1
HIPAA Compliance Recommendation Plan and Compliance Training
Southern New Hampshire University
HIM-440: Management of Health Information Services
July 25,2022
2
HIPAA Compliance and Training in Gateway Healthcare Systems
The Gateway Healthcare Systems will be formed through the merger of St. Catherine’s
Medical Center, St. Luke’s Hospital, and Hickman Community Hospital. However, the
preliminary evaluation of the healthcare facilities has revealed that there exist several gaps in
terms of compliance with necessary regulations and guidelines. The HIPAA compliance issues
have been identified so that a suitable working group can be formed that can help in addressing
gaps and ensure that proper training is offered to the staff members.
HIPAA Issue
In each of the three hospitals there exist HIPAA issues that could affect Gateway
Healthcare Systems and its functioning. A key HIPAA issue that exists in St. Catherine’s
Medical Center is the inappropriate discarding of patient information which could compromise
their privacy and lead to their identification. This practice can violate patients’ right as there is a
lack of safekeeping of their personal health information (PHI) (Ramjist et al., 2018).
Additionally, electronic devices like personal computers are not safely handled by the staff. In St.
Luke’s Hospital, two nurses were seen openly discussing a patient’s prognosis. Furthermore,
there was no systematic procedure to store and manage patient health information in the facility.
In the Hickman Community Hospital, the patients were kept waiting while the staff was leisurely
spending their time in the facility. The staff was also seen discussing every patient’s diagnosis,
prognosis and medical treatment. Such instances show that HIPAA privacy rules are not
followed in the three hospitals.
Form a Team
A team must be formed by involving the stakeholders who can help in addressing the HIPAA
issues. Some of the stakeholders who must be included are a compliance officer, staff from the
3
Health Information Management (HIM) department, the hospital board, a Chief Information
Officer (CIO) and other staff members including doctors and nurses. The HIM staff would add
value to the team since it would have prior insight into HIPAA guidelines and requirements. The
compliance officer would ensure that there is proper compliance with the latest HIPAA rules and
guidelines and that the fundamental rights of patients are not violated. The CIO will ensure
technology is appropriately used to ensure the safe handling of PHI. The involvement of other
staff is crucial so that they will be updated on the HIPAA requirements and carry out their
responsibilities accordingly.
Policies and Procedures
A number of new policies and procedures need to be implemented in order to address the
identified compliance issues. A new policy must be introduced making it mandatory for all the
employees to securely lock their devices when they are not being used. The PHI must be
concealed and at times and the physicians, nurses and other staff members must be prohibited
from openly discussing the health status of patients. A systematic disposal method must be
adopted while discarding patient information since it may contain confidential and sensitive
details. Paper-based records must be shredded using a shredding machine. Additionally, the staff
would be offered frequent IT-based training to securely use digital technologies while handling
PHI. Such training can enhance patient safety in the online setting (Konstantinidis et al., 2021).
c
Workflow Process
An integrated workflow analysis must be carried out to ensure that suitable tasks,
processes and protocols are in place that can help in addressing the existing compliance issues.
As per the current HIM department workflow process that is adopted in St. Luke’s Hospital, the
productivity of the processes is low. On an average, a coder is able to manage 2 inpatient charts
4
and 10 outpatient charts in an hour. However, as per the productivity standards, 4 inpatient charts
must be handled in an hour in addition to the outpatient charts. For making improvement in the
area, the coding quality must be enhanced from 95 % to 100 %. In the current workflow process
of St. Luke’s, the current disposal must be changed, and the records must be shredded instead of
being thrown in the regular trash can.
Cultural Diversity
For addressing the current cultural diversity issues that exist in the healthcare facilities, it
is vital to educate the staff about its importance. A culturally diverse workforce must be
established that can possess the necessary skills, expertise and knowledge to meet the needs of a
diverse population (Konstantinidis et al., 2021). the case scenario, the staff must be given training
on cultural diversity so that they can cooperate with one another and work cohesively to enhance
the quality-of-care solutions. Necessary training can give an opportunity to the staff to enhance
their cultural intelligence and awareness and be respectful towards others in the delicate and
dynamic healthcare environment. Cultural diversity training is imperative to develop the cultural
competence of the staff of Gateway Healthcare Systems (Nair & Adetayo, 2019).
