Security

Ask something
Discussion Locked

HIPAA and Security question

0 helpful
3 replies

by rschling

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello, I am a recently appointed Network Administrator for a small Hospital. (Small enough that I also work in the lab to have enough hours to have a full time job)
One of the things I have been doing is evaluating the security structure of our computer systems to find things that need corrected.
One of the items I have found is that there are a couple of people who take home dictations so that they can be transcribed, and returned to the chart the next day. When I approached the manager in charge of this, she pulled out a non-disclosure agreement, and had the employees involved sign it and considered the situation resolved.
My question is this, does anyone else see any security issues there besides me? I am of the opinion that we (the hospital) should also require that the computers are being kept secure at these people's homes, and should be kept up in accordance with the policies being implemented in the hospital. Possibly even require periodic inspection by one of the network admin's.
I would greatly appreciate any comments on this, and recommendations on how to approach this issue.

3 replies

by drew17

I would think that if the employees are using their own computer then you would absolutely have no legal right to monitor or inspect their personal computers.

If you provide the computer for them to use then you would be able to impliment your inspection policy.

So far as I know, HIPAA doesn't prohibit 'telecommuting' but you should definately talk to someone who knows HIPAA regs better than I do.

by bg_27

Hmm this would not appear to be your problem at all, this would have nothing to do with IT imo. I wuold think that it is the management of the hospitals problem. Because the hospital is allowing that person to take the data home, what if they disk got stolen from their car wouldnt be your problem, it would be the person who allowed them to do that.

by dwdino

I am the SA at a medical facility. Ooh the the fun of HIPAA regs...

Anyway, yes this is a HIPAA concern, but not necessarily for E-PHI. The Privacy committee should definitely look into this.

As this is vocal, not "data" contained on this tape it does not meet E-PHI guidelines, but it does contain PHI and must therefore be governed by the Privacy guidelines.

I would recommend showing the responsible Privacy officer the dangers and mandate that such transcription be done in-house or by a business associate who has complied with your HIPAA agreement.

One thing for sure, someone from I.S. needs to check these systems for residual PHI; as even if this is not ongoin, past PHI may still be on these systems. We had similiar system where old billing dat files were kept. Needless to say, this procedure was completely overhauled.

This discussion is closed to new replies.