EHR Privacy and Security

The purpose of this assignment is to understand how legislation has driven EHR design and use.

Prepare a PowerPoint presentation (10-15 slides) reflecting on the legislation that has affected the privacy and security of EHRs. Each slide should include speaker notes. Address the following:

How did the Institute of Medicine (IOM) and Computer-Based Patient Record Institute (CPRI) lead the way in the conceptualization of EHRs?
Describe the HITECH Act and how it has impacted EHR design and use.
Explain at least two benefits and challenges of the HITECH Act
Describe Promoting Interoperability (formerly called Meaningful Use) as outlined in the HITECH Act.
Describe at least five different types of security measures and include the components of each security measure.
Refer to the resource, ”Creating Effective PowerPoint Presentations,” located in the Student Success Center, for additional guidance on completing this assignment in the appropriate style.

While APA style is not required for the body of this assignment, solid academic writing is expected, and documentation of sources should be presented using APA formatting guidelines, which can be found in the APA Style Guide, located in the Student Success Center.

Rubric

Course Code	Class Code	Assignment Title	Total Points
HCI-655	HCI-655-O500	EHR Privacy and Security	80.0

Criteria	Percentage	1: Unsatisfactory (0.00%)	2: Less Than Satisfactory (74.00%)	3: Satisfactory (79.00%)	4: Good (87.00%)	5: Excellent (100.00%)
Critera	100.0%
IOM and CPRI	5.0%	An explanation of how IOM and CPRI lead the way in EHRs is not present.	An explanation of how IOM and CPRI lead the way in EHRs is present, but it lacks detail or is incomplete.	An explanation of how IOM and CPRI lead the way in EHRs is present.	An explanation of how IOM and CPRI lead the way in EHRs is present and well developed.	An explanation of how IOM and CPRI lead the way in EHRs is present and thorough.

HITECH Act and Its Affects	10.0%	A description of the HITECH Act and how it has affected EHR design and use is not present.EHR Privacy and Security	A description of the HITECH Act and how it has affected EHR design and use is present, but it lacks detail or is incomplete.	A description of the HITECH Act and how it has affected EHR design and use is present.	A description of the HITECH Act and how it has affected EHR design and use is present and well developed.	A description of the HITECH Act and how it has affected EHR design and use is present and thorough.

HITECH Act Pros and Cons	10.0%	Two pros and two cons of the HITECH Act are not present.	Two pros and two cons of the HITECH Act are present, but lack detail or are incomplete.	Two pros and two cons of the HITECH Act are present.	Two pros and two cons of the HITECH Act are present and detailed.	Two pros and two cons of the HITECH Act are present and thorough.

Promoting Interoperability	5.0%	A description of Promoting Interoperability is not present.	A description of Promoting Interoperability is present, but it lacks detail or is incomplete.	A description of Promoting Interoperability is present.	A description of Promoting Interoperability is present and well developed.	A description of Promoting Interoperability is present and thorough.

Security Measures	10.0%	Five security measures and components are not present.	Five security measures and components are present, but lack detail or are incomplete.	Five security measures and components are present.	Five security measures and components are present and well developed.	Five security measures and components are present and thorough.

Presentation of Content	30.0%	The content lacks a clear point of view and logical sequence of information. Includes little persuasive information. Sequencing of ideas is unclear.	The content is vague in conveying a point of view and does not create a strong sense of purpose. Includes some persuasive information.EHR Privacy and Security	The presentation slides are generally competent, but ideas may show some inconsistency in organization or in their relationships to each other.	The content is written with a logical progression of ideas and supporting information exhibiting a unity, coherence, and cohesiveness. Includes persuasive information from reliable sources.	The content is written clearly and concisely. Ideas universally progress and relate to each other. The project includes motivating questions and advanced organizers. The project gives the audience a clear sense of the main idea.

Layout	10.0%	The layout is cluttered, confusing, and does not use spacing, headings, and subheadings to enhance the readability. The text is extremely difficult to read with long blocks of text, small point size for fonts, and inappropriate contrasting colors. Poor use of headings, subheadings, indentations, or bold formatting is evident.	The layout shows some structure, but appears cluttered and busy or distracting with large gaps of white space or a distracting background. Overall readability is difficult due to lengthy paragraphs, too many different fonts, dark or busy background, overuse of bold, or lack of appropriate indentations of text.	The layout uses horizontal and vertical white space appropriately. Sometimes the fonts are easy to read, but in a few places the use of fonts, italics, bold, long paragraphs, color, or busy background detracts and does not enhance readability.	The layout background and text complement each other and enable the content to be easily read. The fonts are easy to read and point size varies appropriately for headings and text.	The layout is visually pleasing and contributes to the overall message with appropriate use of headings, subheadings, and white space. Text is appropriate in length for the target audience and to the point. The background and colors enhance the readability of the text.

Speaker Notes	10.0%	Speaker notes are not present.	Speaker notes are present, but lack detail or are incomplete.	Speaker notes are present.	Speaker notes are present and well developed.	Speaker notes are thoroughly developed.

Mechanics of Writing (includes spelling, punctuation, grammar, language use)	5.0%	Slide errors are pervasive enough that they impede communication of meaning.	Frequent and repetitive mechanical errors distract the reader.EHR Privacy and Security	Some mechanical errors or typos are present, but they are not overly distracting to the reader.	Slides are largely free of mechanical errors, although a few may be present.	Writer is clearly in control of standard, written, academic English.

Documentation of Sources (citations, footnotes, references, bibliography, etc., as appropriate to assignment and style)	5.0%	Sources are not documented.	Documentation of sources is inconsistent or incorrect, as appropriate to assignment and style, with numerous formatting errors.	Sources are documented, as appropriate to assignment and style, although some formatting errors may be present.	Sources are documented, as appropriate to assignment and style, and format is mostly correct.	Sources are completely and correctly documented, as appropriate to assignment and style, and format is free of error.

Total Weightage	100%	EHR Privacy and Security

MORE INFO

EHR Privacy and Security

Introduction

Patient privacy and security are top priorities for doctors and other healthcare providers. If your patients trust you with their information, it’s important that you keep the same level of care in mind when using and sharing that information. Here are some tips to help make sure your EMR is safe:

Measuring Progress

The best way to measure progress is by tracking how many patients you have and how many visits you have had. You can also measure progress by tracking how many patients you see in the last month.

Security Awareness Training

Security awareness training is a learning program designed to help employees understand how their work-related actions can lead to unintended consequences and increase the likelihood of privacy violations. The goal of security awareness training is to raise awareness about employee responsibilities and prevent unintentional misuse of patient data.

Security awareness training should be conducted at least annually by all employees who have access to patient records or other personally identifiable information (PII). It’s also recommended that this type of instruction be available in any location where PII may be used or stored, such as clinics, hospitals and doctor’s offices.

Disabling URLs from Pharmacy Websites

Go to the “Settings” tab and click on “Patient Information.”
Under “Services”, click on “Prescription History” and then select the following options:
Do not show me any links to my prescription history (unless I give permission)
Show me only links from my current pharmacy website

Allowing email access to medical staff only

You can also restrict access to email. If a patient has been given permission to receive emails from the doctor, they may want to read them as well. However, if your EHR system allows this and you do not have a way of restricting the number of people who can receive messages from a single patient’s account (e.g., by using advanced filters or tags), then there is potential for abuse by unauthorized individuals who would simply open any emails that were sent without their consent or knowledge.

To prevent this type of scenario from occurring:

Limit who can access your system; don’t give anyone access except those who need it for their job duties—this includes administrative staff with limited permissions within your organization as well as medical practitioners themselves

Specifying only one authorized recipient for the e-prescribing of controlled substance (EPCS) reports

There are two ways to specify only one authorized recipient for the e-prescribing of controlled substance (EPCS) reports:

Specify that you want to send an EPCS report to your patient’s primary care physician (PCP). The PCP must be a licensed prescriber, registered with their state, and authorized by the patient to receive such reports.
Specify that you want an EPCS report sent directly from your practice’s EHR system into any other systems or platforms where this may be needed—like insurance claims systems or pharmacy management software—but not into another practice’s system; for example if you have multiple practices under one roof but each has its own equipment, then only ONE person in charge of managing these different types of data needs access via an API (Application Programming Interface).

Take initiative to keep your patient’s information safe.

It’s easy to take the “it’s not my job” approach when it comes to HIPAA. But HIPAA isn’t just about the patient—it’s also about you, the healthcare organization manager. You need to make sure that your organization has a privacy policy in place and that you’re aware of its responsibilities under this new law.

If you don’t have one already, create an incident response plan so that if a breach occurs, there will be someone on hand who knows what needs to happen next and how they should respond. If possible, get input from security experts on what kind of system would be best for handling these types of incidents (e-mail vs text message alerts? Social media notifications?).

Conclusion

As you can see, there are many ways to keep your patient’s information safe. Patients deserve to have their medical data protected and secure at all times. This is especially important with EHR systems that allow remote access by third parties like pharmacists, or other healthcare professionals who could use that information for malicious purposes or fraud.

Nursing Worker

EHR Privacy and Security