Privacy and Security

Promotes topics in how patient health information is secured, created, stored, shared, and transferred.

Process for Releasing Protected Health Information (PHI) in Support of Reproductive Health Care Privacy Final Rule

The purpose of the document is to help HI professionals comply with the complex requirements in the Reproductive Health Care Privacy Final Rule by outlining the recommended process for releasing reproductive healthcare PHI.

Release Of Information (ROI) TOOLKIT (2022)

The purpose of the Release of Information Toolkit is to help an individual develop an effective ROI process across any setting. It is to be used as a framework and reference guide to ensure disclosures of PHI are made in accordance with all state and federal regulations in a timely manner to guarantee the integrity of the PHI is maintained. For adequate response and turnaround times, types of requests must be anticipated before they are received with appropriate policies and procedures in place to facilitate smooth business process flow. This includes addressing the common types of disclosures anticipated and how they would be handled, the quality management and tracking procedures, as well as research of state and federal laws that will impact the processes.

Copy Functionality TOOLKIT (2016)

The Copy Functionality Toolkit is designed to support and guide organizations, HIM professionals, providers, and information technology (IT) professionals to examine the issues and circumstances in which the healthcare industry needs to define, support, and execute best practices managing copy technology in the EHR. This toolkit is intended to assist in developing policies and procedures surrounding this functionality. This toolkit will reaffirm that a trustworthy EHR system begins with technology but succeeds only with appropriate and effective information management and governance.

External HIPAA Audit Readiness TOOLKIT (2017)

The External HIPAA Audit Readiness Toolkit is created and designed to be a single resource to provide details about external HIPAA audits and to include government resources as well as other helpful tools to help an organization prepare for any external HIPAA audit. This toolkit will enable the reader to understand the requirements for OCR HIPAA Phase 2 audits, including ongoing future audits, and offers guidance regarding audit preparation and recommended practices. This toolkit can also assist CEs and BAs in meeting requirements, ascertaining how to identify which documents contain what information (and where such documents are located), and developing documentation that may be absent from a CE’s or BA’s HIPAA policies and procedures.

Breach Management TOOLKIT (2018)

The purpose of the Breach Management Toolkit is to provide a comprehensive collection of resources and best practices to help healthcare organizations and health information management (HIM) professionals navigate their way through the HIPAA breach notification rule and the overall breach management process. It is to be used as a framework and reference guide to assist with the breach investigation, determination, mitigation, notification, reporting processes, and to provide assistance with understanding and complying with federal regulations within the required time frame required by federal law. It is intended to bring awareness of the importance and responsibility of training work force members in breach notification, identification, and prevention.

Disaster Planning And Recovery TOOLKIT (2016)

The Disaster Planning and Recovery Toolkit addresses multiple Information Governance Principles for Healthcare (IGPCH). Healthcare entity information assets must be protected to ensure they are secure, reliable, available, and used in an efficient, ethical, lawful, and secure manner even in the face of a disaster. Disruptions, both planned and unplanned,
may make electronic health records (EHRs) and other IT assets unavailable to clinicians and other workforce mentor for day-to-day business operations. When planned and accomplished successfully, disaster planning provides several benefits designed to account for the overall recoverability and resiliency of a healthcare organization. The Disaster Planning Toolkit addresses these requirements with emphasis on data backup plan availability as well as integrity of information.

Redisclosure of Protected Health Information (PHI) (2018 Update)

This Practice Brief offers guidance for covered entities and health information exchanges for the management of the redisclosure of protected health information by outlining challenges and providing recommendations and best practices in compliance with federal and state regulations.

Managing Amendments in an HIE Environment

This Practice Brief outlines the issues to be addressed by a covered entity as it puts the necessary policies and processes in place for amending an electronic health record that has been shared with other healthcare providers through a health information exchange.

Author: Janelle Burns JD CHPS, Stephanie Costello MS RHIA, Sharon Lewis MBA RHIA CHPS CPHQ FAHIMA, et al

Making Amendments to Health Records (2017 Update)

This Practice Brief provides guidance regarding health record amendment rights granted under federal and state law.

Standardizing Data and HIM Practices for Interoperability

This Practice Brief summarizes information about various health IT standards, standardization processes and entities, national and international standardization efforts working to enable health IT interoperability, and the role of AHIMA in developing health information management practice standards.

