Health Information Compliance Alert

Published on Mon Nov 17, 2008 PDF

Work with your tech team to develop and define your security needs.

Your best security rule compliance efforts will be for naught if your transcription vendors' security standards aren't up to par.

Smart idea: Use this security questionnaire excerpt, provided by Grace Upleger, HIPAA manager for Vanderbilt University Medical Center, as a guide to help you create a form that meets your organization's security demands.

The following questions relate to the storage and processing of voice and text files on your voice-capture and transcription management servers and how protection of patient PHI is ensured at all stages of processing.

a. Voice file security and backup

b. Text data (e.g., patient demographics, transcribed reports, etc.) security and backup

c. Security of the physical facilities

d. Systems and data access authorization processes and controls

e. Disaster recovery capabilities and methods

f. Security during voice and text file transmission to and from the data center

g. Security of voice and text data retained on your systems for any sustained periods (including "indefinitely") following-delivery of the transcribed documents to your clients

a. If yes, how are patient PHI voice and text data protected in each central location?-Specifically and clearly address each-of the following as they relate to the control mechanisms you have in place to protect the confidentiality, integrity and-availability of patients' PHI.

1. Voice file security and backup

2. Text data (e.g., patient demographics, transcribed reports, etc.) security and backup

3. Security of the physical facilities

4. Systems and data access authorization processes and controls

5. Disaster recovery capabilities and methods

6. Security during voice and text file transmission to and from the data center

7. Security of voice and text data retained on your systems for any sustained periods (including "indefinitely") following-delivery of the transcribed documents to your clients.

b. If yes, is one or more of these central locations off-shore?-If yes, describe in clear detail the unique policies, procedures-and control mechanisms you have in place to ensure and protect the confidentiality, integrity and availability of-patients' PHI.

3. Do your transcriptionists work from their homes?

a. How are patient PHI voice and text data protected in transmission or upload to and from your workers?

b. How are patient PHI voice and text data protected while in the possession of your workers?

c. Are any of your at-home workers off-shore?-If so, are patient PHI voice and text data protection methods the-same as for your domestic on-shore workers?-If not so, explain in detail.