Automated summary from: WISN.com
Identity theft is a widespread and well-publicized problem with huge financial repercussions, but a hole in the nation's notification laws could potentially prove lethal. There is no law requiring health care providers to inform patients when they learn that a thief may have accessed their health records.One such breach was revealed last November when police said a ring of identity thieves had spent more than eight months pilfering patient records at Columbia St. Mary's Ozaukee Hospital.
In that incident, the band of ex-cons depended on a housekeeper at the hospital to provide them with the information they needed to get online loans in patients' names.
About a dozen patients contacted police, but no law exists that required hospital administrators to notify other potential victims, and the Mequon hospital did not publicize the breach.
"It's point-blank nuts," state Rep. Sheldon Wasserman, D-Milwaukee, said of the loophole.
HIPAA strictly regulates the disclosure of patient records, but it does not require hospitals to notify all at-risk patients after records have been improperly disclosed.
