Health Information Portability Research Articles

Which information locations in covered entities under HIPAA must be secured first? A multi-criteria decision-making approach.

Creating adequate safeguards for physical and online locations (e.g., desktop computers, network servers) where protected health information (PHI) may be breached is critical for management within entities compliant with the Health Information Portability and Accountability Act (HIPAA). With the increasing complexity of cyber breaches and budgetary issues, prioritizing which locations require the most immediate attention by top management through a data-driven model is more important than ever. Using CORAS threat modeling and five methods for multi-criteria decision-making, these locations were ranked from greatest to least risk of data breaches. Statistical methods were subsequently used for consistency and robustness checks. The findings illustrate that each type of covered entity under HIPAA must prioritize a different set of locations to safeguard first: health care providers must focus on the security of network servers, other portable electronic devices, and category of others (i.e., miscellaneous locations); health plans must focus on the security of paper and films, network servers, and others; and business associates must focus on the security of category of others, network servers, and other portable electronic devices. Combined with data on the source of the breaches (external vs. internal) and type of threats (e.g., hacking, theft), these findings provide recommendations for risk identification for privacy officers across health care.

A Lurking Threat: Counselor Practices to Guard Against Cyber Threats

As a result of shifts in global power, the growth of cyber capabilities worldwide, and the impact of COVID-19 on the increasing use of technology in varied workplaces, the potential for threat and disruption to mental health facilities is expected to increase. Counselors and their clients are vulnerable to these threats any time they share data online with each other, with third-party payers, and with allied health professionals. In fact, any private information stored digitally is potentially at risk for exploitation or theft. This current environment highlights the need for an intentional process and approach that can help mental health counselors understand their digital assets and vulnerabilities in order to anticipate and protect against potential cyber threats. This type of process can be facilitated through the application of cyber intelligence and cybersecurity principles to online counseling services in order to address ethical and legal obligations of counselors and to assuage client fears about potential privacy breaches. When counselors keep client data safe, Health Information Portability and Accountability Act and Family Educational Rights and Privacy Act violations are less likely to occur in a variety of settings where clients may be seen. An overview of the need for cybersecurity, a framework for bolstering cybersecurity, and specific guidelines for counselors are provided.

Peripherally Inserted Central Line Catheters following Hand and Wrist Infections.

The PearlDiver Patients Records Database was queried to identify patients who underwent treatment for infection of the hand, wrist, and forearm between 2010 and 2018. Logistic regression analysis was utilized to evaluate the association of patient-related risk factors with PICC utilization, complications, readmissions, and length of stay (LOS). A total of 24,665 patients with an upper extremity infection were included in the study. Ultimately, 416 patients required a PICC placement (1.69%). Patients with older age, male gender, certain medical comorbidities, and infection involving deeper structures were more likely to require a PICC. Ninety-day all-cause medical complication rates were significantly higher for the PICC group (19.7% versus 6.7%) compared to those without. Any hospital readmission rates were significantly higher for PICC group at 90 days (28.4% versus 6.3%) and 1 year (35.8% versus 10.9%). Readmission rates remained slightly higher at 1 year for both groups. The PICC group demonstrated significantly longer LOS by 2 days (7.72 days versus 5.14 days). While not required for the majority of hand, wrist, and forearm infections, PICC placement is associated with increased medical complications, more frequent hospital readmissions, and longer LOS.

The Regulatory Environment of Telemedicine After COVID-19

The COVID-19 pandemic has created many barriers to providing health care, yet it also has created new opportunities. Although telemedicine was a nascent means of health care delivery before COVID-19, it now is one of the principal means for doing so today, and it is likely to remain so. Whether this will happen may depend in part on continued relaxation of regulations that hampered it before the pandemic. Whereas enforcement of compliance with Health Information Portability and Accountability Act will most likely resume, platform operators and providers have had an opportunity to prepare for this. State licensure requirements may also resume; however, the regulations were in the process of becoming more liberal before COVID-19 so that process might continue. There is no reason to anticipate that payment for telemedicine services including check-ins, remote physiologic and therapeutic monitoring, and relaxation of location and service requirements will end. For these reasons, telemedicine therefore is likely to continue as an important part of medical practice.

"I Agree to Disagree": Comparative Ethical and Legal Analysis of Big Data and Genomics for Privacy, Consent, and Ownership.

