 | Home |
| Attorneys |
| Contact Us |
| Site Map |
|
Subscribe |
| | |
| | |
| | |
| | |
| | |   | |  | |
| | |
| | |
| | | | | | | |
| | | | |
 3905 Vincennes Road
Suite 204 Indianapolis, IN 46268 Phone: (317) 704-2400 Fax: (317) 704-2410 | | |
|
|
Posted by: Robert Markette Having successfully entered the office, the thieves stole two computers containing information relating to Indianas Breast and Cervical Cancer Program (BCCP). The BCCP is a program that many states have. State law requires health care providers to report certain cancers (and other injuries or illnesses). This information is maintained by the state and used for various public health planning purposes. Of course, the state does not have the staff to handle all of the related information management and so it contracts with outside companies to handle the data for it. In this case, the computers belonged to a contractor and contained information on 7,700 Indiana women who had been diagnosed with one of those forms of cancer. What is interesting about this case is that even though the contractor kept the computers in its offices, those offices were locked and the information was protected by two separate passwords, there is still a cry of outrage over the theft. Although it is early, there is no indication yet that the thief (or thieves) was able to access the information on the computers. The point here is that even if your computers are stolen out of your locked office instead of your employees cars, there will be negative publicity. This reinforces the importance of physical security. You may have all of the electronic security in the world firewalls, passwords, biometrics, and encryption, but if somebody is able to physically remove your computers from your office, that additional electronic security will not matter to your patients, etc. (It may prevent any information from being accessed, but you may still face a PR backlash from patients who only see that the computers were stolen.) The question you should ask is whether your physical security measures are sufficient. Is there anything else you might do, within the Security Rules concept of reasonableness, to ensure the physical security of your hardware, for example, a security alarm, or locking computers that store PHI in a central windowless room? As you ask this, you should remember that while there is almost certainly more you could do, that does not mean it is reasonable to do so. At some point, the additional safeguards provided by the next step of security is not appreciable enough to justify the additional costs, even in light of the potential for negative publicity. Even with thorough physical security, you may still have a burglary. Because you cannot completely eliminate the possibility, the question, from a compliance standpoint is have you reduced the possible threat to a reasonable level. If you are comfortable with the thought that you have, you should not let stories like this one scare you into costly additional measures. As an aside, another complaint the patients had in this incident was that someone other than their physician had this information. The patients were apparently unaware of fact that health care providers routinely have to report certain illnesses and injuries. They must not have read the Notice of Privacy Practices. |
NewsHealth Care
[08/15] Catalyst Pharmaceutical Partners Reports Second Quarter 2008 Financial Results Topics
Adminstrative Law Recent UpdatesJuly 18, 2008 May 29, 2008 May 28, 2008 May 13, 2008 May 08, 2008 Archives
July, 2007 Web ResourcesFindLaw |
| | |
| | |
| |
|
|
The information you obtain at this site is not, nor is it intended to be, legal advice. You should consult an attorney for individual advice regarding your own situation. Copyright © 2008 by Home Care Law Blog Gilliland & Markette LLP. All rights reserved. You may reproduce materials available at this site for your own personal use and for non-commercial distribution. All copies must include this copyright statement. | |
