HIPAA Compliant Record Keeping

PMA is designed to meet the HIPAA requirements to protect confidential patient information by use of passwords associated with each database and with each patient's Notes.

Each database can have a unique set of user names and passwords, up to 30 each. This allows certain users to be restricted to certain databases.

The Patient Notes for each patient on each database can have a unique password. This allows providers to access only the notes for their patients.

The initial user, when installing or updating the program, is the only user who may add or modify user names and passwords. The initial user, also called User #1 or the System Administrator, should therefore work out a method of assigning user names and passwords for each user and for each patient's Notes. This should be done for each database.

The program can be told to close itself down if unused for a specified time. This option is set on the Option list on the Main Menu of PMA. This is also a HIPAA requirement.

Note that the above is all optional as the user may have other means of maintaining confidential patient data.

The program maintains an audit trail of users, noting when they log on/off and what patient data that they modify. This activity log is maintained per workstation and can be viewed on the Work with Databases screen by clicking on the "View" item on the top and then on "View activity log files". The activity log contains the activity for one day. Each day starts a new log file on the workstation.

                            HIPAA Office Checklist

1. My office does not use a patient sign-in sheet that includes confidential patient information.
A sign-in sheet will allow patients who come into your office to learn the identity of patients who came to your office earlier. This is acceptable, so long as the sign-in sheet does not contain confidential patient information, such as reason for the visit. In some cases this information seems very innocent. However, some physicians specialize in treating sensitive issues or conditions, e.g., cancer, psychological problems or pregnancy, and simply disclosing that an individual had an appointment with you for a specific purpose may be a breach of patient confidentiality. At minimum, the sign-in sheet should be changed periodically during the day.

2. My office does not locate patient schedules in any places that may be seen by patients or other non-staff individuals.
Some practices print out the schedule for the day and post it for the professional staff. Often the schedule is posted where it may be seen by a patient - either in an examination room or corridor, or on a door. This may result in the unauthorized disclosure of patient information. As with the previous consideration, disclosing information about a patient may be a breach of confidentiality.

3. In my office, all confidential conversations take place to the maximum extent possible in areas that cannot be overheard by other patients or non-staff individuals.
A receptionist may schedule appointments or provide results over the telephone. This requires taking and verifying the name of the caller, as well as discussion of medical information, e.g., the reason for the appointment or the results of the tests. If patients and others are sitting in the waiting room, they may hear this exchange of confidential information, and this could represent an unauthorized disclosure of patient information. The same is true of conversations between staff members in a hallway or if a professional takes a call from a patient in the presence of another patient, e.g., in an exam room, or if a professional dictates notes into a recording device. (Providers must use their best professional judgment to reduce the risk of such information being shared, but do not have to guarantee it can never occur.)

4. In my office patients and non-staff individuals cannot gain access to our computers or fax machines and cannot view our computer screens.
Offices use computers for a variety of reasons including billing, accounts receivable, scheduling and medical records. Usually computers and fax machines are placed only in the reception area, although sometimes they are throughout the office, including patient exam rooms. It is important that both physical and viewing access to fax machines and computers be restricted to only staff members. In addition, computers should have screen-savers so that unauthorized persons cannot read the information if they happen to wander into a restricted area. Also, computers should be password protected. When a staff person steps away from a computer for a period of time, the staff person should be required to re-enter a password.

5. Each computer user in my office has a personal computer password. These passwords change on a regular basis, and passwords of terminated employees get deleted immediately.
Ensure that each person in your office has access only to the computer(s) and information to which they are entitled. Toward that end, each user needs to have a password. In addition, passwords need to be kept confidential (i.e., not shared with anyone else) and changed on a regular basis to ensure security. Passwords must never be left on "Post-it" notes next to the computer.

6. In my office, patients and other non-staff individuals do not have any opportunity to access patient medical records, laboratory reports and faxes.
Paper medical records are located in a number of places around the office, including the receptionist area, bins in the exam rooms, on the professional's desk and at checkout. It is vital that no patient or non-staff individual have access to any medical records at any place in the office. For most offices, this will require a change in the manner in which medical records are handled and stored. However, this also includes appointment lists and charts outside exam room doors.

7. My office has formal documented procedures to ensure patient confidentiality when transferring paper files, orders, images and specimens to other offices.
Every office should have formal policies for the transfer of confidential patient information outside its office, and office staff must understand these policies. You must make sure that only appropriate information is transferred and that it goes to the proper individuals. (You may need specific authorization from a patient to transfer information.) If you use e-mail, make certain that the e-mail is secure. If you use couriers, you must ensure that they will keep the information confidential in transit and deliver it only to authorized individuals. If you use a transcription service, you must ensure that the transcription service can keep your information confidential, in compliance with the HIPAA requirements. Even if you currently have such policies, they will need to be reviewed to meet HIPAA requirements. You may have to change your agreements with business associates to make them comply with HIPAA requirements.