Statement of Purpose: Digital healthcare, as it relates to big data and genomics, presents a real threat to privacy and ownership rights for individuals and society.Research Question/Hypothesis: Our experience with genomics provides a lens to facilitate the way we navigate toward a future health data space. Contemporary and innovative legal and ethical models can be applied to concepts of privacy, ownership, and consent in relation to big data.Significance: Technological innovation has transformed healthcare at a faster rate than legal reform, security measures, and consent policies can adapt. The Health Information Portability and Accountability Act (HIPAA) has been recognized as a work in progress, with respect to big data as it relates to healthcare and individual wellbeing. The shortcomings of HIPAA, and its application to big data, can be paralleled with its prior limitations surrounding genomics in the last two decades. The Genetic Information and Nondiscrimination Act (2008) and Genomic Data Sharing Policy (2015) were established to overcome HIPAA’s inadequacies concerning genetic discrimination and security. These policies can serve as a basic model for our approach to legislative reform as it relates to privacy risks with big data generated in healthcare and from healthy individuals in society who are not patients. In addition to notions of privacy, concepts of ownership and consent have become increasingly vague and opaque. The technological advancements have facilitated access and transmission of information, such that big data can be sold for financial gain for commercial enterprise. This applies to genomics, with companies like 23andMe, in addition to big data, as it relates to big tech giants like Apple or Google who oversee wearable and search term data. Clarity of ownership within a digital healthcare arena needs to be defined through ethical and legal frameworks at a global level.Approach: A narrative review of the literature published between 2010 and 2021 was performed using PubMed and Google Scholar. Articles discussing privacy, security, ownership, big data, and genomics were included as relevant literature.Importance: As a society, we are at a crossroads; we must determine the extent of privacy that we are willing to give for science and society. We cannot continue with the current status quo in hope that individual will be used for the greater good of society. We need to strive for a cohesive approach to combat privacy violations by encouraging legislative reform, ethical accountability, and individual responsibility.

A Policy and Practice Review of Consumer Protections and Their Application to Hospital-Sourced Data Aggregation and Analytics by Third-Party Companies.

The Office of the National Coordinator for Health Information Technology estimates that 96% of all U.S. hospitals use a basic electronic health record, but only 62% are able to exchange health information with outside providers. Barriers to information exchange across EHR systems challenge data aggregation and analysis that hospitals need to evaluate healthcare quality and safety. A growing number of hospital systems are partnering with third-party companies to provide these services. In exchange, companies reserve the rights to sell the aggregated data and analyses produced therefrom, often without the knowledge of patients from whom the data were sourced. Such partnerships fall in a regulatory grey area and raise new ethical questions about whether health, consumer, or health and consumer privacy protections apply. The current opinion probes this question in the context of consumer privacy reform in California. It analyzes protections for health information recently expanded under the California Consumer Privacy Act (“CA Privacy Act”) in 2020 and compares them to protections outlined in the Health Information Portability and Accountability Act (“Federal Privacy Rule”). Four perspectives are considered in this ethical analysis: 1) standards of data deidentification; 2) rights of patients and consumers in relation to their health information; 3) entities covered by the CA Privacy Act; 4) scope and complementarity of federal and state regulations. The opinion concludes that the CCPA is limited in its application when health information is processed by a third-party data aggregation company that is contractually designated as a business associate; when health information is deidentified; and when hospital data are sourced from publicly owned and operated hospitals. Lastly, the opinion offers practical recommendations for facilitating parity between state and federal health data privacy laws and for how a more equitable distribution of informational risks and benefits from the sale of aggregated hospital data could be fostered and presents ways both for-profit and nonprofit hospitals can sustain patient trust when negotiating partnerships with third-party data aggregation companies.

Employee Testing, Tracing, and Disclosure as a Response to the Coronavirus Pandemic

As the COVID-19 pandemic continues to devastate the United States, the federal government has largely failed to implement a national program to prevent and contain the virus. As a result, many employers have undertaken their own workplace coronavirus mitigation efforts. This essay examines, in three parts, the legal framework surrounding employer systems of workplace testing, tracing, and disclosure. It first examines the legal issues surrounding employer-mandated COVID-19 testing and temperature checks, especially issues arising under the Americans with Disabilities Act (ADA) and Health Information Portability and Accountability Act (HIPAA). Regarding employer contact tracing efforts, the essay next reviews the multitude of new digital tools and applications designed to aid in contact tracing and how these may implicate various state and federal privacy laws. Finally, the essay looks into employer disclosure of employee infections, including legal ramifications under the ADA, HIPAA, and other privacy laws. Our conclusion: employer testing, tracing, and disclosure programs are legally feasible but require careful planning and execution to protect employee privacy interests.

