Printable version (PDF) 

H1N1 VIRUS

– Emergency event, HHS may waive some rules, 1556
– France, CNIL posts vaccination campaign information, In Brief, 1577

HACKING

– Ameritrade customer e-mail accounts, despite attorney fee concerns proposed class settlement approved (N.D. Cal.), 750; court rejects settlement, decertifies class, 1560
– Blogger postings on porn software data breach not covered by N.J. media shield law (N.J. Super. Ct.), 1095
– Boston College, no warrant based on roommate's hacking allegations (Mass.), In Brief, 842
– Cal.-based anonymizer service use to access Yahoo account creates jurisdiction (N.D. Cal.), In Brief, 1539
– CardSystems data breach, bank negotiates with auditor that certified payment card processor before breach (D. Ariz.), 871
– CFAA

See COMPUTER FRAUD AND ABUSE ACT (CFAA)

– Cloud computing, risks exist but old safeguards still apply, IAPP Privacy Summit, 475
– Colombian cybercrime law signed, 43
– Electric grid, industry group not aware of cyberattacks yet, Thompson (D-Miss) plans legislation, 557
– FBI internet crime report for 2008, fraud and other activity complaints rose 33 percent, 529
– Health data theft, Alberta privacy agency probing virus attack, 1032
– Heartland Payment Sys.

See DATA BREACHES

– Insider trading, fiduciary duty violation not required (2d Cir.), In Brief, 1102
– Monster.com says passwords and IDs compromised but not SSNs, 205
– Network Solutions, source of hack affecting credit card accounts not identified, 1144
– Ohio Univ., breach of alumni database, schools and fired IT managers settle claim, audit report to be released (Ohio Ct. C.P.), 561
– PCI DSS, House Homeland Security panel questions effectiveness against cybercrime, 525; PCI DSS overview, 527
– PINs and payroll debit cards targeted using increasingly sophisticated methods, RSA Conf., 641
– Portugal enacts new cybercrime statute to implement EU framework law, 1354
– Radisson Hotel chain says hackers gained access to guest data, 1232
– RBS WorldPay, U.S. processing arm of Royal Bank of Scotland improperly accessed with actual fraud detected on cards, 9; consumer class amends complaint (N.D. Ga.), 274; RBS WorldPay to process credit card tax payments despite recent breach, 667; oral arguments set (J.P.M.L.), 775; panel consolidates claims, 873
– South Korea indicts two for exploiting e-commerce sites and reusing passwords, 597
– Spam, Project Honey Pot seeks assistance of banks and clearinghouse vendors to identify hackers (E.D. Va.), 1236
– Spyware

See SPYWARE

– Students targeted in scheme, four indicted (W.D. Mo.), In Brief, 677
– TJX Cos.

– – Banks, remaining plaintiffs may pursue some claims (1st Cir.), 532; final bank plaintiffs settle claims (D. Mass.), 1260
– – Hacker pleads guilty (D. Mass.), 1272
– – State investigations, agreement reached with state attorneys general (Mass. Super. Ct.), 957

– U.K. newspaper online jobs site admits to incident, 1571
– UC Berkeley health services center computer systems hacked raising ID theft concerns, 751

HAWAII

– Data breach notification, credit monitoring amendment died, 507
– Identity theft, state law excludes fictional person's data (Haw.), In Brief, 748
– Prescription data, bill restricts use for marketing, 256

HAZARDOUS MATERIALS

– Endorsement (HME) program, TSA completes over 1 million checks on truckers, In Brief, 22
– Transportation Worker Identification Credential (TWIC) program

– – American Samoa, DHS exempts workers, In Brief, 506
– – Delays, employment groups say TSA should speed processing, 1089

HEALTH AND HUMAN SERVICES DEPARTMENT (HHS)

– American Health Information Community (AHIC) successor officially launches as National eHealth Collaborative, 40
– Budget FY2009, Omnibus Appropriations Act

See LEGISLATION, FEDERAL, HR 1105

– Civil Rights office, Sebelius names Verdugo, In Brief, 1312
– HIPAA

– – Privacy Rule compliance answers website, HHS revises and expands, 272
– – Security rule enforcement moves to HHS Civil Rights Office, 1164

– HIT Policy Comm. and HIT Standards Comm.

