Case study:

• Outsourced UCSF notes highlight privacy risk: how one offshore worker sent tremor through medical system.
  by David Lazarus (San Francisco Chronicle) - March 2004

Topic notes

Relevant legal and regulatory documents:

• Summary of Health Insurance Portability & Accountability Act (HIPAA)
• HIPAA statute, August 1996 (Public Law 104-191)
• The Privacy Rule, December 2000 (from the Federal Register) Part 1, Part 2, Part 3, Part 4, Part 5, Part 6, Part 7, Part 8,
  .............background considerations precedes the text of the rule itself, which starts on page 38 of part 7
• Update to The Privacy Rule, August 2002 (from the Federal Register)
  .............background considerations precedes the text of the rule itself, which starts on page 86
• The Security Rule, February 2003 (from the Federal Register),
  .............background considerations precedes the text of the rule itself, which starts on page 42

Relevant guidance documents from the Health and Human Services Department:

• Compliance deadlines
• Guidance on The Privacy Rule,
• Guidance On The Security Rule: Overview, Technical, Physical, Procedural, Administrative Safeguards

Further Help:

• general information from Center for Medicare and Medicaid Services
• educational material provided by the Health and Human Services Department on the Privacy Rule, and Security Rule,
• other non for profit sources:
  American Medical Association,
  Mass Health Data Consortium,
• example of a patient rights declaration from Lahey Clinic (MA)
• example of a consulting company active in HIPAA Beacon Partner(MA)