Overcome E-Health Record Security Challenge
Finding the technology to lock down e-health records is the easy part. Understanding all the requirements is where it gets hard. Here's what you need to be thinking about.
More Healthcare Insights
- Automating Hospital Workflows That Maximize Efficiency And Patient Satisfaction
- How Healthcare Payers are using Customer Communications to Improve Productivity and Effectiveness
White PapersMore >>
- Research: Accountable Care Organizations and Health IT
- Research: Healthcare IT 2012 Priorities Survey
Many large healthcare organizations have been securing electronic health records for years. But now, industrywide adoption will include providers of all shapes and sizes—most of which don't have chief security officers, compliance specialists, CIOs, or even full-time IT staffs.
Helping them secure their electronic records is an unprecedented challenge. The products and technologies needed are available, but the trick is in getting all providers to understand what's required, prepare physicians and staff, and tap into the appropriate expertise.
The Health Insurance Portability And Accountability Act, or HIPAA, requires that EHRs and the data in them be guarded throughout their life cycles. Risk assessments must be performed and access privileges determined. You'll need policies to secure all possible points of data leakage, including desktops, servers, databases, mobile devices, and the Internet.
In short, you must protect data at rest and in motion, and prepare for the inevitable breaches.
Creation And Use
When a patient walks into a provider's office for the first time, the terminal at reception must be hardened, hosted on a trusted network, and continually scanned for viruses and malware. Receptionists should be able to add basic patient information but have limited access to executable files.
Access privileges should be assigned that strictly regulate employees' ability to view, enter, edit, and delete data based on what they need for their jobs. For example, billing personnel don't need to see the results of the medical tests that they're charging patients for.
Attending physicians should use unique credentials to access the EHR application to record diagnoses. E-medical records must be signed with electronic signatures, which include PIN codes and are saved in encrypted files. Signatures verify that information has been reviewed every time a physician signs off on an EHR. They also let the medical staff sign off on records from any location, expediting processing, reducing workflow costs, and maintaining HIPAA compliance.
InformationWeek has published an in-depth report on this year's Healthcare Information and Management Systems Society conference. This report offers the best healthcare IT advice, insight, and analysis coming out of that conference. Download the report here (registration required).