HIPAA Research Articles

42 CFR Part 2 fight continues in wake of fragile victory

Less than a day after the committee reconciling the House and Senate versions of opioid legislation opted to omit H.R. 6082, which would have replaced the confidentiality regulation 42 CFR Part 2 with the Health Insurance Portability and Accountability Act (HIPAA) (see p. tk), proponents of that measure were working on alternative plans.

Text of opioid bill released by House Ways and Means Committee: 42 CFR Part 2 is spared

Last week, the long‐awaited opioid package was released by the House of Representatives Ways and Means Committee. Notably, 42 CFR Part 2, which the House version had slated for elimination but the Senate had not addressed, is spared. The confidentiality regulation, which requires substance use treatment providers to obtain consent from patients before releasing their information, would have been replaced with the Health Insurance Portability and Accountability Act (HIPAA), which would have included their information in their record.

A prospective, randomized, single-blinded trial for improving health outcomes in rhinology by the use of personalized video recordings.

Clear patient-physician communication is critical in improving patient compliance, outcomes, and satisfaction. However, constraints of shortened clinic visits, patient anxiety, and poor recall can cause significant barriers to effective communication. We hypothesized that the ability to view patient-physician counseling videos at home would improve health outcomes. Patients in a tertiary rhinology clinic were enrolled into a single-blinded prospective study after obtaining institutional review board (IRB) approval and informed consent. All enrollees had a short summary of their clinical encounter video-recorded with a tablet using Medical Memory, a Health Insurance Portability and Accountability Act (HIPAA)-compliant software system. Patients were randomized to receive access to their videos by our research coordinator, and outcomes included questionnaires at the first postoperative visit to assess patient recall and satisfaction. A total of 101 patients were enrolled. Half of those with video access watched the video at least once, on average 3.44 times. Of those without access, 90% would have liked the option. Those with video access had a higher percentage of correct answers to questions regarding surgical risk and extent of surgery; however, there was no significant difference between the 2 groups. Our results show that patients in both groups were enthusiastic about this technology and often shared their videos with family and friends. Video-recordings of physician-patient encounters may be a possible solution to improve physician-patient communication.

Health Insurance Portability and Accountability Act Violations by Physician Assistant Students: Applying Laws to Clinical Vignettes.

Students enrolled in medical schools, nursing schools, and physician assistant (PA) programs are required to have instruction on patient privacy and protection of health-related information. The medical literature has several examples of breaches of patient privacy by clinicians, which likely represents only a fraction of the violations that occur. Patient privacy and the protection of health-related information constitute both an ethical issue and a legal issue and are associated with significant consequences. Medical, PA, and allied health students are required to comply with the same federal laws related to patient privacy and confidentiality as licensed professionals. Universities must work diligently to create a culture in which students are taught about the legal requirements of the federal Health Insurance Portability and Accountability Act (HIPAA) and are held accountable for compliance with such requirements. The Health Insurance Portability and Accountability Act must be considered part of standard classroom instruction and be embedded and upheld at all clinical training sites. We present a series of 7 HIPAA violations by PA students, along with a brief description of the HIPAA provisions associated with each case. These real-life examples provide a comprehensive overview of important HIPAA components and illustrate how easily violations can occur in clinical settings.

Audio Transmission of Medical Reports for Visa Processing: A Solution for the Spread of Communicable Diseases by the Immigrant Population

The rapid growth of immigrants is a veritable menace for most state authorities. Aside from the hazards of population overcrowding, they create the risk of health hazards. According to recent medical statistics, international immigrants are the carriers of communicable diseases. In addition to tightened border controls, the strict and transparent visa approval process through proper medical diagnoses may play a vital role in addressing this problem. This requires the safe, secure, and prompt transmission of medical reports from recognized medical centers to embassies without violating the Health Insurance Portability and Accountability Act (HIPAA). This article introduces a novel transfer system of visa applicant medical reports for processing through multilayer security. Both cryptography and steganography are used here to ensure security. This nearly foolproof system helps to reduce the incorrect identification of visa applicants and quickens the visa-processing system. At the same time, it helps to control the spread of communicable diseases.

