Health Care Providers Must Protect Patient Privacy

According to the Health Insurance Portability and Accountability Act (HIPAA), patients and other health care consumers should have the right to decide how their personal information is used. Under HIPAA guidelines, nonauthorized users should be prevented from accessing patient documents.

HIPAA not only effects health care providers and insurers, but also impacts the organizations health care providers may do business with or purchase products or services from, such as law firms or janitorial companies.

To ensure privacy, encryption should be used when sensitive patient information is transmitted electronically. That rules out the use of personal IM tools, which do not allow encryption. Even if you have an enterprise-grade IM system, you cannot encrypt data unless your recipient uses the same software.

According to HIPAA, health care workers are allowed to see only the minimum amount of health information necessary to do their jobs. In the case of physicians, that’s likely to be a considerable amount of sensitive information. As IM technology and security currently stand, IM is probably too risky for doctors to use when communicating with or about patients.

The best advice: If you are unsure if HIPAA applies to your organization, and you have access to sensitive patient records or medical information, be sure to have a comprehensive and consistent IM policy and training program in place, along with the most secure technology on the market, before allowing IM use.

Consider these six sets of questions before authorizing the use of IM to transmit patient records or other medical data:

1. Who is (and is not) authorized to use instant messaging? Why?

2. Under what circumstances may IM be used?

3. When is instant messaging the best means to transmit data? When is it the worst tool to use?

4. Who is on the other end of the transmission? Can you verify the identity of the recipient?

5. How can you ensure that your IM transmission is secure and private? Are you using encryption?

6. Do you really want to play fast and loose with HIPAA? Is there a better alternative to instant messaging for health care providers and vendors who operate under a regulatory microscope?

HIPAA mandates costly penalties for companies that don’t guard their medical records carefully, so an IM oversight today could prove a costly mistake tomorrow.