Health Insurance Portability And Accountability Act Regulations Research Articles

A comparative study on HIPAA technical safeguards assessment of android mHealth applications

Protecting personal health records is becoming increasingly important as more people use Mobile Health applications (mHealth apps) to improve their health outcomes. These mHealth apps enable consumers to monitor their health-related problems, store, manage, and share health records, medical conditions, treatment, and medication. With the increase of mHealth apps accessibility and usability, it is crucial to create, receive, maintain or transmit protected health information (PHI) on behalf of a covered entity or another business associate. The Health Insurance Portability and Accountability Act (HIPAA) provides guidelines to the app developers so that the apps must be compliant with required and addressable Technical Safeguards. However, most mobile app developers, including mHealth apps are not aware of HIPAA security and privacy regulations. Therefore, a research opportunity has emerged to develop an analytical framework to assist the developer to maintain a secure and HIPAA-compliant source code and raise awareness among consumers about the privacy and security of sensitive and personal health information. We proposed an Android source code analysis framework that evaluates twelve HIPAA Technical Safeguards to check whether a mHealth application is HIPAA compliant or not. The implemented meta-analysis and data-flow analysis algorithms efficiently identify the risk and safety features of mHealth apps that violate HIPAA regulations. Furthermore, we addressed API level checking for secure data communication mandated by recent CMS guidelines between third-party mobile health apps and EHR systems. Experimentally, a web-based tool has been developed for evaluating the efficacy of analysis techniques and algorithms. We have investigated 200 top popular Medical and Health & Fitness category Android apps collected from Google Play Store. We identified from the comparative analysis of the HIPAA rules assessment results that authorization to access sensitive resources, data encryption–decryption, and data transmission security is the most vulnerable features of the investigated apps. We provided recommendations to app developers about the most common mistake made at the time of app development and how to avoid these mistakes to implement secure and HIPAA-compliant apps. The proposed framework enables us to develop an IDE plugin for mHealth app developers and a web-based interface for mHealth app consumers.

Legal Governance of Brain Data Derived from Artificial Intelligence

Legal Governance of Brain Data Derived from Artificial Intelligence

Correction: Good News and Bad News About Incentives to Violate the Health Insurance Portability and Accountability Act (HIPAA): Scenario-Based Questionnaire Study.

[This corrects the article DOI: 10.2196/15880.].

Good News and Bad News About Incentives to Violate the Health Insurance Portability and Accountability Act (HIPAA): Scenario-Based Questionnaire Study.

BackgroundThe health care industry has more insider breaches than any other industry. Soon-to-be graduates are the trusted insiders of tomorrow, and their knowledge can be used to compromise organizational security systems.ObjectiveThe objective of this paper was to identify the role that monetary incentives play in violating the Health Insurance Portability and Accountability Act’s (HIPAA) regulations and privacy laws by the next generation of employees. The research model was developed using the economics of crime literature and rational choice theory. The primary research question was whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives.MethodsFive scenarios were developed to determine if monetary incentives could be used to influence subjects to illegally obtain health care information and to release that information to individuals and media outlets. The subjects were also asked about the probability of getting caught for violating HIPAA laws. Correlation analysis was used to determine whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives.ResultsMany of the subjects believed there was a high probability of being caught. Nevertheless, many of them could be incentivized to violate HIPAA laws. In the nursing scenario, 45.9% (240/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, that is acceptable for violating HIPAA laws. In the doctors’ scenario, 35.4% (185/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. In the insurance agent scenario, 45.1% (236/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. When a personal context is involved, the percentages substantially increase. In the scenario where an experimental treatment for the subject’s mother is needed, which is not covered by insurance, 78.4% (410/523) of the participants would accept US $100,000 from a media outlet for the medical records of a politician. In the scenario where US $50,000 is needed to obtain medical records about a famous reality star to help a friend in need of emergency medical transportation, 64.6% (338/523) of the participants would accept the money.ConclusionsA key finding of this study is that individuals perceiving a high probability of being caught are less likely to release private information. However, when the personal context involves a friend or family member, such as a mother, they will probably succumb to the incentive, regardless of the probability of being caught. The key to reducing noncompliance will be to implement organizational procedures and constantly monitor and develop educational and training programs to encourage HIPAA compliance.

