Technical security Safeguarding data integrity and confidentiality means keeping track of exactly who read or updated a record and who authored a message. Each user is required to hold some sort of unique ID, which will allow them access to information based on that user's role, level or context. Audit trails will keep track of who accessed what and when. Providers aren't going to take it easily. The comment period for the privacy piece has been extended twice already because DHHS received more than 50,000 comments on the draft, but a final version is still expected in 2000.
Liability is scaled according to intent, but it's still liability.
That's per violation, and civil fines may also be imposed. The provisions outline a set of 19 data elements that must be removed from a record in order to ensure that the patient behind the data cannot be identified. Insurers, researchers, public health organizations and even providers themselves called the extensive list into question during the comment period, arguing that removing so many elements could render the data useless for demographic and aggregation studies. The provisions also allow patients to unilaterally restrict information disclosure. If patients choose to restrict, referring physicians may find themselves closed out of portions of the patient's medical record.