Informationmanagers.ca Logo
5 Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

5 Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

Are you a new clinic owner and wondering if social media marketing is for you?

Maybe you have been dabbling into social media marketing but now you are feeling overwhelmed?

Or, maybe you have an established social media presence but you want to learn new ways to get social media engagement.

In this Episode #109 of the Practice Management Nuggets Podcast For Your Healthcare Practice, guest expert Kayla Das of Evaspare Inc. provides 5 strategies for writing engaging social media posts for your practice!

Why Is Using Social Media Important?

​Kayla Das believes that the purpose of social media marketing is to inspire, entertain and to give more than you try to sell.

People are on social media because they want to be taken away temporarily from their day so they are much more likely to click on things that inspire, entertain or provide them some type of guidance and support.

After they gain trust with what you have to say you’ll be the first person they think of when they need professional support.

Interview Right to Hire Right Nelson Scott #1 Tip
Interview Right to Hire Right Nelson Scott #1 Tip

Kayla’s #1 Tip

​“My number #1 tip for clinic managers about social media marketing is when you are starting out is to start small. Choose only one or two social media platforms. You do not need to be on every social media platform to get engagement. Start with a social media platform that you are familiar with and that you believe that your ideal client uses.” – Kayla Das

Listen To The Podcast

​5 Strategies for Writing Engaging Social Media Posts for your Practice | Episode #109

Listen to the Practice Management Nuggets for Your Healthcare Practice podcast. Get practical practice management, and privacy tips to help you start, grow, and improve your healthcare practice. If you are a clinic manager, team lead, healthcare provider or practice owner, these practical tips will save you time and money.

I help you manage the pink elephant in the room.

Listen here: Practice Management Nuggets Podcast

Listen To The Podcast Here
social media engagement for healthcare providers Kayla Das contact
engaging social media templates Kayla Das

Featured Guest: Kayla Das, Evaspare Inc.

Kayla Das is a Social Worker and Business Coach for therapists and coaches. Kayla works with therapists to:

  • create a strong private practice foundation based on values;
  • develop marketing strategies that are authentic and generate profits; and
  • establish business systems and processes that are designed for practice sustainability.

Would you like more social media and business strategy tips from Kayla?

Pop over to the podcast show notes here to listen to the podcast!

Be sure to grab Kayla’s gift to help you create engaging social media images.

You may also be interested in:

Social media is about creating a strong digital presence and building relationships – with your clients, with employees and new recruits, and with other colleagues and allies in your field.

If you decide to use social media in your business, you need clear rules about who will authorize messages. You also need a strong social media policy to provide direction and education to your employees about what they can – and can’t – say on-line.

Social Media Practice Management Success Tip – Social media policies, procedures templates to help ensure a professional and privacy compliant presence online while also positively representing and supporting your business brand.

social media management practice management success tip
Managing Employees When They Make Mistakes With Stacey Messner

Managing Employees When They Make Mistakes With Stacey Messner

Managing Employees When They Make Mistakes – Addressing Employee Performance and Restoring the Workplace

Have you ever had an employee who has made a mistake and now you’re scrambling about what to do next?

Your business needs a set of reasonable rules and guidelines for employees to follow. This helps to create a safe and respectful workplace and protect the privacy rights of your patients and employees.

Your healthcare practice should have a written policy and procedure to guide you in your response to a privacy and security incident.

Sometimes, our employees have been directly involved in the incident. For example:

  • Petty theft (personal gain)
  • Snooping in patient or employee records (disregarding policies)
  • Faxing a report to the wrong recipient (carelessness)
  • Using patient or employee information to cause harm (malice)

When employees and healthcare providers do not meet our expectations, sanctions or discipline may be appropriate.

In this episode #105 of the Practice Management Nuggets Podcast, guest human resources expert Stacey Messner gives practical advice to clinic managers and privacy officers to navigate difficult conversations after an employee makes a mistake.

Listen To The Podcast

Managing Employees When They Make Mistakes – Addressing Employee Performance and Restoring the Workplace | Episode #105

Expert tips with Jean L. Eaton on Practice Management Nuggets Podcast For Your Healthcare Practice.

Listen here: Practice Management Nuggets Podcast

Listen To The Podcast Here
 

Are you prepared to have difficult conversations with your employees?

Grab this tip sheet from Stacey Messner free when you subscribe to Stacey’s newsletter list.

Listen in a different way

Featured Guest: Stacey Messner

Stacey Messner Will Teach You How to Manage Employees When They Make Mistakes – Address Employee Performance and Restore the Workplace

Human resources expert Stacey Messner, Leader in HR gives practical advice to clinic managers and privacy officers to navigate difficult conversations after an employee makes a mistake, addressing employee performance improvement and workplace restoration practices.

Get Stacey Messner Listen Differently Tip Sheet

Download the free tip sheet from Stacey here
 
Managing Employees Stacey Messner

Stacey Messner, Leader in HR, has been providing human resource consultation on a contract basis to businesses in the North Peace Region of Alberta since 2016.

With over 20 years of experience working in all disciplines of HR in many industries including not for profit, Stacey prides herself in providing HR services and support to leaders in workplaces who are responsible for their HR programs.

The services Stacey offers are HR advisory, training and development, workplace assessment, conflict resolution, and special projects such as job description review, HR policy manual, performance review, recruitment, and orientation programs. Stacey was born and raised in the Saskatchewan prairies and married into a Peace Country family where she lives with her husband and kids.

She is an active member in her community, loves raising a family in a rural setting, and enjoys the activities and beauty of the region.

Do You Use Employee Privacy and Security Policy and Procedure Checklist Templates?

Do You Use Employee Privacy and Security Policy and Procedure Checklist Templates?

Why Do You Need Policy and Procedure Checklists for Onboarding and Exiting Employees?

There is much excitement when we welcome a new hire to our team and there are many administrative tasks that need to take place to get this individual up and running. An employee policy and procedure checklist will help!

Policies and procedures must be in writing, available to employees, and monitored to ensure that they are followed to protect patient privacy as required by our professional colleges and privacy legislation. Otherwise, you face all sorts of risks, including privacy breaches and other legal problems.

To ensure that onboarding a new employee is a smooth transition, it is imperative to follow a practical checklist procedure to make sure no important steps are missed. There are also many other managerial benefits to adopting this high-quality process:

  • Better job performance and satisfaction
  • Greater commitment to protecting privacy in the organization
  • Reduced stress and better staff retention

Employee Privacy and Security Policy and Procedure Checklist

Policies and procedures are reasonable safeguards to protect the personal and health information entrusted to us. But polices and good intentions alone are not enough; we also need to take action to ensure our policies are understood and are being followed by all our employees.