Çorba: crowdsourcing to obtain requirements from regulations and breaches

Modern software systems are deployed in sociotechnical settings, combining social entities (humans and organizations) with technical entities (software and devices). In such settings, on top of technical controls that implement security features of software, regulations specify how users should behave in security-critical situations. No matter how carefully the software is designed and how well regulations are enforced, such systems are subject to breaches due to social (user misuse) and technical (vulnerabilities in software) factors. Breach reports, often legally mandated, describe what went wrong during a breach and how the breach was remedied. However, breach reports are not formally investigated in current practice, leading to valuable lessons being lost regarding past failures. Our research aim is to aid security analysts and software developers in obtaining a set of legal, security, and privacy requirements, by developing a crowdsourcing methodology to extract knowledge from regulations and breach reports. We present Corba, a methodology that leverages human intelligence via crowdsourcing, and extracts requirements from textual artifacts in the form of regulatory norms. We evaluate Corba on the US healthcare regulations from the Health Insurance Portability and Accountability Act (HIPAA) and breach reports published by the US Department of Health and Human Services (HHS). Following this methodology, we have conducted a pilot and a final study on the Amazon Mechanical Turk crowdsourcing platform. Corba yields high quality responses from crowd workers, which we analyze to identify requirements for the purpose of complementing HIPAA regulations. We publish a curated dataset of the worker responses and identified requirements. The results show that the instructions and question formats presented to the crowd workers significantly affect the response quality regarding the identification of requirements. We have observed significant improvement from the pilot to the final study by revising the instructions and question formats. Other factors, such as worker types, breach types, or length of reports, do not have notable effect on the workers’ performance. Moreover, we discuss other potential improvements such as breach report restructuring and text highlighting with automated methods.

Athletic Training Students' Knowledge of Ethical and Legal Practice with Technology and Social Media

Context:Technology, social media, and access to health care continue to grow simultaneously. There is limited research on the knowledge of athletic training students regarding the ethical and legal practice of protected health information using technology and social media.Objective:To explore social media use of athletic training students and to determine their knowledge of patient privacy regulations within social media and technology.Design and Setting:Online survey instrument and knowledge assessment.Patients or Other Participants:A total of 652 athletic training students.Intervention(s):A knowledge assessment of 12 items based on the governance and use of patient privacy compliance in health care within the context of athletic training students' clinical experiences.Main Outcome Measure(s):An instrument of 26 questions, including 14 demographic and 12 knowledge items, was developed and content validated using a Delphi panel of experts in athletic training, health care information technology, and risk management lawyers. Descriptive statistics and independent t tests were calculated.Results:Athletic training students stated they had received previous education (n = 587 of 637, 92.2%) regarding Health Insurance Portability and Accountability Act (HIPAA) regulations, and had an average of 6.81 ± 2.75 active social media accounts. Only 24.2% (n = 154 of 636) of respondents stated their professional athletic training program had a social media policy that was strictly enforced. We identified a lack of knowledge of best practice by athletic training students, with an average knowledge assessment score of 4.92 ± 1.7 out of 13 (37.8%). Total knowledge scores were significantly different (P = .008) if the respondent had previous HIPAA education.Conclusions:The respondents scored poorly on the knowledge assessment despite previous education related to HIPAA regulations. Athletic training educators should seek out strategies to adapt professional or preprofessional curricula to incorporate health care informatics and ethics to adapt to the current culture of technology and social media.

The role of information security learning and individual factors in disclosing patients' health information

One of the most vulnerable stakeholders that may violate health information privacy prescribed in HIPAA (Health Insurance Portability and Accountability Act) are nursing students who have some limited access to EMR systems to retrieve health records while freely communicating with patients and relevant stakeholders. However, limited attention has been given to nursing students' deviant behaviors. To fill this gap, this study develops a research model of a nursing student's behavior of disclosing health information by identifying the deterrent effects of health information security awareness (HISA) nurtured by nursing schools and personal values such as personal norms and self-control.Our study empirically tests the model and found that three learning components ((1) general information security awareness, (2) health information security regulation awareness, and (3) punishment severity awareness) are significantly important to develop HISA. We find that HISA significantly affects personal norms and self-control which play as deterrence against the intention to disclose patients' health information.As the importance of complying with HIPAA regulations and information security policies by employees who work in health care industry increases, our findings shed new light on the role of HISA and personal values in nursing education and the health care industry's efforts to protect patients' health information.

