Information Managers
  • Home
  • Services
    • All Services
  • Templates
  • Blog
  • Contact Us
  • Practice Management Success
  • Podcasts

Merging Your Healthcare Practice – PIA Considerations

Posted on August 3, 2020 by Meghan in Blog

Merging Your Healthcare Practice – PIA Considerations

 

Mergers and acquisitions and closing and consolidating are activities that healthcare practices undertake at various times in the life cycle of a business.

There are many reasons why a practice may consider buying or acquiring an existing healthcare practice.

You might be expanding your practice to rapidly expand the scope of your services, location, or space. Or you might be downsizing your practice. Or maybe you're merging multiple practices into one streamlined practice so you can better manage your profit margins.

You might be looking to diversify your services or, perhaps, create an area of super-specialty that will provide a competitive advantage for your healthcare practice.

You might be wanting to acquire skilled employees or healthcare providers that you couldn't recruit in your current circumstances.

You might be acquiring or consolidating real estate infrastructure, medical equipment or electronic medical records, computer networking, or perhaps the management team. Or you might be exploring opportunities for economies of scale or cost-cutting.

As a custodian (including physicians, pharmacists, dentists, chiropractors, nurse practitioners, optometrists, and more) you need to ensure that the patient's health information remains private and secure, and that patients have continued access to their health information.

 

Thinking about merging your healthcare practice? Important privacy impact assessment steps for you to consider. #PIA #Privacy #ProtectYourPractice Click to Tweet

5 Important Steps Before You Merge Or Close Your Healthcare Practice To Ensure Your Continued Privacy Compliance

  1. Inventory All Your Existing Patient Records
  2. Patient Records Systems
  3. Agreements
  4. Existing Documents
  5. Privacy Impact Assessment Amendment Plan

 

Read the full article below!

Or listen to the podcast here

Inventory All Your Existing Patient Records

 

When you assume a new practice, you need to know where all the patient records are maintained. If you are closing your practice, you need to ensure the continued security and access of patient records to the patient.

To do this, you need to know which patient records are included in the practice. Create an inventory of the existing patient records.

Remember that you must meet the records retention period (which often is 10 years plus the age of majority) for all the patient records. Make sure that you are meeting the records retention periods and that you have correctly inventoried all of the patient records. This includes all locations and record types including paper, off-site storage, and records that have been backed up to an electronic drive or a separate memory device.

Include all types of patient records – including appointment records, appointment books or electronic scheduling software, billing records, paper records, diagnostic medical devices, electronic medical records and audit logs.

When you assume a new practice, you need to know where all the patient records are maintained.

Patient Records Systems

 

Make sure that you review all the existing patient record systems – electronic medical record, billing systems, records storage, etc. – and the associated termination clauses with the vendors. If you need to transfer the management of patient records between custodians or to a different system, you need to thoroughly explore the data migration and archiving options and the associated costs.

Remember, you must maintain the complete patient record – including the clinic notes, test results reporting, task management, internal messaging, and audit logs – for the entire retention period. Often, exporting a patient record to a PDF file format does not include the complete patient record. Instead, you may need to maintain a read-only version of the electronic medical record.

Agreements

 

Collect all the existing agreements between the custodians and the vendors and stakeholders with whom the custodian has authorized the collection, use, and disclosure of patients’ health information. This may include the EMR vendor, billing agent, custodians, Primary Care Network, and successor custodian agreements.

Existing Documents

 

Request a copy of the existing documents that support the business of managing the patient records, including the health information privacy and security policies and procedures and privacy impact assessments. This will help you to respond to inquiries about previous patient records management practices and assist you in preparing your next privacy impact assessment.

Privacy Impact Assessment Plan

 

Consider the history of the current practices and plan your new operations plan. Complete a risk assessment to ensure the appropriate reasonable safeguards of previous, current, and future patient health information. Then, complete a Privacy Impact Assessment and update the Health Information Management Privacy and Security Policies and Procedures. In Alberta, the Health Information Act (HIA) requires the custodian(s) to submit the Privacy Impact Assessment to the Office of the Information and Privacy Commissioner (OIPC) for review prior to implementing new practices.

 

If you want to know more about Privacy Impact Assessments with step by step instruction, training, and mentoring, register for the on-line training, Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments. 

Related Resources

Watch these Practice Management Nuggets For Your Healthcare Practice Videos:

  •  When You Close Your Healthcare Practice on YouTube
  • What to Consider Before Sub-Leasing on YouTube

Download:

  • Top 3 Agreements Your Healthcare Practice MUST Have (and Why)
healthcare practice, merging healthcare practice, PIA, privacy, Privacy Impact Assessment, protect your practice

CHIMA’s Emerging Privacy Management Practices in Health Care series

Posted on July 30, 2020 by Meghan in Blog

Emerging Privacy Management Practices in Health Care 

I'm tickled pink to be the facilitator for CHIMA's new continuing education series.

The Canadian Health Information Management Association (CHIMA) recently launched a live, 5-part privacy series, Emerging Privacy Management Practices in Health Care, beginning on August 6, 2020.

Telehealth and virtual care implementation has advanced 10 years in the last 3 months in response to the coronavirus (COVID-19) pandemic. This series covers the critical aspects of implementing modern privacy management practices in your health care organization. This series is suitable for individuals with privacy-related roles (e.g., managers, vendors, or employees) across the continuum of health care (e.g., acute, primary, long-term or community care).

Each module will cover a privacy-related topic area including privacy awareness, release of information (ROI), access and disclosure, security/cybersecurity, and breach management. Environment overviews are shared throughout the series along with new opportunities for health information professionals in both traditional and emerging roles. By keeping current with these trends, health information professionals will be better prepared to assume new roles within privacy management.

Attend the live webinars to participate in a Q&A period with series facilitator and industry expert Jean L. Eaton.

Learn more at echima.ca/privacy-series

Speakers:

Jean L. Eaton, Your Practical Privacy Coach and Practice Management Mentor with Information Managers Ltd.

Jean L. Eaton is a Certified Health Information Management (CHIM) professional, and privacy awareness training facilitator.

She has had the honour of sharing her passion for practical privacy and confidentiality advice with hundreds of medical clinics, health care practices, and organizations across Canada and the United States.

Jean has over 20 years of experience in health information management and health care administration and over 15 years in her independent privacy consulting practice. She makes practical recommendations for thousands of independent health care providers to help them comply with privacy legislation and create efficient practices.

Jean is also a keynote speaker on the topic of privacy breach management and serves as an on-demand ‘virtual privacy officer’.

The live webinars will occur on the first Thursday of each month from August to December.

 

Module Date Time
1. Privacy awareness August 6, 2020 12:00 – 1:30 pm EST
2. Release of information September 3, 2020 12:00 – 1:30 pm EST
3. Access and disclosure in patient portals, information sharing, and health information exchange environment October 1, 2020 12:00 – 1:30 pm EST
4. Security/cybersecurity November 5, 2020 12:00 – 1:30 pm EST
5. Privacy breach management December 3, 2020 12:00 – 1:30 pm EST
Purchase Your Series Pass Here!
access, cybersecurity, health care, Health Information Management, healthcare, medical, privacy, privacy awareness, privacy management, security, telehealth, virtual care

Privacy Awareness in Healthcare Training: Dental Practices

Posted on June 15, 2020 by Meghan in Blog, Services

NEW! Privacy Awareness in Healthcare Training – Dental Practices

Privacy Awareness Training for Dental Practices

Is your dental clinic in compliance with the Alberta Dental Association & College, Health Information Act (HIA) and Personal Information Protection Act (PIPA)?

Dentists and dental practices in Alberta are required to have an ongoing privacy program to ensure the protection of private records and patient information. The appropriate collection, use, and disclosure of personal information is critical to maintaining privacy for patients that choose to trust in your practice. Accomplishing this important goal demands an up-to-date training strategy.

Regular privacy awareness training protects patients, employees and your business. The key components of your training strategy must revolve around ensuring HIA compliance to mitigate risk of a privacy breach. Everyone in your clinic – dentists, dental assistants, dental hygienists, office staff, contractors and even practicum students and volunteers must understand how to correctly handle personal information, so it remains confidential and secure. Maintaining high standards that safeguard information privacy and security is an essential aspect of asset management for any health care provider.

Corridor Interactive's training includes a personalized printable certificate of achievement to support compliance and may be used for your continuing education credits, too! Our training delivers industry best practices and is ideal for all levels of staff in any dental organization or clinic that collects, uses or discloses personally identifying information. This includes direct care providers in your practice as well as privacy officers, support staff and any other employees who are not directly involved in patient care.

Corridor’s Privacy Awareness Training for Dental Practices educates dentists, dental assistants, dental hygienists, and all office staff on:

  • Understanding Privacy
  • Privacy Principles
  • Collection, Use & Disclosure
  • Roles & Responsibilities
  • Privacy Breaches
  • Right of Access
  • Safeguards
  • What is “Health Information”
  • Handling Personal Sensitive Health Information
 

If You Are A

  • dentist,
  • dental assistant,
  • dental hygienist,
  • or work in a dental practice

You Need Privacy Awareness in Healthcare Training – Dental Practices

You will 

  • Understand patient and client privacy rights.
  • Respect personal health information and your obligations.
  • Confidently and correctly handle personal health information.
  • Use reasonable safeguards to protect personal health information (PHI).
  • Recognize and respond to a privacy breach
  • Support key policies, procedures and risk management programs in your healthcare practice.

