HCA 417 Electronic Health Record Health Care Only

vroins

chapter_10_part_2.pdf

Home >Information Systems homework help >HCA 417 Electronic Health Record Health Care Only

ELECTRONIC HEALTH RECORDS Understanding and Using Computerized Medical Records

CHAPTER LESSON

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Privacy and Security of Health Records

CHAPTER TEN TWO

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

HIPAA Security Rule

• Security Rule covers only electronic information.

• Security Rule covers all PHI that is stored electronically called EPHI.

• CMS enforces the Security Rule.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Why a Security Rule?

• Before HIPAA, no set of security standards or requirements for protecting health information existed in healthcare industry.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Why a Security Rule?

• HIPAA developed for two primary purposes. – Implementation of security safeguards

protects electronic healthcare information that may be at risk.

– Protecting individual's health information promotes use of electronic health information.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Privacy Rule and Security Rule Compared

• Electronic Versus Oral and Paper – Privacy Rule applies to all forms of patients'

protected health information, whether electronic, written, or oral.

– Security Rule covers only protected health information in electronic form; includes EPHI that is created, received, maintained, or transmitted.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Privacy Rule and Security Rule Compared

• “Safeguard” Requirement in Privacy Rule – Privacy Rule contains provisions that require

covered entities to adopt certain safeguards for PHI.

– Security Rule provides for far more comprehensive security requirements; includes level of detail not provided in Privacy Rule section.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Privacy Rule and Security Rule Compared

• Security Standards – Administrative safeguards: administrative

functions that should be implemented to meet security standards.

– Physical safeguards: mechanisms required to protect electronic systems, equipment and data they hold, from threats, environmental hazards and unauthorized intrusion.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Privacy Rule and Security Rule Compared

• Security Standards (cont.) – Technical safeguards: automated processes

used to protect data and control access to data.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Implementation Specifications

• Implementation specification: additional detailed instruction for implementing a particular standard.

• Implementation specifications in Security Rule are either “Required” or “Addressable.”

• See Figure 10-5: HIPAA Security Standards Matrix.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Implementation Specifications

Figure 10-5: HIPAA Security Standards Matrix.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Implementation Specifications

Figure 10-5 (cont.): HIPAA Security Standards Matrix.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Implementation Specifications

Figure 10-5 (cont.): HIPAA Security Standards Matrix.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Implementation Specifications

Figure 10-5 (cont.): HIPAA Security Standards Matrix.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Privacy Rule and Security Rule Compared

• Administrative Safeguards are policies, procedures, and actions to manage implementation and maintenance of security measures to protect EPHI.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Security Management Process

• Risk Analysis: identify potential security risks and determine how likely they are to occur and how serious they would be.

• Risk Management: make decisions about how to address security risks and vulnerabilities.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Security Management Process

• Sanction Policy: define for employees what the consequences of failing to comply with security policies and procedures are.

• Information System Activity Review: regularly review records such as audit logs, access reports, and security incident tracking reports.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Assigned Security Responsibility

• Security Rule requires one individual be designated security official.

• Security official has overall responsibility for security; specific security responsibilities may be assigned to other individuals.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Workforce Security

• Authorization or Supervision: process of determining whether a particular user (or computer system) has the right to carry out a certain activity.

• Workforce Clearance Procedure: ensure members of workforce with authorized access to EPHI receive appropriate clearances.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Workforce Security

• Termination Procedures: must be in place to remove access privileges when employee, contractor, or other individual previously entitled to access information no longer has these privileges.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Information Access Management

• Access Authorization: in Workforce Security standard, healthcare organization determines who has access.

• Access Establishment and Modification: once a covered entity has clearly defined who should get access to what EPHI and under what circumstances, it must consider how access is established and modified.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Information Access Management

• Isolating Healthcare Clearinghouse Functions: clearinghouse is a unique HIPAA-covered entity whose function is to translate nonstandard transactions into HIPAA standards.

• The rule requires isolation of clearinghouse computers from other systems in organization.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Security Awareness and Training

• Security awareness and training for all new and existing members of workforce is required. – Security Reminders – Protection from Malicious Software – Log-In Monitoring – Password Management

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Security Incident Procedures

• Security incident procedures: – Address how to identify security incidents. – Provide that incident be reported to

appropriate person or persons. • Response and Reporting: establish

adequate response and reporting procedures for these and other events.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Contingency Plan

• Data Backup Plan: important safeguard and required implementation specification.

