Low-tech tactics, including better communication, workforce education and breach simulations, can help covered entities significantly as they struggle with HIPAA data privacy and security, privacy professionals say.
In a panel discussion March 3 at the National HIPAA Summit in Arlington, Virginia, seven HIPAA privacy experts offered tips and advice on topics ranging from new technology to breach cleanup.
Even as the conversation surrounding privacy gets technical, the experts emphasized that patients’ wishes underlie the entire topic. “There are two sides to HIPAA privacy. One is obviously the compliance side. The other is the personal patient side,” said Anne Kimbol, assistant general counsel and chief privacy officer at HITRUST and former general counsel for Texas Health Services Authority.
Kimbol said she always considers what she calls the “creepy” test, which involves considering whether a patient would think what you’re doing with their data is creepy. In this case, she said, there are two questions to answer: “Does HIPAA let me do it? Does my conscience let me do it?”
Elizabeth Delahoussaye, chief privacy officer at Ciox Health in Alpharetta, Georgia, told conference attendees that HIPAA professionals frequently talk about the number of records that were breached. “Well, it was patients that were breached,” she said. “I agree, yes, they are records, but that was an individual’s information.”
Medical staff members and others in health care organizations aren’t always thinking about the patient, said Angela Alton, vice president and privacy officer at Ann & Robert H. Lurie Children’s Hospital of Chicago, and former deputy chief privacy officer, Bay Area, for Sutter Health.
“I think reminding and bringing back your staff to the basics of what they’re required to do and how some of the things that they develop may actually be saving them time but violating a patient’s rights as to how the information is used and where it goes” is important, Alton said. “And I think many times our staff are not necessarily thinking about the patient. They’re thinking about it from a data perspective.”