Cybersecurity Threats and Solutions in the Current E-Healthcare Environment: A Situational Analysis

The need for cybersecurity measures in the field of healthcare is becoming more prescient given both the increased sophistication of cyber criminal activity and the increased prevalence of low-security mobile devices1. Also, hospitals have been slower to increase cybersecurity, but has become an increasing target due to the increased security of the financial industry2. The implementation of the Health Information Portability and Accountability Act (HIPAA) has made patient records more portable and accessible, and created more opportunities for breaches1. The Health Information Technology for Economic and Clinical Health Act (HITECH) promoting greater implementation of electronic systems for coordination and records. The medical field is also becoming increasing dependent on connectivity, and people are wary of the threats to automated and robotic safety procedures. The threat of high dependence on technology for medical practices presents risks in and of itself, such as cases where it disrupts communication between healthcare professionals, or fails to account for user failures that could be prevented with better feedback before implementation. Healthcare providers are in a difficult position, trying to balance the need for quick, responsive systems for users, and need for cybersecurity measures that can slow down the computer system. In the following pages, Lewin's field mapping approach will facilitate an analysis of the current largest cybersecurity threats and current research on the best methods of thwarting these vulnerabilities.

NIH support of mobile, imaging, pervasive sensing, social media and location tracking (MISST) research: laying the foundation to examine research ethics in the digital age

Mobile Imaging, pervasive Sensing, Social media and location Tracking (MISST) tools used in research are raising new ethical challenges for scientists and the Institutional Review Boards (IRBs) charged with protecting human participants. Yet, little guidance exists to inform the ethical design and the IRB’s regulatory review of MISST research. MISST tools/methods produce personal health data that is voluminous and granular and, which may not be subject to policies like the Health Information Portability and Accessibility Act (HIPAA). The NIH Research Portfolio Online Reporting Tools (RePORTER) database was used to identify the number, nature and scope of MISST-related studies supported by the NIH at three time points: 2005, 2010 and 2015. The goal was to: 1-examine the extent to which the NIH is supporting this research and, 2-identify how these tools are being used in research. The number of funded MISST research projects increased 384% from 2005 to 2015. Results revealed that while funding of MISST research is growing, it only represented about 1% of the total NIH budget in 2015. However, the number of institutes, agencies, and centers supporting MISST research increased by roughly 50%. Additionally, the scope of MISST research is diverse ranging from use of social media to track disease transmission to personalized interventions delivered through mobile health applications. Given that MISST research represents about 1% of the NIH budget and is on an increasing upward trajectory, support for research that can inform the ethical, legal and social issues associated with this research is critical.

Healthcare Marketing: Who? What? How?

The Department of Health and Human Services (HHS) has struggled with how to create a workable prohibition on marketing, i.e. communications to patients regarding specific products or services, within the framework of the Health Information Portability and Accountability Act (HIPAA) Privacy Rule. In response to modifications to the rule in 2013, a prescription refill reminder company, Adheris, challenged the marketing prohibition as an unconstitutional content-based and speaker-based restrictions on speech. In response to the challenge, HHS settled with Adheris, agreeing to delay enforcement and provide additional guidance. This Article evaluates the unresolved constitutional question presented by Adheris v. Sebelius — whether the HIPAA Marketing prohibition constitutes unconstitutional restrictions on speech. The Article discusses the creation of the marketing prohibition from the initial proposed rulemaking in 1999 to the 2013 Health Information Technology for Economic and Clinical Health (HITECH) Omnibus Rule. The Article then reviews applicable First Amendment law, with particular focus on the prescription detailing cases filed by IMS Health which culminated in Sorrell v. IMS Health and the Supreme Court's heightened review of speaker-based speech restrictions. The Article concludes by setting forth whether and how constitutional prohibitions can be created.

E-Scripts and Cell Phones: A Blessing or Curse?

E-scripts have been used as part of computerized provider order entry implementation for several years now, particularly with the passage of the American Recovery and Reinvestment Act, Meaningful Use, the Health Information Portability and Accountability Act, the Health Information Technology for Economic and Clinical Health Act, and other laws and regulations. This case study seeks to focus on 2 specific aspects of the effect of increasing electronic technology within health care: e-prescriptions and cell phones or smartphones.

