HIPAA and PACS: collision or coincidence in medical imaging privacy

¶ … HIPAA act and the PACS program to determine whether they collide or coincide with each other.

PACS, the privacy issues

For the past few years the laws in health care with regard to privacy have created a bottleneck effect in many of the industry areas. Those who work in the health care field have had to secure privacy statements, insurance protocol has changed dramatically and many other areas have been addressed in a manner intended to improve overall care of patients, but in reality have also caused many obstacles to be overcome.

As the medical community continues to involve many new technologies have come forth to make the delivery of health care more accurate than ever before. One such technology is the PACS system that is used in the field of medical imaging. The PACS system fine tunes the use and delivery of medical imaging results through the use of digital technology. It allows patients and doctors to access information much more quickly than was possible in the past thereby creating more efficient means of health care delivery. While this is an exciting new ability in the field of medical imaging those who utilize it must take care not to violate the many restrictions that the HIPAA laws have placed on sharing of information without the patient's permission.

PURPOSE of the STUDY

The purpose of this study was to discover whether PACS and HIPAA collide or coincide with regard to the privacy afforded to patients in America today who enter the health care system and need medical imaging completed.

HYPOTHESIS

The working hypothesis of this study is: if PACS is utilized correctly and the proper security measures are put into place then the HIPAA laws will coincide with the PACS system and deliver the most secure, efficient information possible to patients and doctors across the nation.

PACS

The mandates that HIPAA puts into place for the privacy and protection of those purchasing health care are important but it is important that they don't place undue and unnecessary stress on other systems being used within the health care industry. One of those systems is the PACS system. It is a system that promises to revolutionize the medical imaging field.

PACS has commonly been referred to as a crowd pleaser because of its ability to share information with several people at the same time with an almost non-existent wait or delay.

In addition the proper use of the system provides privacy and security so that it complies with the measures mandated by HIPAA.

Before PACS came on the scene the field of medical imaging was fraught with issues because of time delays between having the procedure done and getting the results to the doctors and other health care professionals that needed them to make important health care decisions for their patients (Kywi, 2005).

One would typically have the procedure completed and then one would have to wait several days at the least to have their doctor find out the results. This proved to be problematic in situations where speedy results could mean more effective, earlier treatment.

Problems including gallstones and kidney stones would create significant pain and discomfort for patients who would sometimes wait three to five days to get the results and be scheduled for surgery. More importantly those delays sometimes meant issues would worsen with the liver and other organs of the body.

Also, healthcare delivery was occasionally jeopardized because some studies or reports were misplaced or not returned by users, leading to incomplete records. Patients, too, were inconvenienced. The many steps involved in imaging, interpreting the image, dictating a report and communicating the report to the patient's physician could take several days, which increased patients' anxiety about the results and delayed the next stage of their care (Kywi, 2005)."

The PACS system of approaching the field of medical imaging included several steps that created a more smooth flowing exchange of information between the medical imaging departments, the physicians and the patients.

Some of the benefits that occur with the PACS system include:

physicians to have access to all radiological images from their own computers;

clinicians at different locations to be able to simultaneously view the images;

access to images and reports to be nearly instantaneous, to improve both the quality of healthcare delivery and the efficiency and productivity of staff;

to create a digital archive that would help ease the process of comparing current images to past exams;

to make a complete break with the world of film (Kywi, 2005)."

All of these advantages lead to one outcome, better health care delivery to the consumers. Physicians no longer have to wait until a courier delivers results from tests that they have ordered. With PACS they can sit at the computer in their office or at home and pull any results that they need.

With PACS physicians no longer have to send one set of films or results to specialists one by one as the patient sees them. With the click of a mouse and a few well placed signals from the keyboard many physicians or clinics can view the results at the same time (Kywi, 2005).

The PACS system provides many benefits to the medical community including cost reductions. It has been estimated that almost half a million dollars are saved annually in chemical and film that is no longer needed.

PACS is also responsible for boosting productivity and has been credited with improving the use of resources. When a physician needs to examine a study or procedure that has been completed in the medical imaging field he or she can retrieve it almost as soon as it is completed without having to wait for results to be sent.

The system also provides a video radiologist clip that provides insight to the study without making the physician wait to talk to a "live" staff members.

This means that instant results are available thereby allowing the physician to make important health care decisions for patients without having delays that could be dangerous or costly.

If a physician wishes to consult with a technician or radiologist he can do so in real time. They each get on the phone, pull up the image on computer and discuss the image and the results and what the results indicate.

One recent study measured the productivity benefits of using PACS and the participants, all radiologists estimated there was a 100% increase in productivity for CT scans, MRIs and ultrasounds (Kywi, 2005).

Overall PACS has provided a new and innovative method for physicians to utilize medical imaging to their highest potential.

COLLIDE or COINCIDE

While the PACS system is undeniably important in the world of medical care because of the advantages that it provides. It creates a speedy, accurate and instant result to tests which doctors can pull up at their desk and view almost as soon as the procedure is over with. With the new abilities the system allows it has revolutionized the medical imaging field as well as many aspects of total health care.

With the decision to implement HIPAA laws the government placed mandates on health care professionals that threatened to stretch the very fabric of its boundaries. Many areas of health care had to make some significant changes in order to comply with the HIPAA regulations. The field of medical imaging was revolutionized with the implementation of PACS however, there was concern about the ability to comply with HIPAA while still using PACS to its fullest advantage.

