Creating secure passwords, guest wireless networks, and emailing PHI
by Chris Apgar, CISSP
Q: I work at a doctor's office. If a patient calls and asks to have a copy of his or her medical records sent to his or her home address, are we required to obtain any additional verification beyond checking that the address matches the one we have on file? We have a patient portal where most of our patients are able to access their records, but some still prefer to have copies sent to them.
A: As with any request for PHI from an external party, whether it be the patient or someone else, proper authentication is necessary. This means you need to ask questions such as what is the patient's birthdate before agreeing to send the patient a copy of his or her medical record or designated record set (DRS).
It's a good idea to ask the patient to make the request in writing. Per the HIPAA Privacy Rule, "The covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement" (45 CFR §164.524(b)(1). This is not a "you shall." It's a "may" so in the end you may elect to not require the request be in writing. However, this might leave your practice vulnerable to the risk of someone impersonating the patient and requesting the record or the patient later complaining you sent a copy of his or her DRS without his or her permission.
If you require patients to make the request in writing, you can't make it too burdensome. For example, you can't require patients get the signed request notarized or walk the request in to the doctor's office. OCR recently published guidance regarding a patient's right to access his or her DRS (www.hhs.gov/hipaa/for-professionals/privacy/guidance/access). It provides more detailed information about the dos and don'ts of meeting the HIPAA Privacy Rule requirement that patients are entitled to view or request a copy of their DRS.
Editor's note: Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Nicole Votta at nvotta@hcpro.com.
Creating and conducting an organizationwide risk analysis: Part 1
Editor's note: This is part one of a series about implementing organizationwide risk analyses. Look for part two in an upcoming issue of BOH.
OCR's breach settlements, corrective action plans (CAP), and penalties often take organizations to task for not completing a regular organizationwide risk analysis, yet it's all too easy for this important job to fall by the wayside. A lack of resources and competing demands within an organization can push the risk analysis to the bottom of the list of priorities. But this leaves an organization vulnerable to threats it will only see in hindsight. It also often leads to scrutiny from OCR and the public.
Q: The emergency department (ED) at the hospital where I work often becomes so busy that we do not have enough rooms for all of our patients. This occurred last weekend, which meant that several patients were brought into the ED on stretchers to be evaluated but could not be placed in a room. I witnessed a nurse perform a physical/abdominal examination on a patient who was on a stretcher in the ED hallway and discuss medical history and current treatment options with the patient in this open space where plenty of patients and staff members could see/hear the encounter. Is this a HIPAA violation?
A: What you are describing is an incidental disclosure, not necessarily a HIPAA violation. Organizations must take steps to limit incidental disclosures and mitigate the risks to the patient’s privacy and the security of information. In the case you describe, for instance, could a screen have been erected to protect the patient’s privacy even if circumstances led to no choice but to perform the exam in the hallway? Could a white noise machine have been brought over to reduce the chance of being overheard? Could the gurney have been moved to a private area (or even a slightly more private one) when the exam had to take place? Could the exam have been postponed until a more private space was available, or was it necessary to do it right then? These are the questions staff should ask themselves in these situations.
Editor's note: Simons is the director of health information and privacy officer of Maine General Medical Center in Augusta. She is also an HIMB advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Send your questions related to HIPAA compliance to Editor Jaclyn Fitzgerald atjfitzgerald@hcpro.com.
Tips for small covered entities charged with HIPAA compliance
"OCR has bigger fish to fry than me."
You may have heard that before—or even said it. Maybe you're an employee in a tiny healthcare facility. Or maybe you've seen the big headlines on data breaches, noted how they seem to always involve large insurance companies and massive healthcare facilities, and thought, "That won't happen to us."
Know thy BA
BAs are a part of HIPAA life—no matter how big or small your entity is. So how far should CEs go to ensure their BAs are HIPAA compliant?
Roger Shindell, CHPS, the CEO of Carosh Compliance Solutions in Crown Point, Indiana, notes that things changed in the HIPAA Omnibus Rule, HHS' biggest set of modifications to the HIPAA Privacy and Security rules per the HITECH Act. Prior to 2013, if a CE had a valid BA agreement in place, and the BA had a breach, the CE had a safe harbor exemption for the breach, he notes.
Entities are required to conduct an "accurate and thorough assessment" of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI.
BA agreements stipulate that the BA will comply with all the requirements under HIPAA/HITECH, per the HIPAA Omnibus Rule. So BAs need to be ready, just like you.
Should CEs offer training to the BAs? No, says Shindell.
"The BA has their own obligation to conduct training," he adds, "and if training is on specific policies and procedures, the CE would not know what these are and what is appropriate."
OCR's long-awaited Phase 2 HIPAA Audit Program is finally in full swing. On March 21, OCR announced that it will begin verifying the contact information of covered entities (CE) and business associates (BA) selected for audits (www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/phase2a...). This shouldn't surprise savvy healthcare organizations. The audits kicked off after a flurry of activity from OCR and HHS, including pricey HIPAA settlement fines and the publication of user-friendly HIPAA guidance for providers, developers, and patients.
