Q&A: You've got questions! We've got answers!
Physician Practice Insider, May 16, 2017
Submit your questions to Editor Karen Long Rayburn at klong@decisionhealth.com, and we will work with our experts to provide you with the information you need.
Q. Since our last risk analysis, we’ve added a patient portal. Do we need to include the patient portal in our risk analysis?
A. Yes, because it represents a potential threat to your patient’s protected health information (PHI). When you make any significant change to your IT infrastructure or make any major changes to your business or clinical practices, it’s recommended that you assess the risk before the change and after the change. If a risk analysis was conducted within a year of that change, there isn’t a reason to completely redo the risk analysis, though. A full risk analysis should be conducted annually, especially if you’re receiving Meaningful Use (MU) dollars.
When systems change, like adding a patient portal, it’s a good idea to assess what those changes mean as it relates to risk and mitigate identified risks before making the change. After the change is made, check to make sure the risks you identified and addressed were actually mitigated and that no new risks arise that could threaten your patient’s PHI. This should be included as a process in your risk management program. A risk management program is sound security practice and is a HIPAA and MU requirement.
Editor’s note: This question was answered by Chris Apgar, CISSP. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your questions to Editor Karen Long Rayburn at klong@decisionhealth.com.
Related Products
-
Physician Practice Perspective
Physician Practice Perspective subscribers can find the archive of issues on the Part B News website. Find more information...
-
Medical Environment Update
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
HealthLeaders Media Physician Leaders
HealthLeaders Media Physician Leaders offers commentaries that focus on the hottest issues for doctors as well as concise...
-
Medical Environment Update - Electronic and Print, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
Medical Environment Update - Electronic, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
Most Popular
- Articles
-
- Practice the six rights of medication administration
- Keyes Q&A: Cross-corridor doors, hydraulic placards, HVAC, fire alarm testing
- Note similarities and differences between HCPCS, CPT® codes
- Differentiate between types of wound debridement
- Don’t forget the three checks in medication administration
- OB services: Coding inside and outside of the package
- Q&A: Primary, principal, and secondary diagnoses
- What to include on the incident report
- Know guidelines and subtle differences in code descriptions for laceration repairs
- ICD-10-CM coma, stroke codes require more specific documentation
- E-mailed
-
- Cost of sepsis readmissions exceeds $16,000 per patient
- Recognize levels of observation codes and clear up common misconceptions
- Cost of sepsis readmissions exceeds $16,000 per patient
- Cost of Sepsis Readmissions Estimated at More Than $16,000 Per Patient
- Note from the instructor: Billing Outpatient Laboratory Services - TOB 131 vs. TOB 141
- Tip: Reporting tobacco use in ICD-10-CM
- Differentiate between types of wound debridement
- Correctly code for new cardiac, pulmonary rehab benefits
- Coding, billing, and documentation tips for teaching physicians, interns, residents, and students
- Coding Clinic reiterates guidelines for provider documentation
- Searched
