Is the Electronic Health Information in Your Practice Really Safe?

Harned laid out the following program to help your practice engage in a comprehensive risk assessment to ensure appropriate protections of electronic health information—a good practice whether or not you are participating in the CMS EHR Incentive Program.

To meet the privacy and security objective for Meaningful Use, your practice should conduct a security audit or risk analysis at least once prior to the end of the each reporting period. Your risk assessment should include these basic steps:

1. Identify the scope of the analysis.
2. Identify the location of all electronic health information including where it is stored, how it is retrieved and by whom, and the workflow for maintenance and transmission of this information.
3. Identify and document potential technical and nontechnical threats and vulnerabilities to the protection of the electronic health information, including natural threats, human threats, and environmental threats.
4. Assess your current implemented security measures to minimize or eliminate risks to electronic health information.
5. Ascertain and document the probability that an identified risk will materialize.
6. Determine and document the potential impacts of each identified risk.
7. Determine the overall level of risk to the electronic health information and develop a “risk matrix,” categorizing all of the risks based upon the likelihood of occurrence and potential impact.
8. Identify and document the required security measures and upgrades and the actions that must be taken to mitigate identified risks.

Simply implementing a certified EHR system will not satisfy your responsibilities for protecting your patients’ health information. As you are conducting your risk analysis, you must consider the security of each system that stores or processes electronic health information (e.g., backup systems, hard drives, and removable media). In conducting the risk analysis, your practice should look at the whole system—the people and the electronic systems responsible for collecting, storing, analyzing, and transferring healthcare information.

For more information on performing a privacy and security analysis in your practice and achieving meaningful use of your EHR system, visit www.rheumatology.org/HIT or contact ACR Registries and Health Informatics staff at [email protected].

Reference

1. Department of Health and Human Services, Basics of Security Risk Analysis and Risk Management. HIPAA Security Series. 2005;2(6):1-20.