Medical Records and the Law

Specific Electronic Health Records Security Issues 503has been widely disseminated to other individuals through a forwardingmechanism or some other means. Even an inadvertent disclosurecan result in a breach of patient confidentiality and consequent liability,statutory penalties, and licensure sanctions for the healthcare organization.Accordingly, policies regarding sensitive e-mail communicationsshould include a prohibition against the forwarding of such messagesto others without the prior permission of the sender. As an additionalsafeguard, healthcare organizations may want to consider displaying awarning notice on its e-mail system reminding users that electronicmail should not contain information that could identify any patient, directlyor indirectly, unless the message is secured via encryption.As technology of e-mail advances, any one of these security safeguardsmay be rendered ineffective. Healthcare organizations and practitioners,particularly those who are HIPAA covered entities, must staycurrent with developing security safeguards and best security and privacypractices, and periodically update their policies and procedures.Keeping ahead of potential security and privacy breaches resultingfrom the transmission of electronic health information is an enormouschallenge, but one that must be met in order to avoid liability.A healthcare organization’s information security policies should alsoaddress e-mail retention issues; these policies should address whetherall or certain e-mail communications should be archived, and, if so, forwhat period of time. The organization’s document retention and destructionpolicy should cover treatment of e-mail communications, includingmessages saved on the central computer system, backup media,and individual computer hard drives. Many healthcare organizationsrequire that e-mail communications be included in the patient’s medicalrecord, in which case retention of these communications will besubject to medical records retention requirements. The healthcare organizationmay want to consider a policy encouraging individualhealthcare providers to read sensitive e-mail messages immediatelyupon receipt, and then, to avoid having the messages being retained inthe system’s nightly backup medium, to delete such messages promptly.In addition to access controls and specific policies covering the useand handling of e-mail communications, healthcare organizationsmust provide adequate staff training and education in this area. Individualhealthcare providers should understand how e-mail communicationsregarding patient care are to be recorded, and the risks ofconveying information in an e-mail message. It is particularly importantthat healthcare professionals who use e-mail to transmit patient