# data[].attributes.headline
Health Information Technology for Economic and Clinical Health Act (HITECH Act) 

# data[].attributes.subject
Health Information Technology for Economic and Clinical Health Act (HITECH Act) 

# data[].attributes.attachment_link.title
Health Information Technology for Economics and Clinical Health (HITECH) Act: Impact on HIPAA Privacy and Security Provisions

# data[].attributes.body
Data Breach Lawsuit in Indiana

# data[].attributes.attachment_link.entities[].name
Fort Wayne-based Medical Informatics Engineering

# data[].attributes.attachment_link.entities[].name
Pharmacy Data Breach of Personal Medical Information

# data[].attributes.attachment_link.title
Lawsuit targets one of largest data breaches this year

# data[].attributes.attachment_link.description
A lawsuit has been filed against Fort Wayne-based Medical Informatics Engineering in response to one of the year's largest data breaches. ◂ RTV6 News brings you the best breaking news coverage in Indiana. News, information & entertainment from RTV6 - Central Indiana's ABC affiliate.

# data[].attributes.attachment_link.readable_text
Abstract

Electronic health record (EHR) is increasingly being implemented in many developing countries. It is the need of the hour because it improves the quality of health care and is also cost-effective. Technologies can introduce some hazards hence safety of information in the system is a real challenge. Recent news of security breaches has put a question mark on this system. Despite its increased usefulness, and increasing enthusiasm in its adoption, not much attention is being paid to the ethical issues that might arise. Securing EHR with an encrypted password is a probable option. The purpose of this article is to discuss the various ethical issues arising in the use of the EHRs and their possible solutions.

Keywords: Confidentiality, electronic health record, paper record, security breaches

INTRODUCTION

An electronic health record (EHR) is a record of a patient's medical details (including history, physical examination, investigations and treatment) in digital format. Physicians and hospitals are implementing EHRs because they offer several advantages over paper records. They increase access to health care, improve the quality of care and decrease costs. However, ethical issues related to EHRs confront health personnel. When patient's health data are shared or linked without the patients' knowledge, autonomy is jeopardized. The patient may conceal information due to lack of confidence in the security of the system having their data. As a consequence, their treatment may be compromised. There is the risk of revelation of thousands of patients' health data through mistakes or theft. Leaders, health personnel and policy makers should discuss the ethical implications of EHRs and formulate policies in this regard. The electronic medical record (EMR) is the tool that promises to provide the platform from which new functionality and new services can be provided for patients.

POTENTIAL BENEFITS

A medical record in the past was information documented on paper for research, clinical, administrative and financial purposes. Its major drawback was in terms of accessibility, and it was available to one user at a time. Its completion was delayed anywhere from 1 to 6 months or more because it was updated manually.[ 1]

The purpose of documentation through electronic media remains the same even today that is to support patient care. EHRs have several advantages over paper records. Production of legible records reduces many problems of wrong prescriptions, doses and procedure.[ 2] Moreover adverse drug reactions can be reduced substantially when the EHRs are connected to drug banks and pharmacies. This can be done by not permitting prescription and order for drugs for which a known adverse reaction is known for a certain patient.[ 2] Easy accessibility from anywhere at any given time is also beneficial.[ 3] They require less storage space and can be stored indefinitely. They reduce the number of lost records, help research activities, allow for a complete set of backup records at low cost, speed data transfer and are cost-effective.[ 4, 5] Hence, EHRs have been shown to improve patient compliance, facilitate quality assurance and reduce medical errors.[ 6]

The office of the National Coordinator for Health Information Technology (IT) refers to the health record as "not just a collection of data that you are guarding, it is life."[ 7] The patient owns the information in the record. The physician and the organization is the owner of the physical medical record.[ 8] There are four major ethical priorities for EHRS: Privacy and confidentiality, security breaches, system implementation, and data inaccuracies.

PRIVACY AND CONFIDENTIALITY

Justice Samuel Dennis Warren and Justice Louis Brandeis define privacy as the right "to be let alone."[ 9] The other definition given by Richard Rognehaugh is as the right of an individual to keep information about themselves from being disclosed to others; the claim of individuals to be let alone, from surveillance or interference from other individuals, organizations or the government.[ 10] Information of a patient should be released to others only with the patient's permission or allowed by law. When a patient is unable to do so because of age, mental incapacity the decisions about information sharing should be made by the legal representative or legal guardian of the patient. Information shared as a result of clinical interaction is considered confidential and must be protected.[ 11] Information from which the identity of the patient cannot be ascertained for example, the number of patients with breast carcinoma in a government hospital, is not in this category.[ 12]

Health care institutions, insurance companies and others will require access to the data if EHRs are to function as designed. The key to preserving confidentiality is to allow only authorized individuals to have access to information. This begins with authorizing users. The user's access is based on preestablished role-based privileges. The administrator identifies the user, determines the level of information to be shared and assigns usernames and passwords. The user should be aware that they will be accountable for the use and misuse of the information they view. They have access to the information they need to carry out their responsibilities. Hence assigning user privileges is a major aspect of medical record security.[ 13]

Although controlling access to health information is important, but is not sufficient for protecting the confidentiality. Additional security steps such as strong privacy and security policies are essential to secure patient's information.

SECURITY BREACHES

Security breaches threaten patient privacy when confidential health information is made available to others without the individual's consent or authorization. Two recent incidents at Howard University Hospital, Washington showed that inadequate data security can affect a large number of people. On May 14, 2013, federal prosecutors charged one of the hospital's medical technicians with violating the Health Insurance Portability and Accountability Act (HIPAA). Prosecutors said that over a 17-month period, Laurie Napper used her position at the hospital to gain access to patients' names, addresses and Medicare numbers in order to sell their information. A plea hearing had been set for June 12, 2013 in which she was found guilty and sentenced for 6 months in a half-way house and fined $2,100. A few weeks earlier, the same hospital informed more than 34,000 patients that their medical data had been compromised. A contractor working with the hospital had downloaded the patient's files onto a personal laptop, which was stolen from his car. The data were password protected, but unencrypted, which means anyone who guessed the password could have accessed the patient files without a randomly generated key. By encryption, we mean encoding of information in such a way that only authorized parties can read it. It is usually done with the help of encryption key, which specifies that how the information should be decoded. According to a hospital press release, those files included names, addresses, and Social Security numbers and in a few cases, "diagnosis related information". Recently a hospital chain named Prime Health care Services Inc. has agreed to pay $275,000 to settle a federal investigation into alleged violation of patient privacy. Keeping records secure is a challenge that doctors, public health officials and federal regulators are just beginning to understand. Cloud storage, password protection, and encryption are all measures health care providers can take to make portable EHRs more secure. A survey conducted found that 73% of physicians text other physicians about work.[ 14] Mobile devices are for individual use and are not designed for centralized management by an IT Department.[ 15] Mobile devices can easily be misplaced, damaged, or stolen. Emphasis must be laid on encrypting mobile devices that are used to transmit confidential information. Portable EHRs can be made more secure by using cloud storage, password protection, and encryption. Usage of two factor authentication system with security tokens and password are helpful in securing EHRs.

Security measures such as firewalls, antivirus software, and intrusion detection software must be included to protect data integrity. Specific policies and procedures serve to maintain patient privacy and confidentiality. For example, employees must not share their ID with anyone, always log off when leaving a terminal and use their own ID to access patient digital records. A security officer must be designated by the organization to work with a team of health IT experts.

Routine random audits should be conducted on a regular basis to ensure compliance with hospital policy. All system activity can be tracked by audit trails. This includes detailed listings of content, duration and the user; generating date and time for entries and logs of all modifications to EHRs.[ 16] When there is inappropriate access to a medical record, the system can yield information about the name of the individual gaining access; the time, date, screens accessed and the duration of the review. This information is useful when determining whether the access is the result of an error or an intentional, unauthorized view. The HIPAA Security Rule requires organizations to conduct audit trails, requiring that they document information systems activity[ 17] and have the hardware, software, and procedures to record and examine activity in systems that contain health information.[ 18]

Outside vendors create special privacy issues. Employee-only access to the EMR requires any external vendor to access and navigate the record under the authorization and oversight of an employee.