Decreased rectal meconium signal on MRI in fetuses with open spinal dysraphism

To evaluate rectal meconium signal in fetuses with open spinal dysraphism and correlate findings with postnatal exam. This is a single-institution Institutional Review Board-approved Health Insurance Portability and Accountability Act (HIPAA) compliant retrospective analysis of fetal MRIs of open spinal dysraphism from 2004 to 2016. Fetuses with diagnostic T1-weighted images and postnatal follow-up at our institution were included. A total of 115 fetuses (average gestational age 23.9±3.6weeks) met inclusion criteria. Of these, 80% (92/115) had T1 hyperintense rectal meconium signal. Average height of the meconium column, measured from the base of the bladder to its most inferior extent, was 9.2±4.3mm in fetuses ≥20-week gestational age and 11.1±4.4mm in fetuses ≥23-week gestational age (n=110) . None had bowel dilation. One of 115 fetuses had a simple form of anorectal malformation allowing complete repair in the neonatal period, but this fetus had a normal meconium column height on fetal MRI of 22mm. The remaining 23/115 fetuses with lack of normal rectal meconium signal were born without evidence of anorectal malformation. Decreased or absent T1-hyperintense rectal meconium signal in fetuses with open spinal dysraphism does not correlate with imperforate anus postnatal and may be a reflection of neurogenic bowel in this patient population.

Enterprise Microblogging to Augment the Subinternship Clinical Learning Experience: A Proof-of-Concept Quality Improvement Study.

BackgroundAlthough the Clerkship Directors in Internal Medicine (CDIM) has created a core subinternship curriculum, the traditional experiential subinternship may not expose students to all topics. Furthermore, academic institutions often use multiple clinical training sites for the student clerkship experience.ObjectiveThe objective of this study was to sustain a Web-based learning community across geographically disparate sites via enterprise microblogging to increase subintern exposure to the CDIM curriculum.MethodsInternal medicine subinterns used Yammer, a Health Insurance Portability and Accountability Act (HIPAA)–secure enterprise microblogging platform, to post questions, images, and index conversations for searching. The subinterns were asked to submit 4 posts and participate in 4 discussions during their rotation. Faculty reinforced key points, answered questions, and monitored HIPAA compliance.ResultsIn total, 56 medical students rotated on an internal medicine subinternship from July 2014 to June 2016. Of them, 84% returned the postrotation survey. Over the first 3 months, 100% of CDIM curriculum topics were covered. Compared with the pilot year, the scale-up year demonstrated a significant increase in the number of students with >10 posts (scale-up year 49% vs pilot year 19%; P=.03) and perceived educational experience (58% scale-up year vs 14% pilot year; P=.006). Few students (6%) noted privacy concerns, but fewer students in the scale-up year found Yammer to be a safe learning environment.ConclusionsSupplementing the subinternship clinical experience with an enterprise microblogging platform increased subinternship exposure to required curricular topics and was well received. Future work should address concerns about safe learning environment.

Accurate estimation of diffusion kurtosis (DK) imaging parameters of the prostate

Purpose: To evaluate the performance of maximum likelihood (ML) estimation of diffusion kurtosis (DK) imaging parameters in the prostate and compare the estimated parameters to those measured using least squares (LS) estimation. Materials and methods: The institutional review board issued a waiver of informed consent for this Health Insurance Portability and Accountability Act (HIPAA)-compliant, retrospective study of forty-two patients (median [Md] age=61 years; range: 43-74 years) who underwent magnetic resonance imaging (MRI) between September and October 2016. Diffusion-weighted MRI (DW-MRI) at nine b-values (0-2000 s/mm2 ) were acquired using a 3-T whole-body MRI unit (Discovery MR750; GE Medical Systems, Waukesha, WI) equipped with an eight-channel phased array coil for signal reception. Diffusion coefficient (D) and kurtosis (K) were estimated from the normal appearing prostate peripheral zone and prostate cancer regions of interest (ROIs). The parameters were estimated by fitting the measured MR signal intensities as a function of b-value, using LS and ML algorithms. An estimate of the noise was obtained on the b=0 images in an artifact-free ROI in the rectum. Simulations were also carried out to assess the properties of the two estimators in a range of signal-to-noise ratios. Results: For benign ROIs, the mean D ± standard deviation, (1.88±0.52)×10-3 mm2 /sec, and mean K (0.79±0.20), measured using LS estimation, differed significantly from the mean D (1.96±0.48)×10-3 mm2 /sec and mean K (0.68±0.21), measured using ML estimation (P<0.001 for both). For malignant ROIs, the mean D (1.48±0.38)×10-3 mm2 /sec and mean K (0.94±0.20), measured using LS estimation, differed significantly from the mean D (1.54±0.36)×10-3 mm2 /sec and mean K (0.81±0.19), measured using ML estimation (P<0.001 for both). Simulations demonstrate that ML minimizes the bias estimate of DK parameters within the signal-to-noise ratio range of 5-15. Conclusion: By incorporating the noise level, the ML estimation increases the accuracy of DK parameter estimation. In vivo results with phased array coils showed significant differences in DK parameter estimates with ML as compared with the standard LS estimation.

