|
WASHINGTON – ONC's Office of the Chief Privacy Officer (OCPO)has published a "Guide to Privacy and Security of HealthInformation," which aims to help physicians, nurses and ITstaff better understand how the safety of patient data is essentialto meaningful use of electronic health records and mobile devices. Earlier this spring Healthcare IT News reported the results of a study from HIMSS Analytics and Kroll that showed security breaches are still widespread inhealthcare – despite increased attention paid to patientprivacy. [See also: Breaches epidemic despite efforts at compliance, says Kroll .] The "HIMSS Analytics Report: Security of Patient Data,"suggested that, despite increasingly stringent regulatory activitywith regard to reporting and auditing procedures, most providerswere prioritizing compliance with the rules over actuallybolstering their own organizations' security protocols. The result was that, despite significantly increased confidence onthe part of officials such as HIM directors, compliance officersand CIOs – with many of them reporting they are"extremely prepared" – data breaches are still onthe rise. Twenty-seven percent of respondents reported a security breach inthe past year – well up from 19 percent in 2010 and 13percent in 2008. More than two-thirds (69 percent) of thoseexperienced more than one breach in the past 12 months. [See also: Q&A: Security failings 'a cultural issue,' says expert .] Health providers "have a lot coming at them," said BrianLapidus, senior vice president, Kroll Advisory Solutions."They've got meaningful use, they've got EHR implementations, they've got HIPAA requirements."Nonetheless, "there is a responsibility for theseorganizations to protect patient data." So the new ONC guide, which seeks to offer a comprehensive,easy-to-understand resource to help providers incorporate robustprivacy and security routines into their clinical workflow, comesat a crucial time. Developed by OCPO in partnership with the American Health Information Management Association (AHIMA) Foundation, the 47-page guide offers detailed guidance on topicssuch as security risk analyses and management tips, and workingwith EHR and health IT vendors. The guide also offers a 10-step plan for reinforcing privacy andsecurity protections before attesting for meaningful use: Confirm your organization is a covered entity. Most healthcare providers are covered entities, and thus, haveHIPAA responsibilities for individually identifiable healthinformation. The Department of Health and Human Services offerstools that can help you confirm your organization's status. Provide leadership. Emphasizing the importance of protecting patient information toall your employees is central to ensuring a culture where securityis treated with the importance it deserves. Document your process, findings and actions. The Centers for Medicare & Medicaid Services ( CMS ) advises all providers attesting for meaningful use to retain allrelevant records that support attestation. Record all your practicedecisions, findings and actions related to safeguarding patientinformation. Conduct security risk analysis. A security risk analysis – or a reassessment, if you'vealready done one – compares your current security measures towhat is legally and pragmatically required to safeguard personalhealth information, and identifies high priority threats andvulnerabilities. Develop an action plan. Using your risk analysis results, discuss and develop an actionplan to mitigate the identified risks. The plan must have fivecomponents, the guide notes: administrative, physical, andtechnical safeguards; policies and procedures; and organizationalstandards. Manage and mitigate risks. Begin implementing your action plan. Develop written andup-to-date policies and procedures about how your practice protectspersonal health information. Do not lose sight of basic securitymeasures, some of which can be low-cost and highly effective. Prevent with education and training. To safeguard patient information, your workforce must know how toimplement your policies, procedures, and security audits, accordingto ONC. HIPAA covered providers must train their workforces(employees, volunteers, trainees, and contractors) on your policiesand procedures. Staffs must receive formal training on breachnotification. Communicate with patients. Your patients may be concerned about confidentiality and securityof their health information in an EHR, the guide points out.Emphasize the benefits of EHRs to them as patients, perhaps usingconsumer education handouts that others have developed, andreassure them that you have a system to proactively protect theirhealth information. Update business associate agreements. Ensure your business associate agreements require compliance withHIPAA and HITECH breach notification requirements. This will require your businessassociates to safeguard protected health information they get fromyour practice, train their workforce, and adhere to breachnotification requirements. Attest for the security risk analysis meaningful use objective. Only apply for an EHR incentive program once you'd fulfilled thesecurity risk analysis requirement and have documented yourefforts, the ONC guide emphasizes, pointing out that when youattest to meaningful use, it is a legal statement that you have metspecific standards, including that you protect electronic healthinformation. Participants in the EHR Incentive Program can beaudited. [See also: Risk assessments leave hospitals hamstrung .] Beyond HIPAA and HITECH, "ensuring privacy and security ofhealth information, including information in electronic healthrecords, is a key component to building the trust required torealize the potential benefits of electronic health information exchange ," the ONC guide notes. "If individuals and otherparticipants in a network lack trust in electronic exchange ofinformation due to perceived or actual risks to electronic healthinformation or the accuracy and completeness of such information,it may affect their willingness to disclose necessary healthinformation and could have life-threatening consequences." Access the ONC Guide to Privacy and Security of Health Information here . I am an expert from multitouchscreenmonitor.com, while we provides the quality product, such as Wireless Stereo Speakers , Electronic Interactive Whiteboard, Electronic Interactive Whiteboard,and more.
Related Articles -
Wireless Stereo Speakers, Electronic Interactive Whiteboard,
|