Training new and existing staff on privacy and security best practices is instrumental in making your healthcare practice a success and maintaining its fine reputation. Following a systematic approach to welcoming a new employee, transitioning an existing employee into a new position, or offboarding an employee who is exiting will guarantee that valuable privacy and security training and accesses are completed.

Read this Privacy Breach Nugget that explains what can happen if you don’t have these good practices in place. Do You Know Where Your Policies And Procedures Are? 

New Employee Orientation / Onboarding

New employees are a welcome addition to any team and there is a vast amount of training that needs to take place from general procedures on how to handle phone calls to signing confidentiality oaths to becoming familiar with all policies and procedures, in addition to learning the everyday job duties for their own position.

Since privacy is good for business, we do not want to miss any important opportunities to train our new staff on privacy and security best practices. Using the Employee Privacy and Security Checklist will help facilitate training discussions and document the authorized accesses of each employee.

Existing Employees / Annual Review

The checklist will also act as a tool for each employee at their performance review. Provide positive feedback and observations of an employee’s successes in protecting personal information. Discuss opportunities for improvement, too. This is also a good time to review an employee’s current authorized role-based accesses and determine if any changes are needed to match the employee’s current job duties.

Ensure that the employee still has ‘tokens’ that they were given at the time of their hire, like identity badge, keys to the clinic or Alberta Netcare RSA fob.

Privacy and security best practices dictate that confidentiality oaths should be signed on an annual basis and annual privacy awareness and security refresher training should also be provided to all employees. In the event of a privacy incident or breach, it is imperative that a healthcare practice can prove by their documentation that regular privacy and security training is provided to their staff.

Transferring / Exiting Employees

When an employee transitions into a new role or is terminated, review and update the privacy and security checklist to ensure that access and permissions are appropriately modified or terminated.

Custodian Responsibility

Custodians have an obligation to ensure reasonable safeguards to protect the privacy and security of health information. This includes having appropriate policies and procedures in place, as well as demonstrating and documenting that you have implemented your plans. This is a requirement of professional college standards of practice and privacy legislation like the Health Information Act (HIA).

See the article Do You Know Where Your Policies And Procedures Are? to learn what can happen to you if you don’t have your employee training process well documented

The Employee Privacy and Security Checklist will make it easy for you to ensure your new hires, existing employees, and transferring or exiting employees are privacy and security compliant.

 

Download the FREE Report – Employee Privacy and Security Policy and Procedure Checklist Template
 

Your practice also needs to have policies and procedures that set out how you ensure the privacy, confidentiality, and security of the health information you collect, use, and disclose. Don’t know which policies and procedures you need? Download the Privacy and Security Policies and Procedures Checklist below!

Show Me the Policy and Procedure Checklist!
 

Practice Management Success

If you are a member of Practice Management Success, login and access the webinar replay, and the policy, procedure, and checklist template.

Not a member? Join today!

 

Did you enjoy this article? If you’d like to look at similar posts, visit these links:

Do You Know Where Your Policies And Procedures Are?

Why Do You Need Health Information Policies and Procedures?

Healthcare Policies And Procedures: Essential in EVERY Practice

New! Health Information Policy and Procedure Manuals

 

When we know better, we can do better…

Jean L. Eaton is constructively obsessive about privacy, confidentiality, and security expecially when it comes to the handling of personal health information. If you would like to discuss how I can help your practice, just send me an email. I am here to help you.

Jean L. Eaton
Your Practical Privacy Coach
INFORMATION MANAGERS

 
Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments – A Complete Step-by-Step Course

Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments – A Complete Step-by-Step Course

Do you need a Privacy Impact Assessment?

Or do you need to amend an existing PIA?

Privacy Impact Assessments are just one of the requirements you need in order to fulfill your obligations in Alberta’s Health Information Act (HIA) and other legislation and are an important aspect of developing privacy best practices in your office.

And a little help along the way is always a good thing.

Practical Privacy Coach, Jean  L. Eaton of Information Managers, is constructively obsessive about privacy, confidentiality, and security when it comes to the handling of personal and health information, particularly in primary health care settings. Jean has helped hundreds of healthcare providers, vendors, and health and social service delivery organizations and associations complete their Privacy Impact Assessment which have been successfully accepted by organizations’ management and regulators. Jean has customized and delivered privacy training programs for privacy officers, records management professionals, implementation teams, and healthcare providers across Canada and the US.

Now you can have access to five modules to help you learn everything you need in order to complete your own PIA.

[s3vpp id=3a4b10b9e627f27da781cdb590b784cf]

**** New PIA Amendment Track ****

Each module includes a video training, as well as templates, tools, resources and case studies to build on in each lesson. You can use this scenario to guide you through the PIA process in healthcare. If you work in healthcare or privacy or records management and need to do a PIA, this e-course is for you.

 

You need a Privacy Impact Assessment (PIA) when

  • You  are opening a new clinic or establishing a new health services program.
  • You are changing administrative procedures or technology equipment, services, or vendors
  • You are changing how you collect and use personal information,
  • You are implementing or changing an Electronic Medical Records (EMR)
  • You are sharing health information with another healthcare provider, organization, Primary Care Network or other health program.
  • You want to prevent a privacy breach,
  • You have a Privacy Impact Assessment that was written more than 2 years ago (It is time to review and update this!)

 

If you are a healthcare provider, practice manager, and you need your first Privacy Impact Assessment, this e-course is for you

Are you in a group or solo practice with direct patient care, for example:

  • Physician
  • Pharmacist
  • Registered nurse
  • Optometrist or optician
  • Chiropractor
  • Physiotherapist
  • Midwife
  • Podiatrist
  • Dentist, dental hygienist or denturist
  • Audiologist
  • Mental health practicitioner
  • Laboratory, x-ray, and imaging technician
  • Paramedic

A PIA should be as common place to a healthcare practice as a business plan is to a business. BUT most healthcare practices don’t know this and often don’t know that a PIA is  usually part of their professional college requirements and often even a legislated requirement! Prevent malicious errors, omissions or attacks that could result in fines and even jail time for the business, healthcare provider, employee, or vendor by completing a PIA.

If your Privacy Impact Assessment was written more than 2 years ago this online on-demand course is for you!

The Clinic Manager and Physician Lead and Privacy Officer  must ensure its content is updated to reflect the current state of administrative, physical and technical controls.