– – Creation and funding

See LEGISLATION, FEDERAL, HR 1, HR 598

– – HIT Policy Comm. inaugural meeting, Blumenthal says decisions in 2009 crucial to success of IT investment, 734
– – HIT Standards Comm. inaugural meeting, Blumenthal expresses concerns about timetable, 772
– – Nominations sought, 440

– National Comm. on Vital and Health Statistics, stakeholders suggest “meaningful use” measure should begins at basic level and gradually demand more, 667
– National Coordinator for HIT, office and committees created by stimulus bill, 297; Obama appoints Blumenthal, 496; Blumenthal predicts e-records interstate sharing by 2011, 735; Blumenthal expresses concern about timetable, 772
– National eHealth Collaborative launches and aims to keep HIT leadership, 40; leaders say current private sector structure the best way forward, 273; stimulus bill replaces NeHC with HIT Policy Comm. and HIT Standards Comm. at HHS, 297; NeHC seeks standards role, says goals complementary with new HIT Standards Comm., 440
– Patient Safety and Quality Improvements Act, HHS increases penalty for confidentiality provisions, In Brief, 1293
– Penalties increased by HITECH Act, 394; HHS publishes final rule that increases HIPAA penalties, 1555
– Secretary, Obama names Sebelius after Daschle (D-SD) withdraws, 392; Senate approves, 666

HEALTH CARE

– AIDS patients, doctor must disclose records in misconduct suit (N.Y. App. Div.), In Brief, 1293
– Back Doctors log book, evidence of authorization defeats TCPA fax claim (S.D. Ill.), In Brief, 1356; “educational” fax not TCPA violation, In Brief, 1578
– Cal. patient privacy statute and tabloid legislating, Analysis and Perspective, 943
– Data breach notification

– – Cal., over 800 breaches reported since Jan., 1053
– – Federal regulatory trends, Special Report, 682
– – HITECH Act

See AMERICAN RECOVERY AND REINVESTMENT ACT

– – Mo., new law includes protections, 1085
– – Stakeholders disagree on whether provision positive, 329; correction, 446
– – State AG enforcement of health data breach provisions, attorney in audio briefing, 778
– – Stimulus bill

See LEGISLATION, FEDERAL, HR 1

– – Tex. legislature clears measure adds health data, 787; governor signs bill extending breach notice to public and health sectors, 962; law takes effect, 1387

– Data breaches

– – Alberta privacy agency probing virus attack, 1032
– – AMA approves ethical guidance to physicians including notice, 926
– – Blue Cross and Blue Shield of Del. fined by state regulators for printing error disclosing personal data, 84
– – Blue Cross Blue Shield Ass'n says stolen laptop held unencrypted information on doctors, 1469
– – Carolina Mammography Registry reports unauthorized computer access, 1436
– – Daimler worker health data breached, DPA probes retention of diagnosis data, 597
– – Express Scripts notifies all state attorneys generals of extortion plot, 1435
– – File sharing, Dartmouth study reveals health data leaked, 298
– – Lawyer bought patient data, hospital employee indicted (S.D. Fla.), In Brief, 1175
– – Saskatchewan annual report, In Brief, 993
– – UC Berkeley health services center computer systems hacked raising ID theft concerns, 751
– – VA medical center hard drive lost, putative class cannot demonstrate actual damages, APA claims remanded (11th Cir.), 929
– – Va. dangerous drug prescription reporting system data allegedly held for ransom, 751; Va. sending breach notices over exposure of SSNs, 836

– E-health

See E-HEALTH

– FACT Act red flag rules, “creditors”

– – Benefit plan sponsors, some may be caught unaware, 402
– – Congressional action, groups face uphill battle to change scope of rule, 1165
– – Exemption for small health practices

See LEGISLATION, FEDERAL, HR 2345, HR 3763

– – FAQ guide released by FTC and banking regulators, 865
– – FTC releases compliance guide and launches website, 525; retailers remain anxious about potential liability, 556; FTC officials say focus of new rule on flexibility, risk levels, and good faith efforts, 618; FTC postpones enforcement, possible Congressional role, 659; FTC posts new compliance guidance and checklist, 729; FTC grants third delay at request of House Appropriations Comm., 1137; FTC postpones deadline, 1552
– – Health providers, FTC and AMA argue over application, 389; preparation urged by attorneys at industry meeting, 1233

