Advocating The Need For A Federal Data Breach Disclosure Law

Information Week's Security Blog advocates for a federal data breach disclosure law in this post, The Time Is Now (Better Yet, Yesterday) For A Federal Data Breach Disclosure Law.

Thanks to the HIPAA Blog for point out the article. I agree with Jeff Drummond's conclusion. After having analyzed overlapping and different state disclosure requirements as a part of assisting clients with data breach issue a federal approach is the direction we should go. (caveat: it should require total preemption - not partial preemption like HIPAA privacy).

A federal approach would help set a national industry standard that can be clearly understood, implemented and followed by those who regularly deal in data, health care or otherwise. The state-by-state patchwork of different laws that currently exist create a complexity that is not needed.

For more on the ongoing complexity issue check out California's recently revised law (AB1298) that recently took effect. AB1298 effective January 1, 2008, expands the coverage and protections to medical information and health insurance information under California's State Information Practices Act.

A clear and concise national approach would simplify compliance for those required to maintain and protect data, including health care providers maintaining health information. Customers and patients who expect their data to be maintained would also benefit by a simplified approach and uniform law that provides for a consistent level of breach notification and protection.

For more on state security breach notification legislation/laws check out the National Conference of State Legislatures website page "Breach of Information". Last updated in April 2007, it states "thirty-five states have enacted legislation requiring companies and/or state agencies to disclosure security breaches involving personal information." I suspect this number will increase after the 2008 legislative sessions around the country.

Also, NCSL provides a summary of data breach notification legislation introduced by year. For 2007, they list three bills introduced (but not passed) before the West Virginia Legislature:

WEST VIRGINIA

WV H 2175	Sponsor: Marshall (D) Title: Acquisition of Security Compromising Data Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Relates to the unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2263	Sponsor: Brown (D) Title: Clean Credit Information and Identity Theft Protection Introduced: 01/16/2007 Location: House Judiciary Committee Summary: Ensures clean credit information and identity theft protection (FN). Status: 01/16/2007 INTRODUCED. 01/16/2007 To HOUSE Committee on JUDICIARY.

WV H 2705

Sponsor: Marshall (D) Title: Consumer Right to Impose Freeze on Credit Reports Introduced: 01/30/2007 Location: House Judiciary Committee Summary: Establishes a procedure whereby a consumer may implement a security freeze to prohibit a consumer reporting agency from releasing all or any part of the consumer's credit report. Status: 01/30/2007 INTRODUCED. 01/30/2007 To HOUSE Committee on JUDICIA

As a result of high profile cases like this one that occurred in West Virginia, we will again see activity this year in West Virginia.

WVHCA: Update on the Proposed Cardiac Catheterization Standards

I previously posted about the proposed amendments to the Certificate of Need Cardiac Catheterization Standards issued by the West Virginia Health Care Authority for public comment.

Today, Charleston Gazette reporter, Eric Eyre, reports on the current debate over the standards. To learn more you can read the comments submitted regarding the proposed standards.

2008 WV Legislature: Modification to WV Mental Health Confidentiality Provisions

iHealthBeat (courtesy of Daily Mail) reports on proposed House Bill 4020 introduced last week before the West Virginia Legislature to modify W.Va. Code 27-3-1 authorizing the disclosure of certain mental health records to the National Instant Criminal Background Check System.

According to the article, West Virginia is one of about 24 states that do not allow the release of records to the database. Some states have declined to participate in the federal database because of privacy concerns.

Blawg Review #142: Letter To A New Lawyer

Be sure to check out this week's Blawg Review #142 over at Build A Solo Practice by Susan Cartier Liebel.

This week's edition is creatively formatted as a letter to a new lawyer. Enjoy the read, click on a few of the links and discover interesting posts from around the legal blogosphere.

Dr. Crounse Interviews Dr. Parkinson: A Look Into A New Generation of Physicians and Patients

Bill Crounse, MD of HealthBlog posts about his interview courtesy of ScribeMedia) with Jay Parkinson, MD about his unique business model for today and tomorrows health care delivery - part concierge medicine, part old-time house call infused with modern technology.

Dr Crounse on Dr. Parkinson:

. . . someone who I believe is setting the bar for a new generation of healthcare professionals and the patients they care for. Someone who isn't afraid to buck the system. Someone who says, "why not?" instead of "why?". Someone who just plain understands how to leverage the power of the Net in healthcare . . . he is doing exactly what needs to be done to better serve his patients. He is leading by example, and I have nothing but admiration for what he is doing.

What Do You Get For $2 Trillion?

What do you get for $2 Trillion?
Answer

More from Maggie Mahar at Health Beat Blog with a series of posts on this topic. Great stuff. Tip to KevinMD for the link.

History of HIPAA Standard Patient Health Identifiers

John Halamka at Life as a Healthcare CIO has a nice summary and discussion of the history of the decision not to adopt a HIPAA national standard unique health identifier for each individual patient.

I often talk about this topic when presenting my standard presentation on the various component regulations under HIPAA. Over the years I have asked my audiences whether they think having a standard unique identifier would be a good idea. I saw an upswing in the percentage voting yes after the events of Sept 11. However, over the last couple of year I've again seen that number drop -- not really sure why -- but suspect it has something to do with the increased awareness of the vulnerability of health data as wemove more and more toward a completely electronic system. Maybe the high profile data breach reports also have something to do with the reluctance of individuals to have their health records tied to a single number? Maybe concern over state and federal governments or others using the unique number to more easily access, track information or otherwise use the information?

I agree with John's conclusions that I don't see the federal government adopting a compulsory national health identifier any time soon and that health care technology companies in conjunction with providers will move in the direction of working toward a voluntary standard.

The goal of having a standardized identifier structure is something that those of us in the Health 2.0 community should discuss and work toward. Dr Kibbe shared some great thoughts on these issues and points out that this is one of the pieces of the puzzle that we need to consider as an "accelerator" for Health 2.0.

President-Elect of American Medical Association

Congratulations to Elkins, West Virginia native, Nancy J. Nielsen, M.D., Ph.D., president-elect of the American Medical Association. Dr. Nielsen will only be the second female to hold the position. Another example of a West Virginian making great strides in health care and medicine.

More of the story from today's Charleston Daily Mail. AMA press release dated June 23, 2006.

Health IT Predictions for 2008 by Jane Sarasohn-Kahn

Jane Sarasohn-Kahn has a nice round up of health IT predictions for 2008 over at iHealthBeat. Be sure to check out Get Out the Crystal Ball: Predicting What's Next for Health IT - iHealthBeat.

One correction that I just pointed out to Jane is that Nick Jacobs IMHO is the grandfather of hospital CEO bloggers (started in May 2005) and that Paul Levy comes in a close 2nd. Both are great blogs providing wonderful insight into a variety of topics.