HIPAA Journal published an article online this week regarding General Data Protection Regulation (GDPR) Compliance. Their article states that the goal of their short piece is to provide a checklist for companies or businesses who are concerned with GDPR compliance. Their list should permit such entities to take initial steps in order to comply with GDPR and to note that it is not intended to be a comprehensive guide, more so a few “rules of thumb” to take into account in order to get started.
For more information and to view the full article visit HIPAA Journal’s website here.
This week Mondaq published an article online regarding the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reminded health care providers of the importance of ensuring the availability and security of health information during and after natural disasters.
According to the article, OCR recently published a bulletin during Hurricane Harvey discussing how the HIPAA Privacy Rule applies to sharing protected health information (PHI) during natural disasters. Recirculated while Irma was looming, the guidance document reminds health care providers that HHS may waive sanctions and penalties against a covered hospital for certain activities (e.g., obtaining a patient’s agreement before speaking with family or friends involved in the patient’s care) during an emergency. However, the waiver is limited to certain hospitals located within an emergency area and for a specific period of time. More importantly, OCR noted in the bulletin that the Privacy Rule still applies to covered entities and their business associates during such emergencies, but the Privacy Rule does allow the disclosure of PHI without the patient’s consent for the patient’s treatment or public health activities. Covered entities may also share PHI with a patient’s family or friends identified by the patient as being involved in their care, but OCR recommends that the covered entities obtain verbal permission or otherwise confirm that the patient does not object to sharing the information with these individuals.