5 HIPAA-Compliant Best Practices for Mobile Devices in Healthcare · 2015. 5. 27. · technology in...

MN Systems | 29275 Northwestern Highway, Suite 100 | Southfield, MI 48034 | 855-740-1130 | f: 855-740-1120 | [email protected]

1

A FreedomPACS™ White Paper

for the Healthcare Industry with a Special Focus on Radiology

This white paper will help healthcare professionals, organizations and services to:

Describe how mobile platforms are shaping the industry in terms of communication, workflow, diagnosis and patient care.

Weigh the advantages and disadvantages of this technology in the healthcare environment.

Understand privacy and security issues in light of HIPAA, HITECH and other laws.

Identify and implement specific physical, technological and administrative solutions and strategies to ensure legal compliance.

Outline how mobile medical trends apply to radiology.

4

5

5 HIPAA-Compliant Best Practices for Mobile Devices in Healthcare

How to Enhance Patient Services Without Sacrificing Patient Privacy


2

Executive Summary 3

Best Practice #1 Understand the Role of Mobile Platforms in the Medical Industry 4

Best Practice #2 Identify the Benefits of Mobile Devices in Healthcare 6

Best Practice #3Know the Legal Issues Regarding Patient Privacy and Security 8

Best Practice #4Avoid the Common Pitfalls of Mobile Device Usage 11

Best Practice #5Minimize Risk with Administrative, Physical & Technological Strategies and Solutions 12

Conclusions 14

Research Sources 15

About FreedomPACS™ 15

CONTENTS5 HIPAA-Compliant Best Practices for Mobile Device Usage in Healthcare


3

Mobile device usage is on the rise. How should radiology and healthcare facilities respond to this trend?

Society has exploded into the mobile age with handheld e-readers, tablet PCs and smartphones. People of all ages and backgrounds are using iPads, Androids, Kindles, Blackberrys and Galaxy Tabs for personal and professional reasons. In fact, mobile subscribers worldwide recently topped 5 billion.1

Mobile Trend on the Rise In Healthcare

It isn’t surprising, then, that mobile platforms have also found their way into radiology and healthcare. Consider these recent usage and technology statistics:

• Approximately 2 out of 3 doctors2 now operate a tablet while on the job.

• Over 80% of physicians use a mobile device (tablet or smartphone) at work.3

• Usage is popular among radiology residents: 74% own smartphones and 37% own tablets.4

• The Apple App Store features an inventory of nearly 14,000 medical applications for patients and clinicians.

• Physicians, nurses and other healthcare professionals incorporate mobile technology into their everyday routine. The convenience and portability of these devices help with communication, workflow, patient engagement and even diagnosis.

Privacy and Security ConcernsThe efficiency of mobile platforms, however, is counterbalanced by various patient privacy and security concerns. Improper usage can trigger costly violations of the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health) laws.

In light of these benefits and risks, how should radiology and the broader healthcare industry respond?

This white paper addresses 5 best practices for utilizing mobile devices in healthcare and radiology:

• Understand the role of mobile platforms in the medical industry.

• Identify and harness the benefits of mobile devices.

• Know the legal issues regarding patient privacy and security.

• Avoid the common pitfalls of mobile device usage.

• Minimize risk with administrative, physical and technological strategies and solutions.

EXECUTIVE SUMMARY

1 Applied Radiology 2 American Medical Association 3 American Bar Association 4 American College of Radiology


4

Medical students, clinicians and patients are harnessing mobile technology in record numbers.

By now, to say healthcare is “going mobile” is an understatement. This technology is a popular topic at professional medical conventions, including both the Radiological Society of North America (RSNA) and Healthcare Information and Management Systems Society (HIMSS). Residents and fully trained clinicians use at least one mobile device to learn their trade and carry out their work. Likewise, patient demand for medical apps is skyrocketing.

