·
Are breaches limited to only protected health
information (PHI) that is electronic form?
Response: No, breaches
can occur when unsecured PHI, in any form or medium, is accessed by an
unauthorized person.
·
The doctor dictated the patient’s phone number in the
Plan section of the report. Should the
MT transcribe it as dictated, flag it or ignore it?
Response: The first thing
you should do is review the facility’s policy for use of personal identifying
elements (such as the patient’s phone number) within the body of the
report. Facilities vary greatly as to
their ‘rule’ or ‘policy’ for how this should be done. If you are unsure as to
how to handle this, flag the report or contact your supervisor, whatever is the
policy that you follow for when you have questions related to a report. Many
believe that HIPAA does not allow these personal identifying elements within
the body of the report; however, this is not true. The report is protected
health information because it has to include patient demographic information in
order to be attached to or uploaded in the correct patient chart. We often
forget about this because we seldom see the viewable “final” report; we just
see the sections that we are involved with, such as the body of the report
being transcribed or edited. So the healthcare report is already protected
under HIPAA, the inclusion or exclusion of the patient’s identifying elements within
the report does not make the report more protected or less protected in the
eyes of HIPAA.
Healthcare
organizations constantly struggle with this issue when establishing a policy
related to allowing PHI elements within the body of the report or to restrict
the personal identifying elements only to the demographic section of the
report. There are pros and cons on both sides of this issue. As just one example, the report that has
limited the PHI elements only in the demographic sections can be easily
‘scrubbed’ of all PHI elements if that report would ever need to be
de-identified in the future. Complete and thorough de-identification, however,
becomes a very labor-intense and cumbersome process when PHI elements are
allowed within the body of the report.
The healthcare organization must weigh all of the pros and cons when
establishing their policy for the use of personal identifying elements within healthcare
reports.
·
Can an intern or a nurse practitioner share the same
dictation ID number with their attending physician?
Response: No. Critical to the transcribed report is the proper
identification of the author of the dictation.
An assigned number for each individual dictator provides a level of
assurance that each report they dictate will be accurately matched to them for
authentication and for inclusion within the legal medical record. Technology provides the ability to assign
unique identifiers for dictators to facilitate their individual user
identification within the dictation process.
The HIPAA Security Rule has established requirements for technical
safeguards for electronic protected health information (ePHI) in section 164.304
of the Rule. Both Covered Entities and Business Associates must
follow the rules established in these technical safeguards. One of the required
safeguards is access control. Unique user identification is a requirement
established in the HIPAA Security Rule.
·
Can Business Associates be audited by HHS?
Response: Yes. Under the HITECH Act the provision for audits
was established for both Covered Entities and for Business Associates. HHS (Health and Human Services) contracted
with KPMG Associates to create a protocol for performing audits and to create
guidance tips from lessons learned from actual audits. Those audits were
performed late in 2011 and continued through 2012. Audits resumed in 2013 and
since that time Business Associates have been included in the audit program.
·
As an MT independent contractor, am I a Business
Associate to the MT service that I do work for?
Response: Yes. The HIPAA Final Rule in January 2013 made this
change. You are now a Subcontractor Business Associate to the MT service who is
a Business Associate to their clients who are Covered Entities. This was
changed so that all of those who receive the downstream handoff of PHI will share
the responsibilities and obligations of securing the PHI entrusted to them.
·
What is a common breach that has occurred within the medical
transcription?
Response: There is no real “data” specific to medical
transcription breaches, but from my experience it is from faxing unsecured
documents with PHI. The good news is that when this happens it is usually 1
report at a time; the bad news is that it happens far too often.
·
There are secure ways to deliver reports with PHI, so
why are faxes still being used?
Response: Again,
there is no real “data” as to why faxes are still being allowed to be used, but
it has been my experience that clients (i.e., hospitals, clinics, etc.) have
continued to request (require) fax delivery of reports to physician offices
despite the potential risks of breach associated. Often these physician offices
are not able to receive secure electronic delivery of their reports, so faxing
is the easiest way to accomplish report distribution (although not a secured
method).
·
Is all encryption software considered “acceptable” for
securing PHI?
Response: No. The definition of “secure” is established by
HHS and currently is 128-bit or 256-bit encryption algorithm that is in
compliance with standards established by NIST (www.nist.gov).
·
Does HIPAA now require encryption to be used?
