JR - Health Care Compliance Association

August 2002
6
By Craig Harriger, J.D., MBA and Paul Singleton, CISSP
Editor’s note: Wm. Craig Harriger, J.D., practices, and DME providers. The system’s
insurance company carries PPO,
MBA (HOM) CHC, CHE, is Corporate
Compliance Officer at Washoe Health HMO, and Indemnity and Medicare+
System. He may be reached at 775/982- Choice products.
5249. Paul Singleton, CISSP, is the
Information Security Manager at Washoe Expanded initiative
Health System.
Like many organizations, Washoe
employed the Charter System to form
I
nformation is one of the most a HIPAA Implementation Committee
valuable assets of health care chaired by the Corporate Compliance
organizations. The Federal Officer. As with many organizations,
Government has recognized the importance
of this information. As a consetially
envisioned a “fast and cheap”
some of the committee members iniquence,
HIPAA initiatives must be approach. Others decided to preempt
implemented. As HIPAA deadlines that approach with a proposed Charter
approach, some organizations begrudgingly
are attempting to just meet the
amendment.
deadlines with a minimum investment. The committee not only adopted the
Others however, are taking advantage of amended Charter, but also embraced
the opportunity to enhance information
management across the enterprise. ing into the Charter the goal of “seize
the spirit of the changes by incorporat-
These organizations see this mandatory the opportunity to streamline business
initiative as an opportunity to significantly
enhance their value while meet-
and achieve a competitive advantage
processes, eliminate manual processes,
ing the governmental mandates.
while meeting federally mandated legislation”.
In essence the group acknowledged
that since HIPAA mandates the
One organization that has chosen to
seize this opportunity is Washoe Health consumption of certain resources and
System (Washoe). Washoe is a Reno, time commitments, value-added thinking
should be employed to improve the
Nevada-based vertically integrated
health care system serving Northern organization wherever possible.
Nevada and Northern California.
Washoe’s services include a 529-bed Information management mapping
Medical Center, a surgery center, an inpatient
rehabilitation facility (IRF), the Information Security Manager
As a part of this value-added approach,
extended care facilities and skilled nursing
units (SNFs), in addition to a home information management scheme.
identified the absence of a holistic
health agency, multi-specialty physician Although there were numerous authen-
CRAIG HARRIGER, J.D., MBA
tication requirements in place, there
were no links between the roles and
departments in the management of
information access. The committee
reviewed the deficit and found a multitude
of benefits were available that
would form a competitive advantage
from the process of information management
mapping.
The expanded initiative sought to
devise a system that would meet
HIPAA’s readily apparent basic requirements.
For example, the new process
needed to increase the ability to audit
access to patients’ protected health
information (PHI) both accurately and
efficiently. Second, the prescribed sublevels
of PHI, such as psychotherapy
notes, required additional levels of
scrutiny. Third, Washoe needed a tool
that expedited the manner in which
only the appropriate information is
provided to users. Finally, the system
needed to identify the appropriate
method of destruction for differing
classifications of information.
The group identified several additional
potential benefits of information management
mapping. These value-added
aspects include a quick and accurate
gap analysis prior to a breach in the