Are PDAs a threat to HIPAA?
HIPAA Weekly Advisor, August 27, 2001
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Q: Increasingly our physicians are using their personal digital assistants (PDAs) to download patient records to take home or work on after hours. Should I be concerned about these practices from a HIPAA perspective?
A: As more and more healthcare providers use PDAs or handheld computers to store their appointments, patient information, and prescription data, the likelihood of security threats increases. Many providers "synch-up" their PDAs with their appointment schedule and may download information from home to a central server. PDAs are notoriously insecure as few of them have any built in security features. If you have providers using PDAs to store PHI (protected health information), you need to add password authentication at a minimum. In addition, a number of technology vendors are providing PDA add-ons which provide stronger authentication such as digital signature or fingerprint recognition. In the meantime, I recommend the following procedure for securing handhelds:
- Apply encryption to handhelds
- Use secure sockets layer (SSL) encryption for data transported over the Internet
- Require a automatic screen saver for handhelds
- Develop a policy on the use of handhelds to store patient data
Details on mobile computing and security products can be found at http://www.MOHCA.org or http://www.pdamd.com.
Editor's note: Answered by Jon Bogen, president of HealthCIO Inc. in Duxbury, MA. If you have a question for him, write to BOH, P.O. Box 1168, Marblehead, MA 01945, or send an e-mail to BOH editor Brian Driscoll at bdriscoll@hcpro.com.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- HealthDataInsights posts new issues for medical necessity claims
- Running an effective peer review committee meeting
- Sneak Peek: Effort underway to establish caseload benchmarks
- New FAQ posted on storing laryngoscope blades
- Q&A: Incidental disclosures and patient privacy
- Tip: Perform your own internal investigation prior to government audit
- What does case-mix index mean to you?
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- HHS task force: Consider privacy, security with text messages
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Tip: Correctly code bilateral pain management procedures
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- COT basics to best
- Documentation and coding for toxic metabolic encephalopathy
- Guidance and tact key to compliant, effective physician queries
- Searched