HIPAA Q&A: Taking PHI home
HIPAA Weekly Advisor, October 5, 2009
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Q. Several weeks ago, some security specialists indicated that their staff members take paper PHI home with them to get caught up on their work. Is taking PHI home to process it legal?
A. Yes, workforce members may process electronic and nonelectronic PHI remotely from their homes. The HIPAA security and privacy rules do not prohibit this practice. However, the rules do require adoption of appropriate remote access policies, procedures, and practices that include transporting the PHI securely and reasonably ensuring that it is secure when processed remotely.
Taking PHI home represents an additional security risk, as does any work performed remotely that requires access to electronic or nonelectronic PHI. A significant risk exists when organizations fail to implement appropriate remote policies, procedures, and practices and fail to monitor remote access and PHI use regularly.
CMS published remote access guidelines in 2007 that facilities and their remote workers should follow. The guidelines do not address remote use of paper PHI, but they include guidelines to minimize risk.
Taking any PHI home creates new environments that need to be secure—the mode of transportation a full- or part-time teleworker uses to carry PHI and the home where he or she accesses it.
Editor’s note: Chris Apgar, CISSP, answered this question. This is not legal advice. Consult your attorney regarding legal matters.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
HIPAA Training Handbook for Business Associates
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Executive, Administrative and Corporate Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
Most Popular
- Articles
-
- HealthDataInsights posts new issues for medical necessity claims
- New FAQ posted on storing laryngoscope blades
- Q&A: Incidental disclosures and patient privacy
- What does case-mix index mean to you?
- Tip of the Week: Treat faculty orientation like resident orientation
- Capturing all necessary codes for IUD insertion and removal can be challenging
- Topic: CMS, OESS post new security compliance review information, checklist
- Q/A: New device pass-through categories
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- News and briefs: GA may increase residency number s across state, but cut main hospital?s budget
- E-mailed
-
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- What does case-mix index mean to you?
- Tip: Know the common bunionectomy procedure codes and how to use them
- Code changes should help ease the pain when coding for facet joint injections
- Documentation and coding for toxic metabolic encephalopathy
- News and briefs: UA study links lack of empathy in residents to long shifts
- OB services: Coding inside and outside of the package
- Don't let improper discharge disposition codes fly under the radar at your facility
- Discharge Planning Under the MDS 3.0
- Correctly code for new cardiac, pulmonary rehab benefits
- Searched