AHIMA Advantage Newsletter

April 2016 | Volume 21 | No. 2

ADVANTAGE

SIGN THE MYHEALTHID PETITION PG 6 | CELEBRATING STUDENT SCHOLARSHIPS PG 10 | UPCOMING VIRTUAL CAREER FAIR PG 11

Defusing the Major Privacy and Security Dangers in 2016

Privacy and security threats continue to escalate, with several cybercrime events stealing the national spotlight. At the same time, privacy and security officers are trying to find the right balance between providing access to patient information and protecting their organization’s valuable data.

Because April is Privacy and Security Month, we have asked members of AHIMA’s Privacy and Security Practice Council to tell us how they are addressing these challenges and to share some advice with other HIM professionals.

Defending Against Cybercrime

“The fact that data can now be held hostage shows just how vulnerable protected health information is,” says Lela B. McFerrin, RHIA, HIM director and facility privacy official, Parkridge Medical Center, Chattanooga, TN. McFerrin points to a case in February in which hackers demanded nearly $3.7 million to unlock a Los Angeles hospital’s IT systems, which were infected by so-called “ransomware,” a type of malware that limits users from accessing a computer system until a ransom is paid.

To help members combat such threats, AHIMA has published several articles and a practice brief on cybersecurity practices in the April issue of the Journal of AHIMA. Journal articles, in addition to practice briefs on topics like performing breach risk assessments and privacy and security training, can help members stay informed and protect their organizations against these threats, McFerrin says.

At Parkridge Medical Center, McFerrin has stepped up her organization’s training on cybercrime. “We are providing a lot of training to help staff spot suspicious e-mails that could contain malware that could put protected health information at risk,” she says. “We also are focused more on helping patients understand what could happen if their information is compromised, particularly their social security numbers.” Like many hospitals and health systems, Parkridge Medical Center has eliminated the use of complete social security numbers as a patient identifier. The medical center also has added software that can detect when a social security number is included in an e-mail. Still, physician practices have been slower to adopt such policies and tools, and many still use social security numbers as a patient identifier, McFerrin says.

Focusing on Patient Portals

Patient portals present a particular challenge for organizations
trying to balance the need to facilitate access to the medical
record with the need for privacy and security—even beyond the
portal, says Elisa R. Gorton, RHIA, CHPS, MAHSM, director of
corporate responsibility and privacy officer, St. Vincent’s Medical
Center, Bridgeport, CT.

“Patients need to understand that downloading information from a patient portal to their own computer or device opens them up to breaches that have nothing to do the covered entity,” says Gorton, who is also the chairperson for the Health Information Technology Coding (HITC) Specialist Certificate Program at St. Vincent’s College, also in Bridgeport. “So the more access that we give patients in the portal, the more patients need to be aware of how to protect their information in their own system.” Some of these concerns can be mitigated with resources in AHIMA’s patient portal practice brief and forthcoming new patient portal toolkit, which will be free to members. The toolkit includes a sample patient portal user agreement and other resources, which HIM professionals can use to build their own policies and procedures and gain programmatic support from senior management.