Hackers, HITECH and HIPAA in DTC Genomics, Oh My!

At our practice we run a pretty tight ship when it comes to security of patient records. Why do we do this? Well there are 2 big reasons.

1. It's the right thing to do.

2. The law will put you in the hurt locker if you don't

I want to talk about reason 2 a little bit.

Why?

With all of this protection of health information and DTC genomics companies going bankrupt, I begin to really wonder who a covered entity is.

Daniel Vorhaus over at Genomics Law Review has a pretty good break down of it, but I think there may be some nuances not covered. As well as a notable lack of coverage of HITECH policies in the ARRA.

Wha?

Yes the recovery act has stuff on Health care privacy in it. In HIPAA DTC Genomics may not be covered, but I think in HITECH they are.

Why have I been reading this stuff? Because it's my job.

According to HITECH

H.R.1 150 Title XIII (HITECH)

SEC. 13404

For the purposes of compliance with privacy and security regulations, a "covered entity" and its "business associate" are equally liable as if each were itself was a covered entity.

Which means if I send a DTC genomic test off with a doctor's order, AKA Illumina, a breach in that data due to the lab or interpretive business associate THEY are just as liable as the physician.

This means that DTC Genomic tests ordered by physicians fall into a completely more risky category than those ordered by Joe Blow.

This one risk may be why DTC is dying not to make these tests gatekeeper specific. Once these tests become gatekeeper specific, DTC will

A. No longer be DTC

B. No longer be free of HITECH and HIPAA

Which means a big 'ol nightmare for these companies as they want to emphasize the social networking part. You see, social networks have always balanced growth versus security and the same is true for any Internet Technology.

But let's say this is just one rogue hacker who has decided to hack a genome record ordered by a physician.......Via say a hacked email or website........

What is the penalty?

CITE 42USC1320-6

This is the scary part.

Sec. 1320d-6. Wrongful disclosure of individually identifiable          health information           (a) Offense      A person who knowingly and in violation of this part--         (1) uses or causes to be used a unique health identifier;         (2) obtains individually identifiable health information      relating to an individual; or         (3) discloses individually identifiable health information to      another person,  shall be punished as provided in subsection (b) of this section.  (b) Penalties      A person described in subsection (a) of this section shall--         (1) be fined not more than $50,000, imprisoned not more than 1      year, or both;          (2) if the offense is committed under false pretenses, be fined      not more than $100,000, imprisoned not more than 5 years, or both;      and         (3) if the offense is committed with intent to sell, transfer,      or use individually identifiable health information for commercial      advantage, personal gain, or malicious harm, be fined not more than      $250,000, imprisoned not more than 10 years, or both. 

So let's say someone hacked a record to get the one up on you, maybe you are a political candidate or maybe a business competitor, or maybe they want to sue you.......

If this rogue hacker performs an act of this on genomic information ordered by a doctor or that can be defined as PHI, these are the penalties. If it is not considered PHI, it is a far lesser offense.......

So the question is, do you want these protections if you are a customer/patient? I would say Hell Yeah.

But do you want them as a covered entity? Uhhhhh.....Ahem.......Well........

As a doctor we have to follow these. Why shouldn't anyone else who has been given the responsibility of handling human samples?

The Sherpa Says: As a consumer HITECH is great. But as a start up company it can prove to be a nightmare. But those who have to risk the most are the huge companies making millions of dollars....can you say class action lawsuit for millions? I know a few lawyers who would be interested in that! I wonder if the DTC Genomics investors thought of that

Thank You

Today I received a phone call that made my month. One of my wonderful readers called and said "I love reading the Sherpa everyday! You have some way of fitting in really interesting and insightful information that I don't get anywhere else. Trust me, I am on the Internet all the time. No one has this stuff but you! So keep it up Sherpa!"

Let me tell you a little bit about the Sherpa and his (my) day. I usually get up around five am. I hit the snooze button but it never seems to work. Mainly because my daughter has decided to get up as well. I get the baby, change the diapers and turn on the computer. These days I turn on the Treo 700wx as well. I see what emails have transpired while I was sleeping and I get an invoice from my employees overseas.

My S.O. heads to work and I am left alone with my extremely vigorous child. I feed her the bottle while checking the DNANetwork as well as turn on the "news" (what I mean here is the propaganda machine run by PR specialists)

I usually field 2 to 3 phone calls in the morning from my residents. They tell me about how things went overnight in the hospital. Then I hit the shower (yes, even Sherpa's shower)

When I get out, my RSS feeder has finished updating and my daughter has had enough of the PnP (pack and play).

I feed my lovely daughter her bottle and scan the RSS while she is eating, making notes on my Treo. I then take a 5 minute break to give her TOTAL attention. It's 7:15 am, then the phone rings, it is the sitter. I buzz her in (Thank God)

Then the day begins.....I won't share more here. But let me tell you, that part of the day has been a breeze so far.

So I want to thank all of you who read the Sherpa. I appreciate all of your time and attention. Today I want to put something out there for your digestion. AlterNet has posted on something that had worried for sometime (see here). I don't mean to upset the well intentioned people at Google (They are ALWAYS the biggest viewers of The Sherpa according to feedburner) but there are some significant concerns that medical professionals have. Now it is getting some significant play.

Google has been in the info gathering game and has been doing it very well. Unfortunately HIPAA came along and I think the guys in Mountain View have bit off more than they can chew. Do you have any idea how expensive EMRs are? I chalk it up to the HIPAA and billing code abilities that an EMR must possess. Privacy is a big issue even if GINA passes (which it will). GINA does not cover life insurance, secondary schools, potential mates.....etc

The Sherpa Says: I thank you all for listening to my morning. I hope you find as much enjoyment in reading the Sherpa as I do posting it. As for private information moving out of your control, whether you are a utilitarian or an autonomist you have to admit there is something fishy to this type of power grab.