When it comes to Protected Health Information (PHI), one of the main duties of Health Information Management (HIM) departments is to protect their patients’ privacy and ensure proper disclosure. HIM departments have had a long-held reputation of being the top disclosers of PHI within a healthcare enterprise. However, recent trends in PHI disclosure management are changing things around. Combined requests from other areas such as radiology, business offices, and physician practices are matching, if not exceeding, the PHI disclosure volumes in HIM. This combination of departments managing PHI disclosure causes high volumes of records and increases risk. Below are a few best practices, as outlined in a Journal of AHIMA article, for how HIM professionals can ensure proper disclosure and mitigate breach.

Know the Risky Spots: Audit your Points of PHI Disclosure

A practical first step is to conduct an enterprise-wide audit of all disclosure points. An audit of all PHI disclosure points should be conducted and updated yearly as part of your organization’s privacy compliance assessment. Auditing your enterprise helps HIM leaders become aware of the risks, which they can then work to mitigate. HIM professionals should audit non-HIM PHI disclosure areas to ensure compliance with relevant laws. During the audit, HIM leaders should review a list of items for disclosures which includes date received, date delivered and more.

Train and Educate Based on Needs

Training is essential for safe and compliant enterprise-wide Release of Information. This goes for the HIM department as well as any other employees that release PHI. Well-trained ROI staff keep the flow of information running smoothly. Based on the individual department’s most common requests, ROI training should be focused on accuracy, include all HIPAA privacy basics, and include the following six PHI disclosure management fundamentals:

1. Track and monitor each type of request being received.
2. Define each type of request.
3. Emphasize accuracy.
4. Reiterate minimum necessary.
5. Coach personnel on patient requests.
6. Direct requests to HIM.

Establish HIM as the Enterprise-wide PHI Gatekeepers

Annual HIM reviews and continuous communication with other departments that release information are essential to mitigate breach risk, expedite payer reimbursement, and prevent a requester dissatisfaction crisis. Non-HIM staff are focused on their core competency areas and are rarely trained in proper PHI disclosure management. The result is often hasty PHI processing and increased risk of breach. To mitigate risk while also ensuring the appropriate ROI, HIM departments should maintain oversight of PHI disclosure management across the entire enterprise—not just within HIM.

Complete the form below to download MRO’s eBook “Breach Risk in Release of Information: Don’t Leave Risk to Chance” and learn strategic, enterprise-wide approaches to PHI disclosure management and mitigating breach risk.

At the 2017 AHIMA National Convention and Exhibit, MRO’s client Melissa Landry of Ochsner Health System and I co-presented a session titled “Merger Mania: Impact to Privacy and Health Information Management.” In this presentation, we discussed industry trends around mergers of healthcare organizations and the impact on privacy, Health Information Management (HIM) systems and Protected Health Information (PHI) disclosure management.

Melissa Landry shared how Ochsner successfully responded to challenges resulting from healthcare mergers. Audience members learned strategies for addressing these types of challenges. Below is a video interview where I recap the presentation.

Video Recap: Merger Mania and its Impact on Privacy and Health Information Management Systems

Video Transcript

Rita: I’m Rita Bowen, and I am with MRO. And, I am their Vice President for Privacy, Compliance and HIM Policy.

Question: Tell us about the presentation you gave at the AHIMA Convention about “Merger Mania.”

Rita: I had the opportunity to work with Melissa Landry from Ochsner on a discussion of Merger Mania, and that has been so important because there have been so many physician facilities that are actually merging, buying physician practices, and there needs to be a dedicated process in getting that done correctly. It’s not simply, “I’m going to buy you, and make you part of my team.” There are Information Governance components that have to be demonstrated to make it work correctly.

Question: What best practices did you discuss during your presentation?

Rita: During our presentation today, we talked about best practices for this process of Merger Mania, and we actually took each of the components of Information Governance and threaded that through the discussion; the project management skills required in that; and, actually, the workflow that has to be determined. Because, you often find that the workflow in a physician practice has never been discussed, and you may find that a physician never closes their record, and most of the records will not come into an electronic health record system that you may be trying to merge unless they have actually been closed, which means someone has signed off on those records.

Question: What is MRO doing to address Merger Mania?

Rita: At MRO, we’re doing many things to address Merger Mania—through our acquisition process when we’re bringing on and partnering with a new customer, through the implementation process. We have an assessment phase that helps us do a deeper dive into workflow, and helps analyze those workflow issues. Then, there’s the policy review, which I do, which helps identify policies that the facility may be missing and/or may be complementing policies that we have; or they may be more stringent; or we may perhaps have a policy that’s more stringent, so that sets the foundation for the framework for the implementation team as they go through their education process.

