Electronic Health Reporter

Maintaining the security of a practice’s EHR data is probably one of the biggest reasons physicians decide to implement one in the first place. With all of the reported benefits of electronic health records or their paper counterparts, the information kept guarded in your electronic system clearly is more secure, in most cases, than paper.

In addition to being able to securely protect your clinic’s data and patient information, there’s a clear advantage the EHR offers over paper records in that you are able to monitor, track and audit everyone who has ever accessed certain data and viewed specific records within your system.

This feature is especially valuable when you need to track employees who you think may be trying to gain access to information they should not have access to, as was the case recently when a Florida Hospital Celebration Health employee illegally accessed the personal data of multiple patients. According to American Medical News, fortunately for the hospital, through its EHR it employed a tool known at role based access control, or RBAC.

With RBAC in place, an organization is able to allow system users access to only the information employees need to perform their jobs. Obviously, role based access control systems can be used in any business setting where leadership determines certain information must be protected, as is the case in healthcare and hospital setting where HIPAA is concerned.

What seems to pique my curiosity the most, though, is just how much data snooping occurs in healthcare settings. I’ve often wondered how much of my personal information, like my social security number, birthday and home address are exposed to people who really have no business seeing it, and if it’s seen by an inappropriate person, is anything done about it.

As we know, patients worry that their personal health information might not be kept private and secure if stored electronically, and we’re especially concerned about who will have access to our records. There’s nothing truly valuable in the health record other than that which can be used for financial fraud, like social security numbers and my home address

So, to most fully protect the data included in the record, practices should take whatever precautions needed to protect the data captured in the electronic health record.

The process of protecting my data really begins during the selection and implementation of your EHR, and, according to the New York Department of Health and Mental Hygiene, you should chose a system that has the following security features:

Role-based access control

As stated above, this allows you to define access privileges of each staff person and ensures that only authorized providers can see patients’ health information. Administrative staff should be restricted to basic information such as address, date of birth and other demographic information.

Practice leadership should be the only people who are responsible for establishing the access privileges of staff members.

Audit trails

Audit trails track activities within the EHRs. Documented events in an audit trail include a staff member logging in or out of the system, opening, modifying, creating or deleting a record, scheduling a patient, signing a chart, querying the system or printing personal ealth information.

Audit trails also document the date and time of an event, where the event occurred and who performed the event. Again, only authorized administrators should have access to read these records. No one, not even the office administrator, should be able to modify or delete audit trails.

Password protection

EHRs must require a password to access the system. EHRs should be able to support additional passwords or identifiers for each user. The practice administrator should be able to define the rules for password complexity and expiration, like the practice may require all users to have passwords with five letters and at least one number, and that staff members change their password every three months.

The system must automatically log out a staff member if they forget to log out or leave the screen inactive for a period of time. The system must also require the user to enter his password to get back into the system. If someone repeatedly tries to enter the wrong password, the system should lock the user out. This keeps people from guessing other users’ passwords.

Data encryption

EHRs should encrypt patient data, which helps to protect data if hardware is stolen or messages are intercepted.

Consent

EHRs should have the ability to print, store and display patient consent forms.

All in all, pretty standard information, especially if the EHR you operate performs to industry standards. If you feel the need to contract with an outside vendor for such services, they do exist, are relatively inexpensive and are experts in managing audits and ensuring your data is safe.

Ensure these steps, though, and create and audit schedule so your information and mine remain safe.