Social Media: It’s Different for Professionals

Social Media: It’s Different for Professionals

Direct-to-Consumer Genetic Testing: Finding a Clear Path Forward.

Regulatory compliance in the direct-to-consumer genetic testing market is highly sophisticated as there are numerous federal, state, and ethical barriers to entry. In 2010, amid an underregulated market, 23andMe sought to do what few companies in the medical industry had attempted before-disregard the guidance and requests of the US Food and Drug Administration. This regulatory strategy effectively destined the company's Personal Genome Service for failure; however, the company changed course and has been granted several regulatory clearances. This exemplifies the importance of a healthy relationship with regulatory agencies, although challenges remain. The DTC industry continues to have a perplexing regulatory framework at both the federal and state level. There are also ethical concerns with the monetization of deidentified genetic health information, as genetic data have an inherent level of identifiability and are not fully protected by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in these scenarios. Although some DTC tests are now cleared in the United States, the concern that a learned intermediary is needed for interpretation of results remains. The regulatory oversight of this market will need to continue to develop to ensure the protection of consumer health and privacy.

Reversible Data Hiding Scheme for ECG Signal

In telemedicine system, remote electrocardiography (ECG) monitoring systems are widely used to examine the cardiac health of a patient. So, huge amount of ECG data is collected in real time and send over the network along with the patient's identity to his/her doctor who is geographically far away. In that scenario, it is very important to protect patient's confidential information. The Health Insurance Portability and Accountability Act (HIPAA) of 1996 in US mandates that confidential and private information related to patients be protected. To serve this purpose a novel reversible watermarking algorithm with high embedding capacity based on wavelet transform has been developed. The proposed reversible data hiding scheme allows ECG signals to hide its corresponding patient's confidential data and being reversible the original signal can be completely restored at the same time. Performance has been evaluated in terms of ECG signal distortion and embedding capacity. Experimental results show that the original ECG signal is recovered exactly after the extraction of watermarked data.

Normal pancreatic parenchymal thickness by CT in healthy children.

Chronic pancreatitis is increasingly recognized in the pediatric population. Atrophy is an important, but qualitative, finding of chronic pancreatitis. To transition to a quantitative measure that can specifically define atrophy requires knowledge of normal pancreatic parenchymal bulk in children. The purpose of this study was to define normal pancreatic thickness (linear measurements) at multiple anatomic locations in the pancreas of healthy children. This was an Institutional Review Board-approved, Health Insurance Portability and Accountability Act (HIPAA)-compliant retrospective study. Three reviewers measured the thickness of the pancreas at four locations (head, neck, body, tail) on computed tomography (CT) examinations performed with intravenous contrast in children without a history of pancreatic disease. Measurements were made on 140 examinations, evenly distributed among 7 age groups (3-16.99years) with 10 males and 10 females in each group. Agreement and bias between reviewers were assessed by intra-class correlation coefficients (ICC) and Bland-Altman analyses. Correlation with age, height and weight were assessed with Spearman's rho (ρ). The mean (for 3 readers) thicknesses of the head, neck, body and tail were 1.3-2cm, 0.7-1cm, 0.9-1.6cm and 1-1.6cm, respectively, depending on patient age. Measurement agreement between reviewers was fair to good (ICC: 0.52-0.7). Bias between reviewers ranged from 0 to 3mm. Pancreatic thickness was weakly to moderately correlated with age (ρ=0.39-0.52), height (ρ=0.44-0.61) and weight (ρ=0.51-0.64). We have defined normal ranges for thickness of the pancreas at four locations, and have shown that these measurements depend on patient age and size. These data may be useful to more objectively define pancreatic atrophy in children with suspected pancreatic disease.

How HIPAA Harms Care, and How to Stop It

How HIPAA Harms Care, and How to Stop It

HIPAA and Protecting Health Information in the 21st Century

While the Health Insurance Portability and Accountability Act (HIPAA) has been relatively effective at protecting health-data privacy in traditional healthcare settings, the era of big data poses significant challenges to safeguarding personal health information that could nonetheless put individuals at risk of discrimination, invasive marketing, and other objectionable practices. This article explores some of the challenges of existing American legal infrastructure to protect health-data privacy and proposes a number of potential approaches to improving privacy protections.