SYSTEM IMPLEMENTATION

Health care organizations encounter major challenges in the course of EHR implementation these challenges result in wasted resources, frustrated providers, loss of confidence by patients and patient safety issues. The development, implementation, and maintenance of EHRs requires adequate funds and the involvement of many individuals, including clinicians, information technologists, educators, and consultants.[ 19]

Hospitals and health care institutions are making improvements without significant clinician engagements. Many EHR implementation projects fail because they underestimate the importance of one or more clinician to serve as opinion leaders for providers in the clinic. Thus, clinician must guide colleagues in understanding their roles in the implementation and enlisting their involvement in tasks as EHR selection, workflow design, and quality improvement.[ 20]

Clinical personnel often have little knowledge of the clinic's workflow and the roles others play in care delivery. This blind spot results in inadequate planning for successful implementation. Without identifying a standardized best practice method to do the work, every user is left to struggle. Clinics should map and standardize their workflows before EHR selection.

When any two systems are integrated, an interface is created. By the user interface, we mean an interface between the user and the computer system. These interfaces are critical to the overall success of the implementation process. Interface issues are the greatest system risk because these failures can be invisible initially. Lack of systemic consideration of users and tasks often results in poor user interface. Poorly designed user interface account for unintended adverse consequence leading to decreased time efficiency, poor quality of care and increased threat to patient safety. Improperly designed user interface fail to deliver the much needed quality of care, which lead to user dissatisfaction. The faulty user interface issue, which was small earlier on, increases over a period of time that leads to abandonment of EHR. Maintenance and testing of these interfaces on a routine basis is essential in controlling this major risk. Practice disruption during EHR implementation can negatively impact the quality of care or endanger patient safety along with financial loss.[ 21]

DATA INACCURACIES

Integrity assures that the data is accurate and has not been changed. EHRs serve as a way to improve the patient's safety by reducing healthcare errors, reduce health disparities and improve the health of the public.[ 22] However, concerns have been raised about the accuracy and reliability of data entered into the electronic record.

Inaccurate representation of the patient's current condition and treatment occurs due to improper use of options such as "cut and paste". This practice is unacceptable because it increases the risk for patients and liability for clinicians and organizations.[ 16, 23] Another feature that can cause a problem in the data integrity is the drop down menu and disposition of relevant information in the trash. Such menus limit the choices available to the clinician who in a hurry may choose the wrong one leading to major errors. Clinicians and vendors have been working to resolve software problems to make EHRs both user-friendly and accurate.[ 23]

Loss or destruction of data occurs during data transfer; this raises concerns about the accuracy of the data base as patient care decisions are based on them.[ 24] A growing problem is of medical identity theft. This results in the input of inaccurate information into the record of the victim. The person's insurance company is billed for medical services not provided to the actual policy holder and the patient's future treatment is guided by misinformation that neither the patient nor provider immediately recognize.

ELECTRONIC HEALTH RECORDS IN INDIA

India is providing quality health care of international standards at a relatively low cost and has attracted the patients from across the globe. India is now one of the favorite destinations for the health care services. Considering rapid pace of growth of health care sector in India, Government of India in April 2013, came out with definitive guidelines for EHR standards in India. Guidelines were based on the recommendations made by EMR standards committee, which was constituted by an order of Ministry of Health and Family Welfare. It was coordinated by Federation of Indian Chambers of Commerce and Industry on its behalf. The guidelines recommend set of standards to be followed by different health care service providers in India and hence that medical data becomes portable and easily transferable.[ 25] India having a population of 1.27 billion people with only 160 million internet users maintenance of EHR is a daunting task, but with the interest and support of the Government of India in its implementation, it will a success soon.

CONCLUSION

Regardless of one's role, everyone will need the assistance of the computer. Creating a useful EHR system will require the expertise of physicians, technology professionals, ethicists, administrative personnel, and patients. Although EMRs offer many significant benefits, the future of health care demands that their risks be recognized and properly managed or overcome. Multiple strategies are available to reduce risks and overcome barriers in the implementation of digital health records. Leadership, teamwork, flexibility, and adaptability are keys to finding solutions. EMRs capacities must be maximized in order to enhance improve the quality, safety, efficiency, and effectiveness of health care and health care delivery systems.

