The healthcare industry often uses portable devices for the storage and transmission of protected health information. I find it concerning to hear many of the people I speak with thinking that because they use a jump drive or an external hard drive to store patient information, they are compliant. It simply isn’t true.
The HITECH Act now specifically says that information must be encrypted during transmission AND at rest. That means all of the patient information you are storing on any kind of portable device must also be encrypted. In the publication by OCR of breaches, you will find a good many of them are as the result of theft or loss of a laptop or jump drive.
In a recent conversation I had with a transcription service owner, who is a business associate and thus subject to these new laws, the response to the above information was “well, the customers don’t care so I can’t be responsible for it.” If you read the laws, you realize this is not the case and that business associates are held to the same standards as the covered entity. In addition, you are responsible for the actions of your subcontractors. Simply “telling them to use an external drive for storage” doesn’t relieve you of that responsibility.
Simply storing things on an external drive without encryption isn’t good enough. Be sure you are not caught in this situation. Encryption is a must to provide a “safe harbour” if you have a breach. If you are audited, it could mean monetary penalties and fines for you.
Kathy Nicholls has been involved in the medical transcription industry for over 30 years and is currently the president of the HIPAA4MT Site [http://hipaa4mt.com], which offers guidance for medical transcriptionists and medical transcription companies on compliance with HIPAA and the HITECH Act. She also operates the MT Tools Online [http://mttoolsonline.com] website, which provides continuing education for healthcare documentation professionals. Nicholls is also the published author of the “Stedman’s Guide to the HIPAA Privacy Rule,” and is working on the second edition of that book. She is a certified medical transcriptionist and a Fellow of the Association for Healthcare Documentation Integrity.