Role in Health EducationThe role of mobile devices in med school goes way beyond the fact that many students and residents use them in their personal lives. Stanford University, the University of California-Irvine and multiple others have incorporated them into their medical programs. These institutions are embracing mobile technology in response to how professionals are now practicing their trade and with the goal of improved communication among clinicians, staff workers and patients alike.

Professional Uses Among other things, physicians, nurses and other health practitioners use these devices to:

• View medical images.

• Access electronic health records.

• Measure and monitor patient vitals.

• Conduct medical research.

• Engage patients and track follow-up.

• Assist in making clinical decisions.

• Educate others on medical topics.

• Respond to emergency situations.

• Communicate with coworkers.

• Complete routine office tasks.

For instance, referring physicians and radiologists use tablets to transmit medical images and communicate in real time about their findings. The high pixel resolution of tablets can aid radiologists in interpreting those images. Also, a mobile platform can function like a “wireless doctor’s bag” if armed with the right medical apps. They help clinicians measure vitals, make diagnoses, remotely monitor patients or serve as portable, comprehensive health reference guides.

Best Practice #1:Understand the Role of Mobile Platforms in the Medical Industry


5

Patient Uses Of the nearly 14,000 medical apps offered through Apple’s App store, the majority of them are geared toward the public.5 Health insurance companies are even sending out “how-to” guides to members on the benefits of mobile technology. Patients are responding, using them to take a more proactive role in personal health, including:

• Tracking fitness goals.

• Assessing general medical topics.

• Pricing prescriptions and finding generic equivalents.

• Monitoring certain conditions and vital signs through apps between visits.

• Accessing their electronic health records and even their clinician’s diagnostic notes (when available).

• Scheduling appointments and contacting their physician directly about their case.

Understand the Role of Mobile Platforms in the Medical Industry

5 Applied Radiology


6

Between 66 and 83% of doctors use a mobile device at work to improve workflow and offer better overall service to patients.6

As multi-functional tools, mobile platforms are advantageous to radiologists and other healthcare professionals, as well as patients. The benefits of this technology are numerous: saving time, enhancing communication, streamlining workloads, increasing patient engagement and even saving lives in emergencies.

Saving Time and Improving Workflow Tablets, for example, save medical employees about 1.2 hours a day,7 reports one recent study. Clinicians have all the necessary information at their fingertips; they don’t have to waste time tracking it down from multiple sources. With mobile devices, health personnel can quickly investigate medications, contact insurance companies, access electronic health records and study medical images.

This technology also cuts down the traditional lag time between referring physicians and radiologists. Because mobile devices serve as portable imaging viewers, they literally untie radiologists from traditional workstations, giving them yet another tool with which to efficiently interpret and deliver X-ray, CT, MRI and ultrasound studies.

Connecting with PatientsMedical professionals credit mobile platforms with increased patient engagement. For instance, during examinations, doctors can easily pull up medical images or research on their tablets to directly illustrate medical concepts, conditions or treatments to patients without ever leaving their side. Using the right safety protocols and permissions, this information can also be quickly shared with patients via mobile devices in-between clinical visits.

Best Practice #2:Identify the Benefits of Mobile Devices in Healthcare2

6 American Medical Association and American Bar Association 7 American Medical Association


7

In fact, the quantity of medical apps now on the market is evidence of the growing demand for a personalized, team-oriented approach to healthcare. And, as previously mentioned, patients are just as likely to take the initiative, using mobile technology to play an active role in their own health and well being as never before.

Enhanced Service and Response Time Mobile devices allow health practitioners to provide a higher level of service when they’re off-site. Clinicians can receive and respond to real-time vitals and status reports on their patients from virtually anywhere. They can also be instantly notified if a patient’s condition turns critical.

For example, when clinicians are waiting on the interpretations of medical images from off-site radiologists, mobile platforms can be lifesavers: decreasing turnaround time by making both referring physicians and radiologists more accessible. Furthermore, because certain medical apps can function like traditional medical monitoring devices, health personnel can offer even more care in emergency situations.

