Difference between revisions of "Protected Health Information (PHI)"
(→Summary) |
|||
| Line 1: | Line 1: | ||
| − | '''Protected health information (PHI)''' is individually identifiable health information. | + | '''Protected health information (PHI)''' is individually identifiable health information. PHI is demographic data that relates to individual’s physical or mental health, provision of health care, payment for the provision of health care, and common identifiers such as name, address, phone numbers, birth date, and Social Security Number. All protected health information must comply with [[Health Insurance Portability and Accountability Act (HIPAA)]] standards. |
== Introduction == | == Introduction == | ||
| − | + | PHI is found in many locations in the [[EMR|electronic medical record]]. Data can be found in medical records, billing records, insurance/benefit enrollment and payment, claims payment, and case management records. | |
| − | + | Security and privacy go hand in hand. Security is about controlling access to electronic PHI, while privacy is about controlling how electronic, oral, and written PHI is used and disclosed. Covered entities need to make it a top priority to establish and implement policies and procedures to protect patient information (1). | |
| − | + | == Administrative Safeguards== | |
| − | + | The Privacy Rule requires covered entities to perform administrative tasks to protect privacy of health information. Scalable confidentiality and security procedures, designated security officer, sanctions for violations, and signed statement by all employees regarding confidentiality of data (1). | |
| − | + | === Compliance guidelines === | |
| − | |||
Organizations compliance guidelines, like law and industry codes reflect and are intended to serve patients by safeguarding medical information, enabling us to advance patient care while protecting patient privacy. | Organizations compliance guidelines, like law and industry codes reflect and are intended to serve patients by safeguarding medical information, enabling us to advance patient care while protecting patient privacy. | ||
Fundamental elements to an effective compliance program: | Fundamental elements to an effective compliance program: | ||
| − | + | * Written policies and procedures for compliance | |
| − | + | * A designated compliance officer and committee | |
| − | + | * Effective training and education for employees | |
| − | + | * Effective lines of communication | |
| − | + | * Internal monitoring and auditing procedures | |
| − | + | * Enforcement of standards through disciplinary guidelines | |
| − | + | * Prompt responses to detected problems and implementation of corrective action (2) | |
| + | ==Technical Safeguards== | ||
| − | + | Technical safegyards include: | |
| − | + | ||
| − | + | * unique IDs | |
| − | + | * [[encryption|encrypted]] password storage system | |
| + | * disallowing weak [[password|passwords]] | ||
| + | * automatic time logoff | ||
| + | * system enforced password changes | ||
| + | * firewall | ||
| + | * virus checking | ||
| + | * disallow sharing of passwords | ||
| + | |||
| + | ===Protecting Electronic Data=== | ||
| − | |||
Confidential information stored on a portable electronic device such as a laptop, USB drive, CD, DVD or PDA should be encrypted to ensure data cannot be retrieved by an unauthorized person if lost or stolen. | Confidential information stored on a portable electronic device such as a laptop, USB drive, CD, DVD or PDA should be encrypted to ensure data cannot be retrieved by an unauthorized person if lost or stolen. | ||
| − | ==Recycling== | + | ===Recycling=== |
| + | |||
Placing protected information in an unsecured garbage can (including blue recycle cans) is not an acceptable method of disposal for documents that contain private information. Such information should be secured until shredded or properly destroyed. | Placing protected information in an unsecured garbage can (including blue recycle cans) is not an acceptable method of disposal for documents that contain private information. Such information should be secured until shredded or properly destroyed. | ||
==Summary== | ==Summary== | ||
| + | |||
Healthcare providers in all settings implement compliance programs to protect patient privacy and to ensure ethical business practices. This is necessary due to the increased severity of penalties established by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Balanced Budget Act of 1997 (public law 105-33). By ensuring ethical business practices through compliance programs, healthcare providers reduce their risk of criminal and civil litigation in regards to privacy and security.(3) | Healthcare providers in all settings implement compliance programs to protect patient privacy and to ensure ethical business practices. This is necessary due to the increased severity of penalties established by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Balanced Budget Act of 1997 (public law 105-33). By ensuring ethical business practices through compliance programs, healthcare providers reduce their risk of criminal and civil litigation in regards to privacy and security.(3) | ||
