Health Privacy Lags

Compliance

On Feb. 7, The Boston Herald reported that for six months Brigham and Womens hospital in Boston had been mistakenly faxing confidential records to an investment bankdespite the bank’s repeated attempts to stop the transmissions. It was an embarrassing episode that led the hospital to keep strict inventory of its fax machines, says Jackie Raymond, Brigham and Womens’ director of health information services and privacy officer.

Policies to keep patient data private are at the heart of the 1996 Health Insurance Portability and Accountability Act, or HIPAA. But while a HIPAA rule went into effect last year requiring safeguards to protect electronic health data, practitioners and experts say compliance with the mandate has a long way to go, just as the nation moves toward electronic health records.

The third annual survey by the American Health Information Management Association of 1,117 hospitals and health systems found that only 25 percent of respondents reported compliance at the top level with the security rule, and 50 percent reported being close to full compliance. The survey also reported a drop, from 91 percent to 85 percent, in compliance with a 2003 privacy rule limiting disclosure of medical information.

Reasons cited for the compliance delays include lack of resources and management support. That’s not all, though. Others say regulations, written without reference to technologies and procedures, are open to interpretationincluding whether there are serious consequences for violating the rules.

Practitioners say health-care providers need to involve key players and use e-mail encryption technology to protect private health information. Other recommendations:

• Get buy-in from key players. Bruce Galloway, information system security officer for Deaconess Health System, says it’s key to form a committee with members from various departments. Cindy Smith, senior manager at PricewaterhouseCoopers, says doctors must be involved.
• Educate end users. For example, users need to understand the nature of the data they type in e-mails, because an automated e-mail encryption system may not catch every term, Smith says.
• Create contingencies for mobile devices. Info-Tech Research Group analyst Ross Armstrong says hospitals should be thinking about how to mitigate situations where personal data disappears in a stolen laptop or other device. He says that having in place such things as security and acceptable-use policies, encryption solutions and identity access management will help ensure HIPAA compliance.