HIPAA and Computers – Vigilance Required

[Greg Schneider]

Today I posted an article about Providence Health & Services, a Seattle-based non-profit health system, fined $100,000 as part of a settlement agreement with federal regulators for HIPAA violations relating to computer operations involving Protected Health Information (PHI) of over 386,000 patients. Using computers is a necessity if hospice organizations want to operate with the required financial efficiencies that will ensure their survival in the marketplace, especially at a time when Centers for Medicare and Medicaid Services (CMS) is reducing hospice reimbursement rates. Also as more and more for-profit companies are entering the hospice care field, competition is only going to get tougher. Attention to the bottom line will have an ever-increasing significance. Is Your Hospice in Compliance? The number of ways that a hospice can unknowingly violate HIPAA with respect to EPHI is numerous. Having a good Information Technology (IT) staff is a good start but does your IT staff have a good understanding of the HIPAA Security Rule? I frequently communicate with volunteer coordinators/managers on this issue and it is clear that hospices have many questions about what you can and cannot do with computer EPHI data. The questions cover a wide range of topics, many of which some hospices are completely unaware that such topics even warrant consideration. Here are some examples of questions to ask yourself, if you are managing a department that is using computers at your hospice: 1. Do you use e-mail to transmit patient information to or from a volunteer? 2. Do you use e-mail attachments to transmit patient information to or from a volunteer? 3. Do you attempt to get around HIPAA by sanitizing (i.e. anonymizing) patient data before sending it by e-mail? 4. Do you store patient data on removable storage media such as a USB stick? All of these questions represent commonly occurring situations and all of them could result in your hospice being faced with criminal penalties for violations of HIPAA. Need Help with HIPAA? Contact HVA The Hospice Volunteer Association (HVA) is working with hospices to help them reduce the potential HIPAA violations risks associated with PHI related computer operations. HVA recently initiated a program called the Patient Data Vault (PDV) which allows hospices to securely transmit, store and retrieve Electronic Protected Health Information (EPHI).

[Frances Shani Parker]

Greg, this is really good information that requires commitment to compliance by all levels of workers. Protecting health information must be embedded in the culture of the institution. Ongoing education is the best way to keep everyone knowledgeable, especially with staff turnover and the frequency of technological advancements. The IT staff's understanding of the HIPAA Security Rule is particularly important if they are part of the monitoring team.