California's extension of its data breach notification law to cover health care records promises to have significant impact on how medical organisations deal with patient information.
Most notably, it fills what might be called a loophole in the Health Insurance Portability and Accountability Act (HIPAA), according to Paul Smith, a partner in the health law practice in the San Francisco office of national law firm Davis Wright Tremaine.
Prior to passage of AB1298, which took effect in January, organisations that lost medical records weren't required to notify victims if the lost records didn't contain their name and Social Security number and one of several other data elements, including account numbers with a personal identification number or a driver's license or California ID card.
"Without those data elements, there was no obligation to notify the consumer, for the most part," said Smith. "Now, there will be a number of situations in which health care providers will consider making a notification.
He admits there are some cases where notification requirements may not be so clear-cut. What about a lost laptop protected by a strong password, for example. In this case, he said, the thief might be after just the hardware.
"The most notable impact of this extension might stem from California's exemption of encrypted records," said Chuck Klawans, the information security officer at Children's Hospital and Health System in Milwaukee, Wis. "I believe that only breaches affecting unencrypted records require notification. This could result in more health care IT folks taking a serious look at encrypting data, at rest as well as in transit."
The main problem with California's new law is that it includes no penalties for organisations violating the statute, says Smith. "Does a consumer have the right of action?" he asks. "If your medical health info is hacked, what's your remedy?"
"We've had a similar law in Massachusetts since October 2007," noted John Halamka, CIO of CareGroup Health System as well as the CIO of Harvard Medical School. "Our response was to document all the databases that contain personally identifiable information, ensure they were protected with strong technical security, and that they have audit trails that our privacy officer can review."—
Jim CarrSee original article on scmagazineus.com