St. John's hospital PHI security and HIPAA compliance gaps

PHI Security and Privacy

Privacy and security is significant for any institution operating under offices because of clients, which prompts for the need of protecting the flowing information. In the context of a hospital, there is need for protecting the client's information in order to assure them of their privacy and security. Privacy is always important when attending to the clients since it provides an environment where the latter can open up to their doctors. Privacy refers to what the protected; information about the patient and the determination of the personalities permitted to use while security refer to the way of safeguarding the information through ensuring privacy to information (Rodrigues, 2010). The patients also need security because of the inevitability of serene environment for their recovery. Even though St. John's hospital presents good strategies in terms of their sound policies, this is not enough in ensuring confidentiality in the information of the clients. The cleaning staff, referred to as the subordinate staff, still have access to the discarded printout meant for keeping the information about the clients. Considering that the cleaning staff have already accessed the information, there is need for appropriate action towards them besides an action by the IS administrator.

Response to the situation

The cleaning staff have not done wrong in this situation since the source of whole challenge is from the management. Avoiding the utility of the paper shredder is one of the major cause of the circumstance facing the company (Rodrigues, 2010). The hospital does not use paper shredder on the documents, which contain vital information about the clients. This explains why the cleaning staff have an easier access to the information. Paper shredder is important for any institution who would like to keep vital secret about their organization otherwise it would expose their weakness. This applies the same to the information provided by the clients. The use of paper shredder on the already used document is essential for the hospitals since it assures security of the information provided by the client. This hospital needs the use of paper shredder to that the employees do not leak any information, about the client, to the third party. The machine shreds the document into small pieces making the written words unreadable.

The state of the organization shows that it has not been complying with the guidance provided by HIPAA privacy rules. There is need for proper management that assures of protection for the patient's information. The management has not put proper strategies that look into the state of the flowing information. HIPAA presents a set of rules that guides the management in the context of ensuring privacy and security for the patients. The hospital has the challenge of presenting privacy and security of the patient hence the best response would be complying to the HIPAA Privacy Rules. The HIPAA lists standards within which the hospital can relate with the patients while ensuring their privacy and security. The rules provides determines the information type that needs protection and the situations in which disclosure may be inevitable. The HIPAA privacy rules also defines when an individual can have right of controlling the use of his personal information (Rodrigues, 2010). This rule is often important to PHI because of their universality in application since the hospital can use it any situation including electronic, paper and oral. This privacy rule is applicable in the situation of the hospital because the latter need a better way of ensuring privacy and security for their patients.

Use of paper shredders and other electronic devices

There is need for paper shredders in every office inside the institution. Apart from putting the paper-shredding machine in every office, I would consider training the employees on using the paper shredders. I would advise them to shred the papers on the exit of the patients to ensure that no party have access to the information. Anyindividual, who would fail to do so, would be a subject to punishment by the administration. Putting the paper shredders in every office besides advising the employees to use them would be important in avoiding unnecessary leakage of information to the other individuals. Installing proper computer facilities will also help in implementing the management plans. I would advise the employees to secure their transmission mechanism such as email. For instance, the use of unencrypted email would not comply with HIPAA since it presents possibility for the leakage of the information to third party. Consequently, the implementation process would involve developing safe and secure method of electronically storing and transmitting mandatory public health reporting (HRSA, 2013).

Compliance to the HIPAA

The compliance to the HIPAA privacy rules is important in the implementation of the management plan. There is need to make the employees aware of all the HIPAA rules ensuring that all their actions are within the provision of the privacy rules. The HIPAA informs the employees on the situations when they can expose information about a client and when they ought to keep the information private. The table below shows the description of patient's data privacy and protection:

WHEN YOU CAN, MUST, AND CANNOT SHARE PHI

Without Written Patient Permission

Only With Written Patient Permission

Can Share

Must Share

Cannot Share

Can Share

With the patient

For treatment, payment, and health care operations purposes

When the patient agrees to share PHI

In the case of incidental use or disclosure

In the public interest

For a limited dataset (which includes PHI but direct identifiers of individuals and their relatives, household members, and employers have been removed) for the purposes of evaluation, public health, or health care operations

