Medical Records and the Law

Specific Electronic Health Records Security Issues 499breach of confidentiality is significant—for many of the same reasonsdiscussed above with respect to EHRs, and also because telemedicineinvolves not only collecting and storing patient data electronically, butalso broadcasting it off-site. The airwaves are not secure, and the confidentialityof a patient’s medical history may not be guaranteed whenusing telemedicine for video consultation. Individuals may intentionallyor unintentionally intercept video broadcasts, leading some telemedicinelocations to take precautions to prevent unauthorized accessto health information.In the past, healthcare providers have scrambled their broadcasts toprotect confidentiality. They have had technical personnel present atboth ends of the transmission during a consultation broadcast, and haverequired that these individuals be included in institutional policies andtraining that relate to patient confidentiality. The particular safeguardsthat healthcare providers use when engaged in telemedicine will dependupon the state of technology at the time, and providers must keep currentwith best practices in the industry. The Security Rule permits coveredentities to implement safeguards that accomplish the goals set forthin the rule’s security standards and that are appropriate for a given coveredentity. The periodic security assessments that covered entities performshould alert them to the need for revising their security policiesand procedures to protect health information used in telemedicine.There are very few legislative or accreditation requirements thatgovern the creation or maintenance of telemedical records. AHIMAhas addressed these topics in a practice brief, recommending minimumcontent standards for telemedical records and suggesting specific actionsto protect confidentiality and security. 195 Accreditation standardsdo not specifically address telemedical records, but the Joint Commissionon Accreditation of Healthcare Organizations has specified that afacility using telemedical information in patient treatment decisionsmust comply with all relevant standards. 196Electronic MailIncreasingly, consumers of healthcare services seek to communicatewith their care providers via electronic mail, or “e-mail,” and text messaging.Communications via e-mail may be transmitted through direct195AHIMA, Practice Brief: Telemedical Records, available at http://library.ahima.org/xpedio/groups/public/documents/ahima/pub_bok1_000074.html (1997).196Ibid.