Thursday, August 03, 2006

Karma Police

I came to HIPAA as an IT guy, specifically in the security field. As any InfoSec guru will cheerfully tell you, all the high-tech gizmos and black-ops ultra-whiz code can do is protect you from the outside. There is no protection against yourself.
Dumpster-diving is a long honored and traditional form of gathering information. Any well-ordered penetration test will include a turn around the back and a quick peek under the plastic lid. One of the big frustrations for us all is the fact that no matter how mant times we repeat it, very few people seem to take this back-door approach very seriously.
Now, thanks to a clever news team, even the Office of Civil Rights, who has up to this point shown remarkable reluctance to actually, you know... protect any one's rights, has had their nose rubbed in the odiferous mess of idly tossed away PHI:

In Washington, D.C., officials at the Department of Health and Human Services have been "closely monitoring" the investigation, as well.
"I can tell you there are people in the highest levels of OCR who are watching these reports and are very interested in what they are seeing," said DHHS spokesman Patrick Hadley. OCR is the department's Office of Civil Rights, which investigates violations of the federal health privacy law known as HIPAA.
Last week, several local families filed HIPAA complaints with the OCR's regional office in Chicago after they learned their personal information was found in dumpsters during WTHR's pharmacy investigation. That clears the way for OCR to begin its own investigation, although the agency will not confirm whether that has happened.
"We take complaints very seriously," said Susan McAndrew, senior advisor for HIPAA privacy policy at the Department of Health and Human Services. "Just tossing out patient's personal information where anyone can access it is not taking reasonable precautions."


Though not much has been done to enforce HIPAA's requirements, if the situation is sufficiently blatant even our public servants have to take action.
Don't let this be you! Phamacists have the toughest row to hoe here, with daily exposure and need to use best professional judgement as to who gets information. Do the easy stuff. Walk over to aisle 7, office supplies and pick up that shredder. Shred everything. Get a locking can for used pill bottles, and empty it just before garbage pick-up into your locked dumpster.
See how easy it is to avoid your neighbors talking about seeing you on the six o'clock news?

No comments: