Gap Analysis for Closed Loop Referrals
The need to have appropriate information sharing system when a patient is referred from one clinician to another, or one health facility to the other has been on the rise. There has been a general concern among medical practitioners that the current systems do not allow for adequate sharing of patients’ information during the hand-offs. For this reason, there has been need to close the loop and allow for a comprehensive sharing of information between the clinicians as a way of understand the conditions of the patient better.
Closed-Loop Referrals have become popular as a way of ensuring that health practitioners share patients’ information as appropriate. According to Kelly and Shah (2009), closing the loop, “Implies that clinical information flows easily during a medical referral- the referring clinician is able to let the recipient clinician know the pertinent information about the patient being referred, and the recipient can let the referring clinician know the opinions and recommendations that result from the referral.” This two-way communication design allows the clinicians understand how a patient’s case can be addressed in the most effective manner. Technology has played a pivotal role in making this possible.
It is important to note that despite the progress that has been made in closing the gap during referrals, security gaps have emerged, jeopardizing the positive gains that have been made in this field. These security issues have affected communication in various ways, and to varying degrees. There are cases where these loops have had serious negative consequences to information within given systems. In other cases, the gap has exposed patients’ information to third parties, which is against policies in this sector. It is important to understand these security gaps in order to be able to address them appropriately.
One of the leading security issues in this system is unauthorized users. When this system is developed to enable clinicians share vital information during patient referrals, there are cases where unauthorized users get access to the system. These unauthorized users may be other hospital workers who are not authorized to use this system. This means that they can pass inappropriate message to other users, which may be misleading. To address this issue, users should have their accounts protected by strong passwords to deter unauthorized persons from using them.
Another security issue is the possible eavesdropping by third parties, especially when handling classified customer information. There are cases where third parties get ways through which they can eavesdrop on some important information on patients and share such information with other parties in bad faith (State Health Information Exchange Program, 2012). This security gap may pose serious integrity issue for the health care facility and the practitioners involved. The gap can be controlled by having a secure point of service stations that cannot be accessed easily by third parties.
The issue of corrupt data has also affected the initiative to use telecommunication technologies to close the loop during referrals. Corrupt data refers to any piece of information about a patient that is not accurate as authored by the referring clinician or the receiving practitioner. Corruption of data can occur because of a number of reasons. One of the ways through which data can get corrupt is by deliberate action of unscrupulous individuals who get access to the system and feed wrong information.
Another reason that could bring about corruption of data is a situation where the system has bugs that affect data once it fed into it. Irrespective of the reasons that cause this corruption, corrupt data has serious negative impact on the actions of the health practitioners who are receiving the patient. This is because the data they shall receive may be complete opposite of the true status of the patient. This means that they will start treatment using irrelevant information. As Cress (2012) observes, it better to start treatment with no information at all than to do so with distorted information.
To address this issue, database administrator and operating system administrator should develop strong firewall that will protect data from any interference from external sources. Each of the users of this system must also observe security measures by protecting their accounts with passwords and ensuring that third parties do not have access to their user accounts.
The issue of accountability may also raise security concern, especially when there are a huge number of users sharing the same system. The ultimate aim of this system is to bring together as many health practitioners and healthcare facilities as possible in order to create an efficient way of sharing essential information during the process of referrals. However, the problem comes when the number of users is too high that it becomes impossible to account for information circulating in the system.
Lack of accountability in this sector may result into massive consequences, especially when it becomes impossible to trace specific individuals who could have posted a given information. Lack of accountability also encourages unprofessionalism among the practitioners. They know that they may not be held accountable for their information because they cannot be traced after sharing such erroneous data. To overcome this security gap, the system should have specific users at all times who will be fully responsible for any information coming from their use accounts. Such users will be responsible for ensuring that their accounts remain protected from any form of intrusion. This may involve ensuring that their offices and workstations are not accessible to unauthorized users.
According to Starfield (2008), another security issue that may arise when this system is used to close the loop during referrals is the fact that there will be too many accounts. Each of the users would need their own accounts and this may overstretch the capacity of the system. It is true that the ultimate aim of this strategy is to bring together as many health practitioners as possible within a given region so that they can easily share relevant information about patients during referrals. However, this number should be regulated to enhance security and accountability. There should be a specific number of users per given region to make the system easily manageable. The table below identifies these security gaps.
Security Requirements
This Security Requirements section describes key requirements of security rules and requirements in accordance with the HIPAA. The security rule and requirements include information on people covered and the information that is protected. Security requirements also indicate the safeguards that must be in place to place protection of sensitive electronic health information (Department of Health and Human Services, 2009). As an overview, Security Requirements section describes the Security Rule of each provision other than detailed description. Specifically, it is the requirement that the needed security measures must be observed in order to protect the Electronic Protected Health Information (Department of Health and Human Services, 2009).
Confidentiality requirement
The Security Rule requires that all protected health information to be handled with the highest level of confidentiality. According to Department of Health and Human Services (2009), “confidentiality” means that any information deemed to be e-PHI should not be accessible to unauthorized persons or institution. The requirement of the confidentiality security rule is to support prohibitions of the privacy rule against improper disclosures of Protected Health Information (Department of Health and Human Services, 2009).
