SPOTLIGHT: 'Breach notification' rule is inadequate to protect data, security pro says

HHS recently withdrew its final "breach notification" rule that had been submitted to the White House for approval, and not a moment too soon, says Hospital Impact contributor Cathy Leahy, CEO of Datamed Health Informatics in Bellingham, Wash. For the first half of 2010, the HHS Office for Civil Rights reported 119 breaches of medical records, affecting some 5 million people. "So what did HHS do about these breaches? Not much," Leahy writes. "They seemed satisfied that the offenders promised to beef up their security practices. Not good enough, HHS, whoever you are. This is whistling past the graveyard at its finest." Notification, according to Leahy, happens after "the cat is out of the bag" and someone wishing to steal medical identities may have already done the deed, with little recourse for the victims. "Yes, your big push for electronic medical records and health information exchanges may need to be revamped. But isn't our medical privacy worth it?" Hospital Impact

Post a comment