HIPAA Q&A: Transporting records to satellite clinic
Compliance Monitor, June 13, 2012
Q: Our physician practice operates a satellite clinic. The practice does not use an electronic medical record. Charts are transported to a workforce member’s home at the end of the week and are transported to the satellite clinic Monday morning. Does this practice violate HIPAA? Also, who is responsible for the breach of patient PHI if someone steals the charts from a workforce member’s vehicle?
A: HIPAA does not prohibit transporting charts temporarily to a workforce member’s home. Medical practices that do so must reasonably ensure that charts are secured while they are en route and temporarily stored at the workforce member’s home. Ideally, store charts in a locking file cabinet or safely in the workforce member’s home.
Exercise the same care that is necessary when transporting laptop computers. Don’t leave charts in plain sight in unattended vehicles. If it becomes necessary to leave charts in an unattended vehicle, lock them in the trunk or out of sight of passersby if there is no trunk. These practices (transportation and remote storage of charts) must be documented in policy and enforced.
If the charts are stolen, ultimately the practice is liable. The incident would be considered a breach of unsecure PHI, and the practice would be required to notify patients within a reasonable period of time and follow all requirements of the interim breach notification rule (45 CFR 164.400–164.414).
Editor’s note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, Ore., answered this question. He has more than 17 years of experience in information technology and specializes in security compliance, assessments, training, and strategic planning. Apgar is a board member of the Workgroup for Electronic Data Interchange and chair of the Oregon and Southwest Washington Healthcare, Privacy and Security Forum.
Related Products
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
-
HIPAA/HITECH Omnibus Final Rule: Stay Compliant With 2013 Changes
Is your organization ready to comply with the HIPAA Omnibus Final Rule? Our experts help you understand the Rule and help...
-
The HIPAA Omnibus Rule
Understand the HIPAA Omnibus Rule and what you must do to ensure compliance
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
Most Popular
- Articles
-
- Note from Hugh
- Q/A: How should we report irradiated blood products?
- 2014 SNF Proposed Rule Analysis: Revising and rebasing the SNF market basket
- Depressing Leapfrog scores haunt hospitals
- Reminder: MDS correction policy to be updated effective May 19
- Ask the expert: BIMS assessment
- CMS issues transmittal to update the Medicare Provider Reimbursement Manual
- CMS corrects edit 84, deletes modifiers
- Residents say cause of death reporting often inaccurate
- Creative Ways to Trim Nurse Staffing Costs
- E-mailed
-
- Georgia hospitals scrambling to create residency positions
- Q/A: How should we report irradiated blood products?
- CMS looking for comments on molecular pathology payments
- Tip of the week: Build a successful website to impress candidates
- Applying multiple procedure payment reductions to therapy cap amounts for Critical Access Hospital (CAH) claims
- Joint Commission seeks input on behavioral health home certification
- Depressing Leapfrog scores haunt hospitals
- Don't burn those ICD-9-CM Manuals just yet
- HCA initiative boosts flu shots among hospital workers
- Tip: Keep an eye on evolving molecular pathology codes
- Searched