Author: Anna Orlova PhD, Harry Rhodes MBA RHIA CHPS CDIP CPHIMS FAHIMA, Diana Warner MS RHIA CHPS FAHIMA

Guidelines for a Compliant Business Associate Agreement (2016)

This Practice Brief discusses guidelines for a compliant business associate agreement.

Understanding Cybersecurity: A Primer for HIM Professionals

This Practice Brief provides insight on the surge in cybercriminal activity and to serve as a reference for how to increase awareness as well as strategies that may be employed to assist in reducing the risk of cyber attacks in healthcare.

Managing Unsolicited Health Information in the Electronic Health Record (2016 update)

This Practice Brief addresses the primary challenges in receiving unsolicited health information, followed by key recommendations to help manage it.

Navigating a Compliant Breach Management Process

This Toolkit is intended to raise awareness of the importance and responsibility of everyone within the healthcare organization to report HIPAA breaches to the appropriate designated personnel, as well as provide breach prevention education and training.

Managing a Patient’s Right to Request Restrictions of Disclosures to Health Plans

Covered entities should have in place the mechanisms for limiting disclosure of protected health information under minimum necessary policies and procedures. This Practice Brief provides guidance to assist organizations in complying with restriction requirements.

Privacy and Security Audits of Electronic Health Information (2014 update)

This Practice Brief identifies and defines the components necessary for a successful security audit strategy. It also outlines considerations for legal and regulatory requirements, how to evaluate and retain audit logs, and the overall audit process.

Enabling Consumer and Patient Engagement with Health Information

The purpose of this Practice Brief is to understand the relationship between health information management and consumer/patient engagement, and examine how HIM professionals can advance and support engagement. Its focus is on policies and practices that enable the individual’s access to and use of health information.

Laws and Regulations Governing the Disclosure of Health Information (2014 update)

This Practice Brief provides a general overview of the laws and regulations impacting the timely and appropriate release of Protected Health Information (PHI).

Information Security—An Overview (2014 Update)

This Practice Brief provides an overview of information security, including some of the background and basic concepts involved in securing the privacy of health information. Included are key roles and responsibilities as well as a list of specific policies and procedures that should be considered when developing an organizational security program.

Authorization Requirements for the Disclosure of Protected Health Information

This Practice Brief will explore the requirements for the appropriate disclosure of protected health information (PHI) including authorization content. It will also provide an overview of other federal and state laws and regulations and the impact to specific types of PHI disclosures (i.e. substance abuse records, psychotherapy notes).

HIPAA Security Overview

This practice brief provides a succinct overview of the HIPAA security rule, along with some of the background and basic concepts necessary to understand the security rule. In addition, it highlights the skills HIM professionals possess to maintain HIPAA security compliance within their organizations.

Securing Wireless Technology for Healthcare (2013 update)

This Practice Brief serves as a guideline to help ensure that due diligence has been exercised on the part of healthcare organizations and that information risks pertaining to wireless technologies are adequately identified and managed.

Notice of Privacy Practices (2013 update)

This Practice Brief outlines the federal requirements for the Notice of Privacy Practices (NPP).

The 10 Security Domains (2013 update)

This Practice Brief outlines the 10 security knowledge domains that individuals with a Certified Information Systems Security Professional (CISSP) credential must possess.

Release of Information for Marketing or Fund-raising Purposes (2013 update)

The HIPAA omnibus final rule significantly modified the definition of marketing to require authorization for treatment and healthcare operations communications where the covered entity receives financial remuneration from a third party whose product or service is being marketed.

Regulations Governing Research (2013 update)

This Practice Brief reviews the federal regulations that affect research and the requirements regarding the use and protection of an individual's information.

The Privacy and Security of Occupational Health Records

This Practice Brief will discuss a variety of issues related to OHRs, including privacy and security principles as well as content and record management practices for the healthcare provider.

Protecting Patient Information after a Facility Closure (2011 update)

This Practice Brief provides guidance on managing health information during a facility closure in all practice settings.

Sanction Guidelines for Privacy and Security Violations (2013 update)

This practice brief is intended to bring awareness for a united industry message of the seriousness regarding the handling of violations by workforce members. This brief offers methods for sanction management within organizational policies. This guidance mirrors the breach category approach now codified by HITECH, which encourages sanctions fitting to breach motivation, whether civil or criminal in nature.

Author: Barb Beckett, RHIT, CHPS Kathy Downing, MA, RHIA, CHP, PMP Angie Fergen, RHIA, CHPS Peg Schmidt, RHIA, CHPS