Healthy weight loss, weight loss weight management,

In January, a study published in the Journal of the American Medical Association on the first two commercially available drug-eluting stents found no significant differences in clinical outcomes.

In August, a report in the New England Journal of Medicine concluded that patients with stable angina who underwent percutaneous coronary intervention showed slightly more improvement over those treated with medication. But that added benefit disappeared by 36 months.

Then in September, a study in the NEJM found that arthroscopic surgery for osteoarthritis of the knee provided no additional benefit over physical and drug therapy.

What these very different studies have in common is that they compare the effectiveness of one treatment option with another instead of on its own. Although more of this type of research is being conducted than ever before, physicians, insurers and consumer groups widely agree that not enough comparative-effectiveness data exist on pharmaceuticals, medical devices and procedures.

When drugs and devices go through the Food and Drug Administration approval process, they're compared with placebos. Few are tested in head-to-head trials. "They just have to be better than nothing," said David O. Barbe, MD, chair of the AMA Council on Medical Service, speaking on his own behalf.

Less than 0.1% of the money spent on health research is for studies that compare the effectiveness of two products.

Medical procedures often don't have clinical effectiveness data attached, noted Gail Wilensky, PhD, a former Medicare administrator and senior fellow at Project Hope, an international health advocacy organization.

But if some leading politicians and policy experts have their way, much more comparative-effectiveness research will be generated soon. In his health platform, President-elect Barack Obama calls for starting an independent institute to guide comparative-effectiveness research. In August, Senate Finance Committee Chair Max Baucus (D, Mont.) and Senate Budget Committee Chair Kent Conrad (D, N.D.) introduced a measure that would form a national entity to fund and oversee such research. The bill is expected to be at the center of congressional debate on the issue next year.

The concept of a national comparative-effectiveness body has support in the health care, insurance, consumer and public policy world. But many details, some controversial, must be worked out. How should the national entity be structured? Should it examine cost effectiveness as well? How will public and private payers use the data? How can patient-doctor decision-making be protected?

The rationale for more comparative effectiveness research is twofold: improving quality and lowering costs. Experts say providing the research results to physicians and the public will improve health care decision-making and thus boost quality. Meanwhile, giving the right treatment to the right patient would reduce spending on complications and hospitalizations. Another common belief is that many newer, costlier medical products or services would be found to offer little or no additional benefit than the older, less-expensive alternatives.

"I regard it as a strategy to help us learn how to spend smarter and treat better," Wilensky said, noting this will help slow the unsustainable health spending growth rate. The nation spent an estimated $2.2 trillion last year on health care, which is projected to nearly double by 2017, according to the Centers for Medicare & Medicaid Services.

Many doctors are interested in the benefits comparative effectiveness promises for the practice of medicine. "These are the questions that we as clinicians ask ourselves all the time -- what's the best treatment for my patient?" said Carrie Nelson, MD, program director for the Rush-Copley Family Medicine Residency Program in Aurora, Ill., and assistant professor in the Dept. of Family Medicine at Rush Medical College in Chicago.

The U.S. spent an estimated $2.2 trillion on health care services in 2007.

Most of the information doctors get about medications comes from drug reps who have conflicts of interest, said Dr. Barbe, a family physician. Doctors want more independent research on the comparative effectiveness of various medical options, Drs. Barbe and Nelson said.

Data also would strengthen the doctor-patient relationship, research advocates said. "It would help patients understand their situations so they can be truly informed participants in the decision-making process," said Neil Kirschner, PhD, senior associate for regulatory and insurer affairs for the American College of Physicians.

Some resources already exist for physicians who want this type of data. In 2003, Congress authorized the Agency for Healthcare Research and Quality to support comparative effectiveness research. AHRQ makes findings public through guides for patients, clinicians and policymakers. But experts view that effort and a few private initiatives as too fragmented and too small to have enough of an impact. Plus, there is no one place physicians can go to access data easily.

These issues have helped spur the call for a national research body.

"The need for a centralized, adequately funded comparative-effectiveness research entity is apparent," states an AMA Council on Medical Services report approved at the Association's Interim Meeting in November. The report includes nearly a dozen principles that the entity should follow, including that physicians and patients have a significant oversight role and that the research it sponsors be disseminated in a timely manner. The American College of Physicians also has formal policy calling for such a body.

What about costs?

Many in the health care community agree that the entity should be independent and protected from political pressure, have adequate and stable funding, involve all stakeholders, use rigorous scientific standards and operate transparently. But disagreements exist on whether the body should focus solely on clinical comparative effectiveness or also consider treatment costs.

Wilensky opposes having the body review costs because it is controversial and could jeopardize clinical effectiveness research. Pharmaceutical Research and Manufacturers of America Senior Vice President Ken Johnson said any initiative should focus on comparing health outcomes, not cost effectiveness.

Comparative effectiveness weighs medical treatments against each other, rather than against a placebo.

But some doctors want both efforts handled by the same body, as long as it's done with care. "Now the primary entity dealing with costs is the health plans," Dr. Barbe said. "It raises the issue of conflict of interest."

Creating separate infrastructure for cost analysis also would be wasteful, said Barbara McAneny, MD, chair-elect of the AMA Council on Medical Service, speaking on her own behalf.

If cost data came from an independent national entity, it would be trusted more, Dr. Barbe said. But findings on a procedure's clinical effectiveness should come first and be reported separately from cost-effectiveness data, he noted.

If two treatments are clinically equivalent, doctors need to know which one is less expensive, Dr. McAneny said. One of the profession's ethical obligations is to be an effective steward of the nation's limited health care resources, added the ACP's Kirschner.

More patients are seeking this information as insurers shift more costs onto them, Dr. Barbe said. "Physicians are in the best position to help them decide when it's worth it to spend more for a certain treatment."

Consumers Union, publisher of Consumer Reports, is comfortable comparing treatments' costs and clinical benefits. It does both in its Best Buy Drugs reports, noted Gail Shearer, the organization's director of health policy analysis and director of Best Buy Drugs. "People are ready to talk about value."

Limiting the entity's scope

The AMA and other physician organizations are adamant that any national entity not be involved in coverage or payment determinations, a position with which the trade group America's Health Insurance Plans agrees. But the data generated would help inform insurers' decisions, said Karen Ignagni, AHIP president and CEO. Medicare officials also are monitoring the research out of AHRQ.

Many experts predict payers will use the data to establish tiered co-pays for services, much as they do now for drugs. They also might take clinical and cost-effectiveness data into account in their payment policies.

Plans already make coverage decisions, only they're based solely on cost, Dr. Barbe said. Adding clinical-effectiveness data "will help us hold payers accountable. Right now, we don't have the information we need to say they're denying treatment they should not deny."

But the way plans might use the data raises concerns. Patients are not all the same, Dr. Barbe noted. A treatment deemed the most effective in general may not work for subgroups of patients because of factors such as age, sex, race or comorbidities.

Experts stress that treatment decisions must remain in doctors' and patients' hands and that an easily navigable exceptions or appeals process must be built into insurance coverage. That way patients who wouldn't benefit from the treatment generally accepted as most effective might be able to access an alternative without paying more.

Knowing which types of patients would benefit most from a given intervention will require more studies on subpopulations. Wilensky estimates that $4 billion to $6 billion per year should be invested in the research. Of the $2.2 trillion spent on health care annually, only 5% is dedicated to research, and less than 0.1% goes toward comparative effectiveness studies.

With the election of Obama and the interest from lawmakers, many policy experts predict that comparative-effectiveness legislation will get serious consideration in 2009, either as part of a larger health system reform bill or on its own. "It's a white-hat issue" that appeals across party lines, said Shawn Friesen, government affairs associate for the American College of Surgeons, which supports the idea of the research but has not yet adopted formal policy.

If a bill becomes law it will be years before a large enough body of evidence exists to have a major impact on medical practice and spending, notes a December 2007 Congressional Budget Office report. For research to have an effect, CBO notes, doctors and patients would need to use the data.

Physicians who do a particular procedure that is profitable might need to adapt if research finds it less effective than clinically equivalent, less-costly treatments, Kirschner said. This transition could at times be hard for them.

"People get used to doing what they do, and when they're asked to make a change that affects their livelihood, it's difficult," he said. "That's the human part of this."

A federal trial court rejected a Centers for Medicare & Medicaid Services policy allowing Medicare claims contractors to limit payment for Part B drugs administered in a physician's office to the least costly alternative.

The court in an Oct. 16 ruling found that Medicare law did not authorize CMS or the contractors to redefine payment rates that were already set in statutory formulas.