Response: The short answer is ‘no’ it is not required; however,
if PHI was breached when unsecured per the guidelines established by HHS
(secured is appropriately encrypted), then all notification requirements for
that breach would need to be immediately implemented. When appropriate encryption of PHI is used,
if it was received by a wrong recipient it could not be accessed, read, or used
(because it was encrypted); therefore, it would not be considered a breach.
Although HIPAA does not require encryption, it is your best defense against a
breach.
·
Do reports that have been de-identified of PHI
elements need to be encrypted?
Response: No. Reports
that have been appropriately de-identified are no longer considered PHI, so
they do not require the same protections that documents that include PHI. De-identified reports and voice files have
many uses in our industry such as sample reports, training, and testing.
·
Are there specific rules for destroying documents with
PHI?
Response: Yes. Destruction of PHI needs to follow the guidelines
established by NIST in its publication (800-88) on media sanitation.
·
What type of shredder should I buy to destroy PHI?
Response: The
answer depends on the media that needs to be destroyed. The NIST publication 800-88 recommends using
a cross-cut shredded for paper and for microfilm to a size such that it is
reasonable to assure that the data cannot be reconstructed. Optical disks (CDs,
DVDs, etc.) need to be pulverized to the point that the residue is no larger
than a 25 mm squared surface area.
High-end shredders or commercial shredders can accomplish this.
·
As a medical transcription service, a Business
Associate, is our client (the Covered Entity) responsible for the HIPAA
training of our workforce?
Response:
No. There could be some circumstances, however,
where the client will want to train certain members of your workforce, such as
on software applications, but they are not responsible for training your
workforce on their obligations and responsibilities related to HIPAA.
· I am an employee of an MT service, if there is a
problem with privacy can I be personally liable?
Response: HHS has made it clear that individuals can be
criminally liable in some limited circumstances. Generally these are
individuals who have intentionally breached patient’s information for personal
gain or incidents of willful neglect. HIPAA
has become recognized as the standard of care for protected health information
and when it has not been followed some patients have filed civil suits for
privacy breaches of their information. With that said, as long as you are acting
within the scope of your duties and comply with all established P&Ps, your
personal risk would be greatly minimized.
·
As a
medical transcription service, a Business Associate, do I follow the FTC
security regulations or the HHS security regulations?
Response: Medical
transcription services would follow the HHS security regulations. The FTC (Federal Trade Commission) rules and
its security regulations would apply to PHR (personal health record) vendors.
· Do breach notification obligations apply if only one
patient’s information is breached?
Response: Yes.
The number of patients involved is only relevant to the type of notifications
required.
·
As an MT
service, a Business Associate, if we faxed a report in error to a local pizza
shop, do we notify the Covered Entity (our client)?
Response: You must
provide certain information to the client (the Covered Entity) from where the
report/dictation originated. You will
also need to investigate the breach and its cause, immediately mitigate
significant risk when possible, and fully document your findings as well as the
steps implemented to prevent future occurrences.
·
I bought a new computer; what should I do with the PHI
on my old computer?
Response: The easiest
way to accomplish this is to remove the hard drive from the old computer and
have it pulverized. Commercial shredding
companies offer this service.
· As
an MT service, a Business Associate, if we fax a report in error to the wrong
doctor’s office is that a breach?
Response: It depends. It is possible that these two organizations (your client
and the office that received the fax) may have what HIPAA calls an Organized
Health Care Arrangement (OHCA). If this is the case, then there is no breach because
they are allowed to share PHI between their facilities. Misdirected faxes that go to another covered
entity are often interpreted by HIPAA experts differently. Some consider it a
simple/minor disclosure (not a breach), while others take a stricter view
and label it as a full breach. Either way all experts do agree that it has to
be investigated, mitigated, and documented. The final decision of a simple
disclosure or a full breach is the client’s (the Covered Entity) decision to make
since they will know the relationship of all parties involved. Business
Associates need to fulfill their obligation by investigating it, mitigating
significant risk, implementing new safeguards for prevention, documenting and
reporting it to their client (the Covered Entity).
·
Is HIPAA training required for all of our
workforce members as well as our subcontractor business associates?
Response: Yes, all
members of your workforce and your subcontractor business associates who have
access to PHI need to receive HIPAA training.
· Is there any requirement for periodic retraining on HIPAA
privacy and security?
Response: HIPAA requires
updating the training when making changes to privacy and security policies
and/or processes. Most organizations offer periodic reminders and refreshers at
least on an annual basis for their workforce members and subcontractor business
associates to reinforce a culture of compliance.
