• E-mail
• Print
• RSS

JCAHO's 2004 IM standards more consistent with HIPAA

HIPAA Weekly Advisor, July 18, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

There is a connection between HIPAA and the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) patient rights standards, but the JCAHO confidentiality and security standards (IM.2.10-2.30) have an even stronger link to HIPAA. The JCAHO updated the standards for 2004, and they are now more consistent with privacy and security rule requirements.

Elements of performance for the 2004 hospital standards include the following:

• Develop a written process (in one or more policies), based on and consistent with applicable law, that addresses the privacy and confidentiality of information
• Monitor information and developments in technology to improve privacy and confidentiality
• Remove personal identifiers to the extent possible, while maintaining the usefulness of the information, when using and disclosing health information
• Develop a written process (in one or more policies), based on and consistent with applicable law, that addresses information security, including data integrity

But the Joint Commission only surveys compliance with its standards, says Charlene Hill, spokesperson for the JCAHO. "While our standards are consistent with HIPAA, they do not possess the specificity of HIPAA, such as a requirement for a [privacy official]."

Editor's note: See the upcoming August 2003 issue of Briefings on HIPAA to read more. Go to for more information or to subscribe. Go to http://www.jcaho.org to download a PDF of the JCAHO's "2004 Hospital Accreditation Program Standards."