The Augusta University Health system recently released a notice informing patients of an email breach. On July 31, 2018, investigators determined an unauthorized user may have had access to the personal and protected health information of approximately 417,000 individuals.
Q: While at an appointment, I noticed a receipt sticking out of a patient folder at the registration desk, and I could read the patient's name, last four digits of his or her Social Security number, and diagnosis/billing codes. Is this a HIPAA violation, since anyone walking by could read this information?
In its May newsletter on workstation security and the HIPAA Security Rule, OCR cited a 2015 settlement with Lahey Hospital and Medical Center in Burlington, Massachusetts, over a breach of PHI involving a laptop used in connection with a CT scanner.
The Office for Civil Rights’ (OCR) July Cybersecurity Newsletter, released last week, gave advice on disposing electronic devices and media to protect sensitive information like financial records and electronic personal health information.
Q: Is it permissible to take pictures of patients (including behavioral health) for identification purposes as a part of the registration process? Do the patients need to sign a consent form before their picture can be taken?
Workstation and physical security should be a collaborative effort between the privacy officer and security officer in your organization, but someone, regardless of who, should take the lead on physical security issues.
UnityPoint Health in Des Moines, Iowa, notified approximately 1.4 million patients in late July that their personal information may have been breached after hackers used phishing techniques to enter the company’s email system.
Q: Are we allowed to use case studies involving real incidents that occurred at our facility as part of training for things like safety and policies, or is there a risk that someone could identify the real people who were involved?
HHS is planning to reform HIPAA and 42 CFR Part 2 in an effort to improve care coordination. In remarks to the Heritage Foundation July 26, HHS Secretary Alex Azar conveyed that HHS is starting a review of regulations that interfere with coordination among doctors, hospitals, and payers.
Most HIPAA covered entities have become steadfast in ensuring their digital environments that house ePHI are safe and secure, but this should not be your organization’s only concern. In its May OCR Cybersecurity Newsletter, OCR encouraged healthcare organizations to not forget about workstation security and physical security when it comes to protecting ePHI.
