These statistics are from the Redspin research report “Breach Report 2011: Protected Health Information.”

Of course certain things like encrypting data on all mobile devices is a necessity at any hospital nowadays. You’d be surprised, however, how many facilities don’t do it.

This problem is just going to get worse with employees bringing their smartphones, iPads, etc. to work.

In fact, 39% of all PHI breaches to date are from laptops or other portable devices. They’re the easiest things for thieves to steal and, even more likely, employees to loose. And — here’s the shocking part — 50% of respondents in a recent healthcare IT poll say their facilities aren’t doing anything to protect data on those devices.

Some options for securing PHI aren’t that expensive, but options that provide top of the line security are obviously more expensive.

For example, the Boyd Company estimates that healthcare data security spending in 2012 will go over $40 billion. That’s a 22% increase from 2011 levels. And it’ll top $70 billion by 2015.

The Boyd Company created an analysis of the costs of operating a healthcare data security center in U.S. cities. The analysis looked at the cost of skilled labor in health information and data security; land costs; construction costs; taxes; utilities; corporate travel and other occupancy costs.

The annual costs in the study were based on centers occupying 150,000 sq. ft of newly constructed space, and employing 150 workers.

It found that some cities are most cost effective for operating a healthcare data security center than others.

Top 3 most expensive locales

1. New York
2. San Francisco
3. Los Angeles

Top 3 lowest cost locales

1. Sioux Falls, SD
2. Tulsa, OK
3. Ft. Walton/Destin, FL

For more information about the Boyd Company report, “Healthcare Services Industry: A  Comparative Cost Analysis for Information Assurance Operations,” click here.

Related posts:

1. Study: Healthcare data breaches on the rise From 2010 to 2011, data breaches increased 32% in hospitals...
2. Annual cost of health data leaks: $6.5 billion When patient data is breached there’s a cost to patient...
3. Health care costs pushing more into poverty levels The fast-rising cost of even basic health care is straining...

Related posts brought to you by Yet Another Related Posts Plugin.

Just how much of a risk do they pose?

To find out the answer to this question, Symantec, a provider of security, storage and system management solutions, lost 50 smartphones … on purpose. The phones were left in very public places in five major cities. And the devices were loaded with simulated corporate and personal data, as well as software that allowed the company to monitor phone use.

Here’s what was discovered:

• 96% of the phones were turned on by their finders
• Nearly half of the finders tried to access the phone owner’s bank account
• 60% of the finders tried to view social media info and email
• 80% of finders tried to access corporate info including files marked as human resource salaries, human resource cases and other corporate info, and
• 50% of the people who found the phones tried to return them.

So if your hospital uses mobile devices, what can you do to protect the data on them?

• Develop and enforce security policies for employees using mobile devices for work. For example, all mobile devices must have password-enabled screen locks.
• Don’t just focus on securing the device. The patient data on the phone must also be protected no matter where it’s exchanged.
• If a mobile device is lost, have a formal process in place so everyone knows what to do.
• Integrate mobile device security and management into the overall facility security and management, and
• Take inventory of the mobile devices connecting to your hospitals  network.

Simply having a password on the phone and the ability to remotely wipe data off the phone, could have prevented most of the problems that arose in the Symantec study.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

From 2010 to 2011, data breaches increased 32% in hospitals and healthcare organizations, mainly because of two reasons: 

• The use of unsecured mobile devices to transmit data, and
• employee mistakes.

That’s according to the Second Annual Benchmark Study on Patient Privacy & Data Security by the Ponemon Institute. The study surveyed 72 healthcare organizations.

The rise in breaches is happening despite increased compliance with the HITECH Act and HIPAA. Unfortunately, a lot of hospitals and healthcare organizations feel a bit helpless because their security and privacy budgets aren’t sufficient to cover their expenses of training, technology, etc.

And as data breaches rise, so do the costs. This year, a compromised record cost an average of $214, while a data breach event averaged $7.2 million.

Some statistics from the study that’ll interest health executives include:

• 96% of the organization in the study had at least one data breach in the past 24 months, most of which were due to employee mistakes. On average, respondents had four data breach incidents in the past 24 month.
• 29% of respondents said in a one-year span of time, a data breach at their organizations led to identity theft.
• 81% of the facilities surveyed use mobile devices to collect, store and/or transmit some type of protected health information (PHI), and 49% of them admit these devices aren’t protected.
• The average number of lost/stolen records per breach was 2,575, and
• Only 29% of respondents said the prevention of unauthorized access and loss/theft of patient data is a priority, but 51% of respondents said they were very familiar with HIPAA/HITECH privacy, security and data breach notification laws and rules.

On the plus side, the study found healthcare organizations are making progress in their efforts to stop data breaches.

Thanks to the requirements of HIPAA and HITECH, facilities have better trained and more knowledgeable staff, as well as better policies in place. As a result, more data breaches are being discovered by employees and audits rather than patients. In fact, discovery of breaches by patients has dropped from 41% to 35%.

