Is it secure to house the health information management (HIM) department with another company that is not part of the hospital? The company is sharing space temporarily until it finds its own space.
HIPAA Weekly Advisor, October 23, 2006
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
This arrangement is insecure if the HIM department simply shares a large, open office space with the other company, allowing unauthorized users from the other company to access patient records whenever the department is not staffed.
Look for a way to protect patient records and other PHI from access by employees of the other company. The sharing arrangement is acceptable if the HIM department is either
- staffed 24 hours a day, so the employees can ensure that only authorized individuals access records
- locked when it is not staffed, and the company does not have a key to the space
Editor's note: Mary Brandt, president of Bellaire, TX-based Brandt & Associates, LLC, answered this question. This is not legal advice. Consult your attorney for legal matters.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
Most Popular
- Articles
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Catch up on what's new with injections and infusions
- Topic: CMS, OESS post new security compliance review information, checklist
- Capturing all necessary codes for IUD insertion and removal can be challenging
- What does case-mix index mean to you?
- QA:Coding multiple initial infusions
- News and briefs: Oklahoma Osteopathic Association against residency bill change
- HIPAA Q&A: Level of encryption needed for email
- OB services: Coding inside and outside of the package
- E-mailed
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- HIPAA Q&A: Level of encryption needed for email
- CMS has reformulated payments for some bilateral procedures
- Catch up on what's new with injections and infusions
- New conflicts of interest create new challenges
- Q/A. One injection code or two?
- What does case-mix index mean to you?
- Identify modifiable risk factors to prevent patient falls
- Hospitals are not bound by InterQual criteria for determining patient status
- Searched