Fluent Essays

the articles by Adjerid, Acquisti, Telang, Padman, & Adler-Milstein (2016), Cartwright-Smith, Gray, & Thorpe (2016), Marvin (2017), and Richesson & Chute (2015). HIPAA is a law that was enacted to protect patients’ private health information (PHI). The HIPAA law was enacted in 1996. This law has since been amended to include more specifics on PHI as it relates to technology. Most recently, in 2009, HITECH, a segment of the American Recovery and Reinvestment Act, has been enacted to include an expansion to electronic PHI (ePHI). HITECH provides benefits for providers to encourage the adoption of ePHI systems. From the 2018 OCR HIPPA Summary:  Settlements & Judgements Provide an analysis on the HIPAA violation of patient health information (PHI) that was present in the case selected:  June 2018  In June 2018, an HHS Administrative Law Judge ruled in favor of OCR and required The  University of Texas MD Anderson Cancer Center (MD Anderson), a Texas cancer center, to pay  $4.3 million in civil money penalties for HIPAA violations.  OCR investigated MD Anderson  following three separate data breach reports in 2012 and 2013 involving the theft of an  unencrypted laptop from the residence of an MD Anderson employee and the loss of two  unencrypted universal serial bus (USB) thumb drives containing the unencrypted ePHI of over  33,500 individuals.  OCR’s investigation found that MD Anderson had written encryption  policies going back to 2006 and that MD Anderson’s own risk analyses had found that the lack  of device‐level encryption posed a high risk to the security of ePHI. Despite the encryption  policies and high risk findings, MD Anderson did not begin to adopt an enterprise‐wide solution  to encrypt ePHI until 2011, and even then it failed to encrypt its inventory of electronic devices  containing ePHI between March 24, 2011 and January 25, 2013.  This matter is under appeal  with the HHS Departmental Appeals Board. Date               Name                       Amount June 2018     M.D. Anderson        $4,348,000 Analyze the specific HIPAA privacy and security rules that were broken. Explain the penalties (if any) that were imposed as a result of the ruling on the case. Develop a health system improvement plan to include applicable Federal standards. Propose a risk analysis strategy addressing appropriate laws and regulations. Apply the lessons learned from this particular case to your Proposal and Final Presentation.Chapter 9 Privacy and Security Privacy is an individuals constitutional right to be left alone, to be free from unwarranted publicity, and to conduct his or her life without its being made public. In the healthcare environment, privacy is an individuals right to limit access to his or her health care information. In spite of this constitutional protection and other legislated protections discussed in this chapter, approximately 112 million Americans (a third of the United States population) were affected by breaches of protected health information (PHI) in 2015 (Koch, 2016). Three large insurance-related corporations accounted for nearly one hundred million records being exposed (Koch, 2016). In one well-publicized security breach at Banner Health, where hackers gained entrance through food and beverage computers, approximately 3.7 million individuals information was accessed, much of it health information (Goedert, 2016). Health information privacy and security are key topics for healthcare administrators. In todays ever-increasing electronic world, where the Internet of Things is on the horizon and nearly every health care organization employee and visitor has a smart mobile device that is connected to at least one network, new and more virulent threats are an everyday concern. In this chapter we will examine and define the concepts of privacy, confidentiality, and security as they apply to health information. Major legislative efforts, historic and current, to protect health care information are outlined, with a focus on the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification rules. Different types of threats, intentional and unintentional, to health information will be discussed. Basic requirements for a strong health care organization security program will be outlined, and the chapter will conclude with the cybersecurity challenges inChapter 10 Performance Standards and Measures This chapter examines public and private organizations and processes that establish standards for ensuring that health records are maintained accurately and completely and that they contain the data and information needed to define and report a wide range of measures to determine the quality and efficiency of health care. These activities are very important and have a significant influence on providers and HIT capabilities, significant enough for us to devote an entire chapter to them. Health care organizations and health plans use data and information to measure performance against internal and external standards; to compare performance to other like organizations; to demonstrate performance to licensing, certifying, and accrediting bodies; and to demonstrate performance for reimbursement purposes. This chapter begins with an examination of the licensure, certification, and accreditation of health care facilities and health plans, followed by an overview of key comparative data sets often used by health care organizations in benchmarking performance. The chapter concludes with a description of the national initiatives using performance measures to improve the quality and safety of health care, including those affecting provider reimbursement. In the section titled “Licensure, Certification, and Accreditation,” we define these processes, list the accrediting organizations recognized by CMS, and examine the missions and general functions of the Joint Commission and the National Committee for Quality Assurance (NCQA). These discussions focus on how the licensure, certification, and accreditation processes not only use health information to measure performance but also how they influence the health care information that is collected. “Measuring the Quality of Care” begins with a historical perspective of major milestones in the national agenda for health care quality Chapter 11 Health Care Information System Standards Throughout this text we have examined a variety of different types of standards that affect, directly or indirectly, the management of health information systems. In Chapter Ten we examined health care performance standards; Chapter Two looked at data quality standards, Chapter Nine at security standards, and so on. In this chapter we will examine yet another category of standards that affect healthcare data and information systems: health care information system (HCIS) standards. In all cases the standards examined represent the measuring stick or set of rules against which an entity, such as an organization or system, will compare its structures, processes, or