8. My office has formal documented procedures for the acceptance of confidential patient information from outside our office.
As with records sent offsite, you will need to have formal policies for accepting confidential patient information from outside your office and keeping it confidential. This includes e-mail. Your office staff must understand these policies. Even if you have such policies in place, review those policies to ensure they meet HIPAA requirements.

9. My office has confidentiality statements in place and we make patients aware of our confidentiality policies. HIPAA requires every health care professional to sign confidentiality statements. These statements must be posted in a prominent place in your office. In addition, patients must sign a consent form allowing you to release their confidential information for billing and other purposes. Even if you have confidentiality policies in place and make patients aware of your policies, review them to ensure they meet HIPAA requirements.

10. My office has formal privacy and security procedures regarding access to confidential information, access to computer information, and access to areas of the office that may contain confidential information.
Unauthorized personnel must never have access to confidential information. Your office must have formal policies and procedures to ensure that only appropriate staff and other individuals gain access to confidential information. This may mean limiting access to certain parts of your office, to certain computers, or to certain programs or files in your computers. (For example, if you have separate accounting staff, those individuals do not need to see patient encounter notes, only the billing form prepared by the treating healthcare professional. The cleaning staff should not be able to see any confidential information.)

11. My office requires the return of all keys and other items that allow access to the office and to computer files when a person no longer is authorized to access information.
Unauthorized personnel must never have access to confidential information. This includes all staff and other individuals who may at one time have been authorized with such access. Your office must have formal policies and procedures to ensure the return of all keys and other items that allow access to information, both physical and computer access.

12. My office has formal privacy and security policies for all office personnel, provides training for all office personnel, and documents the training of each individual.
All office personnel must receive training about your privacy and security policies and records must be kept regarding the training. The policies must detail which personnel have access to different kinds of confidential information in different circumstances, personnel clearance procedures, procedures to be followed when a member of the office staff is terminated, and procedures for identifying and correcting potential problems. Training requirements should be included in your human resources policy manual or booklet. In addition, you must have a formal policy manual that details all of your privacy and security procedures. Even if you have a policy manual in place, you must review it to ensure it meets HIPAA requirements.

13. If my office uses laptops or other portable equipment that holds confidential patient information, this equipment is secure and can only be accessed by authorized personnel.
Many offices use portable equipment, including laptops, calendars and "personal assistants." All of these devices may contain confidential information that must be kept secure in an appropriate fashion. Your office must have policies and procedures regarding the setup, use, security and disposal of this equipment.

14. My office has policies and procedures in place to ensure patient confidentiality by off-site contractors, such as billing and accounting services.
You are responsible for ensuring your confidential information remains confidential, even when it is sent off-site. This is not a concern when you send information to another health care provider or a health insurance company. Those entities also are required to comply with the privacy rule and to protect the information they receive. Most billing services will be covered by HIPAA rules, although you should double check with them. However, many businesses are not covered by the rules, e.g., auditors and software vendors. Establish agreements with these businesses to ensure the confidentiality of any patient information they will see or transfer.

15. My office has a comprehensive survey of all our computer systems, including all software.
Security rules require you to keep a complete listing of your computer systems, including all software. This will help you manage your systems and detect any problems that might lead to a breach of patient confidentiality. Remember: Confidential information is contained in billing and accounting records, in letters to patients and other health care providers, as well as in medical records.

16. My office has a disaster plan to protect patient information and contingency plans in the event of a computer systems failure. We perform regular virus checks and correct identified problems.
You must ensure your access to confidential information, even in the case of a disaster. For computer records, this can be fairly simple: Back-up computer files on a daily basis and store the back-up offsite. For paper records, this can be more difficult. In addition, you must ensure your confidential information is safe and cannot be seen or altered without your permission. Electronic information - including billing records and correspondence - is subject to attack if it is not protected from computer viruses and unauthorized intruders (hackers).

17. All confidential information - paper and electronic - is stored with appropriate safeguards.
Protect all confidential information from inappropriate access. This includes both electronic and paper records. For electronic records, use passwords and other methods to ensure that only authorized people have access to information. For paper records, ensure your records are stored and locked in a secure manner. Examine what types of safeguards are in place for shredding and disposal of paper records.

18. Internet transmissions, including e-mail and telephone conversations, are secure.
You must be sure that Internet and telephone conversations are secure. In the case of the Internet - most commonly e-mail - you must ensure communications are "encrypted." For telephone conversations, you must make reasonable efforts to prevent others from listening, e.g., on a second telephone. In most cases, the staff should have some assurance of the identity of the person with whom they are communicating.

19. My office has patients sign a consent form.
Patients must sign a consent form allowing you to release their confidential information for treatment, billing and other purposes. Even if you have such a form in place, review to make it meet HIPAA requirements.

20. My office has confidentiality statements on all faxes and e-mail sent by the office staff.
All faxes and e-mail messages need to state the confidential nature of the contents and include instructions in case the fax or e-mail is misdirected.