- Image by purpleslog via Flickr
By Mary Mosquera
Last yearâs HITECH Act toughened the rules and enforcement penalties health information handlers must follow to protect patient privacy.
Under the new policy regime, providers will have to pay more attention to the confidentiality and safety of patient information as they move more of their operations toward electronic health record-keeping.
Without sound security policies and practices, privacy âwill be just a principle,â said Sue McAndrew, deputy director for privacy in the Office of Civil Rights, the Health and Human Services Department office that was given responsibility for health privacy and security policy under the new law.
OCR-draft-guidelines-for-security-risk-analysis
âWe want it to be a reality for consumers,â she said at a recent privacy and security conference sponsored by OCR and the National Institute for Standards and Technology.
One of the most basic requirements is that providers must now perform a security assessment, a first step in understanding systems and electronic data over which they are temporary stewards.
OCR recently drafted guidance to help providers and payers figure out what is expected of them in doing a risk assessment. While it might sound onerous, a risk assessment might not be as difficult or costly as some providers might believe, even for small practices, privacy.
âWhen you say, âdo a security risk assessmentâ, peopleâs eyes glaze over,â said Lisa Gallagher, security director of privacy and security for the Healthcare Information and Management Systems Society. âBut really, itâs asking, âwhat are the risk areas?â, âhow could someone get to it?â and âwhat controls can you put in place to protect it.ââ
In its guidance, OCR said organizations should identify and categorize their data collections, document threats to information that might lead to a disclosure of protected data and check to see if their current security measures are adequate.
âFor a small organization, it sounds overwhelming and time-consuming, but in a lot of ways, itâs things that they already do,â said Pat Toth, a computer scientist in NISTâs computer security division.
âWhat small providers need to do is get an understanding of the framework and break down each step,â she said. âIt is something thatâs going to be living in their organization, so if they do their categorization and get that right, it will set the correct tone for the rest of the process.â
NIST has developed a quick-start guide, a âCliffâs Notesâ of its security publications detailing its risk management framework and risk assessment, in addition to frequently asked questions, to help providers, especially small practices.
For large organizations, risk management starts in the planning and architecture of systems across the enterprise and system life cycle, Toth said.
Besides a risk assessment, OCR is planning stricter reporting of disclosures of health information when electronic health records are used, even when the disclosure is for treatment and billing purposes. Providers will also have to give the reason for the disclosure. In May, OCR published a request for comments on its rulemaking.
The most effective method of accounting for disclosures is by using automated logging features in electronic health records and other computer systems, according to Mac McMillan, chief executive officer of Cynergistek Inc., an IT security consulting firm.
System logs are used to document and maintain a permanent record of all authorized and unauthorized access to and disclosure of confidential information so providers can recover evidence of that access.
âA lot of the difficulty to get accounting of disclosures in place is because of a lack of industry auditing capabilities,â he said at the OCR and NIST conference. âMost systems donât have the functionality.â Moreover, IT security folks he works with have logging activated, âbut they are still manually digesting them,â McMillan said, adding that manual audits are a time-consuming and imprecise process.
Even so, such practices must now be the order of the day under the new privacy and security framework. âThe security rule says wherever you have electronic health information, you need to protect it,â said HIMSSâs Gallagher. âYou may not even apply for meaningful use incentives. But if youâre keeping data in electronic form, you have to comply with the security rule.â
Related articles
hitech-act-increases-hipaa-security-requirements
healthcare-organizations-may-not-be-prepared-for-hitech-and-other-security-challenges
Related articles by Zemanta
- NIST Releases Revised Assesment Guide Targeting Federal Information Security Controls (infosecurity.us)
- OCR draft guidelines for security risk analysis (deurainfosec.com)
- Ben Rothke – Effective Data Destruction Practices (slideshare.net)
- HHS publishes new guidance on conducting risk analysis (securityarchitecture.com)