Footnotes

Source of Support: Nil.

Conflict of Interest: None declared.

REFERENCES

1. Poissant L, Pereira J, Tamblyn R, Kawasumi Y. The impact of electronic health records on time efficiency of physicians and nurses: A systematic review. J Am Med Inform Assoc. 2005;12:505-16. [[ PMC free article] [ PubMed] Google Scholar]

2. Sanbar SS. American College of Legal Medicine Textbook Committee. Legal Medicine. 6th ed. St. Louis: Mosby; 2004. Medical records: Paper and electronic. [ Google Scholar]

7. Office of the National Coordinator for Health Information Technology. Guide to privacy and security of health information. 2012. [Last accessed 2014 Jan 05]. p. 5. Available from: http://www.healthhit.gov .

8. Odom-Wesley B, Brown D, Meyers CL. Documentation of Medical Records. Chicago: American Health Information Management Association; 2009. p. 21. [ Google Scholar]

9. Warren SD, Brandeis LD. The right to privacy. Harv Law Rev. 1890;4:193. [ Google Scholar]

10. Rognehaugh R. The Health Information Technology Dictionary. Gaithersburg, MD: Aspen; 1999. p. 125. [ Google Scholar]

11. Rinehart-Thompson LA, Harman LB. Privacy and confidentiality. In: Harman LB, editor. Ethical Challenges in the Management of Health Information. 2nd ed. Sudbury, MA: Jones and Bartlett; 2006. p. 53. [ Google Scholar]

12. Rinehart-Thompson LA, Harman LB. Ethical Challenges in the Management of Health Information. 2nd ed. Sudbury, MA: Jones and Bartlett; 2006. Privacy and confidentiality; p. 54. Chapter 3. [ Google Scholar]

13. American Health Information Management Association. The 10 security domains (updated) J Am Health Inf Management Assoc. 2012;83:50. [ Google Scholar]

16. American Health Information Management Association. Copy functionality toolkit. 2008. [Last accessed on 2014 Jan 05]. p. 4. Available from: http://library.ahima.org .

20. Reinertsen JL, Gosfield AG, Rupp W, Whittington JW. Engaging Physicians in a Shared Quality Agenda. IHI Innovation Series white paper. Cambridge, Massachusetts: Institute for Healthcare Improvement; 2007. [Last accessed on 2014 Jan 05]. Available from: [ www.IHI.org . Google Scholar]

25. E.H.R. Standards for India: GOI Report. 2013. Apr, [Last accessed on 2014 Apr 15]. Available from: http://www.mohfw.nic .

Articles from Perspectives in Clinical Research are provided here courtesy of Wolters Kluwer -- Medknow Publications

# data[].attributes.attachment_link.title
Ethical issues in electronic health records: A general overview

# data[].attributes.attachment_link.description
Electronic health record (EHR) is increasingly being implemented in many developing countries. It is the need of the hour because it improves the quality of health care and is also cost-effective. Technologies can introduce some hazards hence safety of ...

# data[].attributes.attachment_link.readable_text
Written by Valerie S. Prater, MBA, RHIA, Clinical Assistant Professor
Biomedical and Health Information Sciences
University of Illinois at Chicago
December 8, 2014

Three important and related concepts are often used interchangeably in discussing protection of health information within the U.S. healthcare system: confidentiality, privacy and security. Yet, each of these concepts has a different fundamental meaning and unique role.

Most frequently "HIPAA" comes to mind when health information privacy is discussed; however, the concept of patient confidentiality has been around for much longer. This article will briefly explore differences in meaning of privacy, security and confidentiality of health information. Selected examples of sources of law and guidelines will be offered with respect to these concepts. Challenges in balancing interests of individuals, healthcare providers and the public will be noted, as will the role of health information management professionals.
Confidentiality
Confidentiality in health care refers to the obligation of professionals who have access to patient records or communication to hold that information in confidence. Rooted in confidentiality of the patient-provider relationship that can be traced back to the fourth century BC and the Oath of Hippocrates, this concept is foundational to medical professionals' guidelines for confidentiality (McWay, 2010, p. 174). This professional obligation to keep health information confidential is supported in professional association codes of ethics, as can be seen in principle I of the American Health Information Management Association Code of Ethics, "Advocate, uphold, and defend the individual's right to privacy and the doctrine of confidentiality in the use and disclosure of information" (AHIMA, 2011).