In this case, Ilene Hays' physician had prescribed the inhalation medication DuoNeb to treat her chronic obstructive pulmonary disease. In April 2008, however, four Medicare contractors changed the basis of the nebulizer's payment from the average sales price of that drug to the price of the least costly alternative -- in this case, separate doses of DuoNeb's active ingredients, albuterol sulfate and ipratropium bromide.

Dept. of Health & Human Services Secretary Michael Leavitt argued in court documents that the Medicare statute prohibits payments for services that are not "reasonable and necessary" for treatment. Cost was a factor in that payment decision, he said.

But the U.S. District Court for the District of Columbia said that once coverage was approved, as in this case, payments are set in preexisting, explicit formulas that CMS and Medicare contractors may not change as they see fit. "It does not make sense to conclude that Congress, having minutely detailed the reimbursement rates for covered items and services, intended that the secretary could ignore these formulas whenever [he or she] determined that the expense of an item or service was not reasonable or necessary," U.S. District Judge Henry H. Kennedy Jr. wrote. "There is no indication that Congress intended to confer such broad authority."

Spokesman Peter Ashkenaz said CMS was disappointed in the ruling and is pondering its next move. Hays' attorneys declined comment.

Better access to come?

Experts disagree on whether the ruling, if it stands, will invalidate other uses of the least-costly-alternative policy. But it could discourage Medicare claims contractors from using the policy as a cost-control measure in Part B drug coverage determinations, said Joseph Bailes, MD, chair of the American Society of Clinical Oncology's Government Relations Council.

That would be a welcome change for physicians who say the policy is arbitrary and hurts beneficiaries' access to needed treatments.

Medicare typically pays 106% of the average sales price for Part B drugs.

The only reference to the least-costly-alternative principle lies in CMS' instruction manual for Medicare contractors, Dr. Bailes noted. Otherwise, the policy "is not part of the statute, and the court is saying [CMS] can't pretend it is by calling it medical necessity," he said.

Most challenges to such determinations go through Medicare's administrative appeals process, though the recent court decision could prompt similar litigation, Dr. Bailes added.

Treatment decisions belong in the hands of physicians and patients, and imposing unwarranted cost restrictions "degrades that process," said Rick Rutherford, the American Urological Assn.'s director of practice management. Medicare contractors "have said that physicians and patients can choose whatever drug they want, but then they only pay the least costly amount."

Cheaper is not always better, Rutherford added. Some more expensive options for treating prostate cancer may include longer-acting drugs more amenable to patient tolerance levels. Medicare typically pays 106% of the average sales price for Part B drugs. Doctors receive a separate payment for administering the medications. While not ideal, average sales price-based payments generally cover the medication cost and physicians' overhead associated with stocking the drugs, Rutherford said. When contractors pay at lower levels, doctors in many instances cannot afford to buy the drugs because Medicare dollars will not cover the up-front cost.

Without certain cancer drugs, patients could face more invasive and unnecessary surgical procedures, Rutherford added.

The AMA continues to advocate for Medicare pay reform, including improved transparency for payment amounts for Medicare Part B. AMA policy also advocates that contractors provide clear guidelines that identify noncovered and medically unnecessary services.

Washington -- Democratic control of the White House and gains in both houses of Congress have raised expectations for comprehensive health system reform to their highest levels since the early 1990s, when the party last found itself in a similar position.

The results of the November elections prompted physician organizations to predict that 2009 will be an active year for reform. They're calling on President-elect Barack Obama and Congress to expand health coverage to the 46 million uninsured and to take the lead on such issues as fostering primary care and medical homes.

"We think there's that window of opportunity next year to really accomplish something," said AMA Board of Trustees Chair Joseph M. Heyman, MD.

Ted Epperly, MD, the American Academy of Family Physicians' president, said he has never before been so excited about a new president. "I believe that under his leadership we will finally start to make significant change toward health [system reform] in this country."

It won't be long before the new Congress and White House have the chance to test out their power arrangement with a major health access issue. The State Children's Health Insurance Program will expire at the end of March, unless there is an extension or reauthorization. Attempts by Democrats this year to expand SCHIP coverage to millions of additional children were stopped by President Bush and his GOP allies.

President-elect Obama's health reform plan would cost $65 billion a year.

With Obama at the helm, Democratic leaders in Congress already have set policy sights much higher. They want to cover as many of the nation's uninsured as possible.