Digital Photograph Security: What Plastic Surgeons Need to Know.

Sharing and storing digital patient photographs occur daily in plastic surgery. Two major risks associated with the practice, data theft and Health Insurance Portability and Accountability Act (HIPAA) violations, have been dramatically amplified by high-speed data connections and digital camera ubiquity. The authors review what plastic surgeons need to know to mitigate those risks and provide recommendations for implementing an ideal, HIPAA-compliant solution for plastic surgeons' digital photography needs: smartphones and cloud storage. Through informal discussions with plastic surgeons, the authors identified the most common photograph sharing and storage methods. For each method, a literature search was performed to identify the risks of data theft and HIPAA violations. HIPAA violation risks were confirmed by the second author (P.B.R.), a compliance liaison and privacy officer. A comprehensive review of HIPAA-compliant cloud storage services was performed. When possible, informal interviews with cloud storage services representatives were conducted. The most common sharing and storage methods are not HIPAA compliant, and several are prone to data theft. The authors' review of cloud storage services identified six HIPAA-compliant vendors that have strong to excellent security protocols and policies. These options are reasonably priced. Digital photography and technological advances offer major benefits to plastic surgeons but are not without risks. A proper understanding of data security and HIPAA regulations needs to be applied to these technologies to safely capture their benefits. Cloud storage services offer efficient photograph sharing and storage with layers of security to ensure HIPAA compliance and mitigate data theft risk.

Technology in Counselor Education: HIPAA and HITECH as Best Practice

The use of technology in counseling is expanding. Ethical use of technology in counseling practice is now a stand-alone section in the 2014 American Counseling Association Code of Ethics. The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act provide a framework for best practices that counselor educators can utilize when incorporating the use of technology into counselor education programs. This article discusses recommended guidelines, standards, and regulations of HIPAA and HITECH that can provide a framework through which counselor educators can work to design policies and procedures to guide the ethical use of technology in programs that prepare and train future counselors.Keywords: counselor education, technology, best practice, HIPAA, HITECHThe enactment of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) brought forth a variety of standards addressing the privacy, security and transaction of individual protected health (PHI; Wheeler & Bertram, 2012). According to the language of HIPAA (2013, §160.103), PHI is defined as individually identifiable health information (p. 983) that is transmitted by or maintained in electronic media or any other medium, with the exception of educational or employment records. identifiable health information is specified as follows:Information, including demographic data, that relates to:* the individual's past, present or future physical or mental health or condition,* the provision of health care to the individual, or* the past, present, or future payment for the provision of health care to the individual, and that identifies the individual for which there is a reasonable basis to believe can be used to identify the individual. Individually identifiable health includes many common identifiers. (U.S. Department of Health and Human Services [HHS], n.d.-b, p. 4)The HIPAA standards identify 18 different elements that are considered to be part of one's PHI. These include basic demographic data such as names, street addresses, elements of dates (e.g., birth dates, admission dates, discharge dates) and phone numbers. It also includes such as vehicle identifiers, Internet protocol address numbers, biometric identifiers and photographic images (HIPAA, 2013, § 164.514, b.2.i).According to language in HIPAA, the applicability of its standards, requirements and implementation only apply to entities, which are (1) a health plan (2) a health care clearinghouse (3) a health care provider who transmits any health in electronic form in connection with [HIPAA standards and policies] (HIPAA, 2013, § 160.102). Covered entities have an array of required and suggested privacy and security measures that they must take into consideration in order to protect individuals' PHI; failure to protect individuals' could result in serious fines. For example, one recent ruling found a university medical training clinic to be in violation of HIPAA statutes when network firewall protection had been disabled. The oversight resulted in a $400,000 penalty (Yu, 2013). Moreover, the recent implementation of the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 increased the fines resulting from failure to comply with HIPAA, including fines for individuals claiming they did not know that can range from $100-$50,000 (Modifications to the HIPAA Privacy, 2013, p. 5583). The final omnibus ruling of HIPAA-HITECH, enforcing these violations, went into effect on March 26, 2013 (Modifications to the HIPAA Privacy, 2013; Ostrowski, 2014). Enforcement of the changes from the HITECH Act on HIPAA standards began on September 23, 2013, for covered entities (Modifications to the HIPAA Privacy, 2013).Academic departments and universities must understand the importance of HIPAA and HITECH regulations in order to determine whether the department or university is considered a covered entity. …