Compliance
Adequate and appropriate training opportunities must be offered to the existing healthcare
staff so that the identified compliance issues can be effectively addressed. Currently, the staff
lacks insight on how to handle PHI in terms of how to use it securely and discard it in an
appropriate manner. The training must focus on PHI so that the HIM staff can handle the
sensitive information in a cautious and secure manner without compromising patient
confidentiality and privacy. The staff must also be made aware of adopting appropriate
disposable mechanisms such as shredding, pulping, burning, etc. According to HIPAA Privacy
5
Rule, relevant administrative, physical, and technical safeguards must be in place to ensure the
safety of PHI (Herold & Beaver, 2003). The training must also focus on educating the staff on
how to communicate about PHI without risking the privacy of the patients such as by using EHR
or other online software.
Project Management Tool
An appropriate professional development plan has been created with the help of a project
management tool to ensure that timely training is offered to the staff relating to cultural diversity
and compliance issues. Gantt Chart has been chosen as the suitable tool to devise the plan. A
Gantt Chart is a useful project management tool that highlights the activities or tasks that will be
conducted while working on a project. It helps in identifying various activities that need to be
done, the starting and ending date of each activity, the approximate duration of the activity and
the beginning and ending date of the entire project. The specific project management instrument
has been chosen to plan and schedule the training of the staff. c
GANTT CHART
Activities
Week
1
Week
2
Week
3
Week
4
Week
5
Week
6
Week
7
Identification of gaps
Assessing detailed training needs
Engaging with the staff about their
challenges relating to compliance and
cultural diversity areas
Making arrangement – Training staff and
other resources
Conducting training session on compliance
issues
Conducting training session on cultural
diversity issues
Comprehensive training session
Outline a Plan
6
A plan has been outlined for evaluating the success of the training so that the cultural
diversity, and training needs of the staff can be met. For evaluating the effectiveness of training
in terms of cultural diversity, the staff retention rate must be monitored. Additionally, the diverse
attributes of the staff must be checked relating to their culture, gender, age, religion and race. The
new hires from diverse cultural backgrounds must be identified. An employee survey can be
conducted to take feedback of the staff relating to their satisfaction with the diverse and inclusive
workplace setting. A detailed evaluation must be done to ascertain whether the training has
fulfilled the exact needs of the staff relating to HIPAA rules, guidelines, and regulations or not.
The evaluation can be done by using an anonymous survey instrument or by conducting an open
‘Question and Answer’ session. Such kind of engagement can help to get an insight into staff
about the training initiative in the healthcare setting. c
Change Management Strategies
A number of change management strategies can be introduced to establish a workplace
environment that is adaptable to change. One of the key strategies involves communicating with
the staff about the need for compliance with HIPAA rules. It will create a sense of urgency and
responsibility in them. The leaders must play a proactive role to obtain the buy-in of the staff to
be a part of the change process. The staff must be motivated to adapt in the new setting. They
must be given training so that their productivity can improve. Kotter’s change model can be
adopted so that change can be introduced systematically in the facility (Gupta, 2011).
Conclusion
Proper compliance to HIPAA rules and cultural diversity can act as the cornerstones of Gateway
Healthcare Systems. For the successful merger of the three facilities, proper training must be
7
offered to the staff so that they can focus on compliance and diversity aspects. It can positively
influence the performance of the merged healthcare entity. c
8
References
Gupta, P. (2011). Leading innovation change-The Kotter way. International Journal of
Innovation Science.
Herold, R., & Beaver, K. (2003). The practical guide to HIPAA privacy and security compliance.
CRC Press.
Konstantinidis, S., Leonardini, L., Stura, C., Richter, P., Tessari, P., Winters, M., ... & Wharrad,
H. (2021, September). Digital Soft Skills of Healthcare Workforce–Identification,
Prioritization and Digital Training. In International Conference on Interactive
Collaborative Learning (pp. 1118-1129). Springer, Cham.
Nair, L., & Adetayo, O. A. (2019). Cultural competence and ethnic diversity in healthcare.
Plastic and Reconstructive Surgery Global Open, 7(5).
Ramjist, J. K., Coburn, N., Urbach, D. R., Govindarajan, A., Armstrong, K. A., Scott, A. L., &
Baxter, N. N. (2018). Disposal of paper records containing personal information in
hospitals. JAMA, 319(11), 1162-1163.
