Download - ADVANCE for Physical Therapy & Rehab Medicine

HIPAA Privacy and RoI:
the Adventure Continues
A good foundation for privacy/security is
just the beginning in avoiding audits
By rita Bowen, MA rhiA, ChiPs, ssgB
mation unconstrained by physical
boundaries. Healthcare organizations
now live in a virtual world, and
HIM professionals must provide privacy leadership
across the institution and beyond.
Although it is easy for us to succumb to tunnel
vision, paying attention only to that which
is perceived to be in our realm, our responsibilities
for patient privacy go further-much
further. Our vision must expand to encompass
a complete data governance policy for
the entire organization.
We’ll provide the remainder of a complete
ROI checklist and discuss three critical areas
within an organization-wide privacy and
security policy where HIM professionals can
lend an important hand: PHI location and
JEFFREy lEESER Technology has made patient infor-
data classification audits, understanding
privacy and security laws and establishing a
global encryption policy.
ROI Checklist Continued
Before we try to influence the privacy of the
rest of the institution, we need assurance that
our own house is in order. The ROI process is
your best place to start. These checklist items
are general and not all-inclusive. You must
tailor them to your specific needs and situation.
That being said, all of them need to be
implemented to some extent.
• Policy/procedures for chart pulls if you are
in a paper or hybrid environment;
• Principles for patient identity controls and
patient look-up if you are totally electronic;
• Mail opened and logged—same day;
[MANAgEMENt FoCus]
• Information maintained in secure/private
manner on desks;
• If material is printed—disposal is made
within shred-bins;
• Are shred bins locked prior to shredding;
• Scanned document validation of patient ID
and second identifier;
• EHR validation of patient ID and second
identifier;
• Processing of subpoenas observed—standards
met;
• Knowledge of who to report MPI issues to;
• Employees can verbalize understanding of
privacy standards.
Be sure to document all processes, training
and validation. This is important should you
ever need to show that all these steps have
been taken. Validation of your efforts is the
best way to minimize any penalties, fines or
investigations should a breach occur. Good
faith best efforts go a long way and are proof
that everyone was doing their part should the
inevitable occur.
Beyond Checklist 101
A good foundation for privacy/security is just
the beginning of the process. There is a need
for considerably more broad work to be done
to create a complete data governance program,
as mentioned in the beginning of this article.
More advanced efforts may be the purview of
management, but those efforts must translate
to action. Three areas of concern that HIM
directors should participate in or lead are:
• PHI location and data classification audit;
• Federal/state privacy and security law
analysis;
• Global encryption policy.
Where Is It?
It is amazing the number of places you can
find PHI. Ask IT, the business office, case management,
utilization review and all clinical
areas where PHI resides, and you will have
a good starting point for defining the world
of privacy. After compiling your list, walk
around and classify the type of data. Then
you should work with IT to verify the list.
You will often find areas that are overlooked
such as unattended computer terminals and
ADVANCE for Physical Therapy & Rehab Medicine
9