TRUSTED CLOUD COMPUTING FRAMEWORK FOR HEALTHCARE SECTOR

Cloud computing is rapidly evolving due to its effi cient characteristics such as cost-effectiveness, availability and elasticity. Healthcare organizatio ns and consumers lose control when they outsource t heir sensitive data and computing resources to a third p arty Cloud Service Provider (CSP), which may raise security and privacy concerns related to data loss and misuse appealing threats. Lack of consumers’ knowledge about their data storage location may lea d to violating rules and regulations of Health Insu rance Portability and Accountability Act (HIPAA) that can cost them huge penalty. Fear of data breach by int ernal or external hackers may decrease consumers’ trust i n adopting cloud computing and benefiting from its promising features. We designed a HealthcareTrusted Cloud Computing (HTCC) framework that maintains security, privacy and considers HIPAA regulations. HTCC framework deploys Trusted Computing Group (TCG) technologies such as Trusted Platform Module (TPM), Trusted Software Stack (TSS), virtual Trusted Platform Module (vTPM), Trusted Network Connect (TNC) and Self Encrypting Drives (SEDs). We emphasize on using strong multi-factor authentic ation access control mechanisms and strict security controls, as well as encryption for data at storage , in-transit and while process. We contributed in customizing a cloud Service Level Agreement (SLA) by considering healthcare requirements. HTCC was evaluated by comparing with previous researchers’ work and conducting survey from experts. Results wer e satisfactory and showed acceptance of the framework. We aim that our proposed framework will assist in optimizing trust on cloud computing to be adopted i n healthcare sector.

Data governance requirements for distributed clinical research networks: triangulating perspectives of diverse stakeholders

There is currently limited information on best practices for the development of governance requirements for distributed research networks (DRNs), an emerging model that promotes clinical data reuse and improves timeliness of comparative effectiveness research. Much of the existing information is based on a single type of stakeholder such as researchers or administrators. This paper reports on a triangulated approach to developing DRN data governance requirements based on a combination of policy analysis with experts, interviews with institutional leaders, and patient focus groups. This approach is illustrated with an example from the Scalable National Network for Effectiveness Research, which resulted in 91 requirements. These requirements were analyzed against the Fair Information Practice Principles (FIPPs) and Health Insurance Portability and Accountability Act (HIPAA) protected versus non-protected health information. The requirements addressed all FIPPs, showing how a DRN's technical infrastructure is able to fulfill HIPAA regulations, protect privacy, and provide a trustworthy platform for research.

Are Forensic Evaluations “Health Care” and Are They Regulated by HIPAA?

Forensic mental health providers (FMHPs) typically do not release records to the examinee. The Health Insurance Portability and Accountability Act (HIPAA) federal regulations might change this position, given that they have created a basic right of access to health care records. This legislation has led to a disagreement regarding whether HIPAA regulates forensic evaluations. The primary argument (and the majority of scholarly citations) has been that such evaluations do not constitute “health care.” Specifically, in this position, the nature and purpose of forensic evaluations are not considered related to treatment (amelioration of psychopathology) of the patient. In addition, it asserts that HIPAA applies solely to treatment services; thus, forensic evaluations are inapplicable to HIPAA. We describe the evidence for and against this argument, the strengths and limitations of the evidence, and recent court decisions related to it. The weakest part of the “HIPAA does not regulate forensics” argument is that HIPAA has no exclusion criteria based on type of services. It only creates an inclusion criteria for providers; once “covered,” all services provided by that provider are thence forward “covered.” Authoritative evidence for patient access can be found in the HIPAA regulations themselves, the US Department of Health and Human Services’ commentaries, additional statements and disciplinary cases, the research literature, other agency opinion, and legal opinion. It appears that the evidence strongly suggests that, for those forensic mental health practitioners who are covered entities, HIPAA does apply to forensic evaluations. The implication is that FMHPs potentially face various federal, state, and civil sanctions for refusing to permit patient access to records.

