Electronic access to patient data has made it easier to look up information -- sometimes too easy.
You've probably heard stories about employees or others tapping patient information systems for identity theft. But the more frequent problem is snooping -- curious staff or others with system access who look at information they're not authorized to see.
It sounds innocent, but HIPAA and an increasing number of state laws that cover disclosure of information breaches don't make distinctions based on intent. An information breach is an information breach, which means physician practices not only have to find ways to keep gawkers away but also must be ready to carry out consequences -- or face them -- if a breach occurs.
A case in point: New Hampshire Orthopedics in Manchester, N.H., discovered that someone who wasn't supposed to look at a patient's information had done so -- and was telling others about what was in the file.
An employee had tapped into the electronic medical record system of Elliot Health System, which the practice and employees were authorized to use. The patient whose files were breached was an employee at the orthopedic practice. When workers started to gossip about what they had found, a practice manager contacted Elliot, which used a system audit to trace the breach back to two employees.
New Hampshire Orthopedics fired the employees, but Elliot was in the hot seat, as state law required the hospital to file a disclosure and contact the patient. The practice's name was included in the publicly available report.
[...]