Electronic Health Reporter

By Ken Lynch, founder and CEO, Reciprocity Labs.

Any healthcare facility that wants to keep its customers happy must have patient portals. It is easy to create these portals, but keeping the data safe from hackers can be tough. In the US, at least half of the healthcare consumers are using patient portals. About 80 percent of these patients have expressed their satisfaction with the level of ownership they have with their health data and the convenience of its accessibility.

Because of the security issues involved, the Affordable Care Act and meaningful use regulations have worked towards incentivizing the healthcare industry to make health records digital and more accessible to the patients. The portal allows patients to manage their personal details including medication lists and lab test results as well as financial information.  This is enough data to set a patient up to hackers. Because the use of patient portal will keep rising, the risk will only get bigger, which means a better approach towards protecting this information needs to be realized.

How to Stay Compliant

The 1996 Health Insurance Portability and Accountability Act (HIPAA) highlighted the protection of the rights of patients. It compels health providers to keep customer data confidential. HIPAA also introduces a measure of safety and imposes precise compliance standards. Breaches carry hefty penalties. Here are a few tactics to help you keep customer data safe:

1. Foster Security Mindset in Your Organization

Protected health information (PHI) according to HIPAA means more than just electronic records. Whether you are speaking on the phone or working on a physical file, the principles apply. Regulatory compliance in healthcare organizations means that every health facility must store customer data securely. The most ideal tool is remote access software. This software does not restrict a user to approved databases and desktop logins.

2. Focus on the People and Not Just the Data

EHRs- electronic health records can only be kept private when only the people permitted to see them are allowed to access. That means giving access to involved parties such as the lab, doctor, and the insurance provider. Breaches and lapses occur when too many people are involved. This is why categorizing them by persona is essential. If, for instance, the patient is at a critical condition, different labs may be involved. It is, therefore, crucial to customize the profile for each user.

3. Give Patients Full Access to Their Records

Patients want to be sure their personal data is stored safely and securely. This is why healthcare providers need to allow patients to view their medical records. Some patients download and send the details to a third party, which is inherently insecure. Instead of giving the data to patients in different copies, it is crucial that the EHR be stored in one database. Because the idea is to have the data accessed remotely, a single EHR version can be shared by different devices.

Compliance and Risk Assessment

The duty of a HIPAA security officer is to uphold the policies and the procedures of HIPAA. They may document activities and assess risk and compliance to determine the safety of a facility’s computer system. If you already have a HIPAA compliant network infrastructure, enlist an independent team to carry out an audit as well as risk assessment each year. Because technology is evolving at a high pace, be sure you are constantly using HIPAA compliant technology.

Ensure also that your employees are not compromising sensitive data. An employee can also foil the most standard firewall if they accidentally open a link containing ransomware on email. Ransomware is malware that holds your patient data hostage to be released once you have paid a ransom.

Your employees should be educated on the requirements of HIPAA network to prevent security breaches. The data security officer should also highlight how different roles will have varying access. For instance, a doctor may have more access to patient data than a nurse. The training should be carried out annually to remind employees about the requirements of compliance.

Compliance Enforcement

Violations to HIPAA compliance carry substantial fines. The US Department of Health and Human Services (HHS) delegates enforcement to the Officer for Civil Rights (OCR). Should you fail to comply with HIPAA, this body will find and penalize you. The enforcement of OCR includes:

• The investigation of complaints filed
• Compliance reviews of individuals responsible for protecting the health data
• Education, resources, and outreach

It means that systems must be put into place to verify the people requesting to view the information are either the patient, the healthcare provider, the legal representative, or any other authorized body.

The purpose of HIPAA compliance is to keep patient data secure and confidential. All healthcare data, including physical addresses and social security data, is protected. Every electronic device according to the rule of compliance must be protected to ensure that unauthorized users do not access the system.