Is the Electronic Health Information in Your Practice Really Safe?

The Centers for Medicare and Medicaid Services (CMS) Electronic Health Record (EHR) Incentive Program (Meaningful Use) provides for eligible physicians who demonstrate “meaningful use” of certified EHR technology to be eligible to receive up to $44,000 in Medicare incentive payments over five years or up to $63,750 in Medicaid incentive payments over six years. But what does it really mean to achieve “meaningful use” for the EHR Incentive Program, and what will your practice need to do to meet the required objectives?

Privacy and Security of Electronic Health Information

One Meaningful Use objective that generates quite a bit of interest and even more questions is the aim to ensure appropriate protection of electronic health information. To meet this objective, you need to ensure that your EHR system is equipped to support basic security functionalities and that your practice is doing everything it can to identify potential threats and implement policy to keep information protected from nontechnical threats.

The Meaningful Use certification program addresses the more technical aspects of privacy and security, making sure that your system functionally protects electronic health information by implementing controls and encryption, such as:

• Assigning a unique user name for each user;
• Encrypting and decrypting health information for backups and removable media;
• Providing for event recording such as deletion of records;
• Creating an audit review log;
• Using systems to ensure health information has not been altered using a hash algorithm;
• Recording disclosures made for treatment; and
• Ensuring identity management is in place.

However, technology is just one piece of the security puzzle. Using certified EHR technology alone will not guarantee compliance with the Health Insurance Portability and Accountability Act (HIPAA) and supporting security rules. Your practice will also need to actively conduct a security risk assessment, documenting the findings and any plans to mitigate risk and improve practice workflow and policy that supports the security of patient data.

The Risk Assessment

During a recent ACR Meaningful Use webinar, Nicholas Harned, JD, a health law attorney from Vedder Price, P.C., focused on the privacy and security requirements. Harned said that the Meaningful Use Privacy and Security objective is framed to ensure certified EHR technology supports the protection of electronic data but “does not impede [a provider’s] ability to comply with HIPAA.”¹

Harned laid out the following program to help your practice engage in a comprehensive risk assessment to ensure appropriate protections of electronic health information—a good practice whether or not you are participating in the CMS EHR Incentive Program.

To meet the privacy and security objective for Meaningful Use, your practice should conduct a security audit or risk analysis at least once prior to the end of the each reporting period. Your risk assessment should include these basic steps:

1. Identify the scope of the analysis.
2. Identify the location of all electronic health information including where it is stored, how it is retrieved and by whom, and the workflow for maintenance and transmission of this information.
3. Identify and document potential technical and nontechnical threats and vulnerabilities to the protection of the electronic health information, including natural threats, human threats, and environmental threats.
4. Assess your current implemented security measures to minimize or eliminate risks to electronic health information.
5. Ascertain and document the probability that an identified risk will materialize.
6. Determine and document the potential impacts of each identified risk.
7. Determine the overall level of risk to the electronic health information and develop a “risk matrix,” categorizing all of the risks based upon the likelihood of occurrence and potential impact.
8. Identify and document the required security measures and upgrades and the actions that must be taken to mitigate identified risks.

Simply implementing a certified EHR system will not satisfy your responsibilities for protecting your patients’ health information. As you are conducting your risk analysis, you must consider the security of each system that stores or processes electronic health information (e.g., backup systems, hard drives, and removable media). In conducting the risk analysis, your practice should look at the whole system—the people and the electronic systems responsible for collecting, storing, analyzing, and transferring healthcare information.

For more information on performing a privacy and security analysis in your practice and achieving meaningful use of your EHR system, visit www.rheumatology.org/HIT or contact ACR Registries and Health Informatics staff at [email protected].

Reference

1. Department of Health and Human Services, Basics of Security Risk Analysis and Risk Management. HIPAA Security Series. 2005;2(6):1-20.