Building public trust in uses of Health Insurance Portability and Accountability Act de-identified data

ObjectivesThe aim of this paper is to summarize concerns with the de-identification standard and methodologies established under the Health Insurance Portability and Accountability Act (HIPAA) regulations, and report some potential policies to address those concerns that were discussed at a recent workshop attended by industry, consumer, academic and research stakeholders.Target audienceThe target audience includes researchers, industry stakeholders, policy makers and consumer advocates concerned about preserving the ability to use HIPAA de-identified data for a range of important secondary uses.ScopeHIPAA sets forth methodologies for de-identifying health data; once such data are de-identified, they are no longer subject to HIPAA regulations and can be used for any purpose. Concerns have been raised about the sufficiency of HIPAA de-identification methodologies, the lack of legal accountability for unauthorized re-identification of de-identified data, and insufficient public transparency about de-identified data uses. Although there is little published evidence of the re-identification of properly de-identified datasets, such concerns appear to be increasing. This article discusses policy proposals intended to address de-identification concerns while maintaining de-identification as an effective tool for protecting privacy and preserving the ability to leverage health data for secondary purposes.

Design of RSA-CA Based E-Health System for Supporting HIPAA Privacy-Security Regulations

The privacy and the security regulations are two essential requirements of Health Insurance Portability and Accountability Act (HIPAA), recognized by US congress in 1996 as the US Federal Law followed by global e-health industry, in the protection of healthcare privacy. In this paper, a certificate authority (CA) based duality solution has been proposed to fulfill the HIPAA privacy and security regulations that supports both contract and smart card based systems. It presents a patient-centric e-health system based on RSA based public key certificate that allows secure sharing of healthcare information through internet. Doctors and relevant medical staff must have to take patients’ permission for online access to patients’ PHI data stored in the national medical center server (MCS). A copy of PHI text-data is stored in patients’ e-health smart card to support the duality. A random session key is generated in each appointment after prior authentication to upload and retrieve patients’ PHI data to or from MCS. One advantage is that the proposed CA based e-health system is easy implementable using existing security standards, tools and products. Discussions regarding the fulfillment of HIPAA regulations and comparison with the existing schemes have been provided to show the better performance of our scheme.

