HIPAA Alphabet Soup The Acts that made all this privacy and security possible: HIPAA: Health Insurance Portability and Accountability Act HITECH Act: Health Information Technology for Economic and Clinical Health Act ARRA Act: American Recovery and Reinvestment Act Key acronyms: BA: Business Associate CE: Covered Entity EHR: Electronic Health Record, [...]

Unique User Identification – Logon ID The HIPAA Security Rule requires Covered Entities and Business Associates to implement a “Unique User Identification” for systems holding Electronic Protected Health Information (ePHI). It is a “required” implementation specification under the Access Control Standard and should be employed for all information assets that [...]

Potential HIPAA Security Violations When an unencrypted device containing ePHI is stolen or missing, this could result in a HIPAA security violation. For example: A thumb drive containing the Electronic Protected Health Information (ePHI) of approximately 2,200 individuals was stolen from a vehicle. The entity needed to conduct an accurate [...]

Working Off-Site When working off-site, remember: Do not take confidential information off-site unless: You have official authorization from your department or division manager and department policy or practice permits the information to be taken off-site. The information must be taken off-site to fulfill your job duties (for example: home visits [...]

Prevent a Breach of PHI Fax: If you manually enter the fax number, double-check all fax numbers before sending the fax. When discharging a patient, double-check the patient’s identifying information on the discharge instructions and any related prescriptions. Make sure all information matches the patient’s records. Do not leave paper [...]

Avoid Peer-to-Peer File Sharing Millions of people use free Peer-to-Peer (P2P) file sharing programs / software to swap files over the Internet. P2P can make files on your computer available to potentially millions of users. Sharing copyrighted material over a P2P network may result in legal action against both the [...]

Your Online Presence Your online presence is all encompassing. The message you send via email or photos needs to be consistent. For a better idea of where this consistency comes in, consider these: Your photo – provide a professional photo for your website and ID badge Emails – make sure [...]

Tailgating/Access Card Usage Tailgating is one of the most common physical security breaches. It starts out innocently – an employee opens a door and holds it open for other employees, visitors without badges, or the passive acceptance of a uniformed worker. The problem with these lax situations is that they [...]

Where do we place servers that store ePHI? When determining the location of servers with PHI or PII, consider these two main factors: physical and environmental protection. Physical protection should be focused on preventing unauthorized individuals from accessing the server (e.g. storing the server in locked room accessible only to staff). Environmental [...]

Breach of PHI Assessment 4-Factor Requirement Do you think there’s been a breach of PHI?   Follow these guidelines to determine if PHI has been compromised: Look at the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification. Find out who accessed [...]