– Family Medical Leave Act

– – Computer misconduct, no FMLA violation to fire executive on leave who refused to give up keys and passwords (7th Cir.), 1235
– – Medical certification rule

– – – HIPAA privacy rule still covers, attorneys warn, 78
– – – Privacy rights

See LEGISLATION, FEDERAL, HR 2161

– Flu pandemic

– – France CNIL approves privacy exemption, worker data may be used in continuity plans, 1388
– – Response, Practice Aid, 1323

– Genetic data

See GENETIC INFORMATION

– Germany, DPA fines retail chain for tracking employee health information, 1284
– H1N1 virus, HHS may waive some rules in event of national health emergency, 1556
– HIPAA

See HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

– Hot topics for 2009, Analysis and Perspective, 24
– Malpractice, no health privacy breach in contact with plaintiff's doctors (Tex.), 874
– Medical devices, possible impact of HHS security guidance encryption requirements, 767
– Minors, new Me. law limits data collection, In Brief, 1102; effective date nears, attorneys warn marketers to prepare, 1209; state AG will not enforce law, files motion to dismiss, legislative review sought (D Me.), 1267; suit dismissed though law likely unconstitutional, 1305; law successful in increasing focus on issue, Analysis and Perspective, 1320
– Motor vehicle accident victim scam, bribes for confidential information, arrests made (N.Y. Sup. Ct.), 1383
– MySpace off-color blog post did not violate patient privacy, nursing student reinstated (W.D. Ky.), 1202
– Norway, doctor choice website increases security after DPA warning, In Brief, 1292
– Nursing home residents' stolen tax data used in identity theft scheme, four more sentenced (W.D. Mo.), In Brief, 174
– Patient Safety and Quality Improvements Act, HHS increases penalty for confidentiality provisions, In Brief, 1293
– Reforms

– – America's Affordable Health Choices Act

See LEGISLATION, FEDERAL, HR 3200

– – Free speech chilled by White House requests for public to forward “fishy” e-mail, suit also alleges Privacy Act violation (D.D.C.), 1274

– Retirement facility employee giving patient files to EEOC legitimate reason for firing (U.S., rev den), 396; In Brief, 406; data copying not misappropriation of property (Okla.), 1386
– RFID, ABA Technology in the Practice and Workplace Comm. meeting discussed, 712
– Sleep study fraud, corporate executives may lack standing to challenge searches of business premises (9th Cir.), 239; ruling amended, In Brief, 842
– Therapist confidentiality breach lawsuit dismissed (Mich. Ct. App.), In Brief, 408
– United Kingdom

– – Data controller registrations, ICO issues reminder to doctors after survey results, 1242
– – General Medical Council revises guidance on physician use and protection of patient data, 1437
– – National Health Service (NHS)

See UNITED KINGDOM (UK)

HEALTH INFORMATION TECHNOLOGY (HIT)

See E-HEALTH

HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT

See AMERICAN RECOVERY AND REINVESTMENT ACT

HEALTH INSURANCE

– Data breaches

– – Blue Cross and Blue Shield of Del. fined by state regulators for printing error disclosing personal data, 84
– – Kaiser Permanente notifying workers that PII may have been stolen, 278; breach traced to terminated employee of union, 403

– E-health

See E-HEALTH

– Medical identity theft

See MEDICAL IDENTITY THEFT

– Medicare and Medicaid

See MEDICARE AND MEDICAID

– Smoking workplace policies

– – Legal challenges, Analysis and Perspective, 1540
– – Off-duty conduct, smoker fired, no violation of privacy law (D. Mass.), 1201

– Wellness programs, GINA implementation

See GENETIC INFORMATION NONDISCRIMINATION ACT (GINA)

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

– Cloud computing

– – Contract terms, companies should review and not move all sensitive data, RSA Conf., 646
– – World Privacy Forum issues report, 337

– Compliance

– – Answers website, HHS revises and expands, 272
– – Health care topics for 2009, Analysis and Perspective, 24

– Contract changes needed, ABA panelists also say changes will increase enforcement, 558
– Criminal violations