• Disaster Recovery Plan: procedures to restore any loss of data.

• Emergency Mode Operation Plan: security processes to protect EPHI must be maintained.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Contingency Plan

• Testing and Revision Procedures: periodically test and revise contingency plans.

• Application and Data Criticality Analysis: analyze software applications that store, maintain, or transmit EPHI and determine how important each is to patient care or business needs.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Evaluation

• Ongoing evaluation of security measures is best way to ensure all EPHI is adequately protected.

• Periodically evaluate strategy and systems to ensure that security requirements continue to meet organization's operating environments.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Business Associate Contracts and Other Arrangements

• Written Contract or Other Arrangements – Covered entities should have a written

agreement with business associates ensuring security of EPHI.

– Government agencies that exchange EPHI should have a Memorandum of Understanding.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Physical Safeguards

• Security Rule defines physical safeguards as physical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Facility Access Controls

• Facility Access Controls: policies and procedures to limit physical access to electronic information systems and facility or facilities in which they are housed. – Access Control and Validation Procedures: to

determine which persons should have access to certain locations within facility based on their role or function.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Facility Access Controls

• Facility Access Controls (cont'd) – Contingency Operations: physical security

measures to be used in event of activation of contingency plans.

– Facility Security Plan: safeguards used to protect facility or facilities.

– Maintenance Records: document facility security repairs and modifications.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Workstation Use

• Specify proper functions to be performed by electronic computing devices.

• Applies to workforce members using off- site workstations that can access EPHI.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Workstation Security

• Workstation Security standard addresses how workstations are to be physically protected from unauthorized users.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Device and Media Controls

• Device and Media Controls: policies and procedures that govern receipt and removal of hardware and electronic media that contain EPHI, into and out of facility, and movement of these items within facility. – Disposal: make sure it is unusable or

inaccessible.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Device and Media Controls

• Device and Media Controls (cont.) – Media Reuse: EPHI must be removed before

media can be reused. – Accountability: when hardware and media

containing EPHI are moved, a record should be maintained of the move.

– Data Backup and Storage: protects availability of EPHI and is similar to Data Backup Plan for contingency plan.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Technical Safeguards

• Security Rule defines technical safeguards as technology and policy and procedures for its use that protect electronic protected health information and control access to it.

• Security Rule is technology neutral; healthcare organizations have flexibility to use any solutions that help them meet requirements of the rule.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Access Control

• Access Control standard outlines procedures for limiting access to only those persons or software programs that have been granted access rights by Information Access Management administrative standard. – Unique User Identification: provides a way to

identify specific user, typically by name or number.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Access Control

• Access Control (cont.) – Emergency Access Procedure: documented

instructions and operational practices for obtaining access to necessary EPHI during an emergency situation.

– Automatic Logoff: way to prevent unauthorized users from accessing EPHI on a workstation when it is left unattended for a period of time.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Access Control

• Access Control (cont.) – Encryption is a method of converting regular

text into code. – Original message is encrypted by means of

mathematical formula called an algorithm. – Receiving party uses a key to convert

(decrypt) coded message back into plain text.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Audit Controls

• Audit Controls: hardware, software, and/or procedural mechanisms that record and examine activity in information systems.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Integrity

• Protecting the integrity of EPHI is a primary goal of Security Rule.

• Mechanism to Authenticate Electronic Protected Health Information: once risks to the integrity of EPHI data have been identified during risk analysis, security measures are put in place to reduce the risks.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Person or Entity Authentication

• Requires procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed. – Require something known only to that

individual (password or PIN). – Require something that individuals possess

(smart card, token, key). – Require something unique to individual

(biometric).

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Transmission Security

• Transmission Security procedures are measures used to guard against unauthorized access to electronic protected health information that is being transmitted. – Integrity Controls: focused on making sure

EPHI is not improperly modified during transmission; transmitted through use of network communications protocols.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Transmission Security

• Transmission Security (cont.) – Encryption is a method of converting an

original message of regular text into encoded or unreadable text that is ecrypted into plain comprehensible text.

– Encryption is necessary for transmitting EPHI over the Internet.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Organizational Requirements

• Business Associate Contracts: used if

business associate creates, receives, maintains, or transmits EPHI; must meet Security Rule requirements.

