DBR ON DATA

Security, Privacy and Information Governance

Category: HHS



Page 2 of 2

HHS Declares Public Health Emergency in California – HIPAA Waivers Apply

Share

In the aftermath of the California wildfires, the Department of Health and Human Services (HHS) has waived sanctions and penalties against covered entities that fail to comply with provisions of the HIPAA Privacy Rule.

The waiver is similar to HHS’ response to Hurricanes Harvey and Irma, which we discussed in a previous blog post. This waiver only applies (1) in the emergency area and for the emergency period identified in the public health emergency declaration, (2) to hospitals that have instituted a disaster protocol, and (3) for up to 72 hours from the time the hospital implements its disaster protocol. Continue reading

OCR Reminder on How to Manage HIPAA Privacy Requirements during Emergency Relief Efforts

Share

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued a reminder to its listserv subscribers following the Las Vegas Strip shooting on October 1, 2017, that HIPAA covered entities are permitted to share patient protected health information (PHI) under the HIPAA Privacy Rule  to carry out specific purposes and under certain circumstances.

For most disclosures, however, a covered entity must make reasonable efforts to limit the information disclosed to that which is minimally necessary to accomplish the purpose.  Per OCR’s reminder, covered entities may rely on representations from a public health authority or other public official that the requested information is the minimum necessary for the purpose.

The following is a summary of OCR’s reminder and the uses and disclosures available under 45 C.F.R. §164.510.

Continue reading

Time to Focus on Cybersecurity in Health Care

Share

In the wake of the WannaCry global attack that impacted the U.K.’s National Health Service, the need to protect valuable health care data has never been more urgent. The U.S. government has begun to take steps in the right direction with the passing of executive orders on cybersecurity, the Cybersecurity Act of 2015, and the Government Accountability Office report on the Internet of Things.

Continue reading

Disrupting the Health Care Cybersecurity Model (or Lack Thereof): Health Care Industry Cybersecurity Task Force Calls Out Regulatory Barriers

Share

In a previous blog post, our team evaluated the draft recommendations prepared by the Health Care Industry Cybersecurity Task Force in its “Report on Improving Cybersecurity in the Health Care Industry.”  

We recently examined three of the six major recommendations in the report and their potential impact on the existing health care regulatory environment. These include:

  • HHS and a Comprehensive Health Care Security Framework
  • Government and Private Incentives to Migrate Vulnerable Health Care Providers to More Secure Environments
  • Development of Fraud and Abuse Exemptions to Foster Collaboration and Permit Shared Resources

For more insight, read our detailed review of the health care security recommendations above.

An Early Review of the Trump Administration’s Health Care Cybersecurity Task Force Report

Share

Formed by the Cybersecurity Act of 2015, a task force established to share cybersecurity information between federal government and private industry representatives has released its “Report on Improving Cybersecurity in the Health Care Industry.” They presented six major action items for Congress, the Department of Health and Human Services, other government agencies and private industry.

The Report organized its recommendations under six Imperatives:

  • Define and streamline leadership, governance, and expectations for health care industry cybersecurity;
  • Increase the security and resilience of medical devices and health IT;
  • Develop the health care workforce capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities;
  • Increase health care industry readiness through improved cybersecurity awareness and education;
  • Identify mechanisms to protect research and development efforts and intellectual property from attacks or exposure; and
  • Improve information sharing of industry threats, weaknesses, and mitigations.

In a recent alert, we evaluated the action items and draft recommendations prepared by the Task Force, = and discuss how the Trump administration will react to these new proposals.

Read our review of the Health Care Cybersecurity Task Force Report

Newer posts »

© 2018 Drinker Biddle & Reath LLP. All Rights Reserved. Lawyer Advertising.

Disclaimer/Privacy Policy