One of the most common questions chiropractors and patients alike have about electronic health records (EHR) is how records stay “safe.”

The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law in February of last year to address the issues of adoption and meaningful use of health information technology.

In particular, subsection D of this law relates to improved privacy and security provisions. In the government’s final meaningful use ruling, which was released in July, compliance with HIPAA privacy and security rules is required for all covered entities, regardless of whether or not they are compensated for EHR compliance through the federal incentive program.

In addition, compliance with the HIPAA Privacy and Security Rules constitutes a wide range of activities, procedures, and infrastructure.

Proven protection

The government’s objective is to protect all information created or maintained in any given EHR system through the implementation of appropriate technical features such as password-protection and audit trails.

Part of the complicated certification procedure for all EHR vendors is a security risk analysis and risk management process to confirm that unauthorized personnel cannot access, or edit, any patient’s medical records.

In general, most of these software platforms are highly secure, with key features such as password protection and audit trails to ensure day-to-day document security. Audit trails aren’t just for large networks with multiple offices offering patients a variety of healthcare services, but also for solo chiropractic clinicians who act as their own administrators.

For example: Morgan Baker, DC, says she appreciates how her system offers an edit log, which tracks not only when changes are made, via time stamp, but also a detailed trail that “keeps a log of my edits, so I can see what I’ve changed, and refer back to previous notes.”

Set parameters

In addition, a common feature allows systems administrators to set the parameters of which in-office personnel may view which parts of any given file, or specific files. All users are given different passwords, meaning each user can have access to distinct parts of the system.

For example: One employee may only be able access scheduling functionalities, while others can see clinical history. “Break glass” 

Full Story