functions to determine compliance. In the case of the HCIS standards discussed in this chapter the aim is to provide a common set of rules by which health care information systems can communicate. Systems that conform to different standards cannot possibly communicate with one another. Portability, data exchange, and interoperability among different health information systems can be achieved only if they can “communicate.” For a simple analogy, think about traveling to a country where you do not speak the language. You would not be able to communicate with that countrys citizens without a common language or translator. Think of the common language you adopt as the standard set of rules to which all parties agree to adhere. Once you and others agree on a common language, you and they can communicate. You may still have some problems, but generally these can be overcome. By nature HCIS standards include technical specifications, which make it less easy for the typical health care administrator to fully understand them. In addition, a complex web of public and private organizations create, manage, and implement HCIS standards, resulting MANAGEMENT SCIENCE Vol. 62, No. 4, April 2016, pp. 1042–1063 ISSN 0025-1909 (print) � ISSN 1526-5501 (online) http://dx.doi.org/10.1287/mnsc.2015.2194 © 2016 INFORMS The Impact of Privacy Regulation and Technology Incentives: The Case of Health Information Exchanges Idris Adjerid Mendoza College of Business, University of Notre Dame, Notre Dame, Indiana 46556, [email protected] Alessandro Acquisti, Rahul Telang, Rema Padman H. John Heinz III Heinz College, Carnegie Mellon University, Pittsburgh, Pennsylvania 15213 {[email protected], [email protected], [email protected]} Julia Adler-Milstein School of Information, University of Michigan, Ann Arbor, Michigan 48109 [email protected] Health information exchanges (HIEs) are healthcare information technology efforts designed to foster coordi-nation of patient care across the fragmented U.S. healthcare system. Their purpose is to improve efficiency and quality of care through enhanced sharing of patient data. Across the United States, numerous states have enacted laws that provide various forms of incentives for HIEs and address growing privacy concerns associ- ated with the sharing of patient data. We investigate the impact on the emergence of HIEs of state laws that incentivize HIE efforts and state laws that include different types of privacy requirements for sharing healthcare data, focusing on the impact of laws that include requirements for patient consent. Although we observe that privacy regulation alone can result in a decrease in planning and operational HIEs, we also find that, when coupled with incentives, privacy regulation with requirements for patient consent can actually positively impact the development of HIE efforts. Among all states with laws creating HIE incentives, only states that combined incentives with consent requirements saw a net increase in operational HIEs; HIEs in those states also reported decreased levels of privacy concern relative to HIEs in states with other legislative approaches. Our results contribute to the burgeoning literature on health information technology and the debate on the impact of pri- vacy regulation on technology innovation. In particular, they show that the impact of privacy regulation on the success of information technology efforts is heterogeneous: both positive and negative effects can arise from regulation, depending on the specific attributes of privacy laws. Keywords : privacy; information systems; IT policy and management; economics of information systems; healthcare History : Received April 19, 2012; accepted December 16, 2014, by Anandhi Bharadwaj, information systems. Published online in Articles in Advance November 13, 2015. 1. Introduction The U.S. healthcare system is in the midst of an infor- mation technology revolution. Adoption of electronic medical record (EMR) systems is quickly rising (Office of the National Coordinator for Health Information Technology 2012). In parallel, health information exchanges (HIEs) have eme207 Health Information Ownership: Legal Theories and Policy Implications Lara Cartwright-Smith, Elizabeth Gray, and Jane Hyatt Thorpe* ABSTRACT This Article explores the nature and characteristics of health information that make it subject to federal and state laws and the existing legal framework that confers rights and responsibilities with respect to health information. There are numerous legal and policy considerations surrounding the question of who owns health information, including whether and how to confer specific ownership rights to health information. Ultimately, a legal framework is needed that reflects the rights of a broad group of stakeholders in the health information marketplace, from patients to providers to payers, as well as the public’s interest in appropriate sharing of health information. TABLE OF CONTENTS I. INTRODUCTION .................................................................... 208   II. THE UNIQUE NATURE OF HEALTH INFORMATION ................ 209   A. Definitions of Health Information .................................. 210   1. Health Information Characteristics .................... 210   2. Health Information Types ................................... 212   III. THE LEGAL AND POLICY LANDSCAPE FOR HEALTH INFORMATION ...................................................................... 214   IV. LEGAL THEORIES OF INFORMATION OWNERSHIP ................. 219   A. Property law ................................................................... 220   B. Intellectual Property Law ............................................... 225   C. Federal Privacy Law ...................................................... 226   1. Constitutional Law .............................................. 226   2. HIPAA .................................................................. 228   * The authors thank Jennifer Ansberry, JD, MPH, Maanasa Kona, JD, LLM, and Resa Cascio, JD, LLM, for their valuable research contributions to this paper. 208 VAND. J. ENT. & TECH. L. [Vol. XIX:2:207 3. Other Federal and State Statutes and Regulations Protecting Health Information Privacy .......................................................... 231   a. The Genetic Information Non-Disclosure Act of 2008 (GINA) ............................ 232   b. Privacy Act and FOIA ............................... 233   c. 42 C.F.R. Part 2 ........................................ 234   D. Contract Law .................................................................. 235   E. State Law ....................................................................... 236   V. POLICY CONSIDERATIONS .................................................... 237   VI. CONCLUSION ....................................................................... 241   I. INTRODUCTION The concept of owning information invokes thoughts of property and profit. Property ownership means that