Originally Posted by Boondoc
I went to John's link and found pages upon pages of information to read on corporate security. This was not an easy check list I was hoping for. I am trying to simplify this enough to be usable.

The Security Management Process standard in the HIPAA Security Rule requires organizations to ?implement policies and procedures to prevent, detect, contain, and correct security violations.? Here is the way we set up our plan, as simple as we could make it:

Protected Health Information (PHI) within our practice:
-- Designate where PHI is maintained within your organization. How is it secured? Simply state: password protection for sign-in, locked cabinets, door and key security, personnel screening etc.
-- Comment on safe transmission or reception of PHI. IE: practice has fax with staff access only, patient portal, no e-mails of patient data, shredder for disposal, signed releases of information needed, etc.
-- Identify threats to PHI: How do we protect access by cleaners, repairman, deliverymen (most commonly either escorting them if they work in PHI areas, or vet their companies). How do we secure our network (router with password, WPA2, etc). How do we protect from fires, storms (Doesn't need to be ironclad, reasonable measures such as alarms, sprinklers, backup copies in outside locations, etc).
-- Data authentication: How do we check that we are creating or filing information on the correct patient. We require patients to give photo ID upon check in -- AC helps here; if the front desk IDs the patient on check-in, brings up the right chart and forwards it to the clinical staff, you can't input to the wrong patient. When filing info into AC, Updox helps us, since it displays both the patient name & DOB when choosing what chart to import into. Does the staff check the patient info release before talking to a third party?
-- Security audits; Our office manager does a brief audit of several of the policies above once a month, and writes a brief report on her findings before our quarterly practice corporate meeting. It goes in our minutes, along with any corrective action needed.

That's what we do. I don't know whether its too much or too little, but its our plan, and we're sticking with it.

John
Internal Medicine