Learning to identify Protected Health Information by integrating knowledge- and data-driven algorithms: A case study on psychiatric evaluation notes

De-identification of clinical narratives is one of the main obstacles to making healthcare free text available for research. In this paper we describe our experience in expanding and tailoring two existing tools as part of the 2016 CEGS N-GRID Shared Tasks Track 1, which evaluated de-identification methods on a set of psychiatric evaluation notes for up to 25 different types of Protected Health Information (PHI). The methods we used rely on machine learning on either a large or small feature space, with additional strategies, including two-pass tagging and multi-class models, which both proved to be beneficial. The results show that the integration of the proposed methods can identify Health Information Portability and Accountability Act (HIPAA) defined PHIs with overall F1-scores of ∼90% and above. Yet, some classes (Profession, Organization) proved again to be challenging given the variability of expressions used to reference given information.

Obama Signs Landmark Legislation With Major Mental Health Provisions

Back to table of contents Previous article Next article Government NewsFull AccessObama Signs Landmark Legislation With Major Mental Health ProvisionsAaron LevinAaron LevinSearch for more papers by this authorPublished Online:30 Dec 2016https://doi.org/10.1176/appi.pn.2017.1a10AbstractThe last major piece of health legislation from the 114th Congress links treatment and research to prior efforts on health care reform, says President Obama.President Barack Obama signed the wide-ranging $6 billion 21st Century Cures Act into law on December 13, 2016, a week after it passed by overwhelming margins in both the House of Representatives and Senate.In one of his last official acts at the White House, President Barack Obama signs the 21st Century Cures Act in an emotional ceremony that recognized the bipartisan support that pushed the legislation over the finish line. The new law contains a number of provisions that will benefit people with mental illness.Aaron LevinThe law includes significant mental health and substance abuse treatment components as well as research funding for Obama’s Precision Medicine Initiative, the BRAIN initiative, and Vice President Joe Biden’s cancer “moonshot.” There are also provisions intended to speed up the Food and Drug Administration’s review of new drugs.At the White House signing ceremony, the president thanked Democrats and Republicans who had worked together on the legislation.“I’m confident that it will lead to better years and better lives for millions of Americans, the work that you’ve done,” said Obama. “I hope in the years ahead, Congress keeps working together in a bipartisan fashion to move us forward and not backward in the health of our people.”Among other provisions, the law establishes an assistant secretary for mental health and substance abuse who will take over the functions of the current SAMHSA administrator. The assistant secretary will appoint a chief medical officer (CMO) to evaluate existing programs and promote evidence-based clinical care. The CMO will not necessarily be a psychiatrist, but the qualifications include holding a medical degree and having experience treating patients with mental illness or substance use disorders.In addition, the law will promote workforce development and integrated care, strengthen enforcement of parity, and improve how the federal government finances and manages evidence-based mental health services.“It was an honor to see the president sign this significant piece of legislation,” said APA President Maria A. Oquendo, M.D., Ph.D., who attended the ceremony. “This marks the passage of the first mental health reform bill in more than 50 years and is long overdue. We should enjoy this moment, but that does not mean our work is over.”“Everything in the act has been authorized, and the continuing resolution that funds government operations until April 28 also appropriates $20 million for the FDA, $352 million for NIH, and $500 million in grants to states to combat the opioid abuse epidemic,” said Ariel González, J.D., M.A., chief of APA’s Department of Government Relations.Obama noted that his administration’s health care reform efforts set the foundation for the 21st Century Cures Act, which now provides access to services for the 20 million Americans newly insured by the Affordable Care Act.The law incorporates elements of legislation previously put forth by Reps. Tim Murphy (R-Pa.) and Eddie Bernice Johnson (D-Texas) in the Helping Families in Mental Health Crisis Act and the Mental Health Reform Act of 2016, sponsored by Sens. Chris Murphy (D-Conn.) and Bill Cassidy (R-La.). APA worked closely with those legislators over the past three years to help craft the mental health provisions in the final bill.“In 2013, a group of Pennsylvania psychiatrists asked me to join in helping Rep. Murphy work on a new comprehensive mental health reform bill,” recalled APA CEO and Medical Director Saul Levin, M.D., M.P.A. “It took three years working with Rep. Murphy to reach the final bipartisan law included in the 21st Century Cures Act. I am proud that APA signed on from the beginning, and that APA President Maria Oquendo, M.D., Ph.D., could attend the signing by President Obama.”To combat the opioid epidemic, the law provides $1 billion over two years to bolster prescription drug monitoring programs, implement prevention activities, provide training for health care providers, and expand access to opioid treatment programs.The law also supports recruitment, training, and retention of the mental health workforce by authorizing a demonstration program that provides five-year grants for residents and fellows who practice psychiatry and addiction medicine in underserved communities. Other mental health clinicians are eligible for similar grants.The act calls for “clarification” of the uses and disclosures of health information covered by the Health Information Portability and Accountability Act (HIPAA), a longstanding complaint of patients’ families. ■“Remarks by the President and the Vice President at the 21st Century Cures Act Bill Signing” can be accecssed here. ISSUES NewArchived

Cyber-Security Issues in Healthcare Information Technology.

In 1999-2003, SIIM (then SCAR) sponsored the creation of several special topic Primers, one of which was concerned with computer security. About the same time, a multi-society collaboration authored an ACR Guideline with a similar plot; the latter has recently been updated. The motivation for these efforts was the launch of Health Information Portability and Accountability Act (HIPAA). That legislation directed care providers to enable the portability of patient medical records across authorized medical centers, while simultaneously protecting patient confidentiality among unauthorized agents. These policy requirements resulted in the creation of numerous technical solutions which the above documents described. While the mathematical concepts and algorithms in those papers are as valid today as they were then, recent increases in the complexity of computer criminal applications (and defensive countermeasures) and the pervasiveness of Internet connected devices have raised the bar. This work examines how a medical center can adapt to these evolving threats.

Self-Report Versus Medical Record for Mammography Screening Among Minority Women.

Self-report is the most common means of obtaining mammography screening data. The purpose of this study was to assess the accuracy of minority women's self-reported mammography by comparing their self-reported dates of mammograms with those in their medical records from a community-based randomized control trial. We found that out of 192 women, 116 signed the Health Information Portability and Accountability Act form and, among these, 97 had medical records that could be verified (97 / 116 = 83.6%). Ninety-two records matched where both sources confirmed a mammogram; 48 of 92 (52.2%) matched perfectly on self-reported date of mammogram. Complexities in the verification process warrant caution when verifying self-reported mammography screening in minority populations. In spite of some limitations, our findings support the usage of self-reported data on mammography as a validated tool for other researchers investigating mammography screening among minority women who continue to have low screening rates.

Professional Confidentiality: A Guide for Self-Vigilance

When pharmacists discuss confidentiality, they are usually referring to patient confidentiality. Ever since the 1996 Health Information Portability and Accountability Act, we have changed how we do business from prescription processing to protection of electronic health information. However, pharmacists deal with many other confidential processes. Are we as vigilant about maintaining confidentiality in these areas?

Legal Issues in Pediatric Transport

The field of pediatric medical transport presents a number of legal questions and challenges. Relevant laws and regulations come from a variety of federal, state, and local agencies. Medical liability arises when a duty to a patient is breached, causing damages. The Emergency Medical Treatment and Active Labor Act requires that a patient receives both a medical screening examination and stabilization of any emergency medical condition. The Health Information Portability and Accountability Act requires that protected health information is kept secure and only disclosed to authorized individuals. At the time of patient handoff during most transports, there are periods of shared responsibility. With constantly changing rules and regulations, it is important to have access to informed legal advice. Equally important is a commitment to providing high-quality, compassionate clinical care in a team-based environment with excellent documentation and communication.

Survey of Publicly Available State Health Databases

We surveyed every state and the District of Columbia to see what patient specific information states release on hospital visits and how much potentially identifiable information is released in those records. Thirty-three states release hospital discharge data in some form, with varying levels of demographic information and hospital stay details such as hospital name, admission and discharge dates, diagnoses, doctors who attended to the patient, payer, and cost of the stay. We compared the level of demographic and other data to federal standards set by the Health Information Portability and Accountability Act or HIPAA), which states do not have to adhere to for this type of data. We found that states varied widely in whether their data was HIPAA equivalent; while 13 were equivalent (or stricter) with demographic fields only 3 of the 33 states that released data did so in a form that was HIPAA equivalent across all fields.

From COWs to BYOD

From COWs to BYOD

Retrieval Studies in Orthopaedic Surgery: Editorial Comment: Learning Every Implant’s Story

Retrieval Studies in Orthopaedic Surgery: Editorial Comment: Learning Every Implant’s Story