Identify the Benefits of Mobile Devices in Healthcare2


8

In light of increased enforcement of HITECH and HIPAA policies, secure mobile device usage is a growing concern for healthcare providers and facilities.

With the universalization of electronic health records looming by 2015, enforcement of patient privacy and security laws is at an all-time high. Improper mobile device usage in a healthcare setting can trigger expensive violations of those laws, specifically the regulations outlined under the Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act.

HIPAA and HITECH OverviewOn Aug. 21, 1996, HIPAA standardized national privacy and security requirements concerning patient health records. This legislation gave individuals increased access to their personal medical information and more influence over how that information is shared and used among insurers, health personnel, medical facilities and the like. Nothing in the federal law, however, prevents states from giving patients more rights and safeguards than those outlined under HIPAA.

The goal of HITECH, enacted on Feb. 17, 2009, is to make all medical records electronic by 2015. Until that time, incentives are available to health entities that adopt this electronic format and the necessary technology to develop and sustain it. After 2015, those same entities face penalties for non-compliance.

Consequently, electronic health information creates new privacy and security concerns. As a result, HITECH extends the scope of HIPAA in terms of stricter disclosure, notification and safety provisions 8 to minimize, prevent and handle any breaches of protected health information (PHI). These provisions even extend beyond the medical industry to certain parties who handle, store or transmit electronic PHI.

Best Practice #3:Know the Legal Issues Regarding Patient Privacy and Security3

8 U.S. Department of Health & Human Services


9

Mobile Platform ConsiderationsSmartphone and tablet usage need to be in compliance with these two laws, especially the HIPAA Security Rule. This rule permits PHI to be shared electronically, but also “requires appropriate administrative, physical and technical safeguards” to be in place before doing so.

Because a mobile device can record transmitted data in its memory or SIM card, PHI shared in this manner is vulnerable. PHI can be at risk because smartphones and tablets are compact and portable.9

Although the portability and size are benefits, these two features also make it easier for:

• Health professionals to use personal mobile devices, instead of professional ones to share PHI. Personal devices are often not equipped with sufficient security safeguards, including passcodes and encryption, and can easily be used on unprotected public wireless networks.

• Mobile devices to be stolen, used by the wrong party or lost.

Know the Legal Issues Regarding Patient Privacy and Security3

Smartphones and tablets in healthcare usage need to be in compliance with the HIPAA Security Rule.

9 American Bar Association


10

Who Regulates Mobile Device Usage in Healthcare?

HIPAA and HITECH aren’t the only acronyms the medical industry needs to be aware of regarding mobile device usage.

Five federal agencies each have a role in ensuring that when this technology is employed in a healthcare setting, all parties involved—developers, transmitters, medical institutions and professionals—are playing by the rules.

Federal Communications Commission (FCC) – Devices and systems based on radio-frequency fall under this agency’s jurisdiction. The FCC oversees certain technological aspects of mobile platforms and their carrier networks.

Federal Trade Commission (FTC) – This agency prohibits developers and distributors of mobile technology from withholding significant information or falsely marketing devices and apps to the medical industry and the public alike.

Food and Drug Administration (FDA) – Because the FDA is “responsible for protecting the public health,” mobile devices used for medical diagnostic purposes fall under its authority. This agency regulates these platforms both in terms of safety and effectiveness.

National Institute of Standards and Technology (NIST) – Although non-regulatory, NIST helps establish guidelines for the secure use of technology, including computers and mobile devices. Many industries voluntarily adopt these guidelines as minimum standards, best practices and benchmarks.

Office of Civil Rights (OCR) – As part of the U.S. Department of Health and Human Services, this agency ensures that the healthcare industry complies with HIPAA. Like computers, mobile platforms must be used in such a way that sensitive health information remains protected and private.

Source: Health IT Exchange’s “The ABCs of Federal Regulation for Mobile Devices in Healthcare”


11

Best Practice #4:Avoid the Common Pitfalls of Mobile Device Usage4

In addition to legal considerations, healthcare facilities and professionals need to ensure that their technical infrastructure, IT support, development and internal policies are mobile-specific.

