The U.S. Department of Justice announced yesterday the formation of a new Opioid Fraud and Abuse Detection Unit. According to Attorney General Jeff Sessions, the new unit, which is part of a pilot program, will utilize data analytics “to identify and prosecute individuals who are contributing” to the opioid epidemic. The Department will also fund additional prosecutors tasked specifically with investigating and prosecuting opioid-related health care fraud.

As expressed on Ice Miller’s Internet of Things (IoT) site, the proliferation of the Internet of Things creates unprecedented new uses for internet-enabled devices and heightens the demand for high-speed connectivity among residential and commercial users. One example of such uses is telemedicine and associated applications to monitor patients, personnel, and medical devices.

The investigation and prosecution of health care fraud will remain a priority for the Department of Justice (DOJ). In comments at an American Bar Association conference on health care fraud, the Acting Chief of the Criminal Division, Kenneth Blanco, said Attorney General Jeff Sessions “feels very strongly” about keeping health care fraud a priority. Blanco also said the investigation and prosecution of health care fraud will be “vigorous” under AG Sessions.

After the risk assessment establishes the facts related to the impermissible disclosure, the covered entity may find that one of three statutory exceptions to the definition of “breach” applies.

The single largest PHI breach in 2013 involved the theft of four desktop computers from an office; the computers contained more than four million patient records. The additional burden of encrypting that data almost certainly pales in comparison to the burden of notifying millions of patients, going through the investigation and monetary penalties that will probably result, and defending the class action lawsuit that has already been filed.

Another collateral consequence of a guilty plea, even to a misdemeanor, is disciplinary action against your license to practice medicine in any state in which you hold a license. 

As you may already know, encryption is not the same as password protection. It’s a good idea to use a password to protect any device that contains PHI, but that is not sufficient to protect the PHI from unauthorized access.