HIPAA should burn these companies/organizations. Should.
I don’t believe there are actual penalties prescribed by that law.
Note: I have had hipaa training for prior jobs and no penalties were ever discussed
Breaches of Unsecured Protected Health Information
21–30 of 31 posts
Re: Breaches of Unsecured Protected Health Information
#22I care less about health info privacy than identity. When I was a kid, hospital admissions were published in the daily paper. Nobody thought much of it. The number of people interested in your health is tiny. The number of people interested in your money, and motivated to try to take it from you, is much higher.
health information is tied incredibly tightly to money (insurance, blackmail, job security)
Re: Breaches of Unsecured Protected Health Information
#23I care less about health info privacy than identity. When I was a kid, hospital admissions were published in the daily paper. Nobody thought much of it. The number of people interested in your health is tiny. The number of people interested in your money, and motivated to try to take it from you, is much higher.
Enjoy: Your medical record is worth more to hackers than your credit card https://www.reuters.com/article/us-cybersecurity-hospitals/y...
> names, birth dates, policy numbers, diagnosis codes and billing information
In other words, identity information.
Re: Breaches of Unsecured Protected Health Information
#24HIPAA should burn these companies/organizations. Should.
I don’t believe there are actual penalties prescribed by that law. Note: I have had hipaa training for prior jobs and no penalties were ever discussed
> I don’t believe there are actual penalties prescribed by that law.
There are, in fact, actual penalties.
A summary: https://www.ama-assn.org/practice-management/hipaa-violation...
And there have been civil and criminal enforcement actions: https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...
> Note: I have had hipaa training for prior jobs and no penalties were ever discussed
I've had HIPAA training for several jobs stretching back to 2001, and civil and criminal penalties, and the fact that the latter especially were available against individual employees as well as covered entities, were stressed every time.
Re: Breaches of Unsecured Protected Health Information
#25There's some kind of database called MIB that sells all your medical information like a credit report. I haven't figured out how to opt out of it or where exactly they get the data so I can opt out of it before they even send it. It's some kind of horrific atrocity. Please somebody expose this to everyone: https://www.mib.com/request_your_record.html
Re: Breaches of Unsecured Protected Health Information
#26There's some kind of database called MIB that sells all your medical information like a credit report. I haven't figured out how to opt out of it or where exactly they get the data so I can opt out of it before they even send it. It's some kind of horrific atrocity. Please somebody expose this to everyone: https://www.mib.com/request_your_record.html
>a member company cannot search MIB or report information to MIB without the applicant’s knowledge and authorization.
Sounds like you consented...
Re: Breaches of Unsecured Protected Health Information
#27I wonder how many of these are encrypted systems. I see a lot of "theft" and "loss" on that list. I know if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption. I'd bet many or most of these are similar.
I’d guess that a lot of the encrypted systems had a password written on a sticky note on the desk or in the laptop bag. Encryption doesn’t do much unless you take the other sensible steps.
It’s more worrying to me that a doctor might not report a breach because the data is encrypted, but had the keys stolen along with the computer.
Re: Breaches of Unsecured Protected Health Information
#28There's some kind of database called MIB that sells all your medical information like a credit report. I haven't figured out how to opt out of it or where exactly they get the data so I can opt out of it before they even send it. It's some kind of horrific atrocity. Please somebody expose this to everyone: https://www.mib.com/request_your_record.html
>a member company cannot search MIB or report information to MIB without the applicant’s knowledge and authorization. Sounds like you consented...
Maybe. It's up to the member company to obtain the consent and report as such to MIB.
I just started shopping for term life insurance recently and have an application that was emailed to me by a local agent. It looks very much like this one (http://www.adkissoninsurance.com/forms/grangelifeapp.pdf), EXCEPT someone has removed the Notice of Information Practices at the top
Page 5 contains the authorization details.
Here's what page 5 looks like on my application - https://imgur.com/a/zk9ZQ (also Grange)
This is from a top tier life insurance provider, who knows what kind of shenanigans are going on out in the wild.
Edit: Just sent an email to my agent asking for a copy of that Notice of Information Practices doc, we'll see what happens lol.
Re: Breaches of Unsecured Protected Health Information
#29There's some kind of database called MIB that sells all your medical information like a credit report. I haven't figured out how to opt out of it or where exactly they get the data so I can opt out of it before they even send it. It's some kind of horrific atrocity. Please somebody expose this to everyone: https://www.mib.com/request_your_record.html
Have you applied for term life insurance in the last ten years? Based on what I'm reading in an application from Grange, you may be able to revoke any authorization through the insurance provider. It may nullify your policy though.
Re: Breaches of Unsecured Protected Health Information
#30> As required by section 13402(e)(4) of the HITECH Act, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
Well, I'm glad this random webpage is broadcasted into the internet and therefore everyone is properly informed about these breaches.
This is the same as Google providing that page somewhere deep in the account settings where you can view what data they have on you. It's beneficial for them to provide this, because 99.99% of users will never find it anyways. And those that are concerned can be calmed down by it.