Interactive Online Learning Experience provided by Corridor Interactive

Corridor Interactive’s Buy Now Training Programs give you access to the most current information available, at your convenience. Complete your course all at once, or in multiple sessions from any location – it’s up to you. All you need is an internet connection and an email address to get started…it’s that easy!

  • Fits into your schedule – you can start, pause at anytime, and return to the course exactly where you left off.
  • Easy to use – navigation buttons makes it easy to continue to the next topic or pick and choose the order that you want to see the content.
  • Get started immediately – the entire course is ready for you!
  • Work at your own pace – you have access to the course for three (3) months. Most students complete the course in under 2 hours.
  • You can listen to the narration for each module.
  • Practical examples, too, to make it easier for you to apply what you have learned in the course to your job.
  • Links to extra resource material and websites related to your topic of study, to peruse at your convenience.
  • A printable Certificate of Completion, available as soon as you successfully complete your course.
  • An audit trail and record of your course activity and training history.
  • Self-directed learning features including the ability to pause your course at any time and resume later, right from where you left off.
  • Unlimited access to your course and resources for the duration of your subscription term.
  • Technical support with a one-business day turnaround for end-user support help and questions.
  • Automatic emails when you complete your course, or reminders if you have not completed.

Developed by Corridor’s team of seasoned software specialists and instructional designers, this unique online learning application is the optimum vehicle for delivering learning content.

$30 per subscription

Register Now

 Give your staff the knowledge and tools they need to apply policy in their day-to-day work AND prevent a privacy breach with privacy awareness training.

 

Privacy Awareness in Healthcare Training – Dental Practices

Protect your organization and your patients. Equip your staff with the information they need to confidently and correctly handle personal health information. Learn basic healthcare privacy principles and how to handle personal health information, use safeguards, and recognize and report a privacy breach.

Sounds great! Sign me up!

This self-paced on-line education includes:

  • 9 Modules
  • 6 Quizzes
  • 2 Case Studies
  • Final Exam

Certificate of Completion

“When we know better, we can we do better.”

As an employer and health care provider, you are responsible to provide training to all of your employees about privacy awareness. Protect your organization and your patients. Equip your staff with the information they need to confidently and correctly handle personal health information.

I am constructively obsessive about privacy and confidentiality in the healthcare sector–and I think you should be, too! I designed this course to assist healthcare providers, clinic managers, practice managers, privacy officers and independent healthcare practice owners provide practical privacy awareness training that was easy to implement, consistent content, cost-effective and meaningful to your day-to-day business.

When each member of your independent healthcare practice completes this privacy awareness course, you will have clearer expectations and confidence that your team will maintain the privacy, confidentiality and security of your patient’s health information. Give your patients the gift of privacy. Improve your healthcare practice with privacy awareness education.

Jean L. Eaton, Your Practical Privacy Coach Information Managers Ltd.

Frequently Asked Questions

How can I access the course?

The course, Privacy Awareness in Healthcare Training – Dental Practices  is available on-line from any internet enabled device. You can use your desktop computer, smart phone or tablet to view the slides and even hear the narration.

How long is the course?

Most students complete the course in under 3 hours. You can start and stop the course at any time. Let's say you decide to take 20 minutes each day to work on the course. You can login and start the course right away. When you come back to the course the next day, you can start right from where you left off. You will have all the modules and the post-test done within 6 days. Don't worry about missing a few days – you have access to the course for a full 3-months!

This is my first job in a dental practice. Do I know enough to start the course?

You bet! The course is easy to read and I explain all the terms that you need to know. There are a lot of practical examples, too, to make it easier for you to apply what you have learned to your job.

I've worked in healthcare for a long time. Do I still need to take this course?

You bet! Seasoned professionals like yourself have an extra obligation to share your knowledge with new workers. This course will help you to refresh key principles and suggest wording, examples, and key messages that you can use to train new employees to their specific tasks in the workplace. The course will help you to advocate for the privacy rights of your patients. Unfortunately, we have many examples where trained professionals who “should have known better” make errors in judgement causing privacy breaches that affect our patients, our business, and the reputation of healthcare. Healthcare practitioners and owners have a responsibility to ensure that everyone in the practice receive comprehensive privacy awareness training regularly.