BONUS! Checklist to update your PIA to meet recent changes to Alberta’s Netcare Portal. If your practice has completed a PIA and now you need to update the PIA, you receive a checklist of items that you need to consider to refresh your PIA.

 

If you are vendor that supports healthcare practices this e-course is for you!

BONUS! One hour tele-consult with Jean, “Create a branded Privacy Impact Assessment Readiness Package”. Jean will work individually with you to review your documentation and coach you on how to prepare the package to give to healthcare practices.

BONUS! Vendor PIA live webinar includes Vendor non-disclosure agreement, Information Manager Agreement, GAP Analysis, Computer Network Narrative templates.

 

Jean has helped hundreds of physicians, chiropractors, pharmacists, and other healthcare providers complete their Privacy Impact Assessment. She has visited hundreds of practices across Canada. But time and geography limit my ability to visit each healthcare practice that needs a PIA. That’s why I developed this on-line interactive course to help you learn everything you need in order to review, amend, or create your own PIA. Each module includes a video training as well as templates, tools, resources and two common case studies to build on each week. You can use these scenarios to guide you through the PIA process.

You know your practice better than anybody else. If you had the right tools, at the time most convenient for you and a mentor to help you, you can develop good office practices, meet legislated and college requirements, and successfully complete your Privacy Impact Assessment requirements.

Using a Webinar on-line interactive program, you will get great content and mentoring from Jean Eaton and once a month during the Q&A live training webinars. Learn the PIA process with these modules.

The modules include:

Module 1:

PIA to Protect Your Practice, Your Assets, and Your Patients

 

Module 2:

Information Flows–-the Foundation of Your PIA

 

Module 3:

Risk Analysis and Mitigation Strategies

 

Module 4:

PIA Format – Pulling it All Together

 

Module 5:

Complete Your PIA Submission

BONUS Module 6:

Create a Branded Privacy Impact Assessment Readiness Package

The replays, tools, and resources will be available to you right away.

If you are new to this field, I suggest that you first register for Privacy Awareness in Healthcare: Essentials to master the key definitions and concepts.

Corridor Interactive

 

Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments –

A Complete Step-by-Step Course

5 Core Modules, Templates, Training, and Tools to Get Your PIA Done!

Monthly Live Q&A Training Webinars

$450.00 (plus GST)

Purchase e-course

 

You will get

  • Learning Resource Guide for EACH module – how-to explanations, templates, and resource lists
  • Checklists to help you plan your PIA
  • MindMap of the entire PIA process
  • PIA project plan timeline templates
  • Checklists of  personal and health information privacy and security policies that you need in your practice
  • Many examples of projects in medical, dental, chiropractic and more practices including new PIA project and PIA amendments.
  • Explanation and real-life examples of key terms that you need to know and include in your PIA
  • Strategies and templates of risk management assessments that you can customize
  • This E-course might qualify for CPE credits, too!

 

BONUS!  Monthly live Q&A webinar training with Jean to help you get un-stuck with your PIA.

BONUS! Checklist to update your PIA to meet recent changes to Alberta’s Netcare Portal.

BONUS! Private discussion group with other registered participants of this course to network and support each other on your PIA journey and continue to help you after this course closes.

BONUS! Regular updates of privacy resources and templates that you can use.

 

If you hired a consultant to do the work of the PIA process for you it may cost you as much as $3,000!

And then…when the consultant is done, they take their knowledge out the door with them.

Invest only $450 in this course and you’ll have what you need to do your first PIA project today…and every project in the future!

Jean Introduction Ecourse PIA (1)

I had the pleasure of working alongside Jean to develop a PIA for my Dental Office. I could not have completed this document without her. She was there to help me every step of the way. Her online course made it easy to communicate with her as well as having so many resources to use that were so helpful. Each Module had videos to watch that explained step by step what needed to be done. The PIA document is a lot of information to put together and if it’s not enough information on its own, you also need to develop a policy and procedures manual. Jean has developed an amazing resource for this manual that was very user friendly and made a 300 page manual a lot more attainable than creating it on your own. I highly recommend taking Jean’s PIA course and having her help throughout the process!”

~~Lindsey Cave, Office Manager, Orion Dental Group

 

What people are saying about our PIA e-courses and in-person workshops:

Q: What did you learn from this workshop?

Participant’s Responses:

  • Understanding of need / use of Information Management Agreement’s and an ‘Evaluation” agreement.
  • Lots – when / how to make amendments.
  • Compliance / requirements of PIA and their purpose.
  • PIA information; agreements, updating.

 

Q: What do you feel was the biggest benefit to attending this workshop?

Participant’s Responses:

  • Understanding a PIA.
  • Having a better understanding of PIA’s and everything included in requirements.
  • Gain a better overview of my PIA and what I need to add; organizational strategy.
  • Clear vision of work to be done.

“When Jean told us about the Protest Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments E-course and explained how the course will help us better understand the Health Information Act, our responsibilities as healthcare providers and our relationship with our vendors and partners, I signed up right away! Thanks again – it is no doubt that we have hitched our wagon to a shining star.”
~~Bill Stowe, Business Manager Synergy Respiratory & Cardiac Care

“This was my first ever time I had to work on a PIA and I was a little nervous about doing it efficiently – but you really made it as simple and straight forward as possible. Thank you for being available for my questions when I had them. I would easily recommend Privacy Impact Assessments to Protect Your Practice course for anyone to do their own PIA’s! Thank you so much!”
~~Karen Sarabura, Clinic Manager and Privacy Officer, CGA Medical Imaging, Alberta

“I attended the Privacy Impact Assessment Walk-through workshop (for ARMA members). Jean shared resources and on-going networking opportunities. The biggest benefit to me is to know that there is help out there in moving forward with our Privacy Impact Assessment responsibilities.”
~~Ellen Sauvé, Parkland County

Comments from other E-course participants:

“Learning about how all the information gathering systems interact was the most valuable part of this workshop”

“Excellent presenter – variety of learning opportunities.”

“Jean is an excellent speaker and I enjoyed the audio seminar you gave today and I learned a lot from your seminar.”
~~Annette T (AHIMA webinar, Three Mistakes in Managing a Privacy Breach”)

“Jean Eaton is one of those ‘critical suppliers’ you keep in your email contacts list, no matter what company you manage. She really knows her stuff and delivers prompt, accurate information on time. Her courses are interesting, informative, and I like the opportunity to meet with classmates who have similar challenges.”
~~Kevin Morris, Shape MD, Team Leader/Office Manager

 

Buy e-course

In-Person Workshops Are Now Available

Are you a hands-on kinda person?

Are you more likely to get things done when you schedule your time for a working meeting?

Would you like help to kick-start your PIA amendment and review with other like-minded clinic managers and privacy officers?

PIA Amendment Workshops are available. Send a request to me and let’s set up a workshop near you! You also get full access to the on-line course to support you after the workshop.

 

 

Not sure if the E-course is for you?

Jean will answer your questions in the free webinar,

 

Prevent Big Fines (or Worse!) for Your Healthcare Practice

How to Plan a Privacy Impact Assessment for Your Healthcare Practice

with Jean L. Eaton
Replay Recorded Live

This webinar is for Privacy Officers, Clinic Managers, Practice Managers and anyone else responsible for doing a PIA.

You will learn what is getting in your way of getting your PIA done!

In this free webinar, you will learn:

  • 5 Manageable Steps of every PIA
  • 3 Biggest Myths about PIA’s that is preventing you from completing your PIA
  • Questions Privacy Officers, Clinic Managers, Practice Managers and Healthcare providers should ask about PIA’s but don’t
  • Biggest fears about doing a PIA and how you can kick it to the curb so that you can finally get it done

Join us for the webinar so that you can plan your PIA for your healthcare practice!

Sign me up for this FREE webinar

Get Free Access Now Arrow

Please provide your email address below and you will be re-directed to the webinar replay right away.

Check your email in-box to confirm your registration!

 

 

 

 

 

 

 Along with your webinar registration, you will also benefit from the occasional Privacy Nugget tips by email of similar privacy resources and articles that you can use right away!

Can You Use Text Messaging With Patients?

Can You Use Text Messaging With Patients?

Have you ever said…

“If only I had someone to ask!”

Each month, we discuss your questions about practice management, human resources issues, clinic management best practices, procedures, resources, practical privacy tips, and more in Practice Management Success membership.

 

In this Q&A, we’re talking about:

Can you use text messaging with patients?

 

Can you use text messaging with patients?

The short answer is, ‘Yes’.

The longer answer is ‘Yes, but . . .  make sure that you are really clear about why you want to use text messaging, carefully plan the implementation and monitor its use.’

What is the Purpose for Texting?

Clinics are feeling pressured to provide texting as a communication option to their patients.

It is important to be clear about why you want to use texting.

Texting from the Patient to the Clinic

What is the primary purpose for patients to text the clinic? It may be because they are in a remote community and texting is the only way to keep in touch with their healthcare provider. You might choose to accept text messages for appointment requests or continuing care and treatment.

Texting is generally not a secure communication method. It is difficult to confirm the identity of both the sender and receiver which can result in both communication and medical error.

 

Emoji

It is difficult to communicate clearly using text short form and emoji!

 

What Are the Risks?

As the custodian, you need to weigh the risks of using texting vs not using texting. For example, if your work includes assisting people who are in crisis or are otherwise at risk, you may decide that the risk to the patient who has access to their healthcare provider using unsecured text messaging is less of a risk than the patient who experiences a critical incident and does not have other access to their healthcare provider.

You must decide what are the acceptable risks and appropriate use of text messaging.

I find that creating scenarios is a good way to do help you set up your boundaries. In what situations is using text messaging OK? In what scenarios is it not appropriate to use text messaging? Are there alternative technologies that can better, and more securely, meet these needs?

Record your reasons about what you will – and what you won’t – accept in your text messaging solution as part of your project documentation and implementation training.

text messaging risks

Workflow When You Receive Text Messages from the Patient

Consider how you will document the communication from your patient into the patient’s health record.

  • Is the device to receive the text message registered with the clinic?
  • Who will receive the text message from the patient?
  • How will you transpose that meaningful communication with the patient to the patients’ health record?

Be guided by the discussions in your team and with your patients to develop your policies and risk mitigation plans.

 

Texting From the Clinic to the Patient

Is your goal of a text solution to automate a workflow like routine appointment reminders? Or, perhaps, some episodic messaging like offering follow up appointments to discuss test results?

Authorization

Remember that the custodian (physician, pharmacist, dentist, dental hygienist, chiropractor, and more) assumes the risk of using unsecure technology. You can’t transfer the risk to the patient. However, you can mitigate the risk of error and unauthorized use of the health information by creating rules for use and ensuring that the patient understands:

  • how the technology is used,
  • your offer to use the technology in your healthcare practice,
  • the risks to the patient’s privacy and security of their personal information,
  • the patients’ role to prevent misuse of their personal health information, and
  • an agreement to follow the rules about the technology solution.

If you are a member of Practice Management Success, click here to access the sample authorization agreement.

Mitigation strategies

Alternate Technology Solutions

There are some third party vendors that can help you with routine text messaging with your patients. Wherever possible, use two factor authentication. For example, you might have a system where the patient must enter a PIN number before they can read the entire message from the clinic.

There are trusted technology solutions that you can use for text messaging. Many EMR providers now allow the clinic to text message your patients right from the EMR or patients can access the EMR using a patient portal. This is, by far, the most efficient workflow. It is usually the most secure technology and integrates the communication into the patients’ health record without copying and pasting, uploading, or re-typing into the patient record.

Microquest’s Healthquest EMR, for example, offers integrated appointment reminders via email, text, or voice messaging. Clinics can also allow patients to book their own appointments online with an online calendar integrated to the clinic’s Healthquest EMR.

Alternate third party texting solutions from trusted vendors that we have interviewed on our podcast, Practice Management Nuggets for Your Healthcare Practice, include Bleen and ezReferral.

Bleen is a third party patient appointment management application that allows patients to register with your clinic to receive appointment reminders by text message or phone call. The system also provides a self-help solution to patients to schedule their own appointment with their healthcare providers.

Clients with Bleen have seen dramatic changes in their patient management resources – reducing 40% to 60% of phone calls and 75% of no shows.

Click here to listen to the Practice Management Nuggets interview with Chris Narine and Robert Cove of Bleen.

ezReferral provides a third party referral management application that improves communication  between the patient and the referring and consulting providers. The system saves an average of 60 minutes of staff time for each referral and improves the patients’ access to health care in a timely, efficient manner. It also includes a built-in secure fax solution.

This solution is ideal for healthcare practices with referrals within the medical community and even better when you are working with multidisciplinary referral teams. ezReferral works well for both paper based and electronic medical record based practices.

Click here to listen to the Practice Management Nuggets interview with Dr. Denis Vincent of ezReferral.