Confidentiality is recognized by law as privileged communication between two parties in a professional relationship, such as with a patient and a physician, a nurse or other clinical professional (Brodnik, Rinehart-Thompson, Reynolds, 2012). As patients, we've come to expect confidential communication in these relationships. While application in legal proceedings is subject to evidentiary rules and consideration of the public need for information, support of privileged communication can be seen in case law. An example is the landmark Jaffee v. Redmond decision where the U.S. Supreme Court upheld a therapist's refusal to disclose sensitive client information during trial (Beyer, 2000). In writing the majority opinion, Justice Stevens said:

Effective psychotherapy... depends upon an atmosphere of confidence and trust in which the patient is willing to make a frank and complete disclosure...The psychotherapist privilege serves the public interest by facilitating the provision of appropriate treatment for individuals suffering the effects of a mental or emotional problem ( Jaffee v. Redmond, 1996, p. 9).

When considering sensitive health information requiring special layers of confidentiality, such as with mental health treatment, state statutes provide guidance for health information management professionals. In Illinois, for example, the Mental Health and Developmental Disabilities Confidentiality Act offers detailed requirements for access, use and disclosure of confidential patient information including for legal proceedings (MHDDCA, 1997).
Privacy
Privacy, as distinct from confidentiality, is viewed as the right of the individual client or patient to be let alone and to make decisions about how personal information is shared (Brodnik, 2012). Even though the U.S. Constitution does not specify a "right to privacy", privacy rights with respect to individual healthcare decisions and health information have been outlined in court decisions, in federal and state statutes, accrediting organization guidelines and professional codes of ethics.

The top-of-mind example is the federal HIPAA Privacy Rule, establishing national standards for health information privacy protection and defining "protected health information" (HHSa, 2003, p. 1). A stated purpose of the HIPAA Privacy Rule "...is to define and limit the circumstances in which an individual's protected heath information may be used or disclosed..."(HHSa, 2003, p. 4).

Established pursuant to the broader Health Insurance Portability and Accountability Act of 1996 (HIPAA), as described by the U.S. Department of Health and Human Services (HHS), the Privacy Rule, "...strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing" (HHSa, 2003, p. 1). Individuals are provided some elements of control, such as the right to access their own health information in most cases and the right to request amendment of inaccurate health information (HHSa, 2003, pp. 12-13). However, in that attempt to strike a balance, the Rule provides numerous exceptions to use and disclosure of protected health information without patient authorization, including for treatment, payment, health organization operations and for certain public health activities (HHSa, 2003, pp. 4-7).

While debate continues as to whether the HIPAA Privacy Rule has substantially strengthened individual privacy rights, it has certainly increased awareness of the topic of health information privacy, of issues surrounding its protection and of the patient's role in the process. There is no question that health information management professionals' roles have been impacted by responsibilities for HIPAA Privacy Rule compliance. In reflecting on the Privacy Rule's tenth anniversary and its more recent amendments pursuant to theHealth Information Technology for Economic and Clinical Health (HITECH) Act, Daniel Solove noted:

HIPAA has evolved during the past decade and was greatly fortified by the 2009 HITECH Act and its HIPAA modification regulations released in January 2013. Whatever one might think about HIPAA, it is hard to dispute that it has had a vast impact on patients, the healthcare industry, and many others over the last 10 years-and will continue to shape healthcare and HIM professionals for many more years to come. (Solove, 2013)

Even before the healthcare privacy conversation was dominated by HIPAA, an important Supreme Court decision, Whalen v. Roe, recognized the right to health information privacy (1977). This case considered a state statute requiring that physicians report for entry into a New York Department of Health computerized database information on prescription of certain types of drugs likely to be abused or over-prescribed; information included patient, physician and pharmacy name, and drug dosage (McWay, 2010, p. 176). A group of patients and two physician associations filed suit, saying this violated the protected physician-patient relationship ( Whalen v. Roe, 1977). In upholding this law, the Court recognized the individual's interest in privacy protection while giving greater weight to the state's right to address an issue of public concern; procedures in place at the Department of Health to protect information privacy were also noted as a factor in the decision ( Whalen v. Roe, 1977).

