Federal officials are working to ramp up enforcement of existing medical privacy rules, but some experts say stronger protections are necessary to ensure the security of health data, the New York Times reports.
Reports of Data Breaches
According to data on a federal website, at least 7.8 million people have experienced a breach of their medical data within the last two years. Some of the largest cases involved:
- The insurer Health Net, which reported in March that records containing personal information on 1.9 million members were missing; and
- New York City's Health and Hospitals Corporation, which reported in February the theft of files containing data on about 1.7 million patients, staff members, contractors and suppliers.
In addition, HHS reported two weeks ago that the agency had identified dozens of vulnerabilities in systems designed to protect patient data at seven large hospitals in California, Georgia, Illinois, Massachusetts, Missouri, New York and Texas.
Ramping Up Enforcement
Lori Pilcher, assistant inspector general at HHS, said federal auditing teams now are inspecting more hospitals for weaknesses in their data security systems.
The Obama administration already has imposed penalties for violations of HIPAA privacy and security rules. In addition, HHS' Office for Civil Rights recently levied its first civil penalty under HIPAA.
Calls for Stronger Protections
Despite the federal government's efforts, some experts are calling for tighter regulations on health data security.
David Brailer, former national coordinator for health IT, said one way to improve medical privacy would be to make it illegal for insurers or employers to discriminate against an individual based on medical information. According to Brailer, federal laws should state that "patients own the data, period, and decide what happens to it." He added, "Today, HIPAA makes no sense. The law didn't anticipate a world where your data passes through many, many hands."
Wes Rishel -- a health care analyst for technology consulting company Gartner and an adviser to the Office of the National Coordinator for Health IT -- said, "Your ability to control access to your [health] information is a horse that is already out of the stable. What is really needed is legislation that controls the use of" such medical data (Freudenheim, New York Times, 5/30).