Will I get a certificate of completion that I can give my employer?

Yes –  at the end of the course, you will have the opportunity to complete a short on-line quiz to confirm that you understand the key concepts. Then you will have access to a Certificate of Completion that you can download and share with whomever you choose.

Can I get continuing education credits with my professional association?

Maybe! If you are a member of a professional association and you would like to seek credits from for taking this course, please let us know so we can take steps to request pre-approval. Often, professional association and colleges will grant continuing education (CE) credits based on your certificate of completion.

How much is the course?

The course is $30 per individual 3 month subscription. Click here to buy it right away.

I think everyone in my healthcare practice should take this course! Can I buy in a group package?

Yes – Privacy Awareness in Healthcare Training – Dental Practices is available in group packages, or it can be customized to incorporate your organization’s privacy policy and practices. Employers can monitor the employee’s training progress and receive a report of employee’s satisfactory completion of on-line quizzes. Track annual privacy awareness training through our online platform to demonstrate your compliance with legislation. Contact Corridor Interactive for more information.

I agree that privacy awareness training is important - but I don't work in healthcare. Do you have a corporate privacy awareness program?

While these programs have been developed with health care providers in mind, the privacy principles and fundamentals of protecting personal information are appropriate for any organization that collects, uses, and discloses personally identifying information. Contact us for information about our Corporate Privacy Awareness Program!

Interested in Group Training?

Employers can also purchase training for groups of employees; employees can access the internet based training at a time and location convenient to them. Employers can monitor the employee’s training progress and receive a report of employee’s satisfactory completion of on-line quizzes. Track annual privacy awareness training through our online platform to demonstrate your compliance with legislation.

Email Corridor Interactive to Order Group Training

Corridor Interactive, dentists, health care, Health Information Act Training, healthcare, healthcare provider, primary healthcare, privacy, privacy awareness, privacy breach, training

Your Guide to Privacy & Security Measures for the Health Care Industry

Posted on June 11, 2020 by Meghan in Blog

I’m tickled pink to be a guest of Rafiki Technologies' EVOLUTION SERIES

Your Guide to Privacy & Security Measures for the Health Care Industry

Join Rafiki Technologies and Jean Eaton to learn effective ways to keep your patient information safe and secure.

Confidentiality and security of personal health information (PHI) are crucial in the health care industry. It's your job to keep your records safe and your patient's information private, confidential, and secure.

Electronic medical records (EMR) have many advantages but security concerns are attached. Internet hackers are able to access private information in a matter of minutes if the medical practice doesn't have strong security measures in place and well-trained staff.

Learn how to protect your patient data with Rafiki Technologies' President Naheed Shivji. He and his team have worked in the medical industry for many years and they understand how to integrate proper IT and security measures seamlessly into existing infrastructure.

Joining Naheed Shivji is a Certified Health Information Management Professional, Jean L. Eaton. Jean is exceptionally versed in privacy awareness training and tools and works alongside many healthcare providers to ensure they're using the right protocols to keep patient information protected while complying with privacy legislation. 

Speakers:

Jean L. Eaton, Your Practical Privacy Coach and Practice Management Mentor with Information Managers Ltd.

I assist healthcare providers, clinic managers, practice managers, privacy officers, and independent healthcare practice owners with practical privacy awareness training and tools that are easy to implement, cost-effective, and meaningful to your day-to-day business.

As a Certified Health Information Management professional (CHIM), and privacy awareness training facilitator, I have had the honour to share my obsession about practical privacy and confidentiality advice with hundreds of medical clinics and healthcare practices and organizations across Canada and the US.

With over twenty years of experience in health information management and healthcare administration and over 15 years in my independent consulting practice, I have made practical recommendations for 1000’s of independent health care providers to help them comply with privacy legislation and create efficient practices.

 

Naheed Shivji, Founder & President of Rafiki Technologies Inc

Naheed has more than 20 years of experience in IT with expertise in the dental industry. He is a passionate entrepreneur helping companies understand and embrace technology and is always searching for business best-practices while giving back to the community.

Naheed works hands-on with his clients to develop winning IT strategies and smooth implementations. He is constantly learning and adapting to industry trends to maintain Rafiki Technologies’ position as a leading managed IT services company in Canada.

 

Your Guide to Privacy & Security Measures for the Health Care Industry

Tuesday, June 16th, 2020

6:00pm MDT

Watch the YouTube Video Here!
cybersecurity, datasecurity, healthcare, informationsecurity, medical, privacy, security

The Future Of Privacy Virtual Summit

Posted on January 7, 2020 by Jean Eaton in Blog

Discover why privacy, protecting personal information and securing critical data assets are priorities for business leaders in 2020.

