The Importance of Administrative Safeguards

Nov 11, 2019 | Administrative Safeguards

The Importance of Administrative Safeguards

Hundreds of Patient Records Found in Trash

The Importance of Administrative Safeguards. Guest Author: Jim Johnson President of Live Compliance

A gastroenterology office in New York is under investigation after hundreds of patient records were left in boxes on a curb outside of the office and in the trash. These records contained Protected Health Information (PHI) such as first and last names, dates of birth, social security numbers, and even pictures of the patients.

They recently moved to a new office down the hall and some of the old records were waiting to be picked up by the shredding company from the former office, and they believe the cleaning company may have disposed of them.

Ensuring that proper administrative and physical safeguards are in place is absolutely necessary and to avoid HIPAA violations, and in doing so, Media Disposal Policies are essential to be understood by all workforce members, especially because breaches and improper disclosures of this kind seem to be occurring more frequently. For example, a medical records maintenance company was fined $100,000 for leaving patient records in an unlocked vehicle!

Patients must trust who they share their personal, private, and protected health information with, and breaches such as this, are obviously devastating for the patient and their doctor’s reputation. How can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?

First, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so would have highlighted a major flaw in the practice’s administrative safeguards and the importance of Media Disposal policies and procedures and the practice’s need to implement.

It is also important to note, that all compliance solutions and Business Associates, must also, in turn, be compliant. Ensuring that your Patient Scheduling (check out our last post about if Google Calendar is compliant!) and other software solutions are HIPAA Compliant can eliminate the risk associated with maintaining paper patient records.

Next, ensure all employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy rule and actionable policies and procedures.

Finally, if visitors, such as janitorial services have access to the facility, it is crucial that  Facility and Visitor Access Logs are kept, as well as a clear understanding of who has access to keys and alarm codes. 

Remember:

Healthcare organizations and their vendors have a responsibility to be HIPAA Compliant, and that starts by performing, updating or reviewing an accurate and thorough Security Risk Assessment covering your Technical, Administrative and Physical Safeguards. This will help uncover vulnerabilities and help you understand what information is being transmitted, shared and how.

TAKEAWAYS AND THINGS TO CONSIDER:

• Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
• Remediate any potential risks or vulnerabilities. A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information.
• Develop Actionable policies and procedures that clearly outline the disclosures of PHI. Policies and Procedures can be edited and shared directly with staff from your Live Compliance staff portal.

• Ensure all employees complete and have a clear understanding of the HIPAA Privacy Rule and policies and procedures. Completely built into your portal, Live Compliance training is custom, online, and role-based. Training is delivered and monitored within your Live Compliance portal, anytime and from anywhere. Easily send and monitor HIPAA training in one click.

Don’t be the cause of your provider’s reputational damage and fines! Take advantage of the limited time offer for a FREE Organization Assessment to ensure you are meeting the requirements mandated for you and your organization. We hope you enjoyed this article about The Importance of Administrative Safeguards. Click here to read more interested and informative articles from EZClaim.