Patient Information Privacy Basics

You have accessThe ASHA LeaderBottom Line1 Sep 2011Patient Information Privacy Basics Kate RomanowJD Kate Romanow Google Scholar More articles by this author , JD https://doi.org/10.1044/leader.BML1.16092011.3 SectionsAbout ToolsAdd to favorites ShareFacebookTwitterLinked In ASHA recently hosted an online private-practice institute for audiologists and speech-language pathologists that focused on how to establish, manage, and grow a profitable private practice. Recorded lectures covered topics such as strategic business planning, fees and pricing, employment law basics, managing a fee-for-service practice, increasing referrals, using web-based and social media marketing, coding updates, Medicare billing, and claims and denials. Many of the participants in one of the sessions, “Data Privacy, Security, and Enforcement: HIPAA and More,” raised several questions during and after the institute on the Health Insurance Portability and Accountability Act (HIPAA). This article clarifies points discussed during the institute to help other clinicians understand HIPAA policies. The HIPAA privacy rule protects personal health information and outlines patients’ rights with respect to that information, while allowing disclosure of information needed for patient care. The HIPAA security rule specifies a series of administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and availability of electronic protected health information. Electronic protected health information includes, for example, patient data stored on a computer hard drive, or data transmitted via a computer for billing purposes. The following questions and answers outline basic HIPAA privacy and security regulations. Q: Do the HIPAA regulations apply to me? HIPAA compliance is required by all “covered entities,” defined as health plans, health care clearinghouses, and health care providers that transmit any health information in electronic form in connection with “transactions” covered under HIPAA. If you are a provider who, for example, sends patient information electronically to a billing company, then you are a “covered entity” and must comply with HIPAA regulations. Q: What transactions are covered under HIPAA? HIPAA regulations define “transaction” as the transmission of information between two parties to carry out financial or administrative activities related to health care. It includes the following types of information transmissions: Health care claims or equivalent encounter information. Health care payment and remittance advice. Coordination of benefits. Health care claim status. Enrollment and disenrollment in a health plan. Eligibility for a health plan. Health plan premium payments. Referral certification and authorization. First report of injury. Health claims attachments. Other transactions that the secretary of health and human services may prescribe by regulation (45 C.F.R. Section 160.103). Q: What does “electronic form” mean? HIPAA does not define “electronic form.” It does, however, define “electronic media” as the following: Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card. Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet, extranet (using Internet technology to link a business with information accessible only to collaborating parties), dial-up lines, leased lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including those by paper (facsimile) and by voice (telephone), are not considered e-transmissions via electronic media because the information did not exist in electronic form before the transmission (45 C.F.R. Section 160.103). Q: If I am a covered entity, what do I need to do to comply with HIPAA? You must protect the privacy of patient information. You must safeguard patient information sent electronically. For example, you must inform patients about the HIPAA privacy practices you observe and train employees about HIPAA requirements. Q: Are there sample notices of privacy practices? More information about HIPAA privacy notices is available at the Department of Health and Human Services website. ASHA includes a sample notice of privacy practices in its Practice Management Tools for SLPs available in the ASHA online store. Q: Where I can get more information? ASHA’s reimbursement web page includes an extensive section on HIPAA. An article in The ASHA Leader also outlines some basics. The Office of Civil Rights, which enforces the privacy and security rule, has information on its website. The Workgroup for Electronic Data Interchange [PDF] (of which ASHA is a member) has information to help small practices comply with HIPAA. The full HIPAA regulations are available at the Department of Health and Human Services website. (Be aware, however, that the most current version may not be posted.) Author Notes Kate Romanow, JD, director of health care regulatory advocacy, can be reached at [email protected]. Advertising Disclaimer | Advertise With Us Advertising Disclaimer | Advertise With Us Additional Resources FiguresSourcesRelatedDetails Volume 16Issue 9September 2011 Get Permissions Add to your Mendeley library History Published in print: Sep 1, 2011 Metrics Current downloads: 271 Topicsasha-topicsleader_do_tagasha-article-typesleader-topicsCopyright & Permissions© 2011 American Speech-Language-Hearing AssociationLoading ...

Pharmacy Student Perceptions of Adverse Event Reporting

To assess US pharmacy students' knowledge and perceptions of adverse event reporting. To gauge pharmacy students' impressions of adverse event reporting, a 10-question survey instrument was administered that addressed student perceptions of the reporting procedures of the Food and Drug Administration (FDA) and pharmaceutical manufacturers, as well as student understanding of the Health Insurance Portability and Accountability Act (HIPAA) and its relationship to adverse event reporting. Two hundred twenty-eight pharmacy students responded to the survey. The majority of respondents believed that the FDA is more likely than a pharmaceutical company to take action regarding an adverse event. There were misconceptions relating to the way adverse event reports are handled and the influence of HIPAA regulations on reporting. Communication between the FDA and pharmaceutical manufacturers regarding adverse event reports is not well understood by pharmacy students. Education about adverse event reporting should evolve so that by the time pharmacy students become practitioners, they are well acquainted with the relevance and importance of adverse event reporting.