Integrity and Availability Requirement
The Security rule requires that the integrity of any information deemed Electronic Protected Health Information should be upheld. According to the Security Rule, “integrity” of the information means that e-PHI must not be tampered with, altered or destroyed in any unauthorized way (State Health Information Exchange Program, 2012). Additionally, the “Availability” requirement means that e-PHI should be accessible and usable whenever needed by authorized parties.
Transactions and Code Set Standards
The rule state requires that privacy should be observed as per the standards of the HIPAA Privacy rule. According to the Department of Health and Human Services (2009), the rule on the Transactions and Code Set standards was developed to establish a federal requirement that will protect individually identifiable health information (Wilson, 2006). This is because of the fact that patient information is normally created during the patient cross-examination, then processed and stored by healthcare institutions. Most of the information that is gathered at such interactions is in electronic formats and not as paper records or oral communications. In this case, transaction standards include all electronic transactions considered to be protected under the HIPAA (Department of Health and Human Services, 2009). Therefore, it also includes the transaction between a physician and a health insurer.
HIPAA unique identifiers rule
Entities that are covered by the HIPAA are required to identify covered healthcare providers in transactions identified as standard (American Medical Association, 2013). This requirement covers organizations such as health providers handling protected electronic transactions, large health plans, covered small health plans and healthcare clearinghouses. They should comply with this rule by using the National Provider Identifier (NPI). Fully covered entities and small health plans must use the NPI from May 2008 while all covered entities using Electronic Protected Health Information must use a new single NPI from May 2006. The requirement however does not replace the DEA number or any other personal identification details of a provider (Wafa, 2010).
Privacy Rule
The HIPAA Privacy Rule regulates disclosure and the use of Protected Health Information (PHI) that is held by organizations regarded as “covered entities.” These entities include health care clearinghouses and hospitals. The HIPAA privacy rule also extends to cover independent contractors of the affected entities. According to the requirement, these entities must not disclose Protected Health Information to any unauthorized individual unless when required to do so by law.
Security Rule
The rule on Security Standards requires that from April 2003, all covered entities and small plans must put security safeguards that comply with administrative, technical and physical protection of Electronic Protected Health Information (Department of Health and Human Services, 2009). The Security Rule generally complements the rule on Privacy as it pertains to Protected Health Information such as paper and electronic data.
The requirement lays out security standards for various covered entities to enable them evaluate their own security situation. The requirement also helps such organizations to determine how to implement the specified specifications (American Medical Association, 2013). Among the standards and specifications include administrative policies and procedures, contingency plans, technical measures, internal audits policies and evaluation of potential security violations (Department of Health and Human Services, 2009).
Compliance and Enforcement Rule
The enforcement requirement was issued in regard to HIPAA enforcement from March 2006. According to Wilson (2006), the Rule demands implementation of all security and control measures under the HIPAA. Any violation to HIPAA rules attracts penalties after the established investigation and hearing are satisfied (Department of Health and Human Services, 2009).
Breach Notification Rule
This requirement protects Electronic Protected Health Information against any anticipated or impermissible use or disclosure. The rule protects any protected health information from all anticipated leakages that fit the definition of “significant harm.” Such leakage could be caused by breach of security measures or anticipated unauthorized access (Wilson, 2006). In 2013, the rule was updated to include more scrutiny of covered entities to determine the extent of any reported breaches that had been unreported (Department of Health and Human Services, 2009). Through the rule, organizations should proof that potential harm had occurred that could potentially expose protected health information.
Applicable government regulations
The government has set various regulations and standards that govern how the above requirements should be met and implemented. The state requires all covered entities to adopt all issued policies and procedures. In addition, the government demands compliance of covered entities with the requirements of the Security Rule. Therefore, a covered entity must maintain written policies and security procedures in addition to written records in relation to the required actions. This should be complied with as long as the entity handles protected health information. A covered entity is also required by the government to review and update its documentation on regular basis. This is in response to organizational and environmental changes protected health information.
Recommended Security Controls
References
American Medical Association. (2013). Understanding the HIPAA standard transactions: The HIPAA Transactions and Code Set rule. Web.
Cress, C. (2012). Handbook of geriatric care management. Sudbury: Jones & Bartlett Learning.
Department of Health and Human Services. (2009). Summary of the HIPAA security rule. Web.
Kelly, K. M., & Shah, S. M. (2009). Emergency neurology: Principles and practice. Cambridge: Cambridge University Press.
Patti, R. J. (2009). The handbook of social welfare management. Thousand Oaks: Sage Publications. 225 (4), 33–6.
Starfield, B. (2008). Primary care: Balancing health needs, services, and technology. New York: Oxford University Press.
State Health Information Exchange Program. (2012). Getting to impact: Harnessing health information technology to support improved care coordination. Washington, DC: The Office of the National Coordinator for Health Information Technology.
Wafa, T. (2010). How the Lack of Prescriptive Technical Granularity in HIPAA Has Compromised Patient Privacy. Northern Illinois University Law Review, Volume 30, Number 3.
Wilson, J (2006). “Health Insurance Portability and Accountability Act Privacy rule causes ongoing concerns among clinicians and researchers”. Ann Intern Med, 145 (4), 313–6.