Even worse, prominent personal injury attorneys have indicated that lawsuits arising from the inadvertent or purposeful release of protected health information will be a significant component of their practices. As of August 2003, there are already 12 ongoing legal cases in the U.S. involving protected health information damages.
One such example is a case against Easton Hospital in Easton, Pa. Medical records with lab reports, drug reports, and doctor's examination notes were found on the streets of Allentown, Pa. All of the records had patient names and many included addresses and phone numbers. Officials at Easton Hospital determined the disclosure was due to poor security at the hospital, and litigation is under way. Cases like this are beginning to crop up around the country.
Protect Yourself and Your Practice
Many physicians and various entities consider themselves to be compliant with HIPAA regulations when in fact they are not. Taking a simple course or reviewing information provided by a state medical society does not in and of itself provide a level of required HIPAA compliance. Proper background checks must be performed, electronic data transmissions must be secured, and records, fax machines, and computer terminals must be kept in a secure locked fashion.
To protect against this new serious liability threat, best-practice procedures of full compliance, with documentation and purchase of insurance for protection, are required. A thorough compliance package should include needs assessment, gap analysis, HIPAA training, secure networks for electronic data transmission, onsite and offsite paper and digital data storage, background checks, and data recovery services. Without the necessary steps, and without insurance protection, providers are opening themselves up to the potential for civil law suits. Providers beware: They can take your personal assets -- they can even take your boat!
Dr. Arnold Rosenbaum is CEO and medical director for Seacrest DocSecurity, as well as a practicing surgeon with a Providence, R.I., practice. He can be reached via e-mail at asr@seacrestdocsecurity.com.