MUSC Compliance Office provides tips on HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 included a Privacy Rule that was implemented in April of 2003. During the last four months, the MUSC’s Compliance Office has identified several areas needing additional emphasis to ensure the privacy of our patients. Below is a tip-list to simplify and improve compliance:

1. Do not share access passwords to computerized patient record systems (for example, Oacis). Remember to log out of these record systems before you leaving the computer terminal even briefly.

2. Do not access a fellow employee’s medical records except for official treatment, payment, or health care purposes. Accessing a medical record for any personal reason (e.g., concern about the health status of a fellow employee) is not acceptable or permissible.

3. Accessing medical records to determine if an adequate population exists to conduct a research study is considered a “Review Preparatory to Research” and must be approved in advance by the Privacy Board.

4. Only methods approved by the Institutional Review Board (IRB) may be used to recruit subjects for research studies. Randomly accessing medical records is not an IRB-approved recruitment method.

5. When discussing a patient’s private medical information in areas accessible to other patients, speak softly and confidentially.

6. Never leave medical records unattended. If you remove a medical record from a storage area, you are responsible for the security of the record.

7. Please remember that our computerized patient record systems (e.g., Oacis) have built in audit functions, including capability to identify which medical records have been accessed by any user and what areas were accessed (e.g., lab or pathology reports, discharge summaries, etc.). If you accidentally access the medical record of a fellow employee, please notify your supervisor immediately.

For further information about HIPAA Privacy Rule guidelines and requirements, please contact Mike Wheeler at 789-6670 or <wheelerm@musc.edu>.

Source: Broadcast Messages, 07/23/2003