UCLA Data Breaches Prompt Criticism of Medical Privacy Laws
Recently disclosed data breaches at UCLA Medical Center have led some critics of federal and state medical privacy laws to question whether the laws are strict enough, the Los Angeles Times reports.
The federal Health Insurance Portability and Accountability Act of 1996 includes rules that govern medical privacy, but a recent legal opinion by the Justice Department concluded that the rules apply primarily to organizations -- hospitals, health plans and physician offices -- and only secondarily to individuals, who typically are implicated in privacy violations.
Some privacy advocates have called for the law to be revised to permit individuals to specifically designate who may access their medical records, but some health care industry stakeholders argue that such a law would be difficult to enforce.
California has its own medical privacy law on the books, but that law leaves jurisdiction to the courts, rather than to state health officials.
However, on Tuesday, Health and Human Services Agency Secretary Kim Belshé said, "My understanding is that we could refer the case to the attorney general to enforce the [state Confidentiality of Medical Information Act], or to the local district attorney or the city attorney. We're looking at all three."
The California Department of Public Health has launched an investigation at UCLA Medical Center into the recent data breaches. If the probe finds privacy deficiencies at UCLA, the department can force the facility to create a plan of correction.
The state would then review the plan and revisit the hospital to ensure the plan has been implemented, the Times reports (Alonso-Zaldivar, Los Angeles Times, 4/9).
The UCLA Medical Center employee, Lawanda Jackson, who allegedly breached nearly 60 patients' medical records said on Tuesday, it was "just me being nosy," the Times reports.
Jackson, an administrative specialist, could face criminal charges for violating HIPAA medical privacy rules (Ornstein, Los Angeles Times, 4/9).