Jeff, my sentiments exactly. We doing almost the exact same thing as you. We do, however, sometimes send PHI as an attachment encrypted by PKzip or Winzip (the p/w is given over the phone and not emailed). The feds may get a lot more restrictive with the new HITECH initiative. And just last year, they did their first HIPAA audit at a hospital that was not generated by a complaint.
Date: Tue, 16 Jun 2009 16:18:50 -0500 Subject: Re: HIPPA help From: [email protected] To: [email protected] You need to be able to demonstrate(in writing) that you have thought about how sensitive data is protected. Biggest part of work(and it is ongoing for us) was/is to teach/convince our employees that patient data NOT be sent using email to anyone outside our organization. We have yet to decide email was the only or even preferred method of getting sensitive data to people outside our buildings/network. Up to this point I believe that has saved us a lot of money. I don't know how long we will be able to do things the way we are, which is to say we use the fax machine a lot. Please don't suggest that we are spending more money than we know on faxes, we do almost ALL our business in this local market, so we aren't paying long distance fees on those faxes. I do hate the faxing technology in general though. On Tue, Jun 16, 2009 at 4:03 PM, Bill Lambert <[email protected]> wrote