Although privacy and security of protected health information should be the top two concerns of the medical industry, mobile device usage also raises other practical concerns. These involve defining or expanding internal policies, technical resources and task capabilities.

In-House Mobile PoliciesApparently, although usage on the job is high, only 38% of the participants in a HIMSS survey reported that their employer had implemented a sufficient mobile strategy.10 To counteract this situation, an in-house policy needs to address mobile technology specifically and meet the following objectives:

1. Adhere to HIPAA’s “administrative safeguards,” ensuring the integrity of protected health information (detailed in the next section).

2. Be available to all employees and necessary third parties (business associates, vendors, etc.)

3. Dedicate resources to stay on top of emerging developments in mobile technology, including new medical apps and devices.

4. Ensure that there are adequate technical resources in place (support and connectivity) to provide optimal mobile platform usage.

Technical Considerations Legal considerations and insufficient internal policies may pose challenges; however, the lack of technical staff was the number one reason cited in another HIMSS study.11 As with any technology used in a professional setting, medical facilities and organizations need sufficent IT professionals to oversee the facility’s technology tools and wireless network capacity in terms of number of users, safety and productivity.

Task Suitability When legal, employer and technical issues are resolved, healthcare professionals need to ensure that the device is suited to the task at hand. If the computer is the best medium for efficiency or workflow, then the accessibility of the mobile device may be secondary.

10 Applied Radiology 11 American Medical Association


To ensure that mobile platform usage does not infringe on patient privacy and security rights, HIPAA requires “appropriate administrative, physical and technical safeguards” to be implemented.

With the rise of mobile device usage and legal enforcement of patient privacy regulations, the risk of violations is increasing. Radiology and the wider healthcare industry need to adopt the recommended safeguards outlined under the HIPAA Security Rule to mitigate that risk.

Administrative SafeguardsThe law defines safeguards as strategies that “provide management, accountability and oversight structure,”12 including:

• Addressing the issue of personal mobile devices in the workplace.

• Periodically training new and existing staff on safe mobile platform use and educating them about HIPAA requirements, consequences, updates and best practices.

• Instituting a secure technical environment for mobile devices.

• Carrying out regular audits to ensure compliance with legal requirements and employer policies.

Technical and Physical SafeguardsTechnical safeguards refer to solutions that protect against unauthorized use—whether intentional or unintentional—of mobile platforms. These include installing passcodes or firewalls, encrypting protected health information (PHI) and other sensitive data and deleting such data after each use.

Technical safeguard best practices are:

• Staying on top of security software updates.

• Avoiding file sharing applications and open Wi-Fi networks.

• Researching new medical apps and downloads carefully before installation.

• Employing encrypted networks and data storage with redundant back-ups off-site.

Best Practice #5:Minimize Risk with Administrative, Physical and Technological Strategies and Solutions

5

1212 U.S. Department of Health & Human Services


13

For example, one solution is to utilize cloud technology for the retrieval and storage of patient records—including radiology studies. The off-site, daily data backup benefits of the cloud (encrypted for privacy) help fulfill HIPAA security criteria while allowing clinicians to efficiently exchange PHI from mobile devices to improve workflow.

Physical safeguards mainly refer to protections against loss and theft. Between 2009 and 2011, the federal government reported that the health information of 1.9 million individuals was compromised due to stolen or misplaced mobile platforms.13

Physical safeguards include:

• Maintaining a list of all devices used by clinicians and other staff to exchange private medical data.

• Securely storing these platforms when not in use.

• Installing remote wiping and location technology tools in case of loss or theft.

Employ encrypted networks and data storage with redundant back-ups off-site.

Minimize Risk with Administrative, Physical and Technological Strategies and Solutions5

13 U.S. Department of Health & Human Services as accessed from the American Bar Association


14

Implementing best practices on mobile device usage enables radiology and the wider healthcare industry to enhance patient care without sacrificing patient privacy.

