Reopen with Renewed Focus on Protecting Patient Privacy
Have you ever gone to an appointment of your own as a patient and observed a number of things that made you uncomfortable? Perhaps when you checked in you didn’t like the idea of writing your name on a sign-in sheet that had the name of all patients in the office that day. Or maybe the front office team was freely and audibly discussing Mr. Jones’ case and you wondered if they’d talk about you like that after you left. Whatever the situation, you have certain expectations surrounding security of your personal information and you expect that health care teams will work to protect your privacy.
Your patients are no different. Your commitment to privacy and security is a commitment to not only your patients but also your practice. And a key part of a solid internal privacy and security program is the Security Risk Assessment.
What is Security Risk Assessment?
A Security Risk Assessment (SRA) is an analysis that involves identifying the risks in your practice, your technology and your processes to verify that controls are in place to safeguard against security threats.
How to Get Started
Our practice is a big proponent of “staging” the patient experience by stepping outside of the office and re-entering through the eyes of a patient. We ask ourselves “What do you see?” “What do you hear?” even “What do you smell?” all in the interest of improving patient impressions. And it’s by looking through the lens of the patient that we’re truly able to appreciate areas for improvement. Importantly, it’s not a one-time exercise, either, because ensuring that we’re putting our best foot forward is a never-ending responsibility.
That same thinking and process can be applied to privacy and security within the walls of your practice. In fact, that’s at the core of the security risk assessment process expected by HIPAA and quality reporting programs like MIPS and Promoting Interoperability. Your SRA process should evaluate the patient data in your practice, identify risks to the privacy and security of that data, and then organize those risks into a plan for mitigation. As an example, if you identified that a workstation in your dispensary was oriented in a way that allowed patients to see your EHR, which could be listed as a risk for mitigation and assigned a “due date” for resolution. Your due date for a specific risk could be based on scope of work required relative to the potential impact of not addressing it.
Importantly, the identification of risks is expected. If your SRA doesn’t identify anything that needs attention there’s a good chance you didn’t look hard enough. Said differently, the presence and identification of risks is not the problem. The lack of a plan and efforts to reduce those risks is. A well-documented SRA and mitigation plan can be the foundation of your internal security policies and practices and will serve you well in a 3rd party audit.
Action Plan
RevolutionEHR is committed to staying on top of eye care industry updates on behalf of our customers. Subscribe to our blog here. If you’re interested in partnering with us for EHR software and practice solutions, contact us at sales@revolutionehr.com or 877-738-3471 x1 or explore our solutions on our website here.