The Supreme Court's holding in Whalen v. Roe addressed the notion of balanced interest seen in the later HIPAA Privacy Rule. In saying "...disclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies are often an essential part of modern medical practice", the court did not give individuals absolute control over sharing of their own health information ( Whalen v. Roe, 1977). Interestingly, the Whalen decision also noted growing concern with collection of private information in electronic format, and the role of regulatory guidelines. As stated by the Justices:

We are not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks....The right to collect and use such data for public purposes is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures ( Whalen v. Roe, 1977).

Security
Security refers directly to protection, and specifically to the means used to protect the privacy of health information and support professionals in holding that information in confidence. The concept of security has long applied to health records in paper form; locked file cabinets are a simple example. As use of electronic health record systems grew, and transmission of health data to support billing became the norm, the need for regulatory guidelines specific to electronic health information became more apparent. The HIPAA Security Rule provided the first national standards for protection of health information. Addressing technical and administrative safeguards, the HIPAA Security Rule's stated goal is to protect individually identifiable information in electronic form-a subset of information covered by the Privacy Rule-while allowing healthcare providers appropriate access to information and flexibility in adoption of technology (HHS, 2003b). Again, that notion of balance appears in the law: necessary access by healthcare providers vs. protection of individuals' health information.

Breaches to confidentiality now face more serious penalties given modifications to both the HIPAA Privacy and Security Rules following publication of final rule provisions of the HITECH Act. In announcing publication of these changes, known collectively as the Omnibus Rule, then HHS Secretary Kathleen Sebelius acknowledged change impacting health care since initial enactment of HIPAA: "The new rule will help protect patient privacy and safeguard patients' health information in an ever expanding digital age" (HHS, 2013).
Conclusion
The sources of law and guidelines noted here are only samples of many considerations in health information confidentiality, privacy and security. Managing electronic health information presents unique challenges for regulatory compliance, for ethical considerations and ultimately for quality of care. As electronic health record system "meaningful use" expands, and more data are collected, such as from mobile health devices, that challenge for healthcare organizations expands.

A response to the challenge is information governance, described as the strategic management of enterprise-wide information including policies and procedures related to health information confidentiality, privacy and security; this includes the role of stewardship (Washington, 2010). Health information managers are uniquely qualified to serve as health information stewards, with an appreciation of the various interests in that information, and knowledge of the laws and guidelines speaking to confidentiality privacy and security. The role of the steward encompasses not only ensuring the accuracy and completeness of the record, but also protecting its privacy and security (Washington, 2010).

All who work with health information- health informatics and health information management professionals, clinicians, researchers, business administrators and others- have responsibility to respect that information. And as patients, we have privacy rights with regard to our own health information and an expectation that our information be held in confidence and protected. As citizens, our public interest in health information may prevail, such as in situations involving public health or crime. Balancing the various interests in health information and upholding its confidentiality, privacy and security present ongoing and important challenges within the U.S. healthcare and legal systems, and career opportunities for health information management professionals.
References
AHIMA. (2011). American Health Information Management Association Code of Ethics.
http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_024277.hcsp?dDocName=bok1_024277

Beyer, Karen. (2000). "First Person: Jaffee v. Redmond Therapist Speaks." American Psychoanalyst,
Volume 34, no. 3. Retrieved from http://jaffee-redmond.org/articles/beyer.htm

Brodnik, M., L. Rinehart-Thompson and R. Reynolds (2012). Fundamentals of Law for Health Informatics
and Information Management Professionals. Chicago: AHIMA Press. Chapter 1.

