I. Health Insurance Portability and Accountability Act (HIPAA):
HIPAA is a federal law in the United States enacted in 1996 to provide individuals with
greater access to healthcare insurance and to protect the privacy and security of individuals'
personal health information. Under HIPAA, individuals who change or lose their job can
continue their health insurance coverage, even if they have a pre-existing condition.
HIPAA establishes confidentiality, integrity, and security standards for the storage and
transmission of individuals' personal health information, including medical records, billing
information, and other related data. The covered entities such as Healthcare providers, health
insurances, and healthcare clearinghouses, are required to implement policies and procedures
to safeguard individuals' protected health information (PHI).
In addition, HIPAA provides individuals the right to access and control their PHI, including
the right to request copies of their medical records and to request the information be
amended or corrected if it is inaccurate. HIPAA also requires covered entities to notify
individuals in the event of a breach of their PHI.
HIPAA has been amended several times since its enactment, including the addition of the
HIPAA Privacy Rule and the HIPAA Security Rule, which provide detailed PHI
requirements protection all covered entities, as well as their business associates who have
access to PHI.
II. HIPAA Compliance Practices:
1. Implement a Security Management Process:
HIPAA requires a security management process to be in place to protect health information.
This helps with risk analysis and management to evaluate the likelihood of risks to e-PHI and
implement security measures to address those risks. The security management process should
include the following steps:
• Designate Security Personnels: Designate an individual or a team responsible for developing
and implementing the organization's security policies and procedures.
• Risk analysis: Conduct a thorough analysis of potential risks and vulnerabilities to the
confidentiality, integrity, and availability of ePHI.
• Risk management: Implement reasonable and appropriate security measures to mitigate
identified risks and vulnerabilities.
• Sanction policy: Establish a policy for responding to violations of HIPAA regulations,
including disciplinary actions against employees and business associates.
• Limit Access to PHI: Access to information must be limited in a way that is consistent with
the HIPAA Privacy Rule. This limits the disclosure and use of PHI to the very minimum
necessary. The HIPAA Security Rule establishes role-based access allowances.
• Workforce security: Develop and implement policies and procedures to ensure that
employees, contractors, and other workforce members are aware of their role in safeguarding
ePHI.
• Conduct security awareness and training: Provide ongoing security awareness and training to
employees and other workforce members to ensure that they understand their security
responsibilities and how to protect ePHI.
• System information review: Implement procedures for regularly reviewing records of
information system activities such as audit logs, access logs, and access reports.
• Evaluate Policies and Procedures: Finally, entities need to regularly perform assessments
and updates to ensure policies or procedures meet the Security Rule in its entirety.
2. Physical Security for Medical Record Storage:
The following practices are recommended:
• Access control: Limiting access to medical record storage areas is key to maintaining
their physical security. This can be accomplished through measures such as key card
access, biometric identification, and physical locks.
• Video surveillance: Video surveillance can be used to monitor who enters and exits
medical record storage areas and to deter unauthorized access. It can also be used to
identify individuals who have gained unauthorized access.
• Environmental controls: Medical records must be stored in an environment that is free
from hazards that could damage them, such as moisture, extreme temperatures, and direct
sunlight. Adequate ventilation and air conditioning must also be provided to ensure
proper storage conditions.
• Fire suppression systems: Medical record storage areas should be equipped with fire
suppression systems to minimize the risk of loss or damage in the event of a fire.
• Inventory management: Regular inventory checks should be conducted to ensure that all
medical records are accounted for and that none have been lost or stolen.
• Staff training: Staff who have access to medical record storage areas should receive
training on the importance of maintaining physical security, as well as on the policies and
procedures for accessing and handling medical records.
3. Policies & Procedures for Workstation and Device Security:
Implementing policies and procedures for workstation and device security is an important
step in protecting sensitive data, including medical records, in healthcare organizations. Here
are some key steps that can be taken:
• Password policies: Establish password policies that require complex passwords that
are changed on a regular basis. Passwords should not be shared, and staff should be
trained on how to create and manage secure passwords.
• Encryption: Implement encryption for all sensitive data, including medical records, on
workstations and devices. This can include full disk encryption or file-level
encryption, depending on the needs of the organization.
• Access control: Implement access control measures to limit who has access to
workstations and devices that contain sensitive data. This can include physical
security measures, such as locks on computer cabinets, as well as electronic measures
such as passwords and biometric identification.
• Remote access policies: Establish policies and procedures for remote access to
workstations and devices, including requirements for secure connections and multi-factor authentication (MFA).
• Software updates and patches: Regularly update software and apply security patches
to workstations and devices to ensure that they are protected against the latest security
threats.
• Data backup policies: Implement data backup policies to ensure that important data,
including medical records, is regularly backed up and can be restored in the event of a
system failure or other issue.
• Staff training: Provide regular training to staff on the importance of workstation and
device security, as well as on the policies and procedures for protecting sensitive data.