Balanced ApproachThe growing trend of mobile device usage among radiologists, healthcare professionals and patients presents many benefits and challenges. In light of the current legal and technological environment, healthcare facilities can be best served by taking a discerning, balanced approach.

Mobile-specific internal policies, protocol and IT support need to be instituted that reduce the likelihood of HIPAA and HITECH privacy and security violations; however, it is key that these policies continue to enable the documented advantages of mobile technology, including saving time, improving workflow and communication, enhancing service and increasing patient engagement.

In Review: Best Practices for Using Mobile DevicesMedical professionals in radiology and throughout the healthcare industry can have both security and efficiency by adopting the five best practices for mobile platform usage:

• Best Practice #1: Understand the Role of Mobile Platforms in the Medical Industry

• Best Practice #2: Identify the Benefits of Mobile Devices in Healthcare

• Best Practice #3: Know the Legal Issues Regarding Patient Privacy and Security

• Best Practice #4: Avoid the Common Pitfalls of Mobile Device Usage

• Best Practice #5: Minimize Risk with Administrative, Physical and Technological Strategies and Solutions

Implementation StepsFollowing three steps will put medical facilities, professionals and healthcare providers on the right track for implementing safeguards as outlined under federal law.

1. Examine current technical resources and data protection strategies.

2. Stay informed of trends, regulations and legal developments, like the HIPAA final omnibus rule.

3. Adapt internal policies in response to mobile platform and technology trends.

This will ensure that all can harness the benefits of mobile platforms while simultaneously avoiding the potential security pitfalls of this technology.

CONCLUSIONS


15

About FreedomPACS™

FreedomPACS™ – a medical picture archiving and communication system (PACS) that provides convenient access and archiving of radiology images from multiple modalities. Using cloud or server technology, FreedomPACS incorporates DICOM standards and is accessible on both PCs, Macs, and mobile platforms.

FreedomPACS Cloud™ – offers secure, HIPAA-compliant off-site storage for radiology images. Available with or without a PACS system, this affordably priced resource harnesses the protection and efficiency of the cloud. It provides instant access and an optional cross-platform diagnostic viewer.

FreedomPACS is owned by MN Systems, a medical software development company, based in Southfield, Michigan, formed from a joint venture between ALZ, Inc. and the Michigan Head and Spine Institute (MSHI). The company provides practical, cost-effective software solutions for the healthcare industry.

To learn more about these and other leading-edge medical software solutions, contact FreedomPACS at 855-740-1130, [email protected] or www.freedompacs.net.

PACS

Research SourcesThe content for this white paper was obtained from the following: 1. American Bar Association2. American Medical Association3. Applied Radiology4. Becker’s Hospital Review5. Health IT Exchange6. National Institute of Standards and Technology7. Radiology Today Magazine8. Radiological Society of North America 9. U.S. Department of Health & Human Services


16

FreedomPACS™ by MN Systems29275 Northwestern Highway, Suite 100Southfield, Michigan 48034Phone: 855-740-1130

Fax: 855-740-1120Email: [email protected] Website: http://www.freedompacs.net/ Facebook: https://www.facebook.com/freedompacsTwitter: https://twitter.com/freedompacs

© 2013 by MN Systems (Owner of FreedomPACS™)

This white paper is for informational purposes only and represents the opinion of MN Systems based on the sources provided. The company retains all rights to the white paper, which is accurate as of the publication date, March 2013. Duplication, in whole or in part, via any medium is prohibited with the prior permission of MN Systems.

Enhance Patient Services Without Sacrificing Patient Privacy

5 HIPAA-Compliant Best Practices for Mobile Devices in Healthcare · 2015. 5. 27. · technology in...

Documents

Transcript of 5 HIPAA-Compliant Best Practices for Mobile Devices in Healthcare · 2015. 5. 27. · technology in...