Achieving Safe Harbor
What the HITECH Act Means for U.S. Healthcare Organizations’ Communications and Business Processes
Executive Summary
This white paper sets out to explain the importance of data security within your healthcare organization and focuses on the following subjects:
- The move from paper to electronic records.
- HITECH and what it means to you.
- How you can comply with HITECH and new regulations.
- Why complying with HIPAA is not enough.
- An introduction to complete health information security from infrastructure to Security and Privacy Driving Improvements
The security and privacy of personal health records (PHR) has long been a hot button within the healthcare industry. The movement from paper to electronic records was first addressed with HIPAA (Health Insurance Portability and Accountability Act) in 1996, and healthcare data security continues to be updated with new documents and implementations over time, most recently with the 5010 update. While HIPAA encouraged the use of electronic medical records (EMR), little was done in the way of enforcing healthcare data security or to encourage the investment in improving processes and securing patient information.
Paper records are still common within healthcare organizations (HCOs), insurers, clearinghouses and related business associates (BAs), leaving these organizations susceptible to data breaches and lost patient data. Personal health information (PHI) is sent via fax, mail and other unsecure methods of transfer on a daily basis. Paper breaches year-to-date 2009 jumped to more than 25% of the total reported breaches tracked by the Identity Theft Resource Center (ITRC). This is up from 17.7% reported for the year 2008.
Not All Automation is Created Equal
Organizations have invested in standardized claims and automated processes with insurance companies, HCOs and care providers, but there are still opportunities to reduce cost and improve business processes. Examples of outdated processes are the use of fax, courier and other insecure methods for communicating information and managing exceptions to patients and outsourced service providers in otherwise automated processes. With clear business gains, the ability to improve the quality of care and deliver value-added services to patients, many organizations have been deploying healthcare data security solutions for electronic records.