• Other Arrangements: implementation specifications apply when both parties are government entities.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Policies and Procedures

• Security Rule does not define either “policy” or “procedure.”

• Policies define organization's approach. • Procedures describe how organization

carries out that approach, setting forth explicit, step-by-step instructions that implement organization's policies.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Documentation

• Time Limit: retain documentation required by rule for 6 years from date of its creation or date when it last was in effect, whichever is later.

• Availability: make documentation available to those persons responsible for implementing procedures to which documentation pertains.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Documentation

• Updates: review documentation periodically, update as needed, in response to environmental or operational changes affecting security of electronic protected health information.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Breach Notification Requirements

• Breach: defined as impermissible use or disclosure under Privacy Rule that compromises security or privacy of PHI such that use or disclosure poses significant risk of financial, reputation, or other harm to affected individual.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Breach Notification Requirements

• Three exceptions to breach: – Unintentional acquisition, access, or use of

PHI by employee of covered entity or business associate.

– Inadvertent disclosure of PHI from authorized person to another authorized person at covered entity or business associate.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Breach Notification Requirements

• Three exceptions to breach (cont.): – If covered entity or business associate has

good faith belief that unauthorized individual, to whom impermissible disclosure was made, would not have been able to retain information.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Individual Notice

• Covered entities must provide affected individuals written notice by first-class mail or by e-mail if affected individual has agreed to receive such notices electronically.

• Must be provided without unreasonable delay.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Media Notice

• Covered entities that experience a breach affecting more than 500 residents of a State or jurisdiction are required to provide notice to prominent media outlets serving State or jurisdiction.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Notice to the Secretary

• Covered entities must notify the Secretary of Health and Human Services of breaches of unsecured PHI.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Notification by a Business Associate

• If a breach of unsecured PHI occurs at or by a business associate, the business associate must notify covered entity following discovery of the breach.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Electronic Signatures for Health Records

• HIPAA does not yet require use of electronic signatures, because HIPAA does not yet have a Rule for Electronic Signature standards.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

What Is an Electronic Signature and What Is Not?

• An electronic signature is not a scanned image of someone's paper signature.

• Message Integrity: recipient must be able to confirm that the document has not been altered since it was signed.

• Nonrepudiation: signer must not be able to deny signing the document.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

What Is an Electronic Signature and What Is Not?

• User Authentication: recipient must be able to confirm that signature was in fact “signed” by the real person.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

What Is an Electronic Signature and What Is Not?

Figure 10-11: Scanned document with image of signature.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

What Is an Electronic Signature and What Is Not?

Figure 10-12: Electronically signed document with a PKI signature.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

How Digital Signatures Work

• Digital signatures use a branch of mathematics called cryptography and PKI (Public Key Infrastructure).

• Each PKI user has two “keys:” private key for signing documents; public key for verifying his or her signature.

• Public key maintained by certificate authority.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

How Digital Signatures Work

• Certificate authority: trusted third party who has validated your identity and issued certificate.

• Certificate: electronic record of your public key, which has been digitally signed by certificate authority.

• See Figure 10-13: How a digital signature works.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

What Is an Electronic Signature and What Is Not?

Figure 10-13: How a digital signature works.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

How Digital Signatures Work

• Computer software program performs mathematical calculation on entire contents of electronic document to be signed.

• Result is a unique code (message digest). • This code encrypted using your “private”

key.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

How Digital Signatures Work

• Validation process uses same algorithm as original program to produce message digest of text of document.

• Public key retrieved from public directory or certificate authority.

• Signature verification process decodes digital signature using your public key and compares it to message digest.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Some EHR Signatures Are Not True Electronic Signatures

• Many systems have a process to “sign” their records with PIN, password, or even fingerprint.

• Software simply sets a field in database indicating provider “signed” the record.

• This is adequate to particular EHR system, but it would not meet criteria of electronic signature.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Some EHR Signatures Are Not True Electronic Signatures

• Always log on to the EHR as yourself. • Always log off when you are through. • Always keep your passwords or PIN

numbers private.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

The Future of Electronic Signatures

• The Joint Commission (JCAHO) accepts use of electronic signatures in hospital, ambulatory care, home care, long-term care, mental health settings.

• CMS permits authentication of medical records by computer key but does not specify methods.