– – Credit card fraud scam, hospital official allegedly stole records (S.D. Fla.), 831; records administrator and accomplice sentenced, 1612
– – Curiosity led to viewing patient records, doctor and two hospital employees enter pleas (E.D. Ark.), 1094; sentenced to probation and fines, 1562
– – Lawyer bought patient data, hospital employee indicted (S.D. Fla.), In Brief, 1175

– De-identified health information, state regulation, Analysis and Perspective, 544
– E-health

– – Coding system, HHS technical rule establishes and extends deadline, 159
– – Transactions standard, HHS updates technical rule to accommodate expanded code sets, 159

– Employer compliance, Practice Aid, 358
– Family medical history

– – Treatment, HHS answers questions on disclosure, 75
– – Web tool, HHS releases, 75

– FMLA medical certification rule, attorneys warn privacy rule still covers, 78
– H1N1 virus, HHS may waive some rules in event of national health emergency, 1556
– Health Express allegedly disclosed personal health information, contract and tort claims belong in state court (W.D. La.), 1309
– HITECH Act

– – Business associates as covered entities, Analysis and Perspective, 344
– – Federal legislation

See LEGISLATION, FEDERAL, HR 1

– – Impact on HIPAA regulation and enforcement, Analysis and Perspective, 417
– – Implementation

See AMERICAN RECOVERY AND REINVESTMENT ACT

– – Penalties increased, 394; HHS publishes final rule that increases HIPAA penalties, 1555
– – Senate Health, Educ., Labor, and Pensions Comm., Kennedy's (D-Mass) passing impacts key committee leadership positions, 1264; Harkin (D-Iowa) picked as new chair, 1308

– Improper disposal of personal information in dumpsters, CVS settles FTC and HHS cases (FTC), 295; pharmacist group asks FTC to continue probe citing concern about pharmacy benefits manager data, 464; CVS settles with Ind. AG (Ind. Pharm. Bd.), 1058
– Malpractice suit, no health privacy breach in contact with plaintiff's doctors (Tex.), 874
– Mental hospital cemetery records, HIPAA does not bar release (Neb.), 985
– MySpace post held as publication, Minn. privacy law not preempted by HIPAA (Minn. Ct. App.), 960
– Patient's guide released by World Privacy Forum, In Brief, 540
– Research impeded, IOM concludes, report calls for new approach, 232
– Retirement facility employee giving patient files to EEOC legitimate reason for firing (U.S., rev den), 396; In Brief, 406; data copying not misappropriation of property (Okla.), 1386
– Security rule enforcement moves to HHS Civil Rights Office, 1164
– State AG suits

– – Criticism of provision expressed, 329; correction, 446; attorney tells audio briefing to expect strong data breach enforcement, 778
– – Federal legislation

See LEGISLATION, FEDERAL, HR 1, HR 598

– Surviving spouse, nursing home must release late patient's records (Ga. Ct. App.), 303; surviving spouse entitled to records (Ga.), 1613

HHS

See HEALTH AND HUMAN SERVICES DEPARTMENT (HHS)

HIPAA

See HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

HIT (HEALTH INFORMATION TECHNOLOGY)

See E-HEALTH

HITECH ACT

See AMERICAN RECOVERY AND REINVESTMENT ACT

HOMELAND SECURITY

See also TERRORISM
– 9/11 Commission recommendations, progress report on implementation, In Brief, 1104
– Aliens and citizenship

See ALIENS AND CITIZENSHIP

– Annual report, privacy office outlines expansion, PIAs, and security incidents, 1375; groups tell Congress that Privacy Office not living up to mandate, 1558
– Bomb, air traveler allegedly monitored for saying word has standing for civil rights claims (D.C. Cir.), 399
– Budget FY2010 proposal includes increased funds, 327; DHS seeks $437M for cybersecurity in request, 703
– Credit checks allowed for hiring some positions, banned for most

See LEGISLATION, FEDERAL, HR 3149

– Critical infrastructure

– – Critical Infrastructure Information Act, Santa Clara County electronic map must be disclosed (Cal. Ct. App.), 469
– – Cybersecurity Act

See LEGISLATION, FEDERAL, S 773

– – Cyberwar, Rand study discusses, In Brief, 1506
– – Electricity grid

– – – Bulk Power System Protection Act

See LEGISLATION, FEDERAL, HR 2165

– – – Critical Electric Infrastructure Protection Act

See LEGISLATION, FEDERAL, HR 2195, S 946

– – – N. Am. Elec. Reliability Corp. not aware of cyberattacks yet, Thompson (D-Miss) plans legislation, 557
– – – Senate energy panel considers bill to give DOE and FERC emergency orders power, 702

– – National Infrastructure Protection Plan, DHS updates, In Brief, 22

– Customs and Border Protection, DHS IG reports finance data security problems, In Brief, 748
– DHS appointments and personnel matters

– – Chief Information Officer, Napolitano appoints Spires, 1142
– – Chief Privacy Officer, Napolitano appoints Callahan, 297; BNA Interview, 846; groups tell Congress that Privacy Office not living up to mandate, 1558
– – Citizenship and Immigration Services, Senate confirms Mayorkas, In Brief, 1208
– – Component Privacy Officer Act

See LEGISLATION, FEDERAL, HR 1617

– – Cybersecurity, Napolitano consolidates DHS leadership and announces new appointments, 845; Napolitano outlines DHS role in administration's efforts, In Brief, 1175; Napolitano announces new hiring authority in effort to be world-class organization, 1464
– – Data Privacy and Integrity Advisory Comm., DHS seeks applicants, In Brief, 717
– – General counsel, Fong named, 195; Fong confirmed, 706
– – National Cybersecurity Center, Beckstrom resigns citing NSA concerns, 437; ICANN names Beckstrom to lead, 981
– – National Protection and Programs Directorate, Obama to name Beers, 556; Senate confirms, 965
– – Secretary, Napolitano confirmed, issued directives on cybersecurity and critical infrastructure, 157
– – Terrorist financing asst. secretary, Senate approves Cohen, In Brief, 717

– Efficiency review launched, 528
– Employee identification cards, TIGTA says IRS progress slower than reported, 1051
– Employment eligibility verification

See ALIENS AND CITIZENSHIP

– End-of-year accomplishments, fact sheet issued, In Brief, 23
– Fair Information Practice Principles framework issued, In Brief, 48
– Fusion centers, DHS releases PIA, In Brief, 22
– Hotel register data collection, DHS reports on whether practice is in compliance with EU Data Protection Directive, In Brief, 173
– International developments, DHS Napolitano to meet with Europeans on data privacy, In Brief, 634
– National security letters (NSLs), Practice Aid, 511
– Obama's official cybersecurity agenda mirrors campaign promises, includes breach notice, 157; FY2010 budget proposal includes increased funds, 327; hearing witnesses urge House panel to avoid prescriptive mandates for private sector, 703
– Passenger name record (PNR) data, EU pact with U.S.

See AIR TRANSPORTATION

– Privacy impact assessments (PIAs) guidance memo issued, In Brief, 48
– Privacy Office issues quarterly report to Congress on complaints and other actions, 774; quarterly report issued, In Brief, 1068
– Real ID Act, Napolitano says DHS rethinking, 528
– Sensitive Security Information designation system, House hearing, witness urges limits on use when blocks public disclosures, 621
– Transportation Worker Identification Credential (TWIC) program

– – American Samoa, DHS exempts workers, In Brief, 506
– – Delays, employment groups say TSA should speed processing, 1089

– Visa Waiver Program country travelers, U.S. electronic travel authorization not visa requirements, 85
– White House and V.P. visitor records must be disclosed (D.D.C.), In Brief, 211; DHS agrees to settle FOIA suit, Obama announces new disclosure policy, 1307

HONG KONG

– Cross-border data sharing discussion paper due soon, 1239
– Data protection, ordinance proposals include voluntary notice rules and cross-border data transfer rules, 1281

HUMAN RESEARCH SUBJECTS

– HIPAA Privacy Rule, IOM says impedes research, report calls for new approach, 232

Contact the Webmaster at webmaster@bna.com
1801 S. Bell Street, Arlington, VA 22202 - Phone: 1-800-372-1033

Copyright © The Bureau of National Affairs, Inc. All Rights Reserved.