Home Forums Website HIPAA question

I'm hoping to get some advice before building a website to help c the design.

I'm researching XHTML, PHP, and MySQL to make a website to collect subjective history for each patient visit. Haven't done it before so looking forward to a lot of coding mistakes. But before I start I want to get input on a safe way to design it for HIPAA.

I have trained my patients to fill out 2-3 pages of checklists about their current function and symptoms on a clipboard before I come into the exam room. I want to do that on cheap android tablets so I don't have to enter it, only review it. Patients could do it from anywhere before the appt if desired or on my tablets at the office.

I would like to expand it later by fleshing out symptoms with follow up checklists. If cough, is it dry, wet, color, SOB, chest pains, fevers, etc..

I'm thinking I could get around HIPAA by not having any identifiers associated with the database record. At my office, staff would note the autonumber generated by MySQL and I would take the tablet from the patient and enter that number to get the data. If the patient does this offsite they could choose their own "password" which they would have to tell me for me to get the data.

Is there a better way to make an amateur portal? Appreciate your help.

Dan,

A number of things:

1. How will the autonumber be generated? You could have them ask for a password
2. Ever considered calling HIPAA to see if it would satisfy the requirements or what they would suggest?
3. With email, if you send them an email telling them their data is as secure as you can get it for email, and they send it back stating they agree by virtue of their name being on the reply address, you can use that for email.
4. So, why not just have a disclaimer stating this is SSL secure 128-bit encrypted, but I can't 100% guarantee it is 100% secure. If they check that off, you should be golden.

Just thinking off the top of my head.

Thanks Bert,

I was going to use the new records ID number, which would be consecutive, rather than trying to generate a random number, for in office transfers. And have the patient enter a keyword if online, and give it to the office when they come in.

Calling HIPAA is a great idea, I'll let you know if I get an audit

Appreciate 3n4 also

I guess I want to have a defense to be able to prove that the data is protected to an adequate standard, without having any experience c Internet HIPAA.

Also the data can be deleted as soon as I've copied the string to AC so there is a very brief exposure.

Let me know if you get any ideas or new recs as this will be a slow work in progress.

I wish updox would give us a sandbox to allow 3rd party programmers to make an app for our practice for interacting with patients with logic based on their symptoms and diagnoses. Eventually, all ehrs will need that capability. Go online, interact c Watson, then go to the office to check everything and start the treatment plan.

Dan,

I think if you have internet access at the office for your patients to utilize, there may be a work around using Updox, that would at least address the HIPAA issue.
My wife was able to design several forms in the private portal section of Updox, and the form you describe is a bit like the 28 question survey for the medicare wellness exam I use with up to 5 buttons per question to answer with.
So by using Updox your patient could fill out the form at home on their computer, on their IPAD or a tablet provided at your office. The patient would have to sign on to their own portal and access the form on the Updox site, and fill out, and then send through encrypted xml, which is password protected on both ends.

Once the form is completed by the patient you would view it in Updox or have your nurse place it in the imported item section under incoming correspondence, progress note or other which ever works the best, which is then part of the permanent record in AC viewable by you at any time.

It may not be the solution you are looking for but I bet you could design the subjective history form yourself and make it work quite nicely. Private message me if you have any questions about how to get started on designing the form thru Updox.

Thanks jimmie,

I was hoping for being able to manipulate the answers to make a paragraph and using a database to load another form with the obvious follow-up questions from the answers given already in order to make it more complete. My understanding is that Updox is limited to a static form.

How do you get the answers to your Medicare wellness exam form into the AC visit? As in, how many clicks or difficulty?

If the patient has filled it before hand by way of portal or handwritten answers at visit, my nurse will have the form placed in the imported item section under incoming correspondence and dated. So with one click I can open up the form, and then address any positive answers, so just in case if the medicare police come, I have my medicare wellness survey dated and in the chart as a permanent record. I also have the eye exam, up and go test results, and Polst form review and list of other docs--I just dictate in the physical exam section--just in case.

Now my nurse will either scan and tag to imported item section using the scansnap 1500 scanner or just tag it and import it through updox, but not many steps at all. I will check with her on Monday, I haven't used the scanner in awhile. But with Updox, mark the item to send, input patient name, send to EHR and click on category-incoming correspondence.

Jimmie,

What do you mean when you say "by way of portal?"

Bert,
By way of portal--patient fills the form out on the Updox web site, usually a day or two before the annual visit. The 28 questions are filled out by the patient and sent to me. Once sent over the Updox portal, it is then viewable on the Updox work space area. I can see it but usually my nurse will go ahead and send this completed survey onto AC inbox and once I sign off goes permanently into the imported item section.

But, does any info go from the patient's computer over the Internet or are they just typing data into the portal? Thanks.

Once a patient has signed in to the portal, whether accessing from a computer, smart phone or whatever, the electronic XML encrypted message is transmitted over the internet, and since the entry and exit point of the electronic message is password protected and the electronic message encrypted this type of electronic transfer of patient data is considered secure by HIPAA standards.

Very cool!

Jimmie,

Could you fill out the questions on a dummy pt with a screen shot of what it looks like and then maybe a screen shot of the imported item (I know it is a pain so if you don't have time)....sounds cool and I want to try the Updox portal just don't know if I have the time for setting up all the forms, etc.

Steven,
I was thinking of making you the dummy patient, if you would like to see how the portal works from a patient's perspective. I could get you in touch with my nurse, who can make you a password and get some info (name and date of birth) to do this--just PM me.
This way you could look at all the forms, fill out the ones you want and I can send the completed forms back to you. Could also attach some of the educational handouts I have made as well.
Time is not a problem, am off this week, and as a reward for passing the re-cert in IM, just bought myself the Shem classic The House of God, re-reading after about 2 decades--better than ever!!!

jimmie,

Congrats on passing your recert boards! I take FP recert exam next year.....

Amazing that you would bring up "House of God" now. I just recently ran across my original copy, I have not read that since residency. I believe I learned more medicine from that book than from Harrisons! I was thinking about rereading it, now I will have to, to keep up with you...

Happy 4th!

Gene

Gene,
Thanks--and Happy 4th to you as well. My wife must think I am a maniacal lunatic curled up with Shem laughing like a hyena. And good luck with your recert.

Steven,
If you would rather do the screen shot thing just let me know what works best for you.

Here is a screen shot of a portion of the Medicare Wellness survey: