Risk and Security LLC

Risk Assessments, Training and More

This content shows Simple View

October 2009

Pandemic H1N1 – Part 2

This is my second post on the H1N1 flu. I have a daughter-in-law in the high risk category — she’s expecting twins in December and didn’t want to get the vaccine — but I did finally convince her. Also: while I was hosting my 150+ person webinar on how to handle the pandemic’s effect on your business — one of my employees came down with the ful. He was very sick for the first 3 days, and then slowly improving but still with a fever after five days.

We asked several questions during the webinar, which was very well attended by banks, hospitals, credit unions, and other companies. The one that surprised me was that only 40 percent of the people had a pandemic plan in place and about 20 percent didn’t know if they had plan or not. When we are discussing alternate staffing plans, the place where you might see the most impact is in the IT area. IT managers and network managers usually have knowledge not shared with the rest of the organization.

It’s easy to get a temp to fill in as a receptionist, to add a salesperson, or replace clerical or admin functions, but to get someone who knows your network and how all the configurations work is a trickier proposition — and FLASH — IT and network people also get the flu!

One of the amazing facts from the webinar was that older people — that is, anyone who was alive in 1957 or right after, has a very low chance of getting the H1N1 virus (unless they have another underlying condition like asthma). This is because a similar strain went around the world is 1957 and so people from the era are relatively immune.

Other considerations to contemplate during this pandemic is whether to relax your requirements for employees to have to get a written doctor’s excuse — doctors may not have time to write one — and employees who only have the flu, but are staying at home sleeping, may not have to visit a physician or hospital. Another aspect to consider is whether you would rather have people stay out LONGER, to make sure they don’t infect others in your company.

A company full is 20-40 year olds is probably going to have more absences because they have small children at home. If you look at the flu maps for the last four months in the U.S., you can easily see that the flu started in March-April 2009 and then died down when school was out. School in session resulted in the 2nd wave of the pandemic that is still increasing, as we enter into the usual flu season.

If all the data was analyzed, I’m quite sure they would find that the concentration of children in school, colleges and universities is a big driver in keeping the flu numbers increasing.

One disturbing note was — children may not be protected completely from the first vaccine, but may need a booster. I saw this on the news this morning, and, with vaccine in short supply anyway, the idea that boosters may be needed would be very unwelcome.

By the end of next week, we should get a better idea of the trending of the flu waves and that will help companies in planning for increases absences. At the beginning of H1N1, experts were predicting a 20-40% absentee rate — so don’t take your eye off this pandemic.



How your health records are safer — or at least you’ll know about all the disclosures now….

Well – it wasn’t a billion dollar bailout and it wasn’t a new ‘public option’, but it was, on September 23rd, the official STARTING DAY of the new HIPAA breach disclosure rule, another tangible effect of the American Recovery and Reinvestment Act of 2009.

The breach disclosure rule is a little unusual in the way it dictates how healthcare entities have to behave if there is a disclosure of YOUR PHI (i.e. Protected Health Information). Your PHI could be interesting little tidbits of information like:

– detailed health info on 1000 Hollywood celebrities, probably all about face lifts, nose jobs and liposuction.

– Details on whose tubes got tied

– Embarrassing information on warts and other disgusting physical problems
Or
– Just info you don’t want everyone to know about.

The new Breach Disclosure rules protect you. Here are some of the details about what the organization that leaked your sensitive info has to do…

If the breach involved less than 500 individuals’ information, then you must be notified within sixty days and “without reasonable delay”. If more than 500 individuals’ information is breached, then the organization has to not only notify the Department of Health and Human Services, but also has to send out a press release and notify the media — film at eleven.

Covered organizations (covered entities) will not be penalized until February 22, 2010. So for now, organizations should make sure they have these disclosure guidelines in place and practice them, including training and awareness exercises, so they will be ready by February.

Organizations must also do an individual RISK ASSESSMENT on each breach to calculate the harm that the breach may do to an individual. For example, whether the breach would affect their health insurance, or their relationship!
There are additional considerations about whether the breach was done in error and actual disclosure was limited; or whether it was malicious disclosure – done on purpose, or for financial gain.

The breach notification rule, in my opinion, is just another manifestation of how serious the government has become about protecting personal information, whether it is protected health information, or personal financial information.

The FTC reported that identity theft is the one number consumer complaint and so protection of your information has moved up to the top of the list. Lucky us




top