Self-Monitoring & Assessment Tools: Reasons

There are many reasons for departments to conduct Privacy and Information Security Self-Assessments. Some of those reasons are below:

1. Patients sometimes perceive that their privacy has been violated.
2. Patient perception is usually based on their experience at the department/practice level (e.g., when I am giving information to a health care provider, others can hear me, I was able to see/overhear another patient’s information, is my information just left around on desks, etc., unattended, with the risk that others might see it?).
3. Including self-assessments in continuous process improvement initiatives helps your department/practice to:
   1. Meet regulatory requirements for putting safeguards in place to protect the confidentiality of data,
   2. Consciously integrate privacy into standard operational practice,
   3. Minimize the risk of inappropriate use or disclosure of PHI that could occur through the unauthorized access, disclosure, loss, theft or tampering of PHI, and
   4. Maintain patient trust in your dedication to patient confidentiality.

Reason for Encryption of Portable/Mobile Devices

More and more, portable electronic devices are being used to facilitate patient care, treatment and supporting business functions. However, these devices are easily lost or stolen creating significant risk to the institution. 

Policy prohibits the capturing of PHI on portable devices unless management approves the use based on attestation that there is a bona fide business need and the user agrees to adhere to guidelines, including encryption as specified on the form: Authorization to Capture/Use PHI on Portable Devices or Removable Media

Additionally, according to existing policies, department heads must keep track of all portable devices used for business purposes within their department regardless of whether PHI is captured on them or not.