With the patient (or their personal representatives) when they request access to, or an accounting of, disclosures of their PHI

With HHS when it is undertaking a compliance investigation or review or enforcement action

Any other PHI with any other entity

Exceptions to this include:

Business associates under a business associate contract

Personal health information that has been de-identified so that it cannot link back to the patient

All other instances in which you plan to use or disclose PHI for reasons other than treatment, payment, health care operations, or activities otherwise permitted or required by the Privacy Rule

HIPAA Privacy Rule. Retrieved from: http://www.hrsa.gov/healthit/toolbox/HIVAIDSCaretoolbox/SecurityAndPrivacyIssues/howcanimaintainpat.html

The above plan shows that the employee can only disclose patient's PHI in case an individual would like to access the information for other treatment purposes. However, the HPPA also shows that the employee should disclose less than 30% of the patient's information in case of the treatment purposes. The employee should not disclose information about the status of the client, in case of HIV / AIDS to save the image held by the latter. The employee should also avoid informing the client about releasing their PHI since this would serve as a coercing factor. The clients normally feel coerced when releasing their PHI consequently there should not be authorization on the client.

Code of conduct

The use of a code of conduct would be useful in implementing the management plans. It is important to create a code of conduct within which the involved subjects, associated with the hospital would have to comply with them. Any individual who go against any of the code of conduct would be subject to punishment by the administration. Any individual who goes to have association with the hospital must be aware of the code of conducts. This means that the management would make available the code of conducts to every individual who visit the hospital. Everyone having association with the hospital must have knowledge about the code of conducts to ensure that they do not perform action out of ignorance. To ensure that every individual have access to the code of conducts, the management would post the code of conduct in all the strategic places around the hospital. The following is the code of conduct:

Confidentiality

The hospital has commitment to ensuring the highest degree of confidentiality when dealing with any client including the potential and the current ones. The hospital maintains commercial confidentiality besides providing protection for all the personal information. This also applies to all the supplier and associates of the hospital.

Ethics

The hospital has trained its employees to exhibit honesty and honor in all their actions, thereby expects the same from the suppliers and clients. All the employees exhibit actions within ethical consideration because of the adequate training and strategic assistance. The hospital also considers the moral position of the third party who may want to benefit from our institution.

Duty of care

Any advice and actions towards our clients will always be in alignment with the relevant laws. Consequently, any individual associated with the institution should not exhibit actions that may be against human rights. We also require our associate to avoid any actions, which may adversely interfere with the environment set for the patients and the institution as large. There should be no noise within the premises.

Intellectual property and moral rights

The hospital retains all the moral rights regarding the intellectual properties created within the institution. We also respect the moral rights of our client and will do anything to protect their stake on the intellectual properties.

Quality assurance

We maintain a continuous contact with our clients to ensure they are always present during the review of our activities and outcomes. We encourage any client to be free in contributing their ideas during the review process to ensure that the hospital incorporate their views, especially those regarding privacy and security.

Reference

HRSA, (2013). How Can I Maintain Patient Privacy in a Health Information Technology

System? retrieved from: http://www.hrsa.gov/healthit/toolbox/HIVAIDSCaretoolbox/SecurityAndPrivacyIssues/howcanimaintainpat.html

Rodrigues, J. (2010). Health information systems: Concepts, methodologies, tools and applications. Hershey PA: Medical Information Science Reference.

Harman, L.B., & American Health Information Management Association. (2006). Ethical challenges in the management of health information. Sudbury, Mass: Jones and Bartlett

Publishers.

Nass, S.J., Levit, L.A., Gostin, L.O., & Institute of Medicine (U.S.). (2009). Beyond the HIPAA

privacy rule: Enhancing privacy, improving health through research. Washington, D.C:

National Academies Press.