JR - Health Care Compliance Association

LEVERAGING HIPAA...continued from page 7
August 2002
8
The owner of the classification project
should understand the determining factors
and apply them to the business
process of the organization to develop
the appropriate classifications. The end
result should be information classified
into five or six simple categories (in
addition to subcategories) that allow
users to quickly understand the type of
information with which they are working.
Identifying the classifications
For example, there are five classifications
that would serve most health care
organizations well. These classifications
are:
■ Research:( Access granted only on
an individual basis and not rolebased)
This classification targets activities
by researchers conducted within an
organization. These include open as
well as blinded studies. Access is
provided after a matching of individuals
to specific information and is
never role-based. An example of the
difference in treatment of this
classification is that in some cases
Independent Review Board members
could have full access to certain
information, while physicians,
therapists, program administrators
on certain studies would be more
restricted.
■ PHI Restricted: This classification is
for sensitive information that must
be carefully controlled. An example
is psychotherapy notes (HIPAA). In
order to determine additional data
that fit into this category, it will be
necessary to consider the extent to
which more stringent state laws
relating to specific categories of
health information, such as HIV test
results, mental health records, and
genetic information are not preempted
by HIPAA.
■ PHI: This is the classification for
most other patient-related information
that does not fall within the
“PHI Restricted” category. Examples
might include regular physician visits,
inpatient stays, personal history,
etc. If the organization has developed
methods for de-identifying
PHI, processes must be developed to
permit broader access to the PHI
after, and only after, de-identification
has been completed.
■ Internal Use: All organizations have
information to which they must
restrict access but is not PHI. This
information may consist of financial
information, real-estate market feasibility
studies for clinic expansions or
decision analysis documents. A subclassification
of “Internal Use” could
include an “Audit” or “Confidential
Financial” category that is further
restricted to employees in certain
departments. Other information
may constitute trade secrets of the
organization under state law, such as
proprietary protocols, business
methods, and customer lists. In
order to afford this information with
legal protection as trade secrets, it is
generally advisable to label the data
as confidential and treat it as such.
■ Public: Some mistakenly believe
that if the information does not fall
into one of the above classifications,
there are no restrictions. This is a
dangerous assumption. First, often
newly produced information has not
yet been classified and identified.
Therefore, the best practice is to
identify all information, even that
which is to be released to the public.
Similarly, each organization should
incorporate a policy in which
unidentified information automatically
defaults (at a minimum) to
“Internal Use” classification until
otherwise classified.
The above categories are proposed as
general guidelines without regard to
organizational particularities. Once the
classification development work is
completed however, the owners of the
specific information (i.e. business office
or health information management)
should begin to group their departmental
information into the appropriate
classifications that have been identified.
Business unit participation
At first glance this may appear overwhelming.
The process is quite manageable
however, given the appropriate
set of tools employed in a reasonable
order. One of the first steps should be
to include the business unit managers
and supervisors in the process.
Although one department will be
responsible for safeguarding and controlling
the access to information ultimately,
business unit participation in
classifying the data is essential.
A key aspect to the effective implementation
of the classification process is
facilitating the meetings with the business
units. Since there are few business
unit leaders with this type of experience,
the classification process owner
will need to take the lead. Individual
meetings with the various business
group managers and supervisors keep
the meeting productive. It is ill advised
to have too many groups present at
once. Each department perceives its sit-