Home Health & Hospice Week

Agency faces lawsuit, investigations.

If you're wondering how bad a patient information security breach might get, just take a look at Providence Home Services in Portland, OR.

On Dec. 31, 2005, a thief stole from an employee's car computer disks and tapes containing the medical records of 365,000 current and former Providence patients, home health agency parent Providence Health System confirms in a release.

The records, which can't be read on normal home computers, date back to 1987 and include names, addresses, dates of birth, health conditions and drug prescriptions, reports The Oregonian newspaper. Many files have Social Security numbers; some also have financial information. Data on 1,500 current and former Providence employees also was included.

The disks and tapes were in an employee's car because the agency designated employees to take computer files home each day as an emergency backup in case the main records system failed, the paper says.

Providence notified the public of the theft Jan. 25 and sent letters to the Washington and Oregon patients affected, the agency says. After public outcry, Providence agreed to arrange and pay for a credit service package for all affected patients. More than 10,000 patients have called a hotline Providence set up, it says.

Patients have filed a class action lawsuit in state court against the agency, state lawmakers have vowed to hold hearings on the matter, the state Attorney General is investigating for legal violations and the Department of Health and Human Services is looking into HIPAA and other regulatory violations, according to press reports. That's on top of the negative newspaper stories and editorials about the topic. In addition, identity theft predators are making the situation worse. "Scam artists are portraying themselves as Providence employees and asking for personal information such as social security numbers and bank accounts so they can 'verify' the stolen data," Providence warns in a release. • The Centers for Medicare & Medicaid Services will revise payment categories for two respiratory assist devices. Codes E0471 and E0472 will move from the durable medical equipment category for frequently serviced items to the DME payment category for capped rental items, effective April 1, CMS says in a Feb. 1 transmittal. This change comes after CMS' announcement in the Jan. 27 Federal Register that it no longer classifies RADs with bi-level capability and a backup rate to be items requiring frequent and substantial servicing (see Eli's HCW, Vol. XV, No. 5).

The first claim received for each beneficiary for these codes with a date of service on or after April 1 will count as the first rental month in the cap rental period, CMS explains. Suppliers should begin submitting cap rental modifiers KH, KI or KJ, as appropriate, with all rental claims for these [...]