HIPAA Privacy and Security Standards for the Electronic Office

Our parents who use e-mail just love it, says Ms. Bauer.They feel more ‘in the loop’ regarding the care of their child. Everyone in the practice has a login ID for e-mail and secure messaging.

Ensuring security is important, as 67% of Americans show high levels of concern about the privacy of their PHI, according to the 2005 National Consumer Health Privacy Survey sponsored by the California Health Care Foundation. Disclosure statements should be a standard part of every e-mail communication. Guidelines for physician-patient electronic communications, prepared by the American Medical Association, can be viewed at www.ama-assn.org/ama/pub/category/2386.html .

At Sacramento ENT, online prescription refills still must be reviewed by a physician and then either phoned or faxed to the pharmacy. However, with our AllMeds EMR system, we can fax without generating any paper, so that simplifies things, plus it documents the activity in the patient’s chart, says Mr. Dudley. Our goal, as we become more electronic, would be to try and eliminate as many steps as possible while maintaining the proper approval and documentation.

The OCR spokesperson suggests that physician practices that are going electronic may find of interest recent HHS regulatory changes, established under the Medicare Modernization Act of 2003 (MMA) and effective October 2006, supporting e-prescribing and EMR technology.

CMS issued new exceptions to the Stark physician self-referral prohibition that allow certain entities to provide nonmonetary assistance to physicians to encourage their use of e-prescribing technology. CMS’ final rule also sets forth the conditions for a new regulatory exception for arrangements involving the donation of EMR software, IT, and training services. The HHS Office of Inspector General (OIG) simultaneously issued a final rule regarding the MMA-mandated anti-kickback statute safe harbor for certain e-prescribing arrangements, as well as a safe harbor for the donation of EMR software, IT and training services.

From the HIPAA perspective, our standards apply to all settings, electronic or nonelectronic, and we expect all covered entities to comply with our standards, says the OCR spokesperson. These standards were designed to be technology-neutral.

Although HIPAA implementation has been challenging, most practices have met the challenge, even when confronted with HIPAA-related problems. State privacy laws supersede HIPAA, making information sharing across state lines and compliance very confusing. Medical identify theft is increasing as more people in physician practices have access to data. Consequently, Congress has introduced numerous bills to protect the privacy of patients’ PHI.