Experts agree that only using PACS some of the time and still depending on paper and film would greatly reduce the effectiveness of PACS on productivity and health care ability in the area of medical imaging.

One of the very benefits of PACS threatens the core process of HIPAA. PACS is a field wide ability to produce medical imaging results to physicians faster than ever before in history. It allows the instant transmission of data to parties at the other end of the connection (Gater, 2004).

HIPAA provides mandates that protect the identity and many other aspects of a health care consumers life with regards to their medical needs.

On the surface it would appear that HIPAA and PACS are in direct opposition of each other with regards to privacy and security.

And if it could be found that HIPAA and PACS collide in their ability to deliver services with security then legally PACS would have to be modified or dismantled all together which would put the field of medical imaging back many years.

While there are concerns about PACS and its ability to maintain the health privacy and security standards set up by the government with HIPAA it is possible for measures to be taken that will insure PACS can continue being used while at the same time maintaining compliance with HIPAA.

The biggest concern when it comes to the use of PACS with regard to the compliance with HIPAA is the security and privacy issue. Those who are concerned believe that the instant transmission of data over a computer connection presents a risk that information will be provided to those who have not been given permission to access the information by the consumer. This leads to concerns of liability for the health care providers and anyone who was involved with the transmission of that information.

If PACS had not become an accepted standard of medical imaging delivery than there would be little concern about the ability to comply with HIPAA standards of laws as the entire medical imaging report and test result would be confined to one area. The patient would have an authorize the sharing of that information with certain entities and provide the name and address of those who would be allowed to see the results. The medical imaging department would then send by courier the results that had been released and they would be signed for at the receiving physician's office.

This would be a safe guarded method that would insure that HIPAA laws were being complied with. However, in light of PACS and the revolutionized abilities that it has provided to the medical community, few if any health care workers would volunteer to give it up to go back to the pervious methods of waiting for days to have results delivered to them through a courier or the mail.

With the advances that PACS has provided for the medical imaging field as well as those that depend on the field for their medical needs it would be a significant disservice to society to stop its use at this point in history. Instead it is important to maintain its use and continued improvement as technology avails itself to such advantage.

The laws of HIPAA are federally mandated therefore PACS is bound by them as well as anyone who uses the PACS system for the storage, retrieval and transmission of medical imaging procedures that have been performed on patients.

When one examines the true scope and depth of the PACS system however one will see that it is indeed a system that coincides with the expectations and mandates of the HIPAA laws.

The first indicator that PACS dovetails with HIPAA is the need for passwords and various codes to get into the system and maneuver around its components. When PACS is first installed there is a training period in which those who will be working with the medical imaging department will be trained in how to use passwords and codes to open and enter the system. In addition, many hospitals and other medical facilities have opted to change and rotate passwords on a frequent basis thereby reducing even further the chance that the information contained within the storage area of the system will be accessible by a hacker.

The second indicator of the fact that PACS and HIPAA actually coincide is the voice recognition ability that PACS has installed. With voice recognition it is virtually impossible for someone other than the intended participant to gain access to the information held within that file or folder.

One of the chief concerns about PACS complying with the HIPAA laws is the concern of human error. Human error creates a possible breach in security if a health care worker forgets to log off or accidentally leaves the screen up and walks away from the area and someone not authorized to access the medical imaging information approaches the computer.

While this is a valid concern it is not a different concern than would be valid if film and paper reports were used. Someone could also leave those open on a desk and walk away while someone who was not authorized to have the informati0on approached the desk and accessed that information,.

Proper training about shutting down the system and logging off when finished with it can help to prevent such errors.

The final concern about HIPAA and PACS is the fact that someone on the other end is receiving private medical information about a patient.

This is a concern because the person who is sending the information could easily type in a wrong email address or other code.

This problem has been easily resolved by PACS use of encryption. Encrypted information is setup in a way that the receiving party has to have an exact code or set of codes in order to open the information.

If the sender accidentally sends it to the wrong party it will not create a liability issue for the receiver or the sender as both of them have to be able to use the encrypted code both to send it and to open it on the receiving end.

This use of encryption helps to insure that the proper parties receive the information. In addition to the wrong place receiving it the encryption also protects the information when it reaches the correct physician office but has many people working in that office. For instance a receptionist, a medical assistant and a bookkeeper may all work in the office but the patient has not released permission for those people to see the records nor is there any reason for those people to see records. The encryption allows only those within the office that need to have access to the medical imaging results and tests to have that access by requiring that they enter an encryption code to open it and read it.

CONCLUSION

While HIPAA produced some issues of stress for many areas of the health care field it didn't cause PACS to have to make any additional adjustments. PACS already has several standards in place that dictate the privacy and security of the information and the patient be maintained.

Through the use of encryptions and passwords PACS coincides with the privacy mandates that the government set out with the recent HIPAA laws.

The need for further study is inherent to any system that uses technology today. With the developing abilities of hacking as well as the continued advancement of the medical imaging field it will be important to continue monitoring the abilities of the system against the mandates of HIPAA. Issues including patient release of information, physician access and delivery methods are all areas of concern as the PACS system sends medical imaging information nationwide to the health care providers who need those results quickly in order to provide the best service possible for their patients.