Senate Health, Education, Labor and Pensions Committee Chair Edward Kennedy (D, Mass.) plans to build off private meetings with representatives from myriad groups to seek consensus on comprehensive reform. Sen. Max Baucus (D, Mont.), chair of the powerful Senate Finance panel, detailed some of his plans for reform on Nov. 12. House Energy & Commerce Committee Chair John Dingell (D, Mich.) wrote a Nov. 10 letter to Obama asking to work with him on comprehensive reforms, starting with an SCHIP expansion.

Such individual efforts likely will merge into a single strategy, said Michael Myers, majority staff director for the Senate HELP Committee. "There's a growing recognition that the best way, maybe even the only way, that this gets done is for Democrats to unite behind a single bill."

Following Obama's lead

Obama ran on a health platform of improving the employer-sponsored health insurance system, not dismantling it to try a new approach, such as a single-payer system. Democrats don't plan to buck the next administration on that issue, Myers said.

Obama pledged to allow people who are happy with their job-based health insurance to keep it as is, but he promised that his plan would make it less expensive by creating a new national market for health insurance. He also pledged to cover more uninsured people in Medicaid and SCHIP.

At the present rate, the Medicare hospital trust fund will be exhausted by 2019.

Meetings among Democratic staffers have focused on how to translate the Obama plan into compatible legislation, Myers said. "Everyone in Congress, at least on the Democratic side and certainly Sen. Kennedy, is going to be taking their cues from the Obama White House on this effort."

Obama supporters are mostly interested in getting help paying their health insurance, said Robert Blendon, ScD, a professor of health policy and political analysis at the Harvard School of Public Health. "We don't find the evidence they were thinking of new ways to reorganize the health care system."

Myers said that likely rules out legislation that would overhaul employer-sponsored health insurance, such as Sen. Ron Wyden's (D, Ore.) bill.

Wyden's bill, the Healthy Americans Act, would replace the employer tax exclusion with a standard tax deduction and an individual health insurance mandate. It would shift most Medicaid and SCHIP enrollees to new state-run insurance pools.

But Wyden said his measure shares many principles with Obama's plan, such as strong support for preventive medicine and comparative effectiveness research. The AMA has not officially endorsed Wyden's bill but has been supportive of his efforts to find a bipartisan approach to health system reform, Dr. Heyman said.

Obama's call for fostering greater care coordination through medical homes echoes physician organizations such as the AAFP and American Academy of Pediatrics. He and the AMA also agree on the need to back income-based insurance subsidies and health information technology.

"I'm sure there are more areas where we can agree than areas where we might disagree," Dr. Heyman said. Obama campaigned against ending the tax exclusion for employer-sponsored health insurance and replacing it with tax credits -- part of the AMA's uninsured proposal. The president-elect might be more supportive of expanding public health insurance programs than is the AMA, Dr. Heyman said. Still, both agree on the need for a mix of public and private solutions.

Finding federal funding

Obama gave no indication the economic recession was leading him to scale back his spending plans. Voters who backed him also have high expectations for health care change despite the financial challenges, Blendon said. "He can't say, 'I'm going to do nothing or something very small.' "

The president-elect's health system reform plan would cost at least $65 billion a year, according to estimates by his campaign staff. This figure assumes the reforms he proposes reduce health spending in other areas.

Experts said needed funding will be hard to find. The next Congress is inheriting a $10 trillion debt and has not made plans to address the more than 20% Medicare pay cut that physicians will receive in 2010. The Medicare hospital trust fund also is set to be exhausted by 2019. "This current Congress coming up needs right now to start dealing with that issue," said Phil Roe, MD, an ob-gyn and Republican newly elected to Tennessee's first congressional district.

But Dr. Epperly said the recession actually could further the cause of health system reform. People who have lost jobs and health coverage should be more apt to support new types of health legislation, he said.

Dr. Heyman said adopting comprehensive reforms is not primarily a matter of dollars. "If we have the political will to spend $700 billion in a week's time to cure the economic crisis, which is a temporary problem, we ought to have the political will to spend much, much less money on compromising and finding a solution to this long-term problem."

Washington -- The final Medicare physician fee schedule for 2009 shows just how large a bullet doctors dodged when they successfully lobbied Congress this year for a payment patch. It also spells out how some of them can move past that close call and secure a relatively healthy raise for next year's work.

