Protected health information

And so we try to take that specialized knowledge and apply it to each and every conflict or dispute that we help our clients navigate.

The first topic we're gonna jump off into is handling, uh, PHI and HIPAA matters in the course of discovery and litigation.

Regardless of what the matter may involve, if we have litigation for a participant in the healthcare industry, planning ahead and conducting discovery in a way that takes account of the, that regulatory overlay is critical.

I think we can begin with an inquiry of Charles to describe some of the most basic or, or, or common mistakes that we see when litigators fail to set up proper discovery protocols and protective orders when they deal with health information.

Sure, yeah.

I, I think, you know, a lot of folks know, have heard of HIPAA and, and, you know, may have a general understanding that it is designed to protect the privacy of patients and their healthcare information.

You know, at, at, in a lot of cases we litigate, there is, um, yeah, patient healthcare information prot- re- referred to as PHI, protected health information, that is, that is often produced in litigation, but it has to be produced in a particular way, and it has to be produced subject to very specific protective orders and rules so that you're following along with the, uh, the regulatory landscape.

It, it isn't...

At the time of the writing, the FBI jobs website said, quote, apply.fbijobs.gov and the special agent applicant portal are currently unavailable, unquote.

Then it goes on to add, quote, all FBI data was compromised, including PII and PHI, which is personally identifiable information and protected health information, on incumbent and former FBI employees and all applicant information.

We have a lot more than we claim here, unquote.

The representative said Shiny Hunters said the group used a zero-day exploit in an Oracle product called PeopleSoft.

You're right.

That's probably a big explanation for it because it included not only individual identifiers, which you know is kind of key to it being a breach of PHI.

But financial information, diagnoses, laboratory results, medications, treatment, all of it, all of it.

You're supposed to say in your letter, I wonder if you could just say all of it, everything.

Did they find it kind of during the investigation? Was it part of the actual breach?

Well, we get a clue down here in a minute from Director Stannard.

Failure to assign unique identifiers for identifying and tracking users in systems containing ePHI.

Yep.

As you can imagine, we're not moving around things that are very trivial.

We're talking about patient data and that inevitably involves some access to PHI.

One of the things that we pride ourselves on is that everything begins with a conversation.

So we want to understand the organization and why they want to work with us.

Who are the patients they serve? What's the environment that they work in and what's their data environment? What are their priorities and what they want to get out of a partnership with us and in what period of time? So from there, we walk through, as you can imagine, the appropriate governance and legal and privacy and technical processes.

There's an important distinction in how we design the model that I think health system leaders should really understand.

And that is PHI, or personal health information, is never sent to HOMUSC.

And so our technology does access PHI within the health system to de-identify that data.

they have the rights to all identified personal information for the purposes of procuring health care.

And it's not about discrimination, right? There's a very big difference between discriminating in PHI and HIPAA and then utilizing information to help people.

So if you know that part of your population has diabetes, or you know that most of your population, welcome to 2026, is on GLP drugs, you've gotta create access to care for those issues versus just letting it all live at the health insurance carrier because if the PBMs, we talked about those, they own the carriers.

So if they know that there's a lot of drugs, What's going to be expensive? The drugs.

At the time of writing, the FBI jobs website, quote, apply FBI jobs dot gov and the special agent applicant portal are currently unavailable.

The defacement adds, quote, all FBI data was compromised, including PII and PHI, that's personally identifiable information and protected health information, on incumbent and former FBI employees.

Uh-oh.

And all applicant information.

Huh.

And a little bit extra here from the BBC, they updated the story saying that cyber criminals who hacked the FBI say they have extremely sensitive medical data.

That's the PHI for thousands of its agents.

BBC News has seen samples of the stolen fitness for work medical exams, which contain information like blood and urine test results and doctor's notes mentioning conditions such as shellfish and banana allergies.

Like, okay, there, there is alerts, but how that vendor is getting used That can help us to answer that question, what we need to do when an alert pops in.

Like if the vendor is, uh, purely, uh, for marketing, there is no PII involved or PHI involved, no sensitive data, okay.

That's, uh, we can deprioritize that.

And then there is PII involved or PHI involved, and a highly critical vendor can't go down or like it's, uh, the, uh, availability should be all nines, then yeah, then it's super critical.

Like we have to take action on that immediately.

The priority goes up.

I think like what, what happens today is they, they, they have basically, uh, given approval for that vendor.

But what changes after that, when they were doing assessment, the internal use case is to just use it to, let's say like a marketing e-email was sent over that email provider.

We can flip it.

Because what can be a possible impediment to data integration because of privacy and usability also means it is a very structured framework how PHI data and how exclusivity and privacy is being considered.

It is not a random thing.

There are three clear HIPAA rules on how data should be considered, how data should be consolidated, how it should be aggregated.

Yeah, like you, like you mentioned, this is a real, uh, topic and has been a big topic of discussion in the industry over the past year that AI has really started to get integrated.

So, you know, if you take, for example, a hospice nurse who uses ChatGPT to draft a visit note using a patient's name and clinical details, um, that's a situation where PHI has been sent to a third party with potentially no business associate agreement, and that's potentially a HIPAA breach.

So that's the kind of example that we wanna be thinking about, um, when we're talking about this shadow AI problem in hospice.

Um, and in fact, we've seen recent OCR guidance.