Medical Records and the Law

HIPAA Security Rule 469improper disclosure of ePHI. Covered entities should also considercreating a retrievable, exact copy of the ePHI before moving equipment.A covered entity that knew that the ePHI would be needed forhealthcare purposes and failed to retrieve it could have exposure to liabilityfor improper disposal of ePHI.Technical Security StandardsThe technical security standards of the Security Rule follow the administrativeand physical security standards in their general nature andtheir focus on requiring covered entities to implement methods andtechnologies appropriate to their business operations. 108 DHHS recognizedthat the speed with which technology changes would makehighly specific regulations obsolete almost immediately. 109 Althoughthese broad standards are disquieting to some covered entities who preferclearly delineated guidance from DHHS, many have taken advantageof the flexibility the rule provides, and have developed policies andprocedures tailored to their own organizations.Access ControlThe standards require covered entities to implement policies andprocedures to grant access to ePHI only to individuals and softwareprograms that have been granted access rights as outlined in the administrativesecurity safeguards of the rule. 110 These procedures mustassign unique user identifications to each individual granted access toePHI, so that users can be identified and tracked. What types of accesscontrols and other implementation features should be used is up toeach covered entity to determine in light of its operations. 111 Coveredentities must also develop procedures for providing access to ePHI inan emergency so that access to essential ePHI will not be lost. Althoughthe rule suggests that covered entities consider installing an automaticlog-off feature in their information and communicationssystems, entities are not required to use the feature if they determineand document that other security features will adequately protect their10845 C.F.R. § 164.310.10968 Fed. Reg. 8343 (Feb. 20, 2003).11045 C.F.R. § 164.312(a)(1).11168 Fed. Reg. 8355 (Feb. 20, 2003).