EHIP

Drug database raises privacy concerns

Tazewell County Coroner Dennis Conover said an amendment to the Illinois Prescription Monitoring Program would make investigations into questionable deaths much easier, but a national privacy advocacy group has some concerns.

House Bill 3695 would amend the Illinois Prescription Monitoring Program --- a database of prescriptions that doctors and pharmacists use to determine if patients are getting prescriptions for regulated drugs from multiple sources. The database is mandated by federal law through the U.S. Department of Justice, Drug Enforcement Administration.

Pekin Police Department Deputy Chief Greg Nelson said the database would help the department in an ever-increasing aspect of the war on drugs. “Pharmacies and doctors are faced with a challenge. People are using fraudulent prescriptions, multiple doctors, using different pharmacies --- there are a number of different ways to get medications.”

A prescription-monitoring program is required in all states by federal law, but the intent of the law is to allow doctors and pharmacies to know if prescription medications are being abused, said Paul Stephens, director of policy and advocacy for the Privacy Rights Clearing House based in California. “There is a huge privacy issue here,” he said of the Illinois amendment. “Certainly no one wants their prescription information given to law enforcement.”

Agencies allowed new access to the database would be the Illinois Attorney General Consumer Protection Division, a prosecuting attorney, the attorney general, a deputy attorney general, county sheriff, state's attorney or city police who are engaged in a controlled substance case.

Automated summary from: Pekin Daily Times

Stimulus Funds Raise Hopes for Increased Adoption of EHRs

Provisions of the federal economic stimulus package could encourage more physicians and hospitals to invest in electronic health record systems, although at least one stakeholder says adoption will fall short of government projections, InformationWeek reports.

The stimulus package includes $17 billion for incentive payments over five years for doctors and hospitals to adopt EHRs. The legislation makes an additional $2 billion available immediately for loans and grants aimed at boosting health IT adoption and research into the use of different systems.

In the event that fewer than 75% of health care providers do not adopt EHRs by 2018, the law permits the government to reduce reimbursements by an additional 1% annually, up to 5%, for providers who have not adopted the technology, according to Janet Marchibroda, CEO of the eHealth Initiative (Kolbasuk McGee, InformationWeek, 3/14). The Congressional Budget Office projects that provisions of the stimulus package will result in almost 90% of U.S. physician offices and hospitals adopting EHRs in a few years.

Automated summary from: iHealthBeat

No Mayo data in HealthVault, PHR questions linger

The Mayo Clinic, Rochester, Minn., one of the nation's premier and best-known healthcare organizations, has yet to deploy the HealthVault personal health record from Microsoft Corp., despite a big-splash publicity notice linking of the two organizations more than a year ago, according to Mayo spokesman Karl Oestreich.

The clinic, thus, is still evaluating whether it needs to enter into a business associate agreement under the Health Insurance Portability and Accountability Act of 1996 with Microsoft to comply with the health information technology privacy and security provisions of the new American Recovery and Reinvestment Act of 2009, the Mayo spokesman said.

In February, President Barack Obama signed into law the stimulus bill, which, among its many healthcare IT and privacy components, included language that seemed aimed at bringing certain PHR systems providers under the privacy and security provisions of HIPAA.

Automated summary from: Modern Healthcare

Many See Privacy on Web as Big Issue, Survey Says

As arguments swirl over online privacy, a new survey indicates the issue is a dominant concern for Americans. When asked if they were comfortable with behavioral targeting --- when advertisers use a person's browsing history or search history to decide which ad to show them --- only 28 percent said they were. More than half said they were not. And more than 75 percent of respondents agreed with the statement, "The Internet is not well regulated, and naïve users can easily be taken advantage of."

Debate over behavioral advertising has intensified, with industry groups trying to avoid government intervention by creating their own regulatory standards. Last month, the F.T.C. revised its suggestions for behavioral advertising rules for the industry, proposing, among other measures, that sites disclose when they are participating in behavioral advertising and obtain consumers' permission to do so.

"Put simply, this could be the last clear chance to show that self-regulation can --- and will --- effectively protect consumers' privacy," Mr. Leibowitz said, or else "it will certainly invite legislation by Congress and a more regulatory approach by our commission."

Automated summary from: New York Times

Behind Wal-Mart's E-Health Records Plans

The World's Biggest Retailer hopes to do for electronic health records what it has done for dog food, plastic lawn chairs, and some generic drugs: make them widely accessible for a reasonable price.

Instead of suburban shoppers, Wal-Mart this spring will be targeting physicians' practices with bundled hardware, software, installation, maintenance and training. In October, it rolled out e-health records to all 1.4 million of its employees and their dependents.

Wal-Mart's foray into the healthcare industry, specifically into the e-records business is laudable on its face, representing fashionable twin attributes, Change and Progress. But serious questions about privacy and security cannot be ignored.

Assuming it has access to patient data under the e-health records plan, what's to stop Wal-Mart DBAs from trolling patient profiles for smokers and sending them targeted ads and coupons for nicotine patches, gums and lozenges? The third parties involved are also potential leakers of private data. Is HIPAA enough of a privacy safeguard to keep a scenario like this from happening?