Privacy Impact Assessment

Before you implement a text solution to your practice you need to update your privacy impact assessment (PIA) or prepare a new, project based PIA. This doesn’t have to be a big undertaking but it is really important that you take the time to design and document your application and implementation.

Privacy Impact Assessment

If you need some help with your PIA, I encourage you to take a look at our on-line e-course, Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments.

Efficient work flow, clear procedures, and rules of use authorization with your patients improves the likelihood that text messages will be used the way that you intended. However, these practices does not make the technology breach-proof. Carefully consider the merits of text messaging and how you can mitigate the risks before implementing text messaging in your healthcare practice.

Tell me more about PIA’s
Download the FREE Report – Can You Use Text Messaging with Patients?

If you are a member of Practice Management Success, login and access the webinar replay, and the patient authorization form template.

 

When we know better, we can do better…

Jean L. Eaton is constructively obsessive about privacy, confidentiality, and security expecially when it comes to the handling of personal health information. If you would like to discuss how I can help your practice, just send me an email. I am here to help you.

Jean L. Eaton
Your Practical Privacy Coach
INFORMATION MANAGERS

 
Improve Your Healthcare Practice Security With Audit Logs

Improve Your Healthcare Practice Security With Audit Logs

How to Improve Your Healthcare Practice Security With Audit Logs

When was the last time that you reviewed your access logs in your healthcare practice?

In our policies, procedures, risk assessments, and privacy impact assessment submissions, we indicate the reasonable safeguards that we expect to implement in our practices to protect the privacy and security of health information.

But policies and good intentions alone isn’t enough.

We also need to take action on our policies.

We have tools, like audit logs, available to us. Audit logs of our computer and software systems are available to monitor users who have accessed the system and the information contained in the systems.

Audit Log Image

Audit logs monitor and records the transactions of users’ activities in your computer network and your electronic medical record (EMR). It is an automated, real-time recording of who did what, and when, in your system.

For example, when a user logs in to your computer network at the beginning of the work day, the user name, date, time, and perhaps the workstation identifier is recorded in the audit log.

When the user logs into the EMR and creates, views, modifies, or prints from a specific patient record, each activity is recorded in the audit log. In this way, the audit log records both the activity of each user and, in each patient’s electronic medical record, who has accessed that patient’s health information.

You MUST implement, use, and monitor your audit logs

The regular review of the audit logs can demonstrate that the administrative, technical, and physical safeguards that we implement to protect the health information, our people, and our assets are working. Review of audit logs can also identify weaknesses so that corrective action can be taken to improve our privacy and security strategy.

For example, when you review your audit log, you may see that an employee (authorized user) is accessing the EMR after clinic hours. When you investigate, you find out that the billing clerk is doing the billing submission from home.

This might be OK in your healthcare practice (or not). But, now you know what is happening iin your clinic EMR after hours and you can take appropriate action.

Audit Logs Are Valuable Metadata

Taken from a different point of view, the audit log provides important additional information, or metadata, about the care and treatment of the patient. Knowing who created a clinic note, wrote a prescription, or reviewed a test result provides a story about the care that the patient received. For this reason, the audit log of the EMR is usually required by legislation to be maintained for the entire retention period of the patient’s record. This is generally 10 or more years for adult patients and longer if the patient was a child at the time that they were a patient or client in your practice.

How You Can Use Audit Logs to Improve the Security of Health Information In Your Practice

Snooping, or viewing someone’s health information for an unauthorized use, is not uncommon in healthcare. Snooping is always a breach of confidentiality and trust that our patients give to us.

Sometimes, snooping is because someone is concerned or curious about a family member or friend and don’t intend to do anything ‘bad’ with that information.

We also know that people will sometimes access information for malicious means – that is,  using a ‘criminal intent’ or to be mean or disparaging to the individuals involved.

Say No to Snooping

When you regularly review your audit logs, you

  • Create a deterrent to all users to check something out ‘just this once, no one will know’.
  • Find potential threats or weaknesses in your current systems that you can improve to better mitigate your risks.

Custodians have an obligation to ensure reasonable safeguards to protect the privacy and security of health information. This means having appropriate policies and procedures in place and demonstrate and document that you have implemented your plans.

Action Steps That You Should Do Now

Use these points as a checklist to help you start using your audit logs to improve security in your healthcare practice.

  • Computer Network System Audit Log
    • Ensure that your computer network system has audit logging enabled.
    • Access and review your audit log. Don’t skip this step! Don’t assume that your audit logging is properly set up. You must discover how to access the audit log and record the procedure so that you can quickly access the audit log in the event that you have a privacy and security breach or routine security audit.
    • Determine how long your audit log information is accessible or retained. Is it included in your routine backup files? Legislative retention requirements differ but you probably want to keep the audit logs accessible for six months or longer.
    • Can you automate an audit log reporting tool to make it easier to review your audit logs regularly? Who in your healthcare practice is responsible to do this?
  • Electronic Medical Records (EMR) / Electronic Health Records (EHR) System Audit Log
    • Most health information legislation and regulations now require EMR / EHR to include an integrated audit log / access log. Confirm that you have enabled your EMR / EHR audit log.
    • Access and review your audit log. Don’t skip this step! Don’t assume that your audit logging is properly set up. You must discover how to access the audit log and record the procedure so that you can quickly access the audit log in the event that you have a privacy and security breach or routine security audit.
    • Determine how long your audit log information is accessible or retained. Is it included in your routine backup files? Legislative retention requirements differ but you probably want to keep the audit logs accessible for as long as you retain the entire patient record – generally, 10 or more years years.
    • Can you automate an audit log reporting tool to make it easier to review your audit logs regularly? Who in your healthcare practice is responsible to do this? Check out the Practice Management Nuggets Podcast

      How AI Improves EMR Auditing | Episode #094 with Rob Pruter from SPHER.

    • User activity recorded in an audit log is often visible to subsequent EMR users when they access a patient record. In the course of routine workflow, users may observe and question inappropriate access to an individual patient record. Instruct your users to notify the clinic manager or privacy officer if the audit log indicates a suspicious activity.
    • Include the review of audit logs as part of your routine privacy and security monthly audit.

Click the link below to get your copy of the audit templates and the training video!

I Want the Audit Templates to Improve Privacy and Security!

Are you already a member of Practice Management Success?

The instructional video and Privacy and Security Monthly Audit Template is already in your membership!

Click the button now to go to the membership to access your resources.

Go to my Practice Management Success membership

 When we know better, we can do better…

Jean Eaton is constructively obsessive about privacy, confidentiality, and security especially when it comes to the handling of personal health information. If you would like to discuss how I can help your practice, just send me an email. I am here to help you.

Jean L. Eaton
Your Practical Privacy Coach
INFORMATION MANAGERS
How Can Cyber Insurance Help Me In My Clinic?

How Can Cyber Insurance Help Me In My Clinic?

Cyber Insurance Can Help Protect Your Clinic

Cyber insurance is a type of insurance that provides protection against cyber attacks, data breaches, and other cyber-related risks. With the increasing number of cyber attacks, many businesses and individuals are starting to consider purchasing cyber insurance. However, there are many misconceptions about cyber insurance that need to be addressed.

The Risk Of Cyber Attacks To Small Business Is Rising

One of the most common misconceptions about cyber insurance is that it is only necessary for large corporations. However, even small businesses and individuals are at risk of cyber attacks and data breaches. Cyber insurance can provide protection against the financial and reputational damage that can result from these events.

Helps to Mitigate Risk

Another myth is that cyber insurance is too expensive. While it is true that the cost can vary depending on the level of coverage, it is often more affordable than many businesses and individuals realize. In fact, the cost of a cyber attack or data breach can be much higher than the cost of cyber insurance.

You can reduce the cost of insurance when you also have other physical, administrative, and technical safeguards in place to prevent the risk of a cyber attack. Systems to help you readily identify an attack and incident response plan to recover your business quickly may help to lower your overall insurance costs, too.

Some people also believe that cyber insurance is unnecessary if they already have traditional insurance policies in place. However, traditional insurance policies typically do not provide coverage for cyber-related risks. Cyber insurance is specifically designed to address these types of risks and provide protection against the unique challenges of cyber attacks and data breaches.

In today’s digital age, it is more important than ever to be proactive in protecting ourselves against cyber risks.

Discover How Cyber Insurance Can Safeguard Your Practice

To help dispel some of these myths, myla.Training is excited to bring in an expert in cyber insurance, Sylvie Forget-Swim from Palladium Insurance, to share important information and answer your questions. Sylvie specializes in working with dental and medical professionals to ensure they have a proper understanding of both their commercial and personal insurance needs.

Want to Learn More?

Do you want more tips and resources like these – for FREE?

Join Anne Genge and Jean L. Eaton for the “Ask Me Anything” style webinar for healthcare professionals, practice managers, privacy officers, and owners on Friday, April 21, 2023 at 1pm EST.

Anne is the founder of Myla Training Co., and a multi-certified cybersecurity expert with global awards for her work in cyber risk management, ransomware prevention, as well as cybersecurity education for healthcare providers.

This month, we will be sharing what dentists need to know about cyber insurance.

It’s free to attend.

Once you register, you’ll have access to the Zoom link on the day of the event.

Click Here to Register For the Free Webinar!
When Clients Ask for Their Records – Release of Information Tips

When Clients Ask for Their Records – Release of Information Tips

When Clients Ask for Their Records – Release of Information Tips

I recently had the pleasure of being a guest on Kayla Das’ The Designer Practice Podcast, where we talked about an important topic for therapists and coaches: managing the release of information when it comes to record disclosure requests.

During the podcast, we covered a range of topics that are essential for therapists and coaches to understand. Here is a summary.

Listen to the full podcast “Episode 5: When Your Client Asks for a Copy of Their Therapy Record with Jean Eaton” for more insights and details.

Client’s Rights and Therapist’s Obligation

Individuals have the right to privacy and can choose what information they share and with whom they share it. As a therapist or business owner, it is your obligation to keep the information that patients or clients share with you confidential and secure.

Case Note Retention Practices

Therapists have an obligation to keep patient information confidential and secure, and to maintain records for the required retention period. The retention period varies depending on the province and discipline, but it is generally 10 years (plus the age of majority. It’s important to ensure that you keep control of the patient information for the entire retention period whether it’s on paper, electronic, or in the cloud.

Reasons Why a Client Might Request a Copy of Their Therapy Record

It is important to inform clients about the purpose of collecting their identifying information, as well as encouraging them to regularly review their records for accuracy.  The client has the right to access a copy of their own information. Trust is a key factor in building a positive therapist-patient relationship, and open communication about record-keeping practices can help establish that trust.

Conversation with Client About Release of Information

At the time that you collect information from the client is the ideal time to discuss with the individual about what information is being collected and how it will be used. This is also an opportunity to discuss how the information may be shared in the future.

Best Practices for Third-Party Disclosure Requests with Client’s Expressed Consent

To ensure patients’ information is not disclosed without their consent, it’s important to have a conversation with them about what information is being collected and how it will be used. If a patient expressly states how they want their information shared (or not shared), you must record their wishes in their file and follow those instructions.

Privacy Legislation

All businesses must comply with privacy legislation. Therapists and life coaches in Canada will likely follow PIPA or PIPEDA legislation. Regulated health professionals (like registered nurses, physicians, pharmacists, chiropractors, and other custodians) working in private practice in Alberta are guided by the Health Information Act.

Best Practices for Third-Party Disclosure Requests Without Client’s Expressed Consent

Before disclosing any information without a client’s expressed consent, one should first determine if there is an immediate safety concern. If there is no immediate danger, it is essential to have the right paperwork in place, and appropriate legal authorization should be obtained before releasing any information without the client’s consent.

How to Manage a Conversation with a Third-Party Before Client Consent is Obtained

When managing a conversation with a third party before obtaining client consent, it is important to have a prepared script to respond to the request. The person making the request should know their legal authority and provide the request accordingly.

Considerations When Using Online Communication to Connect with Client

The use of technology in healthcare requires a proper risk assessment and due diligence to ensure that patient information is secure. Healthcare providers cannot transfer all the risks to the patient and need to take responsibility for the technology they use.

See the Practice Management Success Tip, “Can You Use Text Messaging With Patients?” for more help.

Release of Information Checklist

Businesses must document their policies and procedures for handling requests for information, and to be transparent with clients about the process.

Use the Practice Management Success Tip, ‘Release of Information Checklist’ as a resource for managing and responding to access and disclosure requests.

This checklist will help you release patient records while keeping the privacy, confidentiality, and security of patient information top of mind!

release of information checklist cover image
Media Story Reveals Employee Snooping

Media Story Reveals Employee Snooping

Media Story Reveals Employee Snooping

Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar instances.

The investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.

In this Privacy Breach Nugget series, I will take a look at each of these three incidents as guidance to better respond to a privacy breach in your healthcare practice.

What Happened

A news media story was published containing the names of patients at an Ontario hospital. The hospital Privacy Office initiated an audit which found that a Patient Accounts Clerk had accessed 28 health records without authorized purpose. This snooping is in contravention of the Personal Health Information Protection Act (PHIPA).

Managing the Breach

The Ontario Hospital’s management of the privacy breach can be examined using the 4 Step Response Plan.

4-Step Response Plan

 

 

 

 

 

 

 

 

 

Step 1 – Spot and Stop

The privacy breach was detected by the hospital when the media story aired. The hospital ran a preliminary audit on the health records of those patients named in the story that found suspicious access by an accounts clerk. Once identified, the hospital disabled the clerk’s access to the electronic health record (EHR) system and put them on administrative leave.

Step 2 – Investigate

After identifying the clerk, the hospital initiated second and third audits on their EHR accesses and found 28 patients whose records were accessed without authorized purpose. This is also known as employee snooping. The investigation established that those patients had been deliberately searched for in the EHR system, confirmed with the clerk’s manager that no authorized purpose was given to do so, and that the clerk had previously signed a Statement of Confidentiality and completed privacy and security awareness training.

Step 3 – Notify

The hospital notified those patients affected by the breach by telephone or mail. Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.

Notification in this case was delayed for compassionate reasons as some of the health information accessed was from a deceased patient. One patient was not able to be contacted, and a note on their file was made for the registration department to notify the hospital’s Privacy Office the next time the patient registered at the hospital. The patient will be informed of the privacy breach on their return visit to the hospital.

The hospital also notified the IPC of the incident. It is mandatory for a custodian providing services in Ontario to report a privacy breach of personal health information to the IPC (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)

Step 4 –Prevent the Breach from Happening Again

The hospital considered disciplinary action with the clerk; however, the clerk retired before any actions were taken. Policies and procedures at the hospital were reviewed, and changes made to immediately notify deceased patients’ families of a privacy breach going forward. The hospital’s Privacy Officer will now work closely with the Human Resources department to ensure more consistent investigations.

Commissioner’s Investigation

In the IPC report, the investigation also noted some positive measures taken by the hospital in managing privacy risks:

  • All new staff receive privacy awareness training and sign Statements of Confidentiality. Annual refresher training with new Statements of Confidentiality is mandatory.
  • The hospital’s Privacy Office communicates with staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
  • The hospital’s Privacy Officer holds training sessions when requested or new information is available.
  • The hospital’s EHR system displays a privacy advisory reminder that staff must agree to before accessing information.
  • Policies and procedures are reviewed and amended every three years and when needed.
  • Policies and procedures, and investigation findings are properly documented.
  • As a result of this incident, the hospital outlined a plan to respond to the breaches and the investigation, and to future breaches involving patients who are deceased. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about access without authorized purpose and how to prevent privacy breaches.

Take-Aways

The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to amend their notification procedures for privacy breaches involving deceased patients. Notification to the family will be made immediately in future when breaches involve a deceased patient.

You might need to consider modifying your policies and procedures, too, to include a similar scenario.

Watch for the next article where we share example #2 in IPC Decision 204.

Article submitted by: Aaron Myer

Reference

Ontario Regulation 329/04. Government of Ontario, 2006, https://www.ontario.ca/laws/regulation/040329#BK6. Accessed 9 June 2023.

Personal Health Information Protection Act, 2004. Government of Ontario, 2004, https://www.ontario.ca/laws/statute/04p03. Accessed 9 June 2023.

PHIPA Decision 204. Information and Privacy Commissioner of Ontario, 4 Apr. 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do. Accessed 9 June 2023.

You May Also Be Interested In

4 Step Response Plan training for clinic managers and privacy officers.

Tips to Prevent Employee Snooping – A Key Component of Your Privacy Practice Management Program: A Hands-On Guide to Protect Your Healthcare Practice from Privacy Beaches

 
Employee Snooping Reported by a Clerk’s Relative

Employee Snooping Reported by a Clerk’s Relative

Employee Snooping Reported by a Clerk’s Relative

Privacy awareness training including employee snooping awareness may prevent a privacy breach. Check out the second article in our Privacy Breach Nugget series for valuable insights and tips.

Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar incidents.

The investigation found that the hospital had managed the breaches well and no recommendations were required. The findings were published in PHIPA Decision 204.

This is the second article in this Privacy Breach Nugget series with tips that you can use to better respond to a privacy breach in your healthcare practice.

Missed the first article? Check it out here.

What Happened

A complaint was made to an Ontario hospital by a relative of an admitting clerk that their health information was being accessed by the clerk without authorized purpose. The hospital’s Privacy Officer investigated and found that the clerk had accessed five individuals’ health records without authorized purpose. The investigation concluded with the termination of the clerk’s employment.

The incident was the second of three privacy breaches reported by the hospital to the Ontario Information and Privacy Commissioner in 2020 and 2021. This snooping is in contravention of the Personal Health Information Protection Act (PHIPA).

Managing the Breach

The Ontario Hospital’s management of the privacy breach can be examined using the 4 Step Response Plan.

 

 

 

 

 

 

 

 

Step 1 – Spot and Stop

The privacy breach was detected when the hospital’s Patient Experience Department received a complaint that an admitting clerk may have accessed a relatives health information without authorized purpose. The hospital’s Privacy Officer was notified. The clerk’s access to the EHR system was disabled and they were put on administrative leave once an audit confirmed suspicious accesses were made.

Step 2 – Investigate

The hospital conducted audits of user access of the electronic medical record (EMR) system. This revealed that the clerk accessed five individuals’ health records without a need to do this as part of her job. The investigation also established that the clerk had previously signed a statement of confidentiality and received privacy awareness training. A meeting was held with the clerk, who admitted that she used the EMR to find a mailing address of a friend.

Step 3 – Notify

The hospital notified those patients affected by telephone or mail, and the incident was reported to the Ontario IPC.

Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.

Notification to the IPC is a requirement of a custodian (including hospitals and community physicians, pharmacists, dentists, and other healthcare providers.) (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)

Step 4 –Prevent the Breach from Happening Again

The hospital’s disciplinary actions ended in the termination of the clerk’s employment. The hospital reviewed and committed to maintain its privacy policies and procedures.

Commissioner’s Investigation

The IPC investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.

The investigation also noted some positive measures taken by the hospital in managing privacy risks:

  • All staff receive privacy awareness training and sign Statements of Confidentiality, and annual refresher training with new Statements of Confidentiality is mandatory.
  • The hospital’s Privacy Office informs staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
  • The hospital’s Privacy Officer holds training sessions when requested or new information is available.
  • The hospital’s EHR system displays a privacy advisory that staff must agree to before accessing information.
  • Policies and procedures are reviewed and amended every three years and when needed.
  • Policies and procedures, and investigation findings are properly documented.
  • The hospital outlined a plan to respond to the breaches and the investigation. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about snooping and how to prevent privacy breaches.

Take-Aways

The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to develop specific employee training to better understand and prevent snooping incidents. This is a good reminder that training is not a ‘one and done’ event. Refreshing training regularly with specific examples that relates to work activities can be more meaningful.

Watch for the next article where we share example #3 in IPC Decision 204.

Article submitted by: Aaron Myer

Reference

Ontario Regulation 329/04. Government of Ontario, 2006, https://www.ontario.ca/laws/regulation/040329#BK6. Accessed 9 June 2023.

Personal Health Information Protection Act, 2004. Government of Ontario, 2004, https://www.ontario.ca/laws/statute/04p03. Accessed 9 June 2023.

PHIPA Decision 204. Information and Privacy Commissioner of Ontario, 4 Apr. 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do. Accessed 9 June 2023.

You May Also Be Interested In

4 Step Response Plan training for clinic managers and privacy officers.

Tips to Prevent Employee Snooping – A Key Component of Your Privacy Practice Management Program: A Hands-On Guide to Protect Your Healthcare Practice from Privacy Beaches

 
When Co-Workers Are Victims of Snooping

When Co-Workers Are Victims of Snooping

When Co-Workers Are Victims of Snooping

Victims of snooping can report their concerns to the privacy officer of the organization where the breach occurred. When the breach involves a co-worker, your human resources policies to report a privacy incident can guide you to manage the incident and any resulting discipline. Including employee snooping awareness in privacy awareness training may prevent a privacy breach. Check out the third article in our Privacy Breach Nugget series for valuable insights and tips.

Ontario’s Information and Privacy Commissioner (IPC) opened an investigation into a hospital’s management of employee snooping after three similar privacy breach reports were received from the hospital in 2020 and 2021. The IPC elected to review the privacy breach to ensure that the custodian had adequate safeguards to prevent similar incidents.

The investigation found that the hospital had managed the breaches well and no recommendations were required. The findings were published in PHIPA Decision 204.

This is the third article in this Privacy Breach Nugget series with tips that we can learn from this report as guidance to better respond to a privacy breach in your healthcare practice.

Missed the previous articles?

Check out the first article here,

and the second one here.

What Happened

An employee phoned the hospital’s Privacy Office to lodge a complaint against a co-worker for allegedly accessing the complainant’s health information without authorized purpose. The hospital’s Privacy Officer investigated and found that a radiology assistant had accessed eleven individuals’ health records without needing that information to do their job. The hospital’s investigation concluded with the assistant being reassigned to a position without access to personal health information.

victims of snooping

Managing the Breach

The Ontario hospital’s management of the privacy breach can be examined using the 4 Steps Response Plan:

Step 1 – Spot and Stop

The privacy breach was detected when the hospital’s Privacy Office received a complaint from an employee that a co-worker may have accessed their health information without authorized purpose. The hospital’s Privacy Officer performed an audit on the employee’s electronic health record (EHR) and confirmed there was a suspicious access made by a radiology assistant. The assistant’s access to the EHR system was disabled and they were put on administrative leave.

Step 2 – Investigate

The hospital’s Privacy Officer conducted a second audit on the assistant’s EHR accesses and found suspicious accesses were made on eleven individuals’ EHRs. The Privacy Officer determined that those individuals were searched for deliberately in the EHR system, and confirmed with the assistant’s manager that they had no reason to do so. The investigation also established that the assistant had previously signed a statement of confidentiality and received privacy awareness training. A meeting was held with the assistant who denied accessing those health records.

Step 3 – Notify

The hospital notified the victims of snooping by telephone or mail, and the incident was reported to Ontario’s Information and Privacy Commissioner.

Under PHIPA s. 12(2), it is mandatory for custodians providing services in Ontario to notify patients whose personal health information has been used or disclosed without consent or authorized purpose.

Notification to the IPC is a requirement of a custodian (including hospitals and community physicians, pharmacists, dentists, and other healthcare providers.) (PHIPA regulation s. 6.3 pursuant to PHIPA s. 12.3.)

Step 4 – Prevent the breach from happening again

The hospital took progressive disciplinary actions with the employee by reassigning them to a position without access to personal health information (PHI) after their administrative leave ended. The reassignment was following up a few months later with an audit to ensure PHI was not being accessed. The hospital also reviewed and committed to maintaining its privacy policies and procedures.

Commissioner’s Investigation

The IPC investigation found that the hospital had managed the breaches well and no recommendations were required, and findings were published in PHIPA Decision 204.

The investigation also noted some positive measures taken by the hospital in managing privacy risks:

  • All staff receive privacy awareness training and sign Statements of Confidentiality, and annual refresher training with new Statements of Confidentiality is mandatory.
  • The hospital’s Privacy Office informs staff on privacy issues during a yearly email campaign called Privacy Awareness Week.
  • The hospital’s Privacy Officer holds training sessions when requested or new information is available.
  • The hospital’s EHR system displays a privacy advisory that staff must agree to before accessing information.
  • Policies and procedures are reviewed and amended every three years and when needed.
  • Policies and procedures, and investigation findings are properly documented.
  • The hospital outlined a plan to respond to the breaches and the investigation. These include updating privacy awareness training with examples of snooping similar to those investigated and sending quarterly emails to staff about snooping and how to prevent privacy breaches.

Take-Aways

The hospital had pre-existing privacy awareness training and privacy breach management procedures. A review in response to the incident led the hospital to develop specific employee training to better understand and prevent snooping incidents. This is a good reminder that training is not a ‘one and done’ event. Refreshing training regularly with specific examples that relates to work activities can be more meaningful.

Check out the previous articles in this series for the 2 other snooping examples from IPC Decision 204.

Also see: Managing Employees When They Make Mistakes With Stacey Messner and check out Stacey’s tips on how to have difficult conversations with employees.

Article submitted by: Aaron Myer

References and Resources

PHIPA Decision 204. Information and Privacy Commissioner of Ontario, April 4, 2023, https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/521298/1/document.do

You May Also Be Interested In

4 Step Response Plan training for clinic managers and privacy officers.

Tips to Prevent Employee Snooping – A Key Component of Your Privacy Practice Management Program: A Hands-On Guide to Protect Your Healthcare Practice from Privacy Beaches