CHRIS: If I were to pour energy in first, if I hadn't done anything else, I would pour it into working with someone like Accountable HQ or with the NIST or OCR/HHS-based sorry tools, security risk assessment, and just overall HIPAA compliance auditing tools. That would be where I would put all of my time, in training my staff, reducing access, and documenting that I'm doing all of those things. That is really the meat and potatoes of this and what you see in all of these compliance resolutions.
RON: Two things where I would put my time—from the white papers I've written literally in the last two weeks—is work with a partner like Clarity, someone who can help evaluate your software. You saw all of the resolutions and what the problems were in, the audits. The first thing was the access, right? [Access] was issue number one for the last five years. So have someone like Clarity evaluate your software, evaluate your tools, do an audit, make sure your tools are protecting and providing the ability to do that.
The second one, you see the name here, HITECH. There's a HITECH blueprint for your security infrastructure. And that's the second thing that I would do. So like Chris said, pour yourself into the tools, do the audit. At the same time, figure out if your software allowing for the protection and the control over that access to the ePHI.
I know we talked about that in the in the earlier rule when we were talking about the privacy rule back when we said the x-ray technician could go in and upload an x-ray to my record, but that x-ray technician shouldn't be able to go into my record and see that Ron has type-2 diabetes or anything else that's not in their purview. They don't have a right to that. So if you just give them admin access so that they can go in and take an x-ray and have access to upload that to my record, and then they go see something else that's of interest and then share that information, that's where that access rule is.
The people in the office and the rest within your practice need to have very scoped access to the HIPAA data that is only applicable to what they provide, when they provide it. Sometimes it's not as much as—well, they do that all the time, so they have access to that. “But they haven't seen that patient, that person hasn't been a patient forever. They shouldn't still have access to those records."