Jaffee v. Redmond. 518 U.S. 1; 116 S. Ct. 1923; 135 L. Ed. 2d 337 (1996). LEXIS 3879. Retrieved from
http://www.lexisnexis.com/hottopics/lnacademic.

Mental Health and Developmental Disabilities Confidentiality Act (MHDDCA) (740 ILCS 110). Effective
July 1, 1997. Illinois General Assembly. Retrieved from
http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2043&ChapAct=740%26nbsp%3BILCS%26n bsp%3B110%2F&ChapterID=57&ChapterName=CIVIL+LIABILITIES&ActName=Mental+Health+and+Developmental+Disabilities+Confidentiality+Act%2E

McWay, Dana. (2010). Legal and Ethical Aspects of Health Information, Third Edition. New York: Cengage Learning. Chapter 9.

Solove, D. (2013).HIPAA Turns 10. Analyzing the Past, Present and Future Impact. Journal of AHIMA 84, no.4 (April 2013): 22-28.

The American Psychoanalytic Association. (2014). Landmark Cases. Retrieved from

http://apsa.org/Programs/Advocacy/Landmark_Cases.aspx

U.S. Department of Health and Human Services (HHSa), Office for Civil Rights. (2003). Summary of the HIPAA Privacy Rule. Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf

U.S. Department of Health and Human Services (HHSb), Office for Civil Rights. (2003). Summary of the HIPAA Security Rule. Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html

U.S. Department of Health and Human Services (HHS), Office for Civil Rights. (2013). Omnibus HIPAA Rulemaking, http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/index.html

Washington, L. (2010). "From Custodian to Steward: Evolving Roles in the E-HIM Transition."
Journal of AHIMA. (Volume 81, no.5: 42-43).

Whalen v. Roe. 429 U.S. 589; 97 S. Ct. 869; 51 L. Ed. 2d 64 (1977). LEXIS 42. Retrieved from
http://www.lexisnexis.com/hottopics/lnacademic.

# data[].attributes.attachment_link.title
Confidentiality, privacy and security of health information: Balancing interests

# data[].attributes.attachment_link.description
Written by Valerie S. Prater, MBA, RHIA, Clinical Assistant Professor Biomedical and Health Information Sciences University of Illinois at Chicago December 8, 2014 Three important and related concepts are often used interchangeably in discussing protection of health information within the U.S. healthcare system: confidentiality, privacy and security.

# data[].attributes.headline
This video is 20 minutes but interesting.

# data[].attributes.subject
This video is 20 minutes but interesting.

# data[].attributes.attachment_link.title
Digital ethics and the future of humans in a connected world | Gerd Leonhard | TEDxBrussels

# data[].attributes.headline
Two Students Share Their Stories with Me

# data[].attributes.subject
Two Students Share Their Stories with Me

# data[].attributes.body
True Story
I teach part time in a LPN program, and one of the chapters I teach is law and ethics. Student 1 is a STNA in a long term facility. She shared that a RN took a picture of a resident's wound with his face showing and posted the picture on Snapchat.

Student 2 came to me very upset after class because one of her coworkers who is a STNA posted a video on Instagram. The video consisted of the STNA being stuck in an elevator with a resident. While in the elevator the STNA was cussing at the resident, calling him names, and degrading him.  She wanted to know how to report this and I recommended The Ohio Department of Health because they govern STNA's.

# data[].attributes.headline
This article talks about appropriate use, privacy, and copyright. 

# data[].attributes.subject
This article talks about appropriate use, privacy, and copyright. 

# data[].attributes.attachment_link.description
The advent of technology has raised a host of legal and ethical issues that are unique to the 21st century. From personal privacy online, to the appropriate uses of new technology, to copyright and intellectual property on the Internet, the legal and ethical issues in technology are multifaceted and complex.

# data[].attributes.body
Question 1:There are many legal and ethical issues in informatics. Based on ANA Code of Ethics Provisions 3, 5, 7, & 8, choose one provision and apply a case situation. Then explain your rationale.

Question 2: If a nurse posts a picture of someone's X-ray, wound, or any procedure but doesn't show the patient's face, is it legal and/or ethical? Explain your rationale.