I'm tickled pink to be presenting ‘Privacy of Health Information, an IFHIMA Global Perspective’ with Lorraine Fernandes at Bright Talk’s upcoming Data Security and Privacy Virtual Summit. All professionals with an interest in Data Security and Privacy are welcome!

The increasingly mobile, rapidly digitizing world of data is transforming all aspects of information and leading to new policies and regulations to support data privacy.

Beyond its primary purpose of improving personal healthcare outcomes, health data is being used for a wide range of purposes from improving population health, disease surveillance and the study of health economics. There are dramatic changes in how patients, consumers, or individuals access and use their health data. And, new technologies such as machine learning, artificial intelligence and biometric authentication are further compounding health information privacy challenges. Now more than ever, it is critical that the privacy of health information be protected.

Lorraine Fernandes and Jean L. Eaton will share:

  • The role of The International Federation of Health Information Management Associations (IFHIMA)
  • The need for a privacy information sharing agreement (ISA) explored in the IFHIMA healthcare whitepaper
  • High level overview of global privacy trends impacting healthcare
  • Why privacy is a priority for business leaders in 2020
  • The importance of a privacy management program and privacy awareness training to protect personal information and secure critical data assets
  • Prepare for emerging privacy trends

Register here (https://ifhima.org/sign-up-for-ifhima-global-news-whitepaper-and-events/) to receive this free white paper and learn more about IFHIMA.

Join BrightTALK’s upcoming virtual summit for a global, three-day online event.

Register for free thought leadership from the world’s top speakers, vendors and evangelists in the form of live webinars, panel discussions, keynote presentations and webcam videos. From Data Protection Officers, to CISOs and CTOs, all professionals with an interest in Data Security and Privacy are welcome!

Register To Attend Bright Talks' Free Virtual Summit

Three Virtual Summit Tracks

The 2020 Compliance Landscape – January 21, 2020 Learn what’s needed to achieve and maintain your CCPA, GDPR, PCI and HIPAA compliance.

The Future of Privacy – January 22, 2020 Discover why privacy, protecting personal information and securing critical data assets are priorities for business leaders in 2020.

Data Security Done Right – January 23, 2020  Find out how to improve security from the ground up and what’s needed for building security-by-design.

#IFHIMA, Bright Talk, privacy, virtual summit

Top 3 Practice Management Nuggets Blogs and Podcasts in 2019

Posted on January 2, 2020 by Jean Eaton in Blog

I wish you a prosperous New Year and personal and professional growth.

Practice Management Nuggets blog posts and podcasts is designed to help you achieve that. I started this in January 2014. We’ve grown over the years and improved the technology and platforms to better help you start, grow, and improve your healthcare practice. I help you to manage the pink elephant in the room!

Over the last year, you have made these blog posts and podcasts rank in the top 3 for 2019. If you missed these, or want to re-visit them, follow the links below.

Check out these top 3 Practice Management Nuggets blog posts and podcasts. Click to Tweet

Here Are The 3 Best Blog Posts And Podcasts Of 2019

Top 3 Blogs 

Recent Privacy Breach Convictions Under Alberta’s Health Information Act

Curiosity Is NOT Need-To-Know

The Top 3 Agreements Your Healthcare Practice MUST Have (and Why)

 

Top 3 Practice Management Nuggets Podcasts For Your Healthcare Practice

Privacy Awareness Quiz #PrivacyMatters | Episode #076

How Improved Patient Satisfaction Saves You Time And Money | Episode #074

Fax Received in Error – Is this a Notifiable Privacy Breach? | Episode #067

Stay tuned for more guest experts, tips, tools, templates and training in 2020!

blog, healthcare, podcast, privacy

Privacy of Health Information, an IFHIMA Global Perspective

Posted on November 12, 2019 by Jean Eaton in Blog

The 19th Congress of IFHIMA, the International Federation of Health Information Management Associations, will feature the release of IFHIMA’s latest whitepaper, “Privacy of Health Information, an IFHIMA Global Perspective.” I’m honoured to be the Chair of the Working Group and one of the authors. After months of work from dedicated HIM professionals and IFHIMA volunteers, I’m tickled pink to be able to share this with you.

Privacy of Health Information, an IFHIMA Global Perspective whitepaper provides a synopsis of current trends in privacy in healthcare around the globe, discusses the role of HIM professionals in privacy, and offers more detailed perspectives through case studies from Australia, the European Union, India, Qatar, the Republic of Korea (South Korea), and the USA.

Health Information Management (HIM) professionals have transitioned from their traditional role of health records custodian to data stewards and information privacy advocates and have an opportunity to take a leadership role with regard to the privacy of health information.

This privacy paper includes discussion on

  • Global privacy trends
  • What is personal information?
  • Privacy and trust
  • Challenges in maintaining trust when technology moves faster than regulations
  • Privacy stewardship foundations, including the role of the privacy/compliance officer
  • Avoiding risks, harm, and breaches
  • The complexity of breach notifications
  • How technology impacts privacy

After a thorough discussion, the paper also suggests several actionable steps that anyone can implement and discuss with their teams. Privacy is a team effort, but it requires a strong, trusted leader who can be the voice of clarity and transparency for patients, consumers, and regulators — all while building consensus.

These steps include:

  1. Get involved as privacy regulations are developed
  2. Assess what the regulations may mean to your organization
  3. Communicate your insight to the team, leadership, and regulatory bodies
  4. Identify required changes to systems, processes, and technologies
  5. Train your teams, admins, and patients about their privacy rights and responsibilities
  6. Commit to ongoing professional growth to stay abreast of the changing landscape

Privacy regulations that bring together emerging technology, healthcare processes and individual rights should take a pragmatic approach with consideration to future health information technology solutions such as telemedicine, Internet of Things and big data.

 

HIM professionals, in our role as stewards of health data, should be the voice of clarity and transparency for patients, consumers, and regulators. #IFHIMA Click to Tweet

6 Case Studies

The whitepaper includes observations and commentary about the status of privacy projects around the world, including the following case studies

  • My Health Record – The Australian Experience
  • General Data Protection Regulation of the European Union Reaches Far Beyond Europe
  • Health Care Privacy: An Indian Scenario
  • Developing a Global Standard for Health Information Privacy Workforce Education – A Republic of Korea (South Korea) Case Study
  • Health Information Exchange Implementation – Qatar, HIE Consent Model for Privacy Concerns – Privacy Regulatory Framework
  • Laying the Foundation for Privacy Practice and Compliance in the Outpatient Setting: Policies and Procedures. Download the Privacy of Health Information

This whitepaper will aid anyone tasked with planning for increased data sharing while trying to manage healthcare privacy. Ministers or Department of Health staff, privacy and data governance consultants, vendors, and health systems should find it especially helpful. Whether you are from a nation crafting its initial privacy regulations, or a nation revising insufficient policies, the information is relevant and enlightening.

I’d like to express my appreciation for the hundreds of hours of work contributed by this exemplary group of volunteers, including

Lorraine Fernandes

Angelika Haendel

Jenny Gilder

Mujeeb C. Kandy

Ok Nam Kim

Dr. Sabu Karakka Mandapam

Veronica Miller Richards

Dorinda M. Sattler

Dr. Rajesh Kumar Sinha

Selvakumar Swamy

Christopher Wilde

 

Click here to Register and receive this whitepaper and IFHIMA Global News, published three times per year.

 

Privacy of Health Information, an IFHIMA Global Perspective
#IFHIMA, healthcare, privacy, whitepaper

Privacy Principles Applies After Death

Posted on August 5, 2019 by Jean Eaton in Blog

Are your staff looking at medical records when they shouldn’t be?

Many people have the mistaken impression they can look at a patient's medical records as long as they don’t tell anyone else.

You can’t.

We see over and over again in ‘snooping’ cases where seasoned and new healthcare providers and support team members don’t realize that looking at patient’s health information without a need to know that information to provide a health service right away is wrong.

Kate Dewhirst summarized this as

  • Privacy = don’t look
  • Confidentiality = don’t tell

We still need privacy awareness training – even those experienced healthcare providers who push back and say that they have been in the business for years still often have more to learn.

Yes, we still need privacy awareness training Click to Tweet

In this post I am sharing an example of the Ontario’s Information Privacy Commissioner (IPC) complaint investigation from the family of a deceased individual. Whether you have a new practice, or an existing practice, we have a number of services and resources designed to help you manage your practice in a way that not only meets legal requirements, but is streamlined and efficient, and keep your information secure.

What Happened

In 2014, a physician acting in his role as a coroner, accessed the deceased’s health record. Shortly thereafter, the family alleged that the physician, who was also a family member of the deceased, continued to access the deceased’s personal health information (PHI) contrary to Ontario’s Personal Health Information Protection Act (PHIPA).

The family submitted a complaint to the hospital. Initially, the hospital's response did not satisfy the family. The family filed a complaint to the Information and Privacy Commissioner (IPC) of Ontario.

The IPC started a complaint investigation.

Privacy Breach Investigation

Privacy Complaint Investigation

Under PHIPA, the hospital is a health information custodian and the physician is an agent of the hospital.

During the IPC investigation, the physician confirmed he “accessed the health information in response to his concern about the individual’s well-being.”

“I know now that proceeding in this way was misguided and wrong.” He would never disclose the information to anyone; that would be a violation of patient privacy and a breach of doctor – patient confidentiality.

The physician acknowledged he did not fully appreciate the related but distinct concepts of patient privacy, the circle of care, and the ‘need to know’ principle.

Confidentiality rights arise out the special relationship between the client and the health professional or provider.

In contrast, privacy rights are the general rights of all persons to limit the access to their PHI. Individuals have the right to privacy, even after death.

Individuals have the right to #privacy, even after death. Click to Tweet

4 Step Response Plan

The hospital received a complaint from the family, which triggers the first step to spot and stop the breach.

Secondly, the hospital did an initial investigation to evaluate the risks of the incident. Later, after the IPC initiated their complaint investigation, the hospital re-visited the internal investigation and completed a comprehensive review and used audit log reporting tools to assist them.

Eventually, the hospital took the third step and notified the individuals’ family of the privacy breach. However, the notification was not timely. A more comprehensive response to the families’ complaint, followed by a notice to the family may have provided a better response.

Preventing a similar breach is the fourth step.

Since this incident, the hospital has:

  • installed a new auditing program that considerably enhances its ability to detect unauthorized access.
  • updated its Privacy and Confidentiality Policy, which applies to all agents of the hospital.
  • developed a yearly electronic privacy training program for all staff, volunteers and learners and will require all credentialed physicians to complete this training as part of the annual reappointment process.
  • strengthened the privacy warning on its electronic system, which warns users that unauthorized use of personal health information may result in disciplinary action.

Privacy Breach Physician Sanctions

 

The hospital’s Medical Advisory Committee recommended to the Board of Directors that the physician’s privileges be suspended for three months, that the hospital conduct enhanced monitoring of the physician’s access to the electronic medical record for three years, and that, on his return to practice, the physician be required to present at Grand Rounds on the topic of privacy.

The IPC concluded that the disciplinary consequences for the physician were sufficient in the circumstances.

Privacy Breach Nuggets You Need to Know

Privacy breaches are in the news every day. The more you know how breaches can affect you allows you to be more proactive to prevent privacy breach pain.

Privacy awareness education is more than just having policies and procedures. Demonstrating good practices, regular discussion about examples, and even gamification helps to ensure that all members of your healthcare team understand their roles and responsibilities.

If you need to start or update your privacy awareness training program, check out the on-line education Privacy Awareness in Healthcare: Essentials.

If you need to start or update your privacy breach management program, check out the 4 Step Response Plan; Prevent Privacy Breach Plan.

When we know better, we can do better…

I’ve helped hundreds of healthcare practices prevent privacy breach pain like this. If you would like to discuss how I can help your practice, just send me an email. I am here to help you protect your practice.

PRIVACY BREACH NUGGETS are provided to help you add a ‘nugget' to your privacy education program. Share these with your staff and patients as a newsletter, poster, or staff meeting.

Jean L. Eaton, Your Practical Privacy Coach

Click Here To Register for the FREE Training Video "Can You Spot the Privacy Breach?"

References and Resources

Dewhirst, Kate. After Death: Who Can Access The Records Of A Patient After Death? May 7, 2019. https://katedewhirst.com/blog/2019/05/07/after-death-who-can-access-the-records-of-a-patient-after-death/

Ontario Information and Privacy Commissioner IPC Investigation Report PHIPA DECISION 74 HC15-4 Sault Area Hospital August 10, 2018.

#PrivacyBreachNugget, 4 Step Response Plan, clinic, complaint investigation, death, deceased, healthcare, IPC, medical, Ontario, PHIPA, privacy, privacy after death, privacy awareness training, privacy breach, privacy breach nugget, privacy principles

When is a Privacy Breach a Privacy Breach?

Posted on July 13, 2019 by Jean Eaton in Blog

The biggest mistake in managing a privacy breach is not recognizing the privacy breach.

The second biggest mistake is not knowing what to do about it.

The recent publicity about the privacy breach in Alberta when a laptop with health information was stolen and came to the public's attention several months later is not the first news item of its kind.  In fact, this happens frequently in healthcare, retail, government departments and other industries.  This doesn't make it any easier to swallow and certainly doesn't make it right.  But this is an opportunity for you, healthcare provider or practice manager, and vendor to make sure that you have good practices in place to manage your next privacy breach.

Health information is recognized as being particularly sensitive and important to the person that the information is about.  It is so important, in fact, that a new breed of legislation was developed to set out specific rules to ensure that the health information has robust safeguards (administrative, technical, and physical) to keep the health information confidential and secure.  In Alberta, the Health Information Act (HIA) was proclaimed in 2001 to help custodians (people or organizations who collect, use, and disclose health information) ensure that they have identified the risks to breach of health information and how to prevent those risks.  The legislation also ensures that the people who the health information is about have access to their personal health information.

In August 2018, amendments to the HIA were proclaimed that make it mandatory to report a privacy breach that could result in harm to the Office of the Information and Privacy Commissioner (OIPC).

Privacy breaches come in all types and sizes.  One of the most common forms of a privacy breach is when a clinic or healthcare provider intends to send a report to another healthcare provider for continuing care and treatment but it is sent to the wrong physician.  Or, the referral request went to the correct physician but included extra information about another patient that was not part of the referral.

What Is Considered a Privacy Breach?

A privacy breach is an unauthorized access to or unauthorized collection, use, disclosure , loss, or disposal of personal or health information.

To each of us, our own personal health information is important.  As a healthcare industry, we need to ensure that we recognize this and acknowledge that each privacy breach is important to the person the information is about.  We need to make sure that we minimize the risk of the information being used inappropriately or maliciously.  We need to acknowledge to ourselves and to our patients and clients that we are human and that sometimes we do make mistakes and we will strive to do better.

A ‘small' breach of one person one time might have a big impact to the individuals involved.

A ‘big' breach of a lost laptop might have a bigger magnitude affecting many individuals.

When a breach also meets the requirements of mandatory notification, a custodian must report the breach regardless of how many people's information have been included in the breach.

4 Step Response Plan

When you have a privacy breach, follow these four steps to manage the privacy breach incident.

Step 1 – Spot and Stop the Breach

Each breach is important and needs to be recognized. Contain the breach so that it doesn't get any bigger.

Step 2 – Evaluate the Risks

Your privacy officer will investigate the incident and learn about the size, scope, and details about the breach. Consider if there is a reasonable basis to believe that there is a risk of harm to an individual

Step 3 – Notify

Notify the custodian, the affected individuals and (now, with the 2018 amendments), the Alberta OIPC, Minister of Health, Alberta Health (if the breach includes Netcare) and others.

The individual who's information has been breached needs to be made aware of the problem and the risk that might be experienced so that they can be prepare to limit the risks. The custodian needs to know how to manage the privacy breach and report it – internally and perhaps to other stakeholders.

Step 4 – Prevent the Breach From Happening Again

Correct and monitor the incident(s). Actively take steps so that the breach does not happen again.

Not Sure What To Do?

You never know when a privacy breach will happen! Prepare now with a privacy breach management program and coaching from the Practical Privacy Coach!

Learn what to do if you have a privacy breach.

4 Step Response Plan, Alberta, breach, Health Information Act, HIA, OIPC, privacy, privacy breach, training

Can You Predict Successful Privacy Awareness Compliance Training?

Posted on June 13, 2019 by Jean Eaton in Blog

Protect your organization and your patients.

Investing in privacy awareness compliance training that is engaging, practical, and easy to access will prevent a privacy breach in your healthcare practice.

But, how do you find the right training?

Look for a strong completion rate.

A high completion rate is the single best predictor of successful privacy awareness compliance training. Most on-line courses have a 6-15% completion rate.

The Privacy Awareness in Healthcare: Essentials program from Corridor Interactive has a completion rate of 95%.

And the investment is only $35 per person.

Give your patients the gift of privacy. Improve your healthcare practice with privacy awareness education.

HURRY! A privacy breach can happen at any time!

 

health care, healthcare, HIA, PHIPA, privacy, privacy awareness compliance training
‹1234›»

Search the site

What is the elephant in the room?

The Elephant in the Room Find out here...

Privacy Policy

"I had the pleasure of working alongside Jean to develop a PIA for my Dental Office. I could not have completed this document without her. She was there to help me every step of the way. Her online course made it easy to communicate with her as well as having so many resources to use that were so helpful. Each Module had videos to watch that explained step by step what needed to be done. The PIA document is a lot of information to put together and if it's not enough information on its own, you also need to develop a policy and procedures manual. Jean has developed an amazing resource for this manual that was very user friendly and made a 300 page manual a lot more attainable than creating it on your own. I highly recommend taking Jean's PIA course and having her help throughout the process!"

- Lindsey Cave, Office Manager, Orion Dental Group

Register for Free On-line Privacy Breach Awareness Training!

Privacy Policy

Copyright 2022 Information Managers Ltd.