9

I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, etc., implicitly have authentication. However, what are the requirements, if any, with respect to encrypting and password-protecting a soft copy of clinical information handed to the patient on a CD, Thumb Drive, etc.?

In general, we have secure exchange and encryption/integrity checking. So my question focuses more on what mandates exist for applying passwords, etc., to an electronic copy of this info.

Right now I'm exploring this topic in the context of implementing MU-compliant solutions to deliver electronic copies of patient clinical info upon request. So this includes a full health record/ccd, a visit summary, discharge instructions, etc.

Thanks! (my first question posted, and have reviewed similar titles and didn't find a match for my inquiry)

Improve this question
3
  • Great question! Welcome to town! Please ask more questions, and answer some too.
    – David P. Hochman
    Dec 22, 2011 at 18:45
  • You mentioned MU (meaningful use), so I assume that you want the MU specific requirements for this situation. If I recall correctly the CCD interface I built had the option to not encrypt, specifically for the case where the data is given to the patient, but I'm not 100% on this. It makes sense to assume that the average patient would not have decryption software, though MU requirements should have a stance on this.
    – user453441
    Dec 22, 2011 at 19:04
  • Yes, I'm definitely seeking MU-specific requirements, however, I aimed to ask the question in a broader sense in that I'm not sure what requirements may be out there (and of course, we're seeking to add value to our products for customers to meet regulatory & quality standards that are thrown at them from any angle!). Incorporating interaction design, I'm really hoping we can make this process as simple as possible yet secure as necessary (e.g. PDF file on thumb drive w/password defaulted to patient DOB). Thanks!
    – Wayne Heilala
    Dec 22, 2011 at 19:22

2 Answers 2

Reset to default
5

I just received a notice from Google telling me that since the Google Health service will close on January 1, 2012, I should download my data and close my account. Before the download started, it asked me to confirm this message:

You have chosen to download your profile as ZIP. The downloaded file will include all data in your profile, including PDF, CCR, CSV, notices as XML, and files. This may take a few minutes to prepare and download, so please be patient.

Your Google Health profile may contain sensitive information, including health records. If you download sensitive information to a shared or unsecured computer or device, others might see it. You are responsible for protecting the information that you download, and for deciding with whom to share it.

Are you sure you want to download a copy of your personal health profile to the computer or device you are using?

I downloaded and opened the file. The PDF files were not encrypted, and they contain my name and date of birth, which would qualify as PII (personally identifiable information), and PHI (personal health information).

Now I am not a lawyer (although I have played one on TV ... long story), but I have to ask: if Google doesn't password-protect a PDF containing PII & PHI delivered digitally to the patient, why would anyone else be required to do so?

Improve this answer
4
  • They would have delivered this zip file to you over an SSL encrypted link, so technically they did protect it during transmission to you.
    – Rory Alsop ♦
    Dec 23, 2011 at 15:26
  • 1
    @RoryAlsop, you are correct. I logged in to health.google.com, which is a SSL/HTTPS connection, using my Google account credentials, so they are pretty sure it's me.
    – David P. Hochman
    Dec 23, 2011 at 15:58
  • 1
    Thank you David! I agree that Google's approach is worth taking to the bank in terms of due diligence. This makes sense...I like to remind folks that digital processes & content needn't spawn added layers of bureaucracy above paper processes & content. So long as the recipient acknowledges taking ownership of the content (containing PII/PHI) and it is delivered securely, you've done your job. Thanks again.
    – Wayne Heilala
    Dec 24, 2011 at 0:06
  • 1
    Google is kind of atypical because they probably don't qualify as a "covered entity" under HIPAA. The only health information they receive is that which is voluntarily given to them by the patient. As far as I know, they have no relationships with providers or insurers.
    – Matt
    Dec 27, 2011 at 18:15
2

Standard disclaimer: I am not a lawyer.

Your example mentioned a CD or thumb drive. Consider this: From the moment you put the data on the drive to the moment you hand it to a patient, the data is YOUR responsibility to secure. So you have two options:

Physical security. Think of it like a bank courier with a briefcase chained to their wrist. The person who burned the CD/created the thumb drive must physically secure it either on their person or in a vault until it is handed to the patient. Alternately, they must hand it over immediately after burning it.

You'd have to have work instructions and the like defining this process, train people on it, and make sure they complied to it. Sound like a hassle? It is.

Electronic security. Password-protect the thing. Now it doesn't matter of Dr Bob drops it while on his way to the bathroom or leaves it laying on a desk.

Once it gets to the patient's hands, it's no longer covered by HIPAA because they're not a covered entity. They can do what they want with it. But for their own good it would be nice if it were protected.

Note: Google Health gets around this by not burning a copy themselves but just delivering it immediately and securely to the person's computer.

Improve this answer
2
  • Actually, Google health got around this by not being a resource for providers to store information about their patients. Instead, they are a resource for "Patients" to store information about themselves. There is a small, but important distinction in that HIPAA guidelines don't deal with what a patient can do with their own information.
    – Marshall Anschutz
    Dec 30, 2011 at 21:13
  • Good point. Though even if they were storing data for the providers, their means of transmission should bypass this whole problem.
    – Lynn
    Jan 2, 2012 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy