HITECH

1
HITECH

• Chris Kidd

2
What is HITECH

• Part of the ARRA Stimulus Package
• Provides incentives for adoption of electronic
  health records
• Contains privacy and information security
  requirements.

3
What is PHI

• Protected Health Information (PHI) means any
  information, whether oral or recorded in any form
  or medium that meets both of the following
  criteria
• It is created or received by a health care
  provider or health plan.
• It relates to the past, present, or future
  physical or mental health or condition of an
  individual the provision of health care to an
  individual or the past, present, or future
  payment for the provision of health care to an
  individual.

4
Breach Notification

• Breach means the unauthorized acquisition,
  access, use or disclosure of protected health
  information which compromises the security or
  privacy of such information.
• Establishes Harm Threshold
• 60 Day Requirement
• Call Help Desk Within 24 Hours

5
Securing PHI

• Secured means protected health information that
  has been rendered unusable, unreadable, or
  indecipherable to unauthorized individuals.

6
Methods of Securing PHI

• Encryption. The use of a National Institutes of
  Standards and Technology (NIST) approved
  algorithm and procedure is preferred and may
  allow for safe harbor.
• Destruction paper, film, or other hard copy must
  be shredded or destroyed at end-of-life or use
  such that the PHI cannot be read or otherwise
  reconstructed and is rendered unusable,
  unreadable, or indecipherable.
• Electronic media containing PHI must be cleared,
  purged, or destroyed consistent with approved
  NIST guidelines for media sanitization such that
  the PHI cannot be retrieved.
• Redaction of paper records is not an approved
  method of rendering PHI unusable, unreadable, or
  indecipherable.

7
Next 6 To 9 Months

• Revamping University Policy
• Risk Assessment

8
Questions?