8 Breach Prevention Tips: Action Items Based on Lessons Learned

By Howard Anderson

Govinfosecurity.com

Originally published February 8, 2012

What can be learned from the more than 390 major breaches affecting more than 19 million individuals that have been reported as a result of the federal HIPAA breach notification rule? Plenty, breach prevention experts say.

Here are eight key breach-prevention insights from information security thought-leaders:

1. Don't Forget Risk Assessments

The details of the biggest breaches last year "make it painfully clear that inadequate, if any, HIPAA security risk analysis took place prior to the breaches," says Dan Berger, CEO at Redspin.

2. Encrypt Mobile Devices, Media

"Even though encryption is what's referred to as an addressable standard in the HIPAA security rule - which means it's not actually mandated in all cases - I don't see any reason why information shouldn't be encrypted in all cases on portable media and devices," says Robert Belfort, partner at the law firm Manatt, Phelps & Phillips LLP. "That's one step that organizations can take that can address a very significant share of the types of breaches that are occurring."

3. Beef Up Training

"People have to be trained to understand the policies of the organization, and they have to be trained about common-sense safeguards that they can follow to avoid breaches or the misuse of information," Szabo stresses.

4. Conduct Internal Audits

In addition to training, an important step toward addressing internal breach threats is to conduct audits of records access, Belfort says.

5. Monitor Business Associates

About 22 percent of major breaches, including many of the largest incidents, have involved business associates. As a result, it's essential to work with vendor partners to ensure they're taking adequate breach prevention steps.

The rest of details are here.

In the Resources section of this blog, there is a White Paper on Preventing a Data Breach and Protecting Health Records – One Year Later: Are You Vulnerable to a Breach? by Kaufman, Rossin & Co. to augment these security issues.

Preventing a Data Breach and Protecting Health Records

Preventing a Data Breach and Protecting Health Records
Found in the public domain.

Patient Communication Study Shows Doctors Regularly Withhold Truth

Catherine Pearson
The Huffington Post - Healthy Living
Originally published February 9, 2012

If you think your doctor is hiding something from you, you might be right.

According to a new study, published Wednesday in the journal Health Affairs, some physicians are not always forthright when it comes to patient communication, withholding information about medical errors, relationships with drug companies and severity of a person's prognosis.

"It should be a source of caution," said Dr. Lisa Lezzioni, a professor of medicine at Harvard Medical School and the study's author. "The caution requires patients to think about and discuss what they want in terms of communication with their doctors."

Researchers surveyed more than 1,800 physicians from around the country, working in a variety of specialties, to ask about how they perceive and handle patient communications.

Nearly 35 percent of respondents said they did not "completely agree" that they should disclose serious medical errors to their patients, and approximately 20 percent said they had not revealed a mistake to a patient in the last year because they feared being sued.

Additionally, 35 percent of the doctors said they did not "completely agree" that they should disclose their financial relationships with drug and medical device companies, and 11 percent admitted that they had told a patient something untrue in the past year.

The entire story is here.

Here is a portion of the abstract from the original article in Health Affairs.

Overall, approximately one-third of physicians did not completely agree with disclosing serious medical errors to patients, almost one-fifth did not completely agree that physicians should never tell a patient something untrue, and nearly two-fifths did not completely agree that they should disclose their financial relationships with drug and device companies to patients. Just over one-tenth said they had told patients something untrue in the previous year. Our findings raise concerns that some patients might not receive complete and accurate information from their physicians, and doubts about whether patient-centered care is broadly possible without more widespread physician endorsement of the core communication principles of openness and honesty with patients.

The New Synthesis in Moral Psychology

The New Synthesis in Moral Psychology

For Mentally Ill Inmates, Health Care Behind Bars is Often Out of Reach

By Elizabeth Chuck, msnbc.com

A man who was declared suicidal by a New Mexico jail and alleges he was then left to rot in solitary confinement for nearly two years is just one of many former inmates who say they were denied essential mental health services while incarcerated at that detention center, which like others across the country has struggled with how to treat the mentally ill.

Stephen Slevin, 57, made headlineslast week when a jury awarded him $22 million after he alleged inhumane treatment in the Dona Ana County Detention Center following his arrest in August 2005 on charges of driving while under the influence and possession of a stolen vehicle.

But a search of Dona Ana County court records reveals the detention center was also hit with a class-action lawsuit six months prior to Slevins', in which 13 former inmates alleged their constitutional rights to mental health care had been "continually and persistently ignored."