Peer-to-Peer Collaboration Adds Value for Surgical Colleagues.

Peer-to-peer advisory among colleagues in orthopedic surgery is commonplace in academic medical centers. In the private practice setting, however, it becomes more difficult for surgeons to discuss complex cases among peers. We sought to study the effect of peer-to-peer mentorship on surgeons' decision-making and on patient care across academic and private adult joint reconstruction practices via the use of group secured messages. From 2013 to 2016, we established a messaging system that was compliant with the Health Insurance Portability and Accountability Act (HIPAA) among five previous adult hip and knee reconstruction co-fellows in order to discuss complex cases. Data collected from each case included patient demographics (age and sex), history and physical examination, relevant imaging in orthogonal planes, and preliminary diagnosis and treatment plans. Data collected from group responses included nature of additional inquiries, literature citations, operative recommendations, and sample imaging of similar cases previously treated. The group consisted of two private practice surgeons and three academic surgeons. Data was collected on 283 cases discussed during the study period. None of the patients had any HIPAA violations. The mean number of reviewers who commented on a case was 2.4, with at least one response in 97% of cases. In 33% of the cases, the peers confirmed the initial treatment plan, and in 67% of the cases, an alternative treatment plan was recommended and executed. The case distribution was 94 primary and 189 revision procedures, including 173 hips, 103 knees, three ankles, two shoulders, and two pelvises. In the majority of cases exchanged between young surgeons via a group messaging system, a significant impact on patient care was appreciated. In a technology-driven era, peer-to-peer advisory for difficult cases via a rapid feedback method may allow for substantial improvement in patient care, particularly for surgeons not practicing at a large academic medical center with access to several partners and multiple opinions.

Evaluation of Burn Rounds Using Telemedicine: Perspectives from Patients, Families, and Burn Center Staff.

Burn care requires multiple disciplines to collaborate to achieve best patient care. Because of this, rounds involve a very large burn team to assess patients' wounds and formulate plans. To decrease the amount of team members on rounds, our burn center implemented a new budding technology: telemedicine. We created "Zoom Rounds," a Health Insurance Portability and Accountability Act (HIPAA)-compliant, secure videoconferencing system to relay patient wound evaluations to a remote conference room where team members can participate digitally. We sought to evaluate this new rounding process by querying the burn team, patients, and families regarding their experience. Surveys were developed for each group and were distributed over a 2-month period. Respondents were asked to rate the videoconferencing rounding experience and comment on the educational experience (staff/providers) and one's personal experience (patient/family). We analyzed both the quantitative data with the qualitative responses. Qualitative data analysis for content was used to independently code and analyze responses to the open-ended survey questions by two authors and verified by adjudication review. Thirty-three patients/families and 69 burn staff members completed the confidential survey (response rate of 90% and 83%, respectively). Coded responses identified several themes: inconsistent technology, improved visualization and communication regarding the wounds, better learning experience, and improved patient experience by decreased crowds in the room. There was strong support for the use of videoconferencing for patient wound rounds among providers, burn center staff, and patients/families. Telemedicine is a promising technology to improve inpatient burn rounds.

Utilization of a Clinical Trial Management System for the Whole Clinical Trial Process as an Integrated Database: System Development.

BackgroundClinical trials pose potential risks in both communications and management due to the various stakeholders involved when performing clinical trials. The academic medical center has a responsibility and obligation to conduct and manage clinical trials while maintaining a sufficiently high level of quality, therefore it is necessary to build an information technology system to support standardized clinical trial processes and comply with relevant regulations.ObjectiveThe objective of the study was to address the challenges identified while performing clinical trials at an academic medical center, Asan Medical Center (AMC) in Korea, by developing and utilizing a clinical trial management system (CTMS) that complies with standardized processes from multiple departments or units, controlled vocabularies, security, and privacy regulations.MethodsThis study describes the methods, considerations, and recommendations for the development and utilization of the CTMS as a consolidated research database in an academic medical center. A task force was formed to define and standardize the clinical trial performance process at the site level. On the basis of the agreed standardized process, the CTMS was designed and developed as an all-in-one system complying with privacy and security regulations.ResultsIn this study, the processes and standard mapped vocabularies of a clinical trial were established at the academic medical center. On the basis of these processes and vocabularies, a CTMS was built which interfaces with the existing trial systems such as the electronic institutional review board health information system, enterprise resource planning, and the barcode system. To protect patient data, the CTMS implements data governance and access rules, and excludes 21 personal health identifiers according to the Health Insurance Portability and Accountability Act (HIPAA) privacy rule and Korean privacy laws. Since December 2014, the CTMS has been successfully implemented and used by 881 internal and external users for managing 11,645 studies and 146,943 subjects.ConclusionsThe CTMS was introduced in the Asan Medical Center to manage the large amounts of data involved with clinical trial operations. Inter- and intraunit control of data and resources can be easily conducted through the CTMS system. To our knowledge, this is the first CTMS developed in-house at an academic medical center side which can enhance the efficiency of clinical trial management in compliance with privacy and security laws.

