I understand very well the point my friend David is making. To underscore his point I remember when HITECH extended fines and penalties to Business Associates. It caused many BAs who had not been paying attention to HIPAA requirements to sit up and take notice. This led to an intense and concerted effort among Business Associates to create compliant systems and enhanced protections for PHI. That effort continues to the present day, but as this incident indicates - not all Business Associates have moved in this direction.

I respond to David's point with a question. Is it possible that the proprietor of this business could claim ignorance of the law as an excuse? As long as the answer to that question can be "yes" then the work of the government, industries and associations is not complete on this issue. Will we need to eventually ask all garbage services to put legal notice stickers on trash cans and dumpsters regarding proper disposal of confidential information? Who knows? I place that in the category of other product liability disclaimers and legal information blurbs that tell you how to use your shampoo bottle or warn that ammonia is poison with a skull and crossbones symbol. There is no sticker on your microwave that says don't insert your cat. People are supposed to know better than that. Unfortunately some probably don't. 

I don't think information management associations, foundations or government agencies need to look very far to find worthwhile projects that benefit society. Clearly this incident points to either a flagrant HIPAA violator, (and if judged to be a category IV offender, they will receive their duly earned, up-to-$1.5 million dollar fine and possibly go out of business), or a we will see a small business owner who has way more to do than they have time to do it in and can't be bothered with things like training employees in anything other than basic work objectives and processes, the biggest part of which is lifting things. Those employees, without enhanced training and exercising their own common sense quite independent from any kind of formal education on proper document and confidential records management procedures, wouldn't know a HIPAA from hopscotch and take out the trash just like they do every other night. If this is the case then the message is not penetrating far enough inside the organization. Systems can be designed to do that better. Maybe this issue can make its way into the conversations of organizations that have the resources to design those better systems.

Best wishes,

Jim

Jim Booth, CAE
Records & Information Management Practice Leader

Brightstone Insurance Services, LLC
Direct – 919.323.3266
Direct Fax – 914.636.0802
Main - 877.862.4755 x 3266
[log in to unmask] 
www.brightstoneins.com


Please Note: Coverage cannot be placed, bound or altered without confirmation from a Brightstone Representative. 

Confidentiality Notice: This e-mail (including any file attachments) is for the sole use of the intended recipients - not necessarily the addressees, and may contain confidential and/or privileged material.  You are hereby notified that dissemination, disclosure, distribution, duplication, or other use of this transmission by someone other than an intended recipient or an intended recipient's designated agent is strictly prohibited. If you are not an intended recipient or believe you have received this transmission in error, please return this e-mail using a reply command and then delete all copies.  Also please notify the sender by calling 877-862-4755. Thank you.
 Please consider the environment before printing this e-mail

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]