The IRB Process Needs to Be Reexamined

To the Editor Grady1 has suggested a much needed reexamination of the way modern research is regulated by Institutional Review Boards (IRBs). We had a chance to directly witness the increase in the regulatory burden over a 20-year period. We resubmitted this past year (2010) a research protocol involving a noninvasive blood pressure monitor to our own IRB. This protocol was previously approved and studied in 1990. Although the protocol, the risk to the patient, and the reviewing institution were all unchanged, the length of the required consent form increased from 2.5 pages to 8 pages. The word count increased from 689 to 2596. The increase reflects additional informational requirements pertaining to HIPAA (Health Insurance Portability and Accountability Act) and the Experimental Subject's Bill of Rights, as well as an increased length of comparable subsections such as notification of risk and compensation for research-related injury. It is debatable if this increase in length has improved the safety of research subjects. We feel that these changes reflect an overly conservative approach by the IRB that ends up protecting the institution at the cost of a less well informed research subject. It can be challenging to properly explain a study protocol, including a proper discussion of the benefits and risks of the study, within the constraints of clinical care. The difficulty of providing a full disclosure of risk and benefit is exacerbated when research subjects are presented with an 8-page consent form that nearly buries the critically important clinical disclosure under a mountain of mandated text. We agree with Grady that studies should be done to establish the effect of this ever-increasing IRB regulation on the subjects, the researchers, and the success in getting patients/volunteers to participate in clinical research. Also, methods to streamline the consent form while still providing patients with the necessary information should also be examined. For example, in California, the Department of Health Services publishes a clear and concise patient guide for blood transfusions that must be given to patients as part of the consent process.a A similar standardized brochure could provide obligatory content such as the Experimental Subject's Bill of Rights and an explanation of HIPAA regulations. This would allow the actual consent form to focus on study-specific issues, and thus facilitate productive communication between the researcher and the patient. Roy Esaki, MD Alex Macario, MD, MBA T. Kyle Harrison, MD John G. Brock-Utne, MD, PhD Department of Anesthesia Stanford University School of Medicine Stanford, California [email protected]

Balancing between two goods: Health Insurance Portability and Accountability Act and ethical compliancy considerations for privacy-sensitive materials in health sciences archival and historical special collections.

The investigation provides recommendations for establishing institutional collection guidelines and policies that protect the integrity of the historical record, while upholding the privacy and confidentiality of those who are protected by Health Insurance Portability and Accountability Act (HIPAA) or professional ethical standards. The authors completed a systematic historical investigation of the concepts of collection integrity, privacy, and confidentiality in the formal and informal legal and professional ethics literature and applied these standards to create best practices for institutional policies in these areas. Through an in-depth examination of the historical concepts of privacy and confidentiality in the legal and professional ethics literature, the authors were able to create recommendations that would allow institutions to provide access to important, yet sensitive, materials, while complying with the standards set by HIPAA regulations and professional ethical expectations. With thoughtful planning, it is possible to balance the integrity of and access to the historical record of sensitive documents, while supporting the privacy protections of HIPAA and professional ethical standards. Although it is theorized that collection development policies of institutions have changed due to HIPAA legislation, additional research is suggested to see how various legal interpretations have affected the integrity of the historical record in actuality.

Efficient key management for preserving HIPAA regulations

The protection of patients’ health information is a very important issue in the information age. Health Insurance Portability and Accountability Act (HIPAA) of privacy and security regulations are two crucial provisions in the protection of healthcare privacy, especially electronic medical information. For the quality and efficiency of the electronic services, it is necessary to construct better performance for the user and the trusted party. Based on elliptic curve cryptography (ECC) and complying with HIPAA regulations, this article presents an efficient key management scheme to facilitate inter-operations among the applied cryptographic mechanisms. In addition, the proposed scheme can achieve the complete functionality which includes: (1) a dictionary of key tables is not required for users and other units; (2) users can freely choose their own passwords; (3) users can freely update their passwords after the registration phase; (4) the computational cost is very low for users and the trusted center or server; (5) users are able to access their individual medical information through the authorization process; (6) case of consent exceptions intended to facilitate emergency applications or other possible exceptions can also be dealt with easier.

Child Abuse, Confidentiality, and the Health Insurance Portability and Accountability Act

The federal Health Insurance Portability and Accountability Act (HIPAA) of 1996 has significantly affected clinical practice, particularly with regard to how patient information is shared. HIPAA addresses the security and privacy of patient health data, ensuring that information is released appropriately with patient or guardian consent and knowledge. However, when child abuse or neglect is suspected in a clinical setting, the physician may determine that release of information without consent is necessary to ensure the health and safety of the child. This policy statement provides an overview of HIPAA regulations with regard to the role of the pediatrician in releasing or reviewing patient health information when the patient is a child who is a suspected victim of abuse or neglect. This statement is based on the most current regulations provided by the US Department of Health and Human Services and is subject to future changes and clarifications as updates are provided.