Clinical 3D printing: A protected health information (PHI) and compliance perspective

Advanced manufacturing techniques such as 3-dimensional (3D) printing, while mature in other industries, are starting to become more commonplace in clinical care. Clinicians are producing physical objects based on patient clinical data for use in planning care and educating patients, all of which should be managed like any other healthcare system data, except it exists in the “real” world. There are currently no provisions in the Health Insurance Portability and Accountability Act (HIPAA) either in its original 1996 form or in more recent updates that address the nature of physical representations of clinical data. We submit that if we define the source data as protected health information (PHI), then the objects 3D printed from that data need to be treated as both (PHI), and if used clinically, part of the clinical record, and propose some basic guidelines for quality and privacy like all documentation until regulatory frameworks can catch up to this technology. Many of the mechanisms designed in the paper and film chart era will work well with 3D printed patient data.

Assessing Knowledge Regarding Managing Congestive Health Failure Symptoms: Differences in Patient and Professional Scores.

Objective:To assess whether patients with congestive heart failure (CHF) and health coaches agree about patient knowledge of health-enhancing practices related to CHF after ongoing telehealth coaching.Methods:Forty patients with CHF and eligible for both Medicare and Medicaid were recruited from a regional managed care organization for this pilot study. Telecoaching sessions via a health insurance portability and accountability act(HIPAA)-compliant tablet-based platform focused on educational information designed to improve patient self-care. Social workers administered the 13-item Member Confidence Measure at baseline and at 30 and 180 days into the intervention. Patients and social workers provided separate ratings.Results:As expected at baseline, patient and coach scores differed, with patients reporting higher perceived knowledge scores (P < .01). Contrary to expectation, patient and coach scores did not converge at 30 and 180 days. Patient scores continued to increase at 30 and 180 days, while coaches’ scores increased at 30 days, but not at 180 days.Conclusion:Overall, patients continued to overrate their understanding about CHF. A telecoaching platform provides an opportunity to enhance patient’s knowledge of their chronic disease and for patients to sustain that knowledge over time.Practice Implications:Addressing a patient’s misperception of their knowledge to manage a chronic disease is critical for enhancing well-being. Coaches’ scores did increase at 30 days suggesting that telecoaching is effective, but more monitoring may be required to ensure that these gains persist over time.

The Role of HIPAA Omnibus Rules in Reducing the Frequency of Medical Data Breaches: Insights From an Empirical Study.

Frequent data breaches in the US health care system undermine the privacy of millions of patients every year. A large number of such breaches happens among business associates of the health care providers that continue to gain unprecedented access to patients' data as the US health care system becomes digitally integrated. The Omnibus Rules of the Health Insurance Portability and Accountability Act (HIPAA), which were enacted in 2013, significantly increased the regulatory oversight and privacy protection requirements of business associates. The objective of this study is to empirically examine the effects of this shift in policy on the frequency of medical privacy breaches among business associates in the US health care system. The findings of this research shed light on how regulatory efforts can protect patients' privacy. Using publicly available data on breach incidents between October 2009 and August 2017 as reported by the Office for Civil Rights (OCR), we conducted an interrupted time-series analysis and a difference-in-differences analysis to examine the immediate and long-term effects of implementation of HIPAA omnibus rules on the frequency of medical privacy breaches. We show that implementation of the omnibus rules led to a significant reduction in the number of breaches among business associates and prevented 180 privacy breaches from happening, which could have affected nearly 18 million Americans. Implementation of HIPAA omnibus rules may have been a successful federal policy in enhancing privacy protection efforts and reducing the number of breach incidents in the US health care system.