With HIPAA breaches, no real answer when it comes to blame, expert says

Adam H. Greene, partner, Davis Wright Tremaine, says education, discretion can help reduce privacy infractions.
By Jessica Davis
06:01 PM

LAS VEGAS -- When it comes to HIPAA breaches, the number of providers, insurers and business associates failing to protect patient health information is so staggering it has many organizations looking to place blame.

But according to Adam H. Greene, partner, Davis Wright Tremaine, there's no clear culprit.

"I apologize, but I'm not going to be able to answer the question today of who is at fault during a HIPAA breach," Greene told attendees during a HIMSS16 session Wednesday on understanding the function of HIPAA breaches. "The government hasn't yet decided."

The truth is that it's difficult to navigate HIPAA issues when you consider the network of healthcare operations, he added. It's complex with many specifications.

[Also: See photos from Day 2 of HIMSS16]

The problem is many healthcare leaders aren't reporting what HIPAA constitutes as breaches, including data sent to the wrong entity but who doesn't access the record. This is a HIPAA violation that often goes unchecked.

According to Greene, it boils down to providers understanding that anyone who accesses a PHI record must have a valid reason to do so, and that includes employees and business associates. 

Furthermore, healthcare leaders can't assume that all connected entities are HIPAA compliant.

Adding to the complexity and confusion are individual state laws regarding medical info breaches, Greene said. Organizations struggle to determine what, if any laws, are being broken.

"You have to be sensitive to the fact that state laws versus HIPAA," he added. "You have to look at both. State laws focus on unauthorized access, like computer data. This differs from HIPAA, which extends to user exposure."

What healthcare leader needs to focus on to avoid breaches altogether is ensuring "everyone understands what protected health information is and that's there's guidance," he said. "The focus here, isn’t that this is the correct answer versus this is wrong answer." It's about getting everyone on the same page.

Twitter: @JessiefDavis


This story is part of our ongoing coverage of the HIMSS16 conference. Follow our live blog for real-time updates, and visit Destination HIMSS16 for a full rundown of our reporting from the show. For a selection of some of the best social media posts of the show, visit our Trending at #HIMSS16 hub.

Want to get more stories like this one? Get daily news updates from Healthcare IT News.
Your subscription has been saved.
Something went wrong. Please try again.