HIM6114 - A Comprehensive Guide to HIPAA and HITECH Compliance

This report outlines the necessary steps physicians must take to comply with HIPAA and HITECH regulations to protect patient data within Electronic Health Record (EHR) systems. It addresses the increasing threat of data breaches and emphasizes the importance of securing medical information through measures like encryption, strong password protocols, avoiding file-sharing software, enabling firewalls, installing protective software, and maintaining physical security of devices. The report stresses the role of EHR systems in enhancing data security and preventing potential safety issues, ultimately improving healthcare outcomes. It references a case study involving a stolen computer containing unsecured medical data, highlighting the consequences of non-compliance and underscoring the need for healthcare providers to adopt best practices for data protection.

Running head: HIPAA AND HITECH COMPLIANT STEPS 1
HIPAA and HITECH Compliant Steps
Name
Institutional Affiliation

HIPAA AND HITECH COMPLIANT STEPS 2
HIPAA and HITECH Compliant Steps
Introduction
The EHR can be defined to be a systemization of the patients electrically stored information
in digital format hence another kind of paper-based chart (Clegg et at 2016). The documents are
built on the actual time hence easier access to patients’ records. The system is a fundamental
aspect of health IT technology. The program is helpful in the provision of the financial incentives
for the services in provision by the validation of HER affiliated technology. The federal
government has put much emphasis on the EHR technology for several healthcare institutions to
enable the sharing of medical data (Henry, Pylypchuk, Searcy & Patel 2016). The technology
comprises of the medical information and clinical data, population data, medication data, and the
radiology information.
The HER technology is of much benefits to the stakeholders of the healthcare sector more so
the patients and the healthcare providers. The technique allows for much quicker entry to the
healthcare patients’ records including the checkup data. It also provides the efficiency of the
system by the reduction of paperwork used and the cost involved for the checkup. They as well
facilitate high levels of prescriptions by the medical providers hence reducing errors which could
be fatal to patients. With its features of allowing data exchange, EHR and technology can easily
share data with EHR system which can be made use of in a big healthcare facility thus reducing

HIPAA AND HITECH COMPLIANT STEPS 3
movements (Miotto, Kidd & Dudley 2016). However, it does not easily allow data exchange
with other kinds of the system other than EHR.
The Health Information Technology grounded on the Economic and Clinical health act is
part of the American Recovery and Reinvestment Act of 2009 (Fritz, Tilahun & Dugas (2015.
The technology was vital in the establishment of the financial based incentives and multiple
penalties aimed at constraining the establishment of providers as the legitimate users of EHR
system. The healthcare providers are to use they HER systems which abide by the Health and
Human service standards (Price, Bellwood, Kitson, Davies, Weber & Lau 2015). HIPAA has a
privacy regulation which assists in the provision of the federal based protection which is in
possession of divergent covered entities and would give them the provision of the variety rights.
This case study is rooted in the theft of a computer from a healthcare provider’s car. The
computer contained personal medical data for the patients and other files with medical records.
The computer did not have an appropriate security system as required hence the information was
easily accessible to the thief. The information that might have been stolen is very important for
the medical providers and the patients. Healthcare providers should ensure that the privacy of the
patients are well protected, for this to work through, the providers should abide by the best level
of practices by ensuring that the computers network they use is of best security practices. The
application of secure procedures for security, protection by passwords, use of antivirus software
and use of firewalls is considered key in securing important medical records. Therefore, the
provider violated the HIPAA and HITECH regulations which could attract penalties upon being
found guilty. The provider should have followed the steps provided by the two articles in
ensuring the security of health data in the computer.

HIPAA AND HITECH COMPLIANT STEPS 4
Steps the physician needs to take in order to be compliant with HIPAA and HITECH
The steps below are important for the physicians in securing the important system. The steps
should abide by the HITECH and HIPAA acts.
1. The initial step recommends the installing and enabling appropriate encryption
technology. Encryption of user identification, passwords, accounts plus pass-phrase encryption
to avoid unintended usage of data. The healthcare providers should be alert to avoid file
exchange software that transmit information in plain text.
2. The providers should use the password of would require user verification. This ensures
specific group of known identities with exclusive rights are able access the transmission record
solution (Drolet, Marwaha, Hyatt, Blazar & Lifchez 2017). Connection of confirmation to each
users’ net system can both streamline the authentication by uniquely reinforcing the security
through ensuring that only recognized users to have permission to file transfer set up mandates.
3. This step directs user not to use or use any kind of file sharing software since they can be
subject to misuse and breach of patients’ privacy.
4. The firewall should be installed and enabled to deny unapproved access to the system.
5. The fifth step allows the installation and permitting the protective software to guard the
system from any kind malicious programs
6. The technology programs used for protection are to be regularly be kept up to date and
any mobile application should be adequately investigated prior installation.

HIPAA AND HITECH COMPLIANT STEPS 5
7. Good maintenance of the physical usage of multiple gadgets. The need for an appropriate
level of security in receiving and sending medical information over public or private networks
since some networks can easily be compromised to expose the data they transmit.
8. The final step involved the deletion of any started data of health records from any mobile
devices before disbanding the tools or handing them over to other personnel.
Conclusion
To sum up, the EHR systems are presumed to be extremely vital in securing important
medical records for all patients. The infringement on the data security and theft of medical
information has been on increase among various healthcare centers and institutions. The EHR is
key in revealing the problems being considered to be potential on safety hence it is expected to
assist the physicians in avoiding serious problems for the patients. This would result in
exceptional end results for the healthcare beneficiaries.

HIPAA AND HITECH COMPLIANT STEPS 6
References
Clegg, A., Bates, C., Young, J., Ryan, R., Nichols, L., Ann Teale, E., ... & Marshall, T. (2016).
Development and validation of an electronic frailty index using routine primary care
electronic health record data. Age and aging, 45(3), 353-360.
Drolet, B. C., Marwaha, J. S., Hyatt, B., Blazar, P. E., & Lifchez, S. D. (2017). Electronic
communication of protected health information: privacy, security, and HIPAA
compliance. The Journal of hand surgery, 42(6), 411-416.
Fritz, F., Tilahun, B., & Dugas, M. (2015). Success criteria for electronic medical record
implementations in low-resource settings: a systematic review. Journal of the American
Medical Informatics Association, 22(2), 479-488.
Henry, J., Pylypchuk, Y., Searcy, T., & Patel, V. (2016). Adoption of electronic health record
systems among US non-federal acute care hospitals: 2008-2015. ONC data brief, 35, 1-9.
Miotto, R., Li, L., Kidd, B. A., & Dudley, J. T. (2016). Deep patient: an unsupervised
representation to predict the future of patients from electronic health records. Scientific
reports, 6, 26094.
Price, M., Bellwood, P., Kitson, N., Davies, I., Weber, J., & Lau, F. (2015). Conditions
potentially sensitive to a personal health record (PHR) intervention, a systematic
review. BMC medical informatics and decision making, 15(1), 32.