year, Walgreens will also use the Surescripts network to provide immunization reporting to state and local public health agencies, and Take Care Clinic patient summaries to the patient’s primary care provider.
A recent survey of 400 physicians by Surescripts illustrated the challenge of compiling more complete medical records: 39 percent responded that they are frequently missing immunization records during patient visits; 35 percent are often missing patient summaries.
Source: Walgreens News Release
A recent survey of 400 physicians by Surescripts illustrated the challenge of compiling more complete medical records: 39 percent responded that they are frequently missing immunization records during patient visits; 35 percent are often missing patient summaries.
Source: Walgreens News Release
Report:Hospitals with Advanced EMR Systems Report Numerous Benefits
New research from HIMSS Analytics and The Advisory Board shows that hospitals with advanced electronic medical records (EMR) systems report achieving a broad range of benefits from their implementations, including clinical quality, patient safety and operational efficiencies.
The data collected for the report, EMR Benefits and Benefit Realization Methods of Stage 6 and 7 Hospitals, indicates that highly advanced EMR environments can produce substantial benefits for individual hospitals and the healthcare system as a whole. The survey is the first to report results from hospitals that have achieved Stages 6 or Stage 7 on the EMR Adoption Model (EMRAM)SM , providing unique insight into how ERM systems are working for hospitals further along the development track.
The study collected data from 33 chief information officers (CIOs) at Stage 6 or Stage 7 EMRAM hospitals from throughout the country.
Source: HIMSS News Release
The data collected for the report, EMR Benefits and Benefit Realization Methods of Stage 6 and 7 Hospitals, indicates that highly advanced EMR environments can produce substantial benefits for individual hospitals and the healthcare system as a whole. The survey is the first to report results from hospitals that have achieved Stages 6 or Stage 7 on the EMR Adoption Model (EMRAM)SM , providing unique insight into how ERM systems are working for hospitals further along the development track.
The study collected data from 33 chief information officers (CIOs) at Stage 6 or Stage 7 EMRAM hospitals from throughout the country.
Source: HIMSS News Release
Monday, March 12, 2012
Policies Give States More Flexibility to Establish Affordable Insurance Exchanges
Health and Human Services Secretary Kathleen Sebelius announced policies to assist States in building Affordable Insurance Exchanges. Starting in 2014, these one-stop marketplaces will allow consumers and small businesses to choose a private health insurance plan and offer the public the same kinds of insurance choices as members of Congress.
The policies released will help States in designing their Exchanges to best meet the needs of their consumers. They offer States substantial flexibility as they design a marketplace that works for their residents.
“These policies give States the flexibility they need to design an Exchange that works for them,” said HHS Secretary Kathleen Sebelius. “These new marketplaces will offer Americans one-stop shopping for health insurance, where insurers will compete for your business. More competition will drive down costs and Exchanges will give individuals and small businesses the same purchasing power big businesses have today.”
The policies provide States with the guidance and certainty they need as they continue to work to build these marketplaces for their residents for operation in 2014. The policies offer guidance about the options on how to structure Exchanges in two key areas:
-Setting standards for establishing Exchanges, setting up a Small Business Health Options Program (SHOP), performing the basic functions of an Exchange, and certifying health plans for participation in the Exchange;
-Establishing a streamlined, web-based system for consumers to apply for and enroll in qualified health plans and insurance affordability programs.
The final rule builds on the flexibility and resources provided by HHS already to build State-based Exchanges. A majority of States have taken significant steps in building Exchanges. Previously, HHS awarded 49 States and the District of Columbia $50 million to begin planning their Exchanges, and as announced recently, 33 States and the District of Columbia have received over $667 million in Establishment Grants to begin building their Exchanges.
The announcement builds on over two years’ worth of work with States, small businesses, consumers, and health insurance plans. The administration examined models of Exchanges; convened numerous meetings and regional listening sessions across the country with stakeholders; and consulted closely with State leaders, consumer advocates, employers and insurers. To finalize the rules , HHS accepted public comment over 75 days to learn from States, consumers, and other stakeholders on how the rules could be improved, and HHS modified the proposals based on feedback from the American people.
For more information on the announcement, visit:
http://www.healthcare.gov/news/factsheets/2011/07/exchanges07112011a.html
For more information on Exchanges, including fact sheets, visit http://www.healthcare.gov/exchanges.
Source: HHS News Release
The policies released will help States in designing their Exchanges to best meet the needs of their consumers. They offer States substantial flexibility as they design a marketplace that works for their residents.
“These policies give States the flexibility they need to design an Exchange that works for them,” said HHS Secretary Kathleen Sebelius. “These new marketplaces will offer Americans one-stop shopping for health insurance, where insurers will compete for your business. More competition will drive down costs and Exchanges will give individuals and small businesses the same purchasing power big businesses have today.”
The policies provide States with the guidance and certainty they need as they continue to work to build these marketplaces for their residents for operation in 2014. The policies offer guidance about the options on how to structure Exchanges in two key areas:
-Setting standards for establishing Exchanges, setting up a Small Business Health Options Program (SHOP), performing the basic functions of an Exchange, and certifying health plans for participation in the Exchange;
-Establishing a streamlined, web-based system for consumers to apply for and enroll in qualified health plans and insurance affordability programs.
The final rule builds on the flexibility and resources provided by HHS already to build State-based Exchanges. A majority of States have taken significant steps in building Exchanges. Previously, HHS awarded 49 States and the District of Columbia $50 million to begin planning their Exchanges, and as announced recently, 33 States and the District of Columbia have received over $667 million in Establishment Grants to begin building their Exchanges.
The announcement builds on over two years’ worth of work with States, small businesses, consumers, and health insurance plans. The administration examined models of Exchanges; convened numerous meetings and regional listening sessions across the country with stakeholders; and consulted closely with State leaders, consumer advocates, employers and insurers. To finalize the rules , HHS accepted public comment over 75 days to learn from States, consumers, and other stakeholders on how the rules could be improved, and HHS modified the proposals based on feedback from the American people.
For more information on the announcement, visit:
http://www.healthcare.gov/news/factsheets/2011/07/exchanges07112011a.html
For more information on Exchanges, including fact sheets, visit http://www.healthcare.gov/exchanges.
Source: HHS News Release
AHRQ Releases Patient Safety Organization Tools
The Agency for Healthcare Research and Quality (AHRQ) launched a resource program for Patient Safety Organizations (PSOs) that wish to assist hospitals in reducing unnecessary readmissions. This program is in response to the Affordable Care Act (ACA), which designates PSOs as an entity that can help hospitals with high readmission rates improve their performance, and calls for the Department of Health and Human Services (HHS) to support PSOs in this work.
To obtain additional information about this program, including the provisions in the ACA legislation and available readmissions resources, please go to: http://www.pso.ahrq.gov/readmin/readmin.htm
Source: AHRQ News Release
To obtain additional information about this program, including the provisions in the ACA legislation and available readmissions resources, please go to: http://www.pso.ahrq.gov/readmin/readmin.htm
Source: AHRQ News Release
Subscribe to:
Posts (Atom)