4. Technical Security for Electronic Medical Record Storage:
• Limit Electronic Access to PHI: Access control is a serious concern for PHI
protection. Covered entities need to implement technical procedures and policies that
allow only specific, authorized individuals to access any electronic PHI.
• Audit Electronic Access to PHI: With audit controls, covered entities must use
software, hardware, or other mechanisms to track any access or activity in an
information system. For example, if a hacker were to access a document in the system,
the audit controls should identify the attack and examine what kind of access
occurred. Good health information technology software may help identify threats in an
electronic health record system or on a hard drive so that data doesn’t get into the
wrong hands.
• Securely Transmit PHI: If transmission of the electronic documents is necessary, the
healthcare provider must implement security standards for doing so. These should
guard against unauthorized access when the information is transferred over an
electronic network.
5. Medical Records Maintenace:
Every state has its requirements for the storage of medical data. Medical records are required
to be kept for at least 10 years in California, 7 years in Texas.
There can also be different timelines for storage depending on the type of provider. For
example, physicians and hospitals may keep records for various lengths of time.
To stay compliant with federal law and with federally funded programs such as Medicare
and Medicaid, a medical business office or hospital must retain patient medical records for at
least five years. Critical access hospitals must keep records for at least six years to stay
compliant.
Other kinds of records may need to be kept longer. For example, if medical personnel are
exposed to hazards, the Occupational Safety and Health Administration’s regulations may
come into play. Those regulations mandate that exposure records be kept for 30 years, even
if HIPAA doesn’t require the records to be retained for that long.
Under HIPAA privacy regulations, disclosure accounting documents, policy documents, and
procedure documents need to be kept for at least six years. This is based on the HIPAA
Privacy Rule.
For pediatric patients, records may not be destroyed until the individual is at least 21 years
old.
In New York, obstetric and pediatric records have to be kept until the child turns 19. Records
for adults need to be kept for at least six years at a time. Companies can keep themselves
safer by maintaining electronic records for at least six years at their medical facility, but
longer retention times may be advised in exceptional cases.
6. Medical Records Disposal:
When it is time for paper or electronic health records to be destroyed, it must be done in
such a way that they cannot be used for illegal or unauthorized purposes. To do this,
organizations must follow specific protocols. Medical practices may destroy paper
documents by: Burning, Shredding, Pulverizing, Pulping.
Electronic records must be destroyed using software or magnets on hard drives to fully
eliminate the data. Without the use of specialized software or magnets, it could be possible
to recover files even after they’ve been deleted.
7. General Practice for Safely and Securely Store Medical Records:
Safely storing medical records is the key to staying compliant with HIPAA. Medical records
and PHI should be stored out of sight of those who are not authorized to access them. For
example, a digital document may be kept on a physician’s and medical records
professional’s locked network, or a room of patient files may only be accessible by approved
personnel with a special code.
8. Security Policies and Procedures:
Policies and procedures need to be created to comply with
the Security Rule. These then must be retained for at least six years from their last effective
date as a written record.
9. Regularly Train All Employees on Policies and Procedures: Medical facilities need to
regularly train their employees on their policies and procedures to protect patient
confidentiality and keep the facility compliant with HIPAA. For example, if the policy is to
take the patient file out, hand it off to the nurse, hand it to the doctor, and then return it to the
office to refile, this should be done every time. Any deviation from the procedure, such as
setting the document aside in a shared office, should be noted and followed up on for
correction.
10. Label System for Accurate Indexing:
To index patient files, it is helpful to have a
labeling system. Many offices label them by birthdate, last name, or full name. Depending
on the number of patients at the facility, it may be more reasonable to file by the first letter
of the last name and in alphabetical order. Using a middle name and birth date may also be
appropriate for patients with the same name. The goal is to have a label system that makes it
possible to find patient information without pulling the wrong files quickly. Pulling the
incorrect files could lead to a breach of confidentiality.
11. Automate Processes When Applicable:
When possible, automating processes helps keep
medical information and documentation secure. For example, instead of keeping copies of
the patient’s prescriptions in a paper file, storing them digitally may be better for
safekeeping. Like HIPAA-compliant cloud services or end-to-end encryption, technical
safeguards may help prevent identifiable health information from being leaked.
12. Self-Audit:
As mentioned earlier, self-auditing the system is the best way to prevent a digital
breach. However, you can also audit the office. Check for paperwork that is out of place or
that isn’t stored as it should be. Mention file transfers that did not go as they should have.
Self-auditing will help find more security risks.
13. Stay on Top of Data Security:
An office should have a data security officer to identify threats and address them. If there is a data breach, patients may need to be informed. The security officer needs to regularly self-audit the system to prevent a data breach. Antivirus software should also be used to maintain security. Cookies should be cleared and monitored for potential phishing or keylogging.
Comments
Post a Comment