Dava Stewart

One of the requirements of the Health Insurance Portability and Accountability Act (HIPAA) is to name a security officer. In smaller practices, the position of security officer is often filled by whoever appears to have the time to fill it.

However, taking some time to consider the talents and skills of each staff member could mean the difference between having a security officer who is truly dedicated to getting the job done, and having one in name only, says Diane Robben, JD, of Sandberg Phoenix & von Gontard, in St. Louis, Missouri.

	HIPAA requires practices to name both a privacy officer and a security officer. The two roles do have some overlap, however, Robben suggests that having separate people fill them allows for checks and balances. 

	A significant difference in the two roles is that the security officer needs to be more focused on the  technology side of operations. The security officer needs to know whether or not physicians and staff members are accessing protected health information (PHI) from their phones or tablets, whether there is even a remote possibility of a laptop containing accessible PHI being lost or stolen, and where physical charts are located within the office.

	“The security officer has to understand all of that and then develop policies to help control PHI and to keep it safe,” Robben says.

	In smaller practices, staff members may lack technological know-how. Robben says that is not a terrible handicap, even for the security officer.

	“The security officer doesn’t have to have all the answers,” she says, “but they do need to be able to [identify] the issues,” and know when to ask for help.

	Having an outside firm come in to help audit security practices or to strengthen a firewall is reasonable and often necessary. Robben notes that in smaller practices, “often decisions are made on a financial basis,” and risks must be prioritized.

	Robben says a common question among small-to-medium sized practices is whether it is possible to outsource the role of HIPAA security officer. Robben strongly advises against having an IT company serve as the HIPAA security officer for a practice, as “you are not going to have the cultural shift within the organization without someone having the responsibility.”

	Rather than naming a staff member who will simply take responsibility for the role of security officer, practices should look for an individual who will seek out educational opportunities, read the latest HIPAA and technology news and look for chances to learn.

	“You want someone who is going to be proactively looking at the systems and the organization and who will take steps to tighten things down instead of waiting to react when something happens,” says Robben, “because something is going to happen.” 

	She offers the example of a stolen laptop, noting that if the security officer has done a good job, the practice is facing a rather small property loss and not an expensive and potentially embarrassing data breach with possible legal ramifications. 

Articles

In smaller practices, the position of security officer is often filled by whoever appears to have the time to fill it.

How to choose your HIPAA security officer

	The Joint Commission recently announced a change in stance on whether or not it is acceptable for clinicians to use text messaging to submit orders for patient care, treatment or services to a hospital or other healthcare facilities. As an independent, non-profit organization, The Joint Commission works to improve the quality of healthcare through well-recognized and respected certification and accreditation programs. In 2011, the Commission issued a frequently asked questions document, stating that sending orders via text was prohibited due to security concerns. Now, recognizing that technology has evolved, The Joint Commission revised its position, 

 that text messaging to convey orders is acceptable, within certain parameters.

	John Ferguson, an attorney with Husch Blackwell LLP, in Dallas, says one of the positive aspects of HIPAA âis that as strict as it can be, it does allow for flexibility in how it can be applied.â He says that this change in guidelines on text messaging is evidence of that flexibility, adding, âThey saw an advance in technology that mitigated the fears they hadâ about texting and security. Ferguson finds it encouraging when a government agency adjusts, because, he says, âItâs hard for the law to keep up with technology.â

	The change is not so radical that clinicians can simply begin using any SMS platform to send messages to anyone in a professional setting. Most people are comfortable with texting; however, certain security measures are necessary in order to protect patient information. The Joint Commission states clear guidelines for organizations implementing text messaging. Those guidelines include:

	â      A secure sign-on process

	â      Delivery and read receipts

	â      Customized message retention time frames

	â      A specified list of contacts who are authorized to receive and record orders

	Additionally, organizations are encouraged to set standard policies and procedures for text messaging. Those standards should incorporate both the Medication Management Standard, published by The Joint Commission and the guide by which most healthcare organizations manage the selection and administration of medications, as well as how text orders will be documented into patientsâ medical records. The agency is also assessing whether or not more guidance regarding the development of policies and procedures is necessary.

	Until The Joint Commission issues more details, the group suggests that any organization drafting policies and procedures develop a method to document the capabilities of the platform in use, clearly state when text messaging is appropriate, track how often text messaging is used to deliver orders, conduct internal audits to confirm compliance, assess risk and provide training for staff.

	Ferguson advises practices go over the provisions provided by The Joint Commission first. Then he suggests working with either an internal IT department or seeking help from a consultant, depending on the size of the organization and its financial capabilities, in order to cover all of the parameters of the new guidance. Once everyone understands the provisions, itâs simply a matter of choosing the best platform for the organization. âThen,â Ferguson says, âmake sure everyone is using it.â

	Getting everyone within a practice to actually use a secure text messaging platform may be more challenging than expected. People are used to texting, and often default to what they know how to do, particularly if the new platform is challenging or unintuitive. Ferguson suggests quarterly internal audits at first, along with heavy internal marketing to encourage adoption of the new platform. It should also be part of the onboarding process for new employees. Once compliance and adoption rise, audits can be conducted less frequently.

	Ferguson says he likes the idea that things will naturally fall into place over time, but admits thatâs optimistic. Things will come up over time, and practices will have to deal with them as they arise. âThe most important thing to recognize is that text messaging [in the healthcare setting] does not mean the same thing as what you use with your family,â concludes Ferguson. 

New guidance on the use of text messaging by physicians shows some flexibility when it comes to HIPAA, notes a healthcare attorney.

The Joint Commission updates stance on text messaging

nearly two-thirds of Americans own smartphones

. People, including clinicians, are generally comfortable accessing information, sending text messages, recording information and scheduling, among other things, using a phone. However, in the professional healthcare setting, use of a personal smartphone or other mobile device can present challenges in remaining compliant with the regulations of the Health Insurance Portability and Accountability Act (HIPAA).

	In light of the recent announcement from The Joint Commission that 

 is now acceptable within certain parameters, it is fair to say that technology has evolved to the point where there are fewer barriers for practices to use text messaging and other mobile applications. However, there are a few important steps to take that may increase the likelihood of remaining compliant.

	One of the most important aspects of adding any new technology to a practice is to make sure that the people using it are happy about it. Al Villarin, MD, CMIO at the Burwood Group, an IT consulting firm headquartered in Chicago, says it all begins with a contract between the technological and the clinical. In order for adoption to take place across an organization, the new tool needs to fit into the existing workflow, and the best way to make sure that happens is to involve clinicians from the beginning.

	Tim Needham, executive director for the healthcare solutions delivery practice at Burwood Group agrees. âAny communication system will only succeed as much as you can involve all participants,â he says. When physicians are asked to use additional tools that do not deliver additional value, they are less efficient, adds Needham. âThey default back to the app they know,â which could be an unsecured SMS platform.

	Perhaps equally importantly, only technologies that are shown to be HIPAA compliant should be under consideration. Since most vendors have been focused on compliance for the last several years, most of the tools they have developed are compliant. Itâs likely to be more difficult to find a tool that will be widely adopted across the organization and will also increase efficiency.

	Once a platform is chosen, the next critical step is making sure that everyone is using it. Needham poses an interesting question: What if a vendor has done their part and made a tool that is compliant, and the practice as an organization has chosen to implement that tool, but after six months no one is using it? He says that any application under consideration should have an âintuitive auditing or reporting tool,â and reports can show both how individuals are using it, and can identify any out of policy usage.

	Health systems have a role to play, as well, because they are in a position to âfund a common tool,â according to Needham, âas well as to bring additional value through things like physician rosters, care teams and availability and status notifications.â Although independent practices can certainly benefit from the resources and support provided by health systems, there is a price to pay. Villarin says that one of the ways health systems handle security of personal devices is through a mobility device management system [MDM], which âcreates an automated firewall, so that if a phone leaves the hospital it can no longer access certain things.â

	However, one protocol most health systems have in place is that the administrator of an MDM can wipe all information from a device if it is lost or stolen. Villarin says, âItâs a point of contention, looking through a health systemâs eyes,â and in most cases it is mandatory. âItâs not about the physician, itâs about the patient,â he said.

	Needham points out that, for independent practices, the situation can be particularly difficult. âIf you refer to three different hospitals in your area, you have three different systems coming at you. Itâs a very uncomfortable position to be in.â Villarin adds that the way in which regulations are issued complicates the problem. âThe government tells the healthcare systems to comply, but they donât tell them how. Thatâs whatâs missing.â

With smartphone use in healthcare on the rise-both by patients and providers-there are important steps to take to avoid a HIPAA violation.

Author | Dava Stewart

Articles

How to choose your HIPAA security officer

The Joint Commission updates stance on text messaging

Smartphones, text messaging and HIPAA compliance