|
HIPAA: "Somebody Finally Went to Jail"
By
Dale Dauten
A bakery in the Midwest had a break-in where all their money was stolen from
their locked safe. The safe was undamaged. How did the crooks "crack
the safe" and get to the money?
The combination was written on a post-it note stuck to the wall above the safe.
What got me
thinking about that bakery burglary was listening
to Dr. Bill
Braithwaite speak at the STC Users' Group
meeting this past summer. Braithwaite is known as Dr. HIPAA or "the Father of HIPAA."
He commiserated
about how easy it can be to get lazy with security measures.
He mentioned, for instance, one medical
facility that uses a
fob to display security codes for the health information system. However, rather than go and
look at the fob, someone aimed a webcam at it so everyone could
always see the code numbers.
Why should we care? Braithwaite provided two good reasons:
1. Because health records contain enough information for identity theft, they are worth $50 apiece on the black market. Credit card records, the ones getting all the press? Just 50 cents.
2. "Somebody finally went to jail."
This last point made me curious. I discovered that the somebody who went to jail was an employee at the UCLA Medical Center, a cardiothoracic surgeon from China who did not resell, share or otherwise publish protected health records; he merely snooped, apparently for the sake of snooping.
Here's the story...
The UCLA Medical Center hired Huping Zhou as a researcher in rheumatology. His employment turned out to be, as the HR folks like to say, not a good fit. Zhou was fired for performance in 2003. Shortly thereafter, Zhou accessed the medical records of his former boss and co-workers.
Although UCLA fired Zhou, management forgot to terminate his access to medical records, thus violating required termination protocols. However, it also turned out that even before being let go Zhou had often ventured into private records, including those of celebrities like Tom Hanks and Arnold Schwarzenegger.
Eventually Zhou earned himself the distinction of being the first person to be convicted and sentenced for illegally looking at protected medical records - not for selling or using the information, simply looking at it. His lawyers appealed the decision.
His defense team argued that UCLA had failed to provide adequate training.
The court rejected that argument. The defense also argued that the law was unclear and Zhou did not know that simply looking at the records was a crime. The latter was key to an appeal to the Ninth Circuit Court of Appeals.
The appeal decision hinged on the word "and." The court's opinion stated that the statute's criminal penalty applies to those who "knowingly and in violation... obtained individually identifiable health information..."
Keying on the word "and," the court argued that if someone knowingly obtained information that was in violation, then the law had been broken.
Here's a surprising quote from the ruling:
...we cannot ignore "and" because its presence often dramatically alters the meaning of a phrase. Without "and," the Second Amendment would guarantee "the right of the people to keep bear arms..."
The upshot was that the court upheld the ruling and Zhou received four months in prison, plus fines.
Further, an HHS investigation of a number of incidents at UCLA Health Systems resulted in an $865,500 settlement.
THE TAKEAWAY?
The stories of the bakery safe, the webcam aimed at code numbers, and the lax termination protocols at UCLA all have the same culprit: a corner was cut.
We live in the Time of No Time and so we all can identify with finding an easier way, or letting a detail slip. However, here's the important lesson: the safe is only as secure as the combination and the people who use it.
All of this is a good reminder to review security procedures. The folks at HHS have published a booklet that can guide that review. A PDF is available at...
|