The lawsuit was settled in 2010, with a judgment of $400,000 for the plaintiffs and a commitment from the county to change its practices.

According to criminal justice experts, many other jails and prisons have struggled to adequately handle mentally ill inmates. Few areas of the country, they say, have the money and resources and staff to handle such a challenging population.

"The Supreme Court has established that you have a constitutional right to a basic level of adequate health care, which now includes mental health care," Thomas Hafemeister, an associate professor at the University of Virginia School of Law, told msnbc.com. "They've recognized that there tends to be limited resources in this setting. As long as a qualified professional has examined the inmate and exercised his or her judgment as to what needs to be done, that's all that is required."

'Cruel and unusual'

But Hafemeister, who has written about alternatives to the traditional criminal justice system for the mentally ill, explained that the definition of a "qualified professional" is a loose one.

"Some would argue for inmates, all that is required is medication," he said, meaning anyone with a medical degree, from a physician to a psychiatrist, could be considered qualified.

"Often it's very expensive. They're only willing to come in for an hour a week, and they zoom through very quickly. It can be a very cursory examination," Hafemeister said.

Slevin was detained for 22 months, released in June of 2007 without ever having been given a trial. By the time he was freed, he was deemed mentally incompetent, and his charges were dropped.

The rest of the story is here.

Vignette 10: Multiple Relationships Revealed

A female psychologist works with a male patient for about one year in a suburban area.  They agreed to meet weekly for the first four months of psychotherapy, and then they agreed to meet twice per month.  They developed a good therapeutic alliance.  During the course of their work, he discussed significant facts about his troubled past, numerous details about failed past relationships, and sexual fantasies.  The main therapeutic issues are depression and loneliness.

During the current session, the patient related having made a new female friend.  As social isolation, loneliness and depression are regular themes in treatment; the psychologist frames this as positive progress.

As the conversation continues, the psychologist is surprised to learn that the patient’s new friend is the ex-wife of the psychologist’s husband.  The patient reveals that he became aware of that information after several dates and recently felt comfortable revealing this to the psychologist.  He also indicated that the relationship is taking on a more serious tone.

The ex-wife moved back to the area about six months ago.  The psychologist knows that the ex-wife had been struggling with isolation and loneliness as well.  The psychologist, her husband, and his ex-wife are on good terms.  They see her regularly for informal family events and do holidays together with their adult children and grandchildren.

After the session is over, the psychologist has time to reflect on her concerns.  The psychologist feels stuck and overwhelmed by her present situation.  She calls you for an ethics consult.

What are the ethical issues involved?

What would you suggest that she does?

With whom does the psychologist discuss the multiple roles? 

With only the patient?

With the patient and the ex-wife?

With her husband, the patient and the ex-wife?

Can the psychologist continue the treatment relationship with the patient?

Even if they terminate therapy, how does the psychologist cope with family gatherings since she knows significant details about her patient’s life?

Hospitals Mine Their Patients' Records In Search Of Customers

Critics say hospitals cherry pick best-paying patients

By Phil Galewitz
Kaiser Health News

Originally published February 5, 2012

When the oversized postcard arrived last August from Provena St. Joseph Medical Center promoting a lung cancer screening for current or former smokers over 55, Steven Boyd wondered how the hospital had found him.

Boyd, 59, of Joliet, Ill., had smoked for decades, as had his wife, Karol.

Provena didn't send the mailing to everyone who lived near the hospital, just those who had a stronger likelihood of having smoked based on their age, income, insurance status and other demographic criteria.

The nonprofit center is one of a growing number of hospitals using their patients' health and financial records to help pitch their most lucrative services, such as cancer, heart and orthopedic care. As part of these direct mail campaigns, they are also buying detailed information about local residents compiled by consumer marketing firms — everything from age, income and marital status to shopping habits and whether they have children or pets at home.

Hospitals say they are promoting needed services, such as cancer screenings and cholesterol tests, but they often use the data to target patients with private health insurance, which typically pay higher rates than government coverage. At an industry conference last year, Provena Health marketing executive Lisa Lagger said such efforts had helped attract higher-paying patients, including those covered by "profitable Blue Cross and less Medicare."

Strategy Draws Fire

While the strategies are increasing revenues, they are drawing fire from patient advocates and privacy groups, who criticize the hospitals for using private medical records to pursue profits.

Doug Heller, executive director of Consumer Watchdog, a California-based consumer advocacy group, says he is bothered by efforts to "cherry pick" the best-paying patients.

"When marketing is picking and choosing based on people's financial status, it is inherently discriminating against patients who have every right and need for medical information," Heller says. "This is another example of how our health system has gone off the rails."

Deven McGraw, director of the health privacy project at the Center for Democracy and Technology in Washington, says federal law allows hospitals to use confidential medical records to inform patients about things that may help them. 

The whole story is here.

Standing Their Ground

by Libby Nelson

Inside Higher Ed

Originally published February 3, 2012

WASHINGTON -- At a panel discussion at the Council for Christian Colleges and Universities’ annual meeting of presidents today, the presenters made one thing clear: American culture may have changed, but their institutions’ interpretation of the Bible -- which views homosexuality as immoral -- will not.

So the discussion, as described by the panelists and members of the audience, dealt not with whether colleges should change their attitudes toward gay students, but how to deal with the controversy that breaks out when students or alumni pressure a college to change.

But the fact that the session, which was closed to reporters, was held at all is an acknowledgment that CCCU colleges -- which all require professors to sign “statements of faith” in Christian doctrine, and many of which have behavioral requirements for their student body, including on sexuality -- most likely have gay students on campus and will confront difficult situations when an increasingly accepting culture clashes with the colleges’ theological beliefs.

“It’s a conversation that’s here to stay, and we want the conversation to be both honest and fair,” said Gayle Beebe, president of Westmont College.

Last year, a group of 31 gay and lesbian Westmont alumni wrote a letter to the college, saying they had lived in an environment of “doubt, loneliness and fear” while enrolled there. More than 100 additional alumni signed on in support, and more than 50 faculty members signed a letter in response, asking forgiveness for causing the students pain.

A few months later, an openly gay student at Messiah College, in Pennsylvania, told the Harrisburg Patriot-News that he planned to transfer after two semesters of bullying. Students had excluded him, he said, a professor had called him an “abomination,” he received death threats on Facebook, and his wallet, keys and student ID were stolen, among other incidents, he said.

“It was a very difficult situation,” said Kim Phipps, Messiah’s president, another member of the panel, in part because the college could not counter accusations without revealing private information about the student himself.

The entire story is here.

Georgia Court Overturns Assisted Suicide Restrictions

Court Finds that Law Banning People from Advertisng Suicide Violated Free Speech Rights

By Greg Bluestein

Associated Press

Georgia's top court struck down a state law that restricted assisted suicides, siding on Monday with four members of a suicide group who said the law violated their free speech rights.

The Georgia Supreme Court's unanimous ruling found that the law violates the free speech clauses of the U.S. and Georgia constitution. It means that four members of the Final Exit Network who were charged in February 2009 with helping a 58-year-old cancer-stricken man die won't have to stand trial, defense attorneys said.

Georgia law doesn't expressly forbid assisted suicide. But lawmakers in 1994 adopted a law that bans people from publicly advertising suicide, hoping to prevent assisted suicide from the likes of Dr. Jack Kevorkian, the late physician who sparked the national right-to-die debate.

The law makes it a felony for anyone who "publicly advertises, offers or holds himself out as offering that he or she will intentionally and actively assist another person in the commission of suicide and commits any overt act to further that purpose."

The court's opinion, written by Justice Hugh Thompson, found that lawmakers could have imposed a ban on all assisted suicides with no restriction of free speech, or sought to prohibit all offers to assist in suicide that were followed by the act. But lawmakers decided to do neither, he said.

"The State has failed to provide any explanation or evidence as to why a public advertisement or offer to assist in an otherwise legal activity is sufficiently problematic to justify an intrusion on protected speech rights," the ruling said.

State attorneys said they were reviewing the order. The network's members said they were thrilled with the decision.

'Turned out to be a boondoggle'

"This was politically motivated and ideologically driven as opposed to being, in any way, motivated by sound legal practice," said Ted Goodwin, the group's former president and one of the four defendants. "I'm just sorry that as many people have been put through what they've been put through in what turned out to be a boondoggle."

The challenge was brought by four members of the network who were arrested in February 2009 after John Celmer's death at his north Georgia home. They were arrested after an eight-month investigation by state authorities, in which an undercover agent posing as someone seeking to commit suicide infiltrated the group. Prosecutors say group members helped Celmer use an "exit hood" connected to a helium tank to kill himself.

The entire story is here.