Does HIPAA Even Exist for Large Corporations? -- PART 2
Today I got my official reply to my HHS Office of Civil Rights complaint of 5/3/24 against CVS for violating HIPAA regulations. The minor and rather impressive miracle here is that I got a signed letter from an attorney in only 17 days with relevant regulations and interpretations attached. Good so far.
The result was that they are not going to pursue a formal complaint -- instead they are going to "resolve this matter informally through the provision of technical assistance to CVS."
HHS OCR points out that "a covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of PHI in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.... Further, under the Security Rule, with certain exceptions, the use of encryption is addressable; i.e., not mandatory." [red emphasis mine]
HHS further states under Reasonable Safeguards that "It is not expected that a covered entity’s safeguards guarantee the privacy of protected health information from any and all potential risks. Reasonable safeguards will vary from covered entity to covered entity depending on factors, such as the size of the covered entity and the nature of its business."
If HHS OCR actually in fact offers this technical assistance in a meaningful way, that WOULD satisfy my complaint -- not that anyone is asking me. This was almost certainly a stupid screw-up by someone in CVS Info Tech programming the canned computer "after visit summary" process to send out way too much information in unencrypted format to people who received a COVID booster at a CVS. If CVS STOPS doing this, I'm good.
To recap -- I received an after-visit summary not only listing what COVID booster med I received, but also my DOB, home address, and all the answers to my screening questionnaire including my answers to whether or not I have ever had a seizure, a bleeding disorder, am currently pregnant, am immunocompromised (including from cancer), have a history of myocarditis, and many other questions.
I will waste my time writing HHS OCR back to thank them and to remind them that to the best of my knowledge I never signed a release for disclosure (which apparently has no legal bearing here?), and that in this new age of AI every major tech company is incorporating AI into EVERYTHING. If I had a Gmail account, Google would have all my medical information from this CVS after visit summary email and likely would be utilizing AI to monetize it in some way.
I suppose the good news here for small psychotherapy practices is that if this is close to acceptable practice for even a giant company like CVS, then maybe we have little to worry about when it comes to client privacy. Heck -- why not just email client PHI to them without getting releases first? Why have encrypted client portals for communication?
-- Michael
**Does HIPAA Even Exist for Large Corporations? -- PART 1**
I don't care if anyone knows I just got a COVID vaccine. Most people don't care.
However, CVS Pharmacy just sent me an after-visit report across unencrypted Internet to my email address.
The form included such fields as:
-- My Full Name
-- **DATE OF BIRTH!**
-- My Full Home Address
-- Medication Administered
-- Date and Time of Appointment
-- Name of Pharmacist I saw
-- Name of Doctor at CVS overseeing it all
-- Name and Address of my Primary Care Doctor
Also:
-- All the answers to my *screening questionnaire!* including my yes/no answers to multiple medical conditions such as heart problems, immunocompromise, seizures & other brain problems, and pregnancy.
So many things wrong here. This is almost enough information for identity theft (lacking only SSN). It gives away LOTS of my medical information. If I had a Gmail email address, Google would now have all this information. What if I was a pregnant female in the southern USA where Attorney Generals are starting to track state of pregnancy for later prosecution if women go out-of-state for abortions or have a suspicious (to them) miscarriage?
**How does CVS get away with this when smaller medical offices have to be so careful?**
Michael Reeder, LCPC
#AI #EHR #medicalnotes #progressnotes #healthcare #patientportal #HIPAA #dataprotection #infosec @infosec@a.gup.pe #doctors #hospitals #CVS #COVID #sars-cov-2 #longcovid #severecovid#covidisnotover #pharmacy #vaccine
Informative interview with Svetlana Blitshteyn, a pioneering MD in treating #dysautonomia (autonomic dysfunction), which has exploded with #LongCovid by @erictopol
Bishof said, “As a patient advocate, I urge insurance providers to reassess their policies and embrace a more inclusive approach that recognizes the ongoing challenges faced by Long Covid patients. It’s imperative that we support and protect these individuals, not isolate them further.”
"We are THRILLED to share the rolling successes of our 'Teach ME Treat ME' campaign with you, as we report back on the amazing medical education events that have taken place so far – with many more to come in the upcoming months!"
Article has lots more details along with reports of other Millions Missing events! 😁
A thread for eleven #MECFS, #LongCovid and related research papers from w/c 13th May 2024.
Links are to our forum discussion threads, where abstracts, links to paper, analysis and discussion can be found. Inclusion does not equal recommendation.
hey! johns hopkins is doing a survey about long covid! but they're having trouble finding CONTROLS, so if you've managed to avoid covid (#novid ) they wanna hear from you!
i took it! took about 30mins, and they ask about your vaccinations, so you might wanna have your card handy because they wanna know how many, what brand, and when. go help them out! #covid#LongCovid#COVID19
I have enough followers on here (👋 💞) that I think it is worth a little thread on how I relate to social media and online conversations & try to cultivate community
I am a person, not an object. I have personal thoughts, feelings, experiences, a family, & a life. Angry interactions from strangers & esp those interested in exploiting me as An Example Of Some Battle of Yours are dehumanizing & will get blocked (e.g.: "this is why those Ex Twitter people should be banned by default")
Not everything I share is for everyone -- how could it be? Sometimes I make silly jokes, or sideways references; sometimes I might understand a word differently than you do or make a typo or don't finish a clause. I also have #LongCovid , which means managing my stress, fatigue, and exposure to threat is quite LITERALLY life and death for me.
I block anyone who reads into this as moral failing. I don't tolerate "you didn't mention x, therefore you must be evil and hate x" on social media.
(pay wall)
"Parents of children with #longCovid claim they have been accused of faking or exaggerating their child’s illness, leading to social services’ involvement and... court cases and the threat of the child’s removal from the home."
I think it is really important we speak out against this bill as it could be copy-catted in other states, and its just messed up, so I started an email campaign: TIME-SENSITIVE!: Join the email campaign to stop HB 237 from passing in NC House of Representatives! If passed, this bill will make it illegal to wear a mask in public even for medical reasons, more info at https://the-maskers-comic.yolasite.com/stophb237 We need to send these emails out ASAP!
"For some people, disabling symptoms lead to complete inability to work. In less extreme cases, “work instability,” which is a mismatch between patients’ functional abilities and the demands of their work, can threaten employment if not addressed."
"Children with #LC have a reduced VO2 peak […], abnormal cardiovascular efficiency (VO2/HR% pred), pathological VE/VCO slope […], and abnormally reduced slope of VO2 work" "48% of the LC patients had a suspicious phenotype for pulmonary hypertension."