Home Health & Hospice Week

Make sure you’re taking this simple step to head off a HIPAA disaster.

If you don’t want to explain yourself to your patients — not to mention your referral sources, the press, potential customers down the road and the Department of Health and Human Services — then you’d better make sure your staff’s laptops are encrypted.

That’s a lesson one Vermont home care provider is learning the hard way. Caledonia Home Health and Hospice in St. Johnsbury contacted patients in an Aug. 6 letter to let them know a staffer had a work-issued Netbook stolen from home on July 20, according to news reports.

Patient health information including Social Security Numbers were included in Palmwyse software on the Netbook, the agency reportedly told patients. Both the Netbook and software application were password-protected, so "we think it is unlikely the information could be accessed without the dual password process," the letter said.

The HHA advised patients on how to look for and report suspicious activity related to misuse of the PHI, but did not offer free credit monitoring or similar services.

Don’t Overlook This Important Safeguard

This notification could have been prevented fairly simply. "If the electronic PHI … is stored and transmitted in encrypted form, then you do not need to notify patients, even if there is a security breach," notes the American Medical Association in education materials on the matter.

"Encryption is an easy method for making lost information unusable, unreadable and undecipherable," HHS Office for Civil Rights director Leon Rodriguez said when an Idaho hospice had to pay $50,000 to settle HIPAA violations over a stolen laptop earlier this year (see Eli’s HCW, Vol. XXII, No. 2). It was the first HIPAA fine levied for a breach affecting less than 500 patients.

Susan Johnson, Director of Clinical Care and Performance Outcomes for Caledonia parent Northern Counties Health Care Inc., declined to comment to Eli.