• State laws vary on electronic signatures for medical records.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Critical Thinking Exercise 62: Your Electronic Signature

• What is the legal status of the electronic signature in the EHR in your state?

• How can you protect your own electronic signature?

• Identify potential impacts of a failure to log off or exit from the patient record.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

HIPAA Privacy, Security, and You

• Follow privacy policy and security rules at your place of work.

• Know who privacy and security officials are.

• Do not to give others your password.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

HIPAA Privacy, Security, and You

• Always log out of medical records computer when you are not using it.

• Remember to treat every medical record (paper or electronic) in confidential manner.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Health Insurance Portability and Accountability Act (HIPAA) passed in 1996. – Transactions and code sets – Uniform identifiers – Privacy – Security

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• HIPAA regulates health plans, clearinghouses, and healthcare providers as covered entities or covered entity.

• HIPAA standardized formats for EDI or Electronic Data Interchange by requiring specific Transaction Standards.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• HIPAA established uniform identifier standards. – National provider identifier – Federal employer identification number – National health plan identifier

• PHI (Protected Health Information) • EPHI (Protected Health Information in an

Electronic Format)

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• HIPAA privacy standards designed to protect patient's identifiable health information from unauthorized disclosure or use in any form.

• Practice can use PHI for almost anything related to treating patient, running medical practice, and getting paid for services.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Authorization differs from consent in that it does require patient's permission to disclose PHI.

• Whether practice has disclosed PHI based on signed authorization or to comply with government agency, patient is entitled to know about it.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Privacy Rule allows covered providers and health plans to disclose protected health information to business associates.

• Congress provided civil and criminal penalties for covered entities that misuse personal health information.

• Security Rule sets standards for ensuring that only those who should have access to EPHI actually will have access.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Privacy Rule applies to all forms of patients' protected health information, whether electronic, written, or oral.

• Security Rule covers only protected health information that is in electronic form.

• Security standards designed to be technology neutral.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Security standards divided into categories of administrative, physical, technical safeguards.

• Breach Notification Requirements require covered entities to notify affected individuals, Secretary of Health and Human Services, and in certain circumstances media.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• HIPAA does not require use of electronic signatures.

• Valid electronic signature criteria: – Message Integrity – Nonrepudiation – User Authentication

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Chapter Summary

• Digital signatures cryptography and PKI (Public Key Infrastructure).

• Each PKI user has two “keys:” private key for signing documents; public key for verifying his or her signature.

Slide Number 1
HIPAA Security Rule
Why a Security Rule?
Why a Security Rule?
The Privacy Rule and Security Rule Compared
The Privacy Rule and Security Rule Compared
The Privacy Rule and Security Rule Compared
The Privacy Rule and Security Rule Compared
Implementation Specifications
Implementation Specifications
Implementation Specifications
Implementation Specifications
Implementation Specifications
The Privacy Rule and Security Rule Compared
Security Management Process
Security Management Process
Assigned Security Responsibility
Workforce Security
Workforce Security
Information Access Management
Information Access Management
Security Awareness and Training
Security Incident Procedures
Contingency Plan
Contingency Plan
Evaluation
Business Associate Contracts �and Other Arrangements
Physical Safeguards
Facility Access Controls
Facility Access Controls
Workstation Use
Workstation Security
Device and Media Controls
Device and Media Controls
Technical Safeguards
Access Control
Access Control
Access Control
Audit Controls
Integrity
Person or Entity Authentication
Transmission Security
Transmission Security
�Organizational Requirements�
Policies and Procedures
Documentation
Documentation
Breach Notification Requirements
Breach Notification Requirements
Breach Notification Requirements
Individual Notice
Media Notice
Notice to the Secretary
Notification by a Business Associate
Electronic Signatures for Health Records
What Is an Electronic Signature and What Is Not?
What Is an Electronic Signature and What Is Not?
What Is an Electronic Signature and What Is Not?
What Is an Electronic Signature and What Is Not?
How Digital Signatures Work
How Digital Signatures Work
What Is an Electronic Signature and What Is Not?
How Digital Signatures Work
How Digital Signatures Work
Some EHR Signatures Are Not True Electronic Signatures
Some EHR Signatures Are Not True Electronic Signatures
The Future of Electronic Signatures
Critical Thinking Exercise 62: �Your Electronic Signature
HIPAA Privacy, Security, and You
HIPAA Privacy, Security, and You
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary
Chapter Summary