Today, the Office for Civil Rights (OCR) announced a $25,000 settlement with a small federally qualified health center (FQHC) for systemic HIPAA Security Rule violations. Over 9 years ago, the FQHC reported a disclosure of patient information to an unknown email account affecting 1,263 patients. This breach report prompted an investigation revealing a near complete failure to comply with the HIPAA Security Rule.
We learned early in life from the Three Little Pigs that a house made of straw or sticks, while much easier to build, lacks the safety and security of a brick house. This fable’s lesson applies to many scenarios including the recent rapid deployment of telehealth services. While a pandemic, not laziness, caused the hurried telehealth services implementation for many, that’s irrelevant to the big bad wolf (and there is always a big bad wolf). He will come and he will huff, and he will puff, and he will compromise the privacy of patient information in a system without adequate protections.
Below is a piece I put together with Dayle Duran, CIPP/US, a contributing DMC Law blog author, as a brief guide to key aspects of the CCPA. Of course, the CCPA is a complex set of rules and requirements, so this post is intended only to be a very basic and high-level overview of important […]
Today, the United States Supreme Court issued its decision in Barr v. American Association of Political Consultants, Inc. concluding that an exception to the Telephone Consumer Protection Act (TCPA) constitutes a content-based speech restriction and violates the First Amendment. But, instead of invalidating the entire statute, the Court only severed the offending provision.
In guidance issued today, OCR explained that, with a few limitations, healthcare providers may use patient information to contact recovered COVID-19 patients and provide information about donating blood and plasma.
In Part I of this mini-series last week, Dayle A. Duran, Esq., CIPP/US articulately described Apple and Google’s COVID-19 contact tracing API. Overall, she concluded that, if used as intended, the technology provides good privacy protections, but flagged that the real privacy risks lie in unintended use and function creep. Recently proposed bipartisan legislation may adequately address these concerns.
This is part one of a two-part series focused on COVID-19 contact tracing technology and its implications for US privacy law. The next installment of this series will examine legislative solutions to protect data subjects from misuse of information collected through contact tracing apps and related technologies.
The Federal Trade Commission’s Health Breach Notification Rule (HBNR) is a perfect example of a narrowly tailored regulation that only contributes to the cumbersome patchwork of privacy rules in this country without providing any real benefit. In this blog post, I explore the problems with the HBNR and why we should focus instead on creating meaningful, comprehensive privacy legislation.
Until recently, telehealth was not commonplace here in CT. Not only has the public health emergency forced widespread adoption of telehealth, but it also triggered a flurry of piecemeal rules and executive orders in rapid-fire succession causing substantial confusion. The most confusing of those rules relate to the delivery of telehealth services via telephone.
Keeping track of the flurry of rules and changes related to telehealth during this COVID-19 public health emergency has been challenging. I offer the timeline below as a resource with links to all the underlying sources. I will update this timeline as changes come about.