Legislation enacted in July reversed a 10.6% cut that took effect at the beginning of that month. Starting in January 2009, a 1.1% across-the-board increase will replace an additional roughly 5% cut that would have gone into effect if lawmakers had not acted, the Centers for Medicare & Medicaid Services said in the final pay rule issued Oct. 30. Because the rule applies payment changes related to the most recent five-year adjustment in Medicare relative values for certain services, some physician specialties might see updates slightly larger than or smaller than 1.1%.

"Medicare's new rule confirms that physicians caring for seniors would have faced a harsh payment cut of 15.1% next year if Congress had not stepped in," said American Medical Association President-elect J. James Rohack, MD.

The upcoming 1.1% boost will fall short of the CMS-projected 1.6% increase in the cost to physicians of providing care next year. Payment freezes and increases in recent years also have come in under the rise in costs. But the agency stressed that two bonus opportunities exist to more than quadruple the raise that doctors will get for the year.

Physicians who successfully participate in the Physician Quality Reporting Initiative will receive a 2% bonus on all of their Medicare payments for the year. Also, the program for the first time will award a separate 2% bonus to physicians who successfully prescribe medications electronically for their Medicare patients. Although the sums will not be paid out until sometime in 2010, after Medicare has processed all of next year's claims, this means the maximum effective raise for 2009 will be 5.1%.

The rule gives more detail on how a doctor can secure an e-prescribing bonus. For example, he or she would need to have a qualified system that can adequately communicate with the patient's pharmacy, identify appropriate drugs and lower-cost alternatives, provide formulary information, and generate adverse event alerts. A physician must report one of three special e-prescribing codes at least half of the times they are applicable. Claims containing the codes must represent at least 10% of all the services for which the physician bills Medicare for the year.

CMS envisions that the e-prescribing bonus will provide the "tipping point" for the health care industry as a whole to move to widespread adoption of the technology, the agency said in the final rule. The effects would go well beyond physician pay.

"E-prescribing can greatly reduce the number of medication errors that jeopardize the health and safety of Medicare patients and waste precious health care dollars treating conditions that never should have happened," said CMS Acting Administrator Kerry Weems.

More enrollment headaches ahead?

Despite the prospect of more money on the table, physicians worry that more restrictive policies in other areas of the rule could increase the number of doctors who see their payments -- or their ability to see Medicare patients -- stop altogether.

"We are reviewing the 1,500-page rule now to determine how it addresses AMA concerns with proposals that would exacerbate already significant administrative hassles that take physicians away from patient care," Dr. Rohack said Nov. 10.

Earlier this year, for example, the AMA and others strongly opposed a provision in the proposed 2009 fee schedule rule to clamp down on retroactive Medicare billing. Doctors cannot bill until they are officially enrolled in Medicare, but afterward they can bill for services provided as far back as 27 months from when their enrollment takes effect. CMS proposed limiting that retroactive billing to only 30 days before the date the enrollment application was successfully filed or the date a doctor started providing services at a new practice location, whichever comes later.

The organizations argued that the process of enrolling or re-enrolling in Medicare has turned into a complex process that often takes much longer than a month to complete. Backlogs on the part of Medicare contractors often make the process even longer, and the prospect that this could lead to a denial of retroactive payments means that a doctor waiting to enroll or re-enroll might be unable to see Medicare patients until the contractors resolve the problems, they said.

"Simply adding another 'gotcha' regulation to the mix will only make matters worse," AMA Executive Vice President and CEO Michael D. Maves, MD, MBA, wrote in a comment letter on the proposed rule.

But CMS rejected the comments and adopted the new retroactive billing restrictions in the final rule. Agency officials insisted that they cannot know whether a newly enrolled physician met Medicare requirements prior to the date that the enrollment actually takes effect.

CMS in this case appears to be fixed on a solution in search of a problem, said Lisa Goldstein, government affairs representative with the Medical Group Management Assn. A practice taking on a new physician who needs to be enrolled in Medicare, for instance, would never risk the liability of having that doctor see Medicare patients if he or she were not in compliance with program rules, she said.

Goldstein said even more physicians could experience enrollment-related payment problems once the new restrictions take effect Jan. 1, 2009. Doctors are already citing widespread enrollment delays and payment stoppages related to this year's Medicare contracting reforms and the move to the National Provider Identifier.

Some of the physician comments on the proposed rule did have a positive impact. CMS had planned to ban the use of computer-generated faxes to order Medicare drug prescriptions starting next year, but a strong response from the AMA and others caused the agency to push off that effective date until 2012.