Do you feel your facility is on the cutting edge when it comes to policies and procedures in place to protect patients’ PHI? If so, share them in the comments box below.

Related posts:

1. Annual cost of health data leaks: $6.5 billion When patient data is breached there’s a cost to patient...
2. Enabling Data as a Service for Healthcare Providers The healthcare provider sector has a clear opportunity to modernize...
3. Hospital accuses own COO of stealing patient data A hospital is suing its former COO, alleging that she...

Related posts brought to you by Yet Another Related Posts Plugin.

The Centers for Medicare & Medicaid (CMS) has some answers.

First off, to avoid payment delays, you need to register for the program as soon as possible. If you’re not sure what’s needed to register, here’s a list for hospitals and professionals:

Professionals

• National Provider Identifier (NPI)
• National Plan and Provider Enumeration System (NPPES) User ID and Password
• Payee Tax Identification Number (if you are reassigning your benefits)
• Payee NPI (if you are reassigning your benefits)

Hospitals

• CMS Identity and Access Management (I&A) User ID and Password
• CMS Certification Number (CCN)
• National Provider Identifier (NPI)
• Hospital Tax Identification Number

A hospital may qualify for both the Medicare and Medicaid EHR Incentive Programs if it meets all of the following qualifications:

• It’s a subsection (d) hospital in the 50 U.S. States or the District of Columbia, or it’s a Critical Access Hospital (CAH)
• It has a CMS Certification Number ending in 0001-0879 or 1300-1399,  and
• 10% of its patient volume derives from Medicaid encounters.

Note: Hospitals that are eligible for both programs should select “Both Medicare and Medicaid” during the registration process, even if they plan to apply only for a Medicaid EHR incentive payment. Dually-eligible hospitals can attest through CMS for their Medicare EHR incentive payment at a later date, if they want to.

Hospitals that fall into one of the following three categories only qualify for the Medicaid EHR Incentive Program:

• Children’s hospital
• Cancer hospital, or
• Acute-care hospital in the U.S. territories.

When registering, facilities should select “Medicaid-only” for the hospital type and select their state from the drop-down menu. Not all states have launched a Medicaid EHR Incentive Program yet. Facilities that aren’t sure about their state can check its status here.

Eligible professionals who qualify for both the Medicare and Medicaid EHR Incentive Programs must select which incentive program they want to participate in during registration. And if they want to switch to the other program before 2015, they only can do so once after the first incentive payment is initiated.

For eligible hospitals and professionals who need more help, CMS offers a step-by-step guide.

Related posts:

1. Congress reaches deal on Medicare payments Good news — but not great news: Congress has reached...
2. 5010 compliance delayed … again Here we go again! The Centers for Medicare & Medicaid...
3. EHR The integration of digital technologies into every facet of life,...

Related posts brought to you by Yet Another Related Posts Plugin.

A provision in the Affordable Care Act (ACA) has set new standards with electronic funds transfers for carriers.

The changes are expected to save providers and health plans up to $4.6 billion dollars over the next decade, according to the U.S. Department of Health and Human Services (HHS). The estimates were included in a proposed rule that cuts red tape and simplifies administrative processes for doctors, hospitals and health insurance plans.

And the best part? You won’t have to do a thing.

The new rule – the Adoption of Standards for Health Care Electronic Funds Transfers and Remittance Advice – creates a universal standard format all carriers must use when transmitting data to banks for electronic payments.

Another major change: Carriers must now use a tracking number linking payments with remittance advice notices. This means staff will no longer have to hunt down this information to manually match up bills with payments.

Currently, when health plans bill providers, they’re identified using a number of different identifiers that don’t have a standard length or format. As a result, healthcare providers run into a number of time-consuming problems, such as misrouting of transactions, rejection of transactions due to insurance identification errors and difficulty determining patient eligibility.

But no more.

The regulation went into effect at the beginning of the year, and all health plans covered under HIPAA have until 2014 to fully comply.

In the not-too-distant future, HHS will issue additional simplification rules under ACA, including standards for claims attachments and requirements for certification of health plans’ compliance with all HIPAA standards and operating rules.

All of these administrative simplifications will require less time on the part of providers filling out forms and give them time to do what they were trained for – taking care of patients.

Related posts:

1. HIPAA Security Rule HIPAA Security Overview The Security Standards for the Protection of...
2. HIPAA Privacy Rule The “Standards for Privacy of Individually Identifiable Health Information,” or what...
3. 5010 compliance delayed … again Here we go again! The Centers for Medicare & Medicaid...

Related posts brought to you by Yet Another Related Posts Plugin.

The deadline for complying with the new standards was Jan. 1, and that hasn’t changed.

What has changed is CMS originally said it wouldn’t start initiating enforcement of the new standards until March 31. But now after numerous complaints from providers poured in, stating the conversion was “significantly delaying” claim submission and payment, CMS offered a compromise by extending the grace period.

Now, non-compliant medical practices, hospitals and other healthcare entities have until June 30, 2012, to work out any remaining issues, fix technical glitches and become compliant with the new 5010 transaction standards.

While becoming compliant has been challenging for facilities and their IT departments, HIPAA 5010 is supposed to offer hospitals reduced administrative burdens and streamline their revenue cycle.

CMS predicts that after this enforcement extension is over, 98% of claims submitted at that point will be compliant.

Why’s CMS so optimistic?

It seems that many organizations have been making great strides in achieving HIPAA 5010 compliance and just need a little more time to work out the kinks.

If you’ve already achieved compliance, great. But if you’re still in the process and experiencing some difficulties, here are some things to watch for that could cause your claims to be denied:

• A National Provider Identifier (NPI) needs to be used, not a tax ID or Social Security number.
• P.O. boxes aren’t allowed on the claims, a street address is required and a nine-digit zip code is required.
• A maximum of 12 diagnosis codes can be on each claim, however, each specific service can only have four codes.
• Any unlisted CPT or HCPCS code must have a code description.
• A Medicare Secondary Payer (MSP) indicator must be submitted on the primary and secondary claim when Medicare is the secondary payer, and
• Drug quantity and unit of measurement are required when a National Drug Code is listed.

Related posts:

1. Medicare wants back $38M it paid to emergency departments Oops! Medicare says it wrongly paid more then $38 million...
2. Use ICD-10 delay to get up to speed You’ve likely heard the U.S. Department of Health and Human...
3. Justice Dept.: 2011 record-setting year for fraud settlements The Justice Department announced that fiscal year 2011 saw a...

Related posts brought to you by Yet Another Related Posts Plugin.

The study, published in Health Affairs, reviewed data on more than 28,000 patient visits to over 1,100 office-based physicians from a 2008 federal study. The information included data such as the doctors’ specialties, whether the doctors had access to EHRs, and the tests ordered at each visit.

The researchers found that even after controlling for factors like the physician specialty and patient demographics, doctors with EHR access ordered various imaging tests in just under 13% of patient visits. Their peers with electronic access ordered the tests in 18% of visits — while doctors who had computerized access ordered the tests in about 22% of visits.

The reasons for the difference aren’t entirely clear and may hinge on factors including the sophistication level of the software doctors are using and whether or not they look at prior test results. More advanced programs, such as those some large hospitals use, can tell a doctor the likelihood that a specific test for a specific patient will provide useful data. But most doctors have much more basic programs that wouldn’t provide such guidance.

Related posts:

1. More non-docs handling patient visits on their own A new report from the CDC shows the number of...
2. EHR upgrades can lead to more prescribing errors A new study indicates upgrading your EHR system can actually...
3. Survey: Most patients leery of EHRs due to privacy concerns Electronic health records may be the way health care is...

Related posts brought to you by Yet Another Related Posts Plugin.

A large part of that growth is driven by health care’s increasing reliance on IT — and the people who design and maintain IT systems. Electronic health records play a huge part in that — physician adoption of EHRs has roughly doubled in the past two years.

Along with installing and maintaining EHR systems, hospitals and practices adopting EHRs are creating a larger need for skilled people who can train medical professionals on those systems.

Related posts:

1. Top health care tech trends for 2012 Technology is moving faster than ever and health care organizations...
2. Did alternative medicine doom Steve Jobs? After the death of the tech legend from a cancer...
3. Health care spending increases slow — because no one can afford it It was a second year of slower spending on health...

Related posts brought to you by Yet Another Related Posts Plugin.

The survey conducted by Health Tech Review polled IT managers, administrative managers, executives and physicians representing all types of health organizations.

The results indicate the major ongoing trends health care pros expect to be grappling with continue to be the use of electronic health records (EHRs). A close second is adoption of tablets in the workplace.

To see the full results of the survey, click here.

Related posts:

1. Survey Reveals Future Trends in Hospital Security The world of hospital security has changed dramatically over the...
2. 2012 outlook: real estate, construction and mergers on the increase Here’s another sign of a rosier outlook for health care...
3. EHR adoption growing… slowly Adoption of electronic health records is expanding — but don’t...

Related posts brought to you by Yet Another Related Posts Plugin.

Specifically, doctors who switched from one EHR system to another had an increase in their rate of prescribing errors as measured at three months and one year after adoption. By year two, the prescribing rate had decreased again.

For practices that added new EHR systems saw dramatic improvement in errors rates — in some cases prescribing errors decreased as much as 85%.

Related posts:

1. Two docs indicted for fraud & over-prescribing patients to death Two doctors face potential life sentences for charges they defrauded...
2. Drug shortages lead to pill scalping Shortages of some key medications are leading some to make...
3. Removing blame increases error reporting New research indicates that certain ways of tracking medical error...

Related posts brought to you by Yet Another Related Posts Plugin.