== References == | == References == | ||
| − | # Hartley, C. & Jones, E. (2004) HIPAA Plain and Simple, a compliance guide for healthcare professionals. AMA | + | # Hartley, C. & Jones, E. (2004) HIPAA Plain and Simple, a compliance guide for healthcare professionals. AMA Press, Chicago, IL |
# Healthcare compliance-an introductory guide for employees. Johnson and Johnson. Retrieved from: http://www.shareholder.com/Shared/DynamicDoc/jnj/1293/6210%20Overview%20Guide_WEB_single_pg.pdf | # Healthcare compliance-an introductory guide for employees. Johnson and Johnson. Retrieved from: http://www.shareholder.com/Shared/DynamicDoc/jnj/1293/6210%20Overview%20Guide_WEB_single_pg.pdf | ||
# AHIMA (2011). Healthcare compliance. Retrieved from: http://www.ahima.org/resources/compliance.aspx | # AHIMA (2011). Healthcare compliance. Retrieved from: http://www.ahima.org/resources/compliance.aspx | ||
Revision as of 20:45, 2 July 2012
Protected health information (PHI) is individually identifiable health information. PHI is demographic data that relates to individual’s physical or mental health, provision of health care, payment for the provision of health care, and common identifiers such as name, address, phone numbers, birth date, and Social Security Number. All protected health information must comply with Health Insurance Portability and Accountability Act (HIPAA) standards.
Contents
Introduction
PHI is found in many locations in the electronic medical record. Data can be found in medical records, billing records, insurance/benefit enrollment and payment, claims payment, and case management records.
Security and privacy go hand in hand. Security is about controlling access to electronic PHI, while privacy is about controlling how electronic, oral, and written PHI is used and disclosed. Covered entities need to make it a top priority to establish and implement policies and procedures to protect patient information (1).
Administrative Safeguards
The Privacy Rule requires covered entities to perform administrative tasks to protect privacy of health information. Scalable confidentiality and security procedures, designated security officer, sanctions for violations, and signed statement by all employees regarding confidentiality of data (1).
Compliance guidelines
Organizations compliance guidelines, like law and industry codes reflect and are intended to serve patients by safeguarding medical information, enabling us to advance patient care while protecting patient privacy.
Fundamental elements to an effective compliance program:
- Written policies and procedures for compliance
- A designated compliance officer and committee
- Effective training and education for employees
- Effective lines of communication
- Internal monitoring and auditing procedures
- Enforcement of standards through disciplinary guidelines
- Prompt responses to detected problems and implementation of corrective action (2)
Technical Safeguards
Technical safegyards include:
- unique IDs
- encrypted password storage system
- disallowing weak passwords
- automatic time logoff
- system enforced password changes
- firewall
- virus checking
- disallow sharing of passwords
Protecting Electronic Data
Confidential information stored on a portable electronic device such as a laptop, USB drive, CD, DVD or PDA should be encrypted to ensure data cannot be retrieved by an unauthorized person if lost or stolen.
Recycling
Placing protected information in an unsecured garbage can (including blue recycle cans) is not an acceptable method of disposal for documents that contain private information. Such information should be secured until shredded or properly destroyed.
Summary
Healthcare providers in all settings implement compliance programs to protect patient privacy and to ensure ethical business practices. This is necessary due to the increased severity of penalties established by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Balanced Budget Act of 1997 (public law 105-33). By ensuring ethical business practices through compliance programs, healthcare providers reduce their risk of criminal and civil litigation in regards to privacy and security.(3)
References
- Hartley, C. & Jones, E. (2004) HIPAA Plain and Simple, a compliance guide for healthcare professionals. AMA Press, Chicago, IL
- Healthcare compliance-an introductory guide for employees. Johnson and Johnson. Retrieved from: http://www.shareholder.com/Shared/DynamicDoc/jnj/1293/6210%20Overview%20Guide_WEB_single_pg.pdf
- AHIMA (2011). Healthcare compliance. Retrieved from: http://www.ahima.org/resources/compliance.aspx
Submitted by Sherry Dexheimer