Many doctors who have electronic medical records systems rely on computer-generated faxes for drug orders. A Medicare ban in 2009 likely would have driven a large number of them to revert to paper prescriptions rather than having the intended effect of moving them toward true e-prescribing, said Steven E. Waldren, MD, the director of the American Academy of Family Physicians' Center for Health Information Technology.

Tougher enforcement of federal rules for health information security likely is in store following a critical report by the Dept. of Health and Human Services Office of Inspector General.

In an Oct. 27 review, OIG chastised the Centers for Medicare & Medicaid Services for lax oversight of the Health Insurance Portability and Accountability Act's security rule and for taking "limited actions" to urge compliance with the federal statute. The security rule requires covered entities -- such as physicians, hospitals and health plans -- that use electronic protected health information to employ systems to ensure the confidentiality of such data and safeguard them from unauthorized disclosures or security risks. Under HIPAA's privacy rule, covered entities must make sure patient information is not shared with unauthorized parties.

CMS has maintained an effective process for receiving, tracking and resolving outside complaints filed with the agency since it began enforcement of the security rule in 2006, OIG noted. But that system does little to ensure that covered entities are using measures to stop breaches before they occur, the report said. In a national audit of several hospitals, the inspector general found "numerous, significant vulnerabilities in the systems and controls" intended to protect personally identifiable health information.

As of August 2007, CMS "had not implemented proactive compliance reviews and therefore had no effective way to determine whether covered entities were complying with HIPAA security rule provisions. Nor did CMS know how vulnerable [protected health information] was to attack by individuals intent on accessing and misusing" such data, OIG concluded.

Patients' privacy depends on the security of health information, said Deborah C. Peel, MD, founder and chair of the consumer advocacy organization Patient Privacy Rights. "Privacy means you have control of the data, and you can't have privacy as long as these databases are insecure. Even if you have a totally secure system, if you give out a thousand master keys, the security is meaningless."

HHS received 379 security complaints over HIPAA in 2007.

Dr. Peel said such risks generally would not come to light in a largely complaint-driven process. "People can't complain, because they don't know what is going on in these complex systems," she said, adding that most HIPAA security complaints start out as privacy breaches when patients realize their information was disclosed improperly.

According to the OIG report, the HHS Office for Civil Rights, which enforces the HIPAA privacy rule, received more than 16,000 complaints between 2003 and 2005, whereas CMS took in only 413 security-related complaints during the same period.

The inspector general recommended that CMS establish specific procedures for compliance reviews.

CMS disputes the findings

CMS disagreed with OIG's conclusions, saying its complaint-driven enforcement process has furthered the goal of voluntary compliance.

"What the OIG defines as lax enforcement is very focused on the compliance review area, and we really consider our program to be much more than that," said Anthony Trenkle, director of the CMS Office of E-Health Standards and Services.

CMS consented to implementing the compliance reviews recommended by OIG, he said. But the agency considers them a complementary tool in a comprehensive enforcement strategy that includes complaint investigation, education, and outreach to help physicians and entities identify and correct security issues.

"On one level you could say we've ratcheted [enforcement] up a bit," Trenkle said. "But this has been a high priority and continues to be." CMS completed 10 hospital compliance reviews and has begun developing criteria to initiate audits of a sample of covered entities, including physicians. The agency also is considering partnering with OIG on future compliance reviews, he added.

Given increased awareness of privacy and security risks, physicians can expect heightened enforcement activity, not only around HIPAA, but around other state and federal data protection laws as well, said Barbara Bennett, a HIPAA expert and partner at the law firm Hogan & Hartson LLP in Washington, D.C.

For example, HHS levied the first sanctions against a covered entity in July, when a hospital agreed to a $100,000 settlement for potential privacy violations. The agreement involved cooperation between CMS and the Office for Civil Rights.

HIPAA generally allows states to enact stricter privacy and security requirements than the federal government, Bennett noted. In addition, recent security breaches that led to medical identity theft have generated substantial media coverage and government scrutiny, she said. She pointed to the recent Federal Trade Commission's "red flag" rules requiring physicians to implement a formal identity theft prevention program by May 1, 2009 -- rules that could overlap with HIPAA regulations.

Bennett recommended physicians adopt a privacy and security compliance program in line with state and federal standards and continue to review its effectiveness. Adequate documentation is key, she noted. "Lack of documentation that the organization has made any effort to comply is the fastest road to liability."