Medical Records and the Law

Specific Electronic Health Records Security Issues 509hold e-mail accounts make it difficult to rely on an e-mail address inorder to validate identity.The identity authentication requirements imposedon covered entities by the Security Rule require continuously secureauthenticating methods.Moreover, if the healthcare organization makes use of the Internetto exchange patient-identifiable information, healthcare informationmanagers should devote special attention to security weaknesses associatedwith the Internet. Finally, one other concern related to Internetuse is the potential for introducing computer viruses and othercomputer contaminants into the organization’s computer systems andnetworks.The need for network security does not apply to the healthcare industryalone, however; many industries now rely on the Internet forcommercial purposes. Therefore, a growing demand exists for techniquesto secure information relayed in transactions over the Internet.Accordingly, health information managers should become knowledgeableabout such techniques, including the establishment of standardsfor encryption of documents as well as choices of software and hardwarefor user authentication.The HIPAA Privacy and Security Rules will likely apply to PHImaintained on, and transmitted through, the Internet by a covered entity.In addition, as states update their health information privacy laws,individually identifiable health information on the Internet will becomesubject to state law. Thus, sending sensitive health information such asthat concerning HIV testing, genetic counseling, mental health, andsubstance abuse over the Internet may be inadvisable. Such informationis given special protection under some federal laws and many state lawsthat contain provisions likely to preempt even those of the Privacy Rule.Therefore, healthcare organizations must implement measures to ensurenetwork security and the confidentiality of patient medical records.Most healthcare organizations already have implemented comprehensiveinformation security programs, in which case many of the policies,training procedures, and controls will be in place to address Internet informationsecurity risks. Because the Internet is changing so rapidly,however, health information managers should continually review informationsecurity measures to ensure sufficient protection of healthcareinformation; an organization-wide information security programshould facilitate ongoing attention to this objective.Liability risk relating to privacy and confidentiality can be managedin part through appropriate patient authorizations, together with