Question: What are some of the biggest trends and themes you’ve noticed at this year’s AHIMA Convention?

Rita: At this year’s convention, some of the biggest trends that I’ve noticed and observed, especially in the general sessions, is that there’s still a focus and discussion regarding Information Governance (IG). There’s still a disconnect from many members thinking they’re not in that IG space. I contend that everything that everybody does in HIM is IG. Everybody is in some kind of lane of IG. It’s not different; it’s not a different domain; it’s one in the same of Health Information Management. The other big thing is population management and how information has got to flow in a way that it can be used in a way that patient privacy is still protected but it actually helps the population management improve health and improvements can be seen—because we still have a way to go there in this country.

Question: What is your favorite part about AHIMA?

Rita: When you ask me what my favorite part about AHIMA is, that’s hard because this is my 43rd convention, so obviously I love to come here. But, my favorite part is seeing friends. Seeing and networking with all the colleagues who I’ve worked with over the years. And, then networking is an excellent way to learn. You stay engaged with someone that’s doing one niche, because you may be working in a different lane, so it helps you stay identifiable into the whole processes. But, the friendships that you’ve maintained through those years is just so vital.

To download slides from MRO’s Merger Mania presentation, complete the form below.

As advancements in health information technology allow increased access to Protected Health Information (PHI), the risk of breach is on the rise. In 2017 alone, there have been 233 reported data breaches, which have impacted 3,159,236 patients. This steady climb suggests that Covered Entities (CEs) and Business Associates (BAs) are still struggling to establish the measures needed to protect patient data and confidentiality.

CEs must be vigilant about the risks and threats directly related to their activities. And now more than ever, they need to focus on the additional threat vector presented by their BAs. As you would expect, the types of breaches encountered by BAs are similar to the threats facing CEs. The causes of breaches include malware/ransomware incidents, accidental disclosures, loss or theft of media containing sensitive data, physical loss of records, application and system vulnerabilities, social engineering exploits and payment fraud. While there are many different culprits of breach, improper and accidental disclosure of PHI is the most common cause of data security incidents. These improper disclosures of PHI include a wide range of errors such as comingled records and misdirected faxes and emails.

The impact of BA breaches on patients of a CE can run deep—from cases of identity theft to exposure of sensitive information regarding a condition, treatment or test that could lead to harm, embarrassment or discrimination. If fines are levied, sanctions and actions will be held against the CE as well.

In an upcoming AHIMA Convention educational session titled “Essentials for Business Associate Management: Due Diligence and Ongoing Risk Analysis,” my colleague Rita Bowen, MA, RHIA, CHPC, CHPS, SSGB, and I will review ways CEs can mitigate breach risk associated with BAs. The following is a sampling of what we will discuss.

1. 1. Perform initial due diligence. Identify what services are being performed, where the services are being performed, and what contracts should be in place including Master Service Agreements (MSAs), Business Associate Agreements (BAAs), Nondisclosure Agreements (NDAs), Data Use and Reciprocal Support Agreement (DURSA) and others.
   2. Get your security and compliance teams on board early in the process to avoid delayed services or rushed assessments. I cannot tell you how many meetings I’ve attended with our prospective client’s security and compliance teams, when we are just days away from finalizing a contract, and their opening statement is: “Well this is the first time we’re hearing of this. Let’s start from the beginning.” So, we just lost two weeks getting a project started, and the client needs us to go live in seven days. To avoid these types of delays, it’s recommended to have security and compliance teams involved in the onboarding of new partner services and technologies early in the process.
   3. Have a standard assessment. Have an equal way to measure the risk associated with the various services BAs can provide. No one shoe fits all, but attempting to keep the assessment process as standardized as possible allows for better assessments of risk. This assessment should cover all the applicable administrative, physical and technical controls associated with the services provided—all shoe sizes!
   4. Confirm cyber insurance. Make sure your BAs have adequate cyber insurance protections in the event of a breach—based on the services being delivered and the associated risk.
   5. Perform annual reviews and third-party assessments. Healthcare organizations should implement a formal program to review their BAs on an appropriate schedule. This would include your typical or an abridged assessment and any third-party certifications, accreditations or audits your BA has achieved.

   Complete the form to download the HCPro HIPAA Briefings article “Managing HIPAA Business Associate Relationships.”