Avoid HIPAA confusion

A well designed network will already have most of the needed features for security already implemented. However, a bigger part of the (security) guidelines indicates the need for good policies, education and documentation. The crafters of this policy tried to consider the need for flexibility in implementing Hipaa. That's probably why it seems, no, it is, so vague in some areas. Before the provision was finalized there was ample opportunity to write in and have one's opinion considered. Many did. Now the provision is a watered down shadow of it's former self. Hipaa will provide a much needed push to inadequately designed networks and have minor impact on others. Without Hipaa how would security for the sake of privacy happen in healthcare?

I do agree that caution is advised. There are likely many consultants thinking of how to capitalize on this opportunity. That's not new. Caveat Emptor.

Remember the old medical adage "The operation was a success but the patient died"? Well it is about to be replaced by new one: "We had the right diagnosis and treatment plan but the patient died two days before we received his medical records."Which raises the question, is there a way for an individual to waive his or her Privacy rights under the HIPAA?

If so, a waiver document could be carried by an individual at all times that would legally and unconditionally exempt everyone from any liability whatsoever with regard to the privacy and handling of the individual's medical information.

A HIPAA waiver document would have the same legal standing as a Do Not Resuscitate ("DNR") document. Ideally it would be wallet-sized--just like an organ donation card.

It appears, based on Mr. Yarden's supposition, that he also does not understand the far reaching implications behind the regulatory text.

One of the true issues brought out by Mr. Yarden is the broad interpretations on each of the individual regulations. However, that is where the problem lies. CE's are NOT supposed to be compliant with each individual regulation. They are supposed to be compliant with all regulatory text.

Given that HIPAA will not be finalized until late 2007 (purportedly), a CE can not be compliant, but can only work towards compliance. Furthermore, only the CE itself can determine whether it is achieving HIPAA compliance or not, based upon it's own risk mitigation. A consultative body, outsourced body, orresource not intrinsic to the CE is free from accountability and subsequent penalties for non-compliance.

A questions beg in response to Mr. Yarden. If a complaint is filed on his customer and the DHHS or DOJ determine non-compliance it is Mr.Yarden's company or Mr. Yarden himself who will serve the time and pay the penalties? Does Mr. Yarden's contract provide with this stipulation?

Ladies and Gentlemen, the bottom line is not our opinion or beliefs. The bottom line is what is law whether we like it or not. The regulatory text is exceedingly clear on who is held accountable for CMP's or time served for non-compliance: The CE as a whole (CMP's), the CECP (CMP's & time served) and the CE employee who committed the non-compliance (CMP's and time served).

Not that anyone should care, but I am the Compliance and Security Officer for a software development company serving the healthcare industry. We have been dealing with HIPAA since 1996.