HIPAA & Healthcare Privacy & Security News

January 2023

• Lab Pays $16,500 Settlement to HHS, Resolving Potential HIPAA Violation over Medical Records Request

  U.S. Department of Health and Human Services

  Jan 03 2023

  https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/life-hopes/index.html

• Washington AG sues ‘gender affirming’ plastic surgeon claiming fake reviews, threatening patients

  Jan 3 2023

  https://readlion.com/2023/01/03/washington-ag-sues-gender-affirming-plastic-surgeon-claiming-fake-reviews-threatening-patients/

• 290 Hospitals Potentially Affected by Ransomware Attacks in 2022

  HIPAA Journal

  Jan 3 2022

  https://www.hipaajournal.com/healthcare-ransomware-attacks-2022/

• HIPAA Regulated Entities: Website or App Tracking Technologies, Pixels Can Create Significant Compliance and Litigation Risks

  Jan 2 2023

  https://www.natlawreview.com/article/hipaa-regulated-entities-website-or-app-tracking-technologies-pixels-can-create

• HIPAA and video recordings in the clinical setting

  PubMed.Gov

  Jan 1 2022

  https://pubmed.ncbi.nlm.nih.gov/36573862/

• What is a HIPAA Violation?

  HIPAA Journal

  Jan 1 2023

  https://www.hipaajournal.com/what-is-a-hipaa-violation/

December 2022

• HHS Issues New Strengthened Conscience and Religious Nondiscrimination Proposed Rule

  Dept of Health & Human Services

  Dec 29 2022

  https://www.hhs.gov/about/news/2022/12/29/hhs-issues-new-strengthened-conscience-and-religious-nondiscrimination-proposed-rule.html

• Are You Using Tracking Technologies That Collect Protected Health Information Under HIPAA?

  Securiti

  Dec 29 2022

  https://securiti.ai/blog/hipaa-online-tracking/

• Do the HIPAA Privacy Rule protections apply to the health information of deceased individuals?

  Dept of Health & Human Services

  Dec 28 2022

  https://www.hhs.gov/hipaa/for-professionals/faq/1500/do-hipaa-protections-apply-to-the-health-information-of-individuals/index.html

• What constitutes a “serious and imminent” threat that would permit a health care provider to disclose PHI to prevent harm to the patient, another person, or the public without the patient’s authorization or permission?

  Dept of Health & Human Services

  Dec 28 2022

  https://www.hhs.gov/hipaa/for-professionals/faq/3002/what-constitutes-serious-imminent-threat-that-would-permit-health-care-provider-disclose-phi-to-prevent-harm-patient-public-without-patients-authorization-permission/index.html

• What is the difference between addressable and required implementation specifications in the Security Rule?

  Dept of Health & Human Services

  Dec 28 2022

  https://www.hhs.gov/hipaa/for-professionals/faq/2020/what-is-the-difference-between-addressable-and-required-implementation-specifications/index.html

• How to Properly Dispose of Electronic PHI Under HIPAA

  HIPAA requires covered entities to implement appropriate safeguards to protect electronic PHI throughout its lifecycle.

  Dec 28 2022

  https://healthitsecurity.com/features/how-to-properly-dispose-of-electronic-phi-under-hipaa

• The 5 most common HIPAA-compliance mistakes and how to overcome them

  Jotform

  Dec 27 2022

  https://www.jotform.com/hipaa/webinar/hipaa-compliance-mistakes-webinar/

• Common HIPAA Compliance Issues and How to Avoid Them

  Dec 22 2022

  https://www.magmutual.com/learning/article/hipaa-key-areas-where-problems-occur/

• HHS OCR Issues Bulletin on HIPAA Compliance for Tracking Technologies

  Reed Smith

  Dec 21 2022

  https://www.jdsupra.com/legalnews/hhs-ocr-issues-bulletin-on-hipaa-6404783/

• HIPAA Q&A: Business associate contracts and trainings, Roe v. Wade

  Rebecca Herold

  Dec 21 2022

  https://revenuecycleadvisor.com/archives

• HHS Releases Bulletin on Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates

  Andrews Kurth Law

  Dec 19 2022

  https://www.huntonprivacyblog.com/2022/12/19/hhs-releases-bulletin-on-use-of-online-tracking-technologies-by-hipaa-covered-entities-and-business-associates/

• Executive Summary: Tracking Telehealth Changes State-by-State in Response to COVID-19

  Manatt law

  Dec 16 2022

  https://www.manatt.com/insights/newsletters/covid-19-update/executive-summary-tracking-telehealth-changes-stat

• HIPAA Right of Access Investigation Resolution Agreement and Correction Action Plan

  Dept of Health & Human Services

  Dec 15 2022

  https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/health-specialists-ra-cap/index.html

• HHS Civil Rights Office Resolves HIPAA Right of Access Investigation with $20,000 Settlement

  Dec 15 2022

  https://www.hhs.gov/about/news/2022/12/15/hhs-civil-rights-office-resolves-hipaa-right-of-access-investigation-with-20000-dollar-settlement.html

• Mandatory Disclosures for Healthcare Workers Under Idaho Law

  Holland & Hart Law

  Dec 15 2022

  https://www.hhhealthlawblog.com/category/hipaa/

• HHS Civil Rights Office Enters Settlement with Dental Practice Over Disclosures of Patients’ Protected Health Information

  Dec 14 2022

  https://www.hhs.gov/about/news/2022/12/14/hhs-civil-rights-office-enters-settlement-with-dental-practice-over-disclosures-of-patients-protected-health-information.html

• HHS Bulletin: Covered Entities’ Disclosure of PHI Collected via Online Tracking Technologies Falls under HIPAA

  Proskauer Law

  Dec 14 2022

  https://privacylaw.proskauer.com/2022/12/articles/data-privacy-laws/hhs-bulletin-covered-entities-disclosure-of-phi-collected-via-online-tracking-technologies-falls-under-hipaa/

• HIPAA Considerations When Business Associates and Data are International.

  National Alliance of Medical Auditing Specialists

  Dec 9 2022

  https://namas.co/hipaa-considerations-when-business-associates-and-data-are-international/

• HIPAA Considerations When Business Associates and Data are International.

  Dec 8 2022

  https://namas.co/hipaa-considerations-when-business-associates-and-data-are-international/

• Are you regulated under HIPAA? Ensure your website or app’s user tracking is HIPAA compliant

  Bricker Law

  Dec 8 2022

  https://www.bricker.com/insights-resources/publications/are-you-regulated-under-hipaa-ensure-your-website-or-apps-user-tracking-is-hipaa-compliant

• Amazon ends support for HIPAA-protected Alexa tool

  GABRIEL PERNA

  Dec 7 2022

  https://www.modernhealthcare.com/technology/amazon-alexa-tool-hipaa-protections-ending

• HHS Proposes New Rule Aligning Part 2 Regulations with HIPAA

  Baker Hostetler

  Dec 5 2022

  https://www.bakerlaw.com/alerts/hhs-proposes-new-rule-aligning-part-2-regulations-with-hipaa

• HHS Warns HIPAA Covered Entities and Business Associates That Use of Website Cookies, Pixels and Other Tracking Technology May Violate HIPAA Rules

  National Review

  Dec 5 2022

  https://www.natlawreview.com/article/hhs-warns-hipaa-covered-entities-and-business-associates-use-website-cookies-pixels

• Confidentiality of Substance Use Disorder (SUD) Patient Records

  A Proposed Rule by the Health and Human Services Department

  Dec 2 2022

  https://www.federalregister.gov/documents/2022/12/02/2022-25784/confidentiality-of-substance-use-disorder-sud-patient-records

• HHS Offers HIPAA Guidance on Online Tracking Technologies

  Holland & Knight LLP

  Dec 2 2022

  https://www.lexology.com/library/detail.aspx?g=4f655593-9d22-40db-91e8-2f514cff91f2

• HHS bulletin clarifies when pixel tracker use may violate HIPAA

  Dec 2 2022

  https://www.fiercehealthcare.com/health-tech/hhs-bulletin-offers-clarity-when-use-pixel-trackers-may-violate-hipaa

• HIPAA Enforcement Discretion and Preparing for the End of the National COVID-19 Public Health Emergency

  University of North Carolina – Chapel Hill

  Dec 1 2022

  https://canons.sog.unc.edu/2022/12/hipaa-neds-covid19/

• Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates

  Dept of Health & Human Services

  Dec 1 2022

  https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html

• COVID-19: FAQs on Health Privacy

  Wisconsin Dept of Health Services

  Dec

  https://www.dhs.wisconsin.gov/covid-19/privacy.htm

November 2022

HIPAA and Healthcare

• HIPAA violations and consequences: How the recent updates impact the healthcare industry

  Nov 28 2022

  https://blogs.oracle.com/healthcare/post/hipaa-violations-and-consequences-how-the-recent-updates-impact-the-healthcare-industry

• HHS Proposes New Protections to Increase Care Coordination and Confidentiality for Patients With Substance Use Challenges: New Proposed Rule to Implement the Bipartisan CARES Act Legislation

  Department of Health & Human Services

  Nov 28 2022

  https://www.hhs.gov/about/news/2022/11/28/hhs-proposes-new-protections-increase-care-coordination-confidentiality-patients-substance-use-challenges.html

• HHS Proposes New Protections to Increase Care Coordination and Confidentiality for Patients With Substance Use Challenges

  Substance Abuse and Mental Health Services Administration

  Nov 28 2022

  https://www.samhsa.gov/newsroom/press-announcements/20221128/hhs-increase-care-coordination-confidentiality-patients-substance-use-challenges

• HIPAA violations and consequences: How the recent updates impact the healthcare industry

  Oracle Health

  Nov 28 2022

  https://blogs.oracle.com/healthcare/post/hipaa-violations-and-consequences-how-the-recent-updates-impact-the-healthcare-industry

• Immunization Data Sharing, HIPAA, and MIIC

  Minnesota Department of Health

  Nov 22 2022

  https://www.health.state.mn.us/people/immunize/miic/privacy/hipaa.html

• Top 3 HIPAA Compliance Challenges of This Year

  A privacy expert, Rebecca Herold, breaks down the top HIPAA compliance challenges coming out of 2022, including the Dobbs decision, third-party risk, and the increasing interconnectedness of healthcare.

  Nov 17 2022

  https://healthitsecurity.com/features/top-3-hipaa-compliance-challenges-of-this-year

• Five Former Methodist Hospital Employees Charged with HIPAA Violations

  U.S. Dept of Justice

  Nov 10 2022

  ttps://www.justice.gov/usao-wdtn/pr/five-former-methodist-hospital-employees-charged-hipaa-violations

• HIPAA vs Ethical Care: Accounting for Privacy With Neuropsychiatric Impairments

  Psychiatric Times

  Nov 8 2022

  https://www.psychiatrictimes.com/view/hipaa-vs-ethical-care-accounting-for-privacy-with-neuropsychiatric-impairments

• Advocate Aurora Health and WakeMed Sued Over Meta Pixel Privacy Breaches

  Nov 4 2022

  https://www.hipaajournal.com/advocate-aurora-health-and-wakemed-sued-over-meta-pixel-privacy-breaches/

• Sen. Warner calls on healthcare stakeholders to consider wide-ranging policy options for improving cybersecurity

  Charlie Mitchell

  Nov 4 2022

  https://insidecybersecurity.com/daily-news/sen-warner-calls-healthcare-stakeholders-consider-wide-ranging-policy-options-improving

• Vendor Hack Tied to 20 Anesthesiology Practice Breaches: New York Firm At Center of Breaches Affecting About 430,000

  Nov 4 2022

  https://www.govinfosecurity.com/vendor-hack-tied-to-20-anesthesiology-practice-breaches-a-20414

• Tips to Protect Your Health Data This Holiday Season HIPAA Rules Don’t Always Apply to Apps You Download on Your Phone or Tablet (Press release from AHIMA)

  Nov 4 2022

  https://www.globenewswire.com/news-release/2022/11/04/2549060/0/en/Tips-to-Protect-Your-Health-Data-This-Holiday-Season.html

• Congressional report finds health care sector ‘uniquely vulnerable’ to cyber attacks

  Nov 3 2022

  https://news.yahoo.com/congressional-report-finds-health-care-183104405.html

• Cybersecurity Is Patient Safety, Says US Senator. Sen. Mark Warner Suggests Imposing Cybersecurity Requirements Through Medicare

  Marianne Kolbasuk McGee (HealthInfoSec)

  Nov 3 2022

  https://www.govinfosecurity.com/cybersecurity-patient-safety-says-us-senator-a-20401

• VA Senator Seeks Feedback on Healthcare Cybersecurity Policy Options. In a policy options paper, Senator Mark R. Warner examined current healthcare cybersecurity challenges and ways that the federal government could further help the sector.

  Nov 3 2022

  https://healthitsecurity.com/news/va-senator-seeks-feedback-on-healthcare-cybersecurity-policy-options

• St. Luke’s Health Suffers Third-Party Data Breach, Unrelated to CommonSpirit Attack. Texas-based St. Luke’s Health notified nearly 17,000 individuals of a third-party vendor data breach that originated at Adelanto Healthcare Ventures, a consulting services vendor.

  Nov 3 2022

  https://healthitsecurity.com/news/st-lukes-health-suffers-third-party-data-breach-unrelated-to-commonspirit-attack

• Ransomware Attack Disrupts Japanese Hospital for 2nd Day. Emergency Services Only at Osaka Acute and General Medical Center

  Mihir Bagwe

  Nov 2 2022

  https://www.bankinfosecurity.com/ransomware-attack-disrupts-japanese-hospital-for-2nd-day-a-20397

• HHS Office for Civil Rights Releases Webinar on Recognized Security Practices: Provides Guidance on Mitigating Potential Violations of HIPAA

  Nov 2 2022

  https://www.lexology.com/library/detail.aspx?g=23ec8962-8892-43c5-84de-be212457cd3b

• Lawsuit accuses WakeMed of collecting patient data and sending it to Facebook for marketing

  Nov 2 2022

  https://www.kake.com/story/47617300/lawsuit-accuses-wakemed-of-collecting-patient-data-and-sending-it-to-facebook-for-marketing

• WakeMed Faces Data Breach Lawsuit Over Meta Pixel Use. A proposed class action lawsuit alleged that WakeMed knowingly implemented tracking software on its website without patient consent.

  Nov 2 2022

  https://healthitsecurity.com/news/wakemed-faces-data-breach-lawsuit-over-meta-pixel-use

• Protecting patient confidentiality: What physicians can—and can’t—share with caregivers

  By Naveed Saleh, MD, MS | Fact-checked by Jessica Wrubel

  Nov 2 2022

  https://www.mdlinx.com/article/protecting-patient-confidentiality-what-physicians-can-and-can-t-share-with-caregivers/24XTKrIcnofVkqhehhcIEA

• Employer Medical Records Responsibilities After Dobbs

  Nov 2 2022

  https://www.law360.com/cybersecurity-privacy/articles/1544635/employer-medical-records-responsibilities-after-dobbs

• Lawsuit accuses WakeMed of collecting patient data and sending it to Facebook for marketing. The lawsuit filed this week alleges this tool collects identifying information about patients, like their names, email addresses, IP addresses, phone numbers, medical information and sends it to Facebook.

  Nov 2 2022

  https://www.wral.com/lawsuit-filed-against-wakemed-for-collecting-selling-patient-data-to-target-ads/20551652/

• HHS releases video on documenting recognized HIPAA security practices

  Nov 1 2022

  https://www.aha.org/news/headline/2022-11-01-hhs-releases-video-documenting-recognized-hipaa-security-practices

• OCR Explains HITECH Recognized Security Practices and How to Demonstrate They are in Place

  HIPAA Journal

  Nov 1 2022

  https://www.hipaajournal.com/ocr-hitech-recognized-security-practices/

• Why cybersecurity education is key to protecting your medical practice

  November 1, 2022

  https://www.medicaleconomics.com/view/why-cybersecurity-education-is-key-to-protecting-your-medical-practice

October 2022

HIPAA and Healthcare

 

• Woman Responsible For Putting OKC Man Behind Bars For Allegedly Spreading HIV Speaks Out & Says He Told Her “It’s Not A Big Deal” When She Shared Her Diagnosis

  BY LAJANEE

  Oct 31 2022

  https://theshaderoom.com/exclusive-woman-responsible-for-putting-okc-man-behind-bars-for-allegedly-spreading-hiv-speaks-out-says-he-told-her-its-not-a-big-deal-when-she-shared-her-diagnosis/

• OCR Reminds Healthcare Providers and Their Business Associates – You Need an Incident Response Plan!

  Oct 31 2022

  https://www.jdsupra.com/legalnews/ocr-reminds-healthcare-providers-and-6886891/

• A Parent's Guide to Healthcare for College Students- Q&A Pro Series. There are so many decisions parents make when sending their children to college. Our CPA and legal expert says healthcare decisions might be the most important ones to make

  JULIE BENNETT IANNUZZI AND ZACH FAULDS

  OCT 31 2022

  https://www.thestreet.com/taxes/parents-guide-healthcare-college-students-q-a

• OCR Highlights HIPAA Security Rule Incident Response Procedures. OCR stressed the importance of timely incident detection and response, as required by the HIPAA Security Rule.

  Oct 28 2022

  https://healthitsecurity.com/news/ocr-highlights-hipaa-security-rule-incident-response-procedures

• Proactively Avoiding a Potential Defamation Lawsuit

  Oct 28 2022

  https://www.physiciansweekly.com/proactively-avoiding-a-potential-defamation-lawsuit-3

• HHS Office For Civil Rights Posts HIPAA Security Rule Security Incident Procedures

  Oct 28 2022

  https://www.mondaq.com/unitedstates/security/1244632/hhs-office-for-civil-rights-posts-hipaa-security-rule-security-incident-procedures

• HHS Office for Civil Rights Posts HIPAA Security Rule Security Incident Procedures.

  Oct 26 2022

  https://www.securityprivacyandthelaw.com/2022/10/hhs-office-for-civil-rights-posts-hipaa-security-rule-security-incident-procedures/?utm_source=Mondaq&utm_medium=syndication&utm_campaign=LinkedIn-integration

• CHIME Submits Comments to FTC on Proposed Data Security, Surveillance Rulemaking CHIME expressed its support for the FTC’s commitment to enforcing data security while noting some key health data considerations.

  Oct 25 2022

  https://healthitsecurity.com/news/chime-submits-comments-to-ftc-on-proposed-data-security-surveillance-rulemaking

• Australian health insurer says data of all customers hacked. Australia’s largest health insurer says a cybercriminal has hacked the personal data of all its 4 million customers, as the government introduced legislation that would increase penalties for companies that fail to protect clients’ private information.

  Oct 25 2022

  https://abcnews.go.com/Business/wireStory/australian-health-insurer-data-customers-hacked-92099981

• ACLU sues RIPTA, UnitedHealthcare over data breach that affected thousands of RI workers

  Oct 25 2022

  https://www.providencejournal.com/story/news/crime/2022/10/25/aclu-lawsuit-ripta-unitedhealthcare-rhode-island-state-workers-data-breach/10594987002/

• Federal and state authorities investigate a data breach at Philadelphia-area ob/gyn practice. An employee stole confidential patient information from Main Line Women’s Healthcare.

  Oct 21 2022

  https://www.inquirer.com/health/data-breach-main-line-womens-healthcare-20221021.html

• USB stick sold in Yukon pawn shop had personal data from Health ministry

  Oct 21 2022

  https://www.itworldcanada.com/article/usb-stick-sold-in-yukon-pawn-shop-had-personal-data-from-health-ministry/509236

• Australia: ‘Dog act’: Medibank hackers have customers’ treatment, diagnosis information

  Oct 20 2022

  https://www.smh.com.au/technology/immense-harm-federal-police-investigating-threat-to-sell-australians-health-data-20221020-p5bra0.html

• Hacker holds Australian health insurer's data for ransom. A cybercriminal is holding for ransom an Australian health insurer’s customer data including diagnoses and treatments, in the nation’s second major privacy breach in a month.

  Oct 20 2022

  https://abcnews.go.com/Health/wireStory/hacker-holds-australian-health-insurers-data-ransom-91782792