Automated summary from: InformationWeek

Electronic Medical Records: Will Your Privacy Be Safe?

Doctors are supposed to be nosy. But the doctor-patient relationship was never meant to be other than confidential and privileged and solely for the benefit of the patient. Patients expect it, or they would not be forthcoming.

Electronic medical records have become a national goal, a way to replace the highly fragmented and inefficient paper system used in most medical settings today. Indeed, the economic stimulus package assigns billions of dollars to that effort. In light of public sensitivity, this major jump-start for centralized records comes with provisions to further strengthen privacy laws.

The Institute of Medicine issued a report on privacy of medical records in early February that fuels concerns about EMRs. The IOM started with the premise that protections for electronic medical records are a must, because the benefit of health IT is so great. The records will speed up access to a patient's health information, cut down on redundant care, and reduce medical errors.

The group concluded that government rules to protect patients' medical records are simply inadequate. The report also points to the many security breaches of medical record databases, covering tens of thousands of patients, that have occurred in the past two years, and cites this as a growing problem.

Automated summary from: US News & World Report

RIM records all employee calls

BlackBerry maker Research in Motion admitted yesterday that it recorded all employee conversations in the interest of maintaining control over intellectual property.

RIM chief information officer Robin Bienfait, during an interview with ZDNet.com.au in Sydney, said that all actions carried out on RIM's internal network were logged, which meant that people who wanted to carry out private conversations might want to bring in personal devices.

It wasn't a violation of privacy according to Bienfait, who maintained the workers were aware of the surveillance: "They're doing business inside of RIM. Everything they can say or do can be patented... We're not violating anybody's privacy. They're aware that their information is transparent and in visibility."

Automated summary from: ZDNet News

Medical Identity Theft Turns Patients Into Victims

If identity thieves were to disregard your financial accounts and instead target your medical information, your first thought might well be, "Take my medical identity.Please.” What nut would want your high cholesterol, trick knee, and family history of Alzheimer's? The answer is simple: one without health insurance who needs surgery or prescription drugs , or someone who sees a medical ID as the open sesame that will allow him or her to collect millions in false medical claims.

Unlike financial identity theft, there's no straightforward process for challenging false medical claims or correcting inaccurate medical records. For victims, the result can be thousands in unpaid charges, damaged credit, and bogus, possibly dangerous details cluttering up their medical records for years to come.

Privacy experts are concerned that as doctors and hospitals switch from paper records to EMRs, as they're called, it may become easier for people to gain unauthorized access to sensitive patient information on a large scale. In addition, Microsoft, Revolution Health, and, just this week, Google have announced they're developing services that will allow consumers to store their health information online.

Ed Markey of Massachusetts and Rahm Emanuel of Illinois, with support from several privacy groups and Microsoft, introduced a bill that would strengthen safeguards protecting access to consumers' medical information and make it a federal requirement to notify patients if their healthcare data get exposed.

Automated summary from: US News & World Report

Google Privacy Blunder Shares Your Docs Without Permission

In a privacy error that underscores some of the biggest problems surrounding cloud-based services, Google has sent a notice to a number of users of its Document and Spreadsheets products stating that it may have inadvertently shared some of their documents with contacts who were never granted access to them.

According to the notice, this sharing was limited to people "with whom you, or a collaborator with sharing rights, had previously shared a document" - a vague statement that sounds like it could add up to quite a few people.

The notice states that only text documents and presentations are affected, not spreadsheets, and provides links to each of the user's documents that may have been shared in error.

Google has confirmed that the note is real, and says that it was an isolated incident affecting less than .05% of all documents. The damage may not be widespread, but it's still an unsettling lapse in security.

Automated summary from: TechCrunch

Advertising, data sales subsidize EMR products

When you're out shopping for bargains, free is as good as it gets---except in healthcare information technology, where for many physicians, even free hasn't been good enough. Several developers of electronic medical-record systems have announced plans to offer free EMRs to office-based physicians. The costs for the systems will be subsidized by sales of dynamically linked advertisements on the EMR screens. One vendor says it plans to sell patient data as well.

The ad-driven approach is something of a mash-up of a couple of earlier ideas, subsidized EMRs delivered via the Web using the application service provider, or ASP, delivery model. Using ASP-based systems, at least a pair of vendors are offering the ultimate in low-cost EMRs---free systems---or at least free in the sense that the physician user pays nothing to install or operate them. A physician's costs will be offset by one vendor, Practice Fusion's, sale of their patients' data (aggregated and de-identified, according to a company spokesman) and by advertising that would appear on a portion of their EMR computer screen.

Steven Waldren, director of the Center for Health Information Technology at the American Academy of Family Physicians, says the medical society hasn't taken a policy position on EMRs with advertising, but says he doubts that the ad market alone will provide enough revenue to support an EMR service. And that will likely prove problematic for many physicians.

"You have my data and you have a business model with pharma. I think the docs will put those things together and say, 'Oh, you'll probably sell my data to pharma,' and that's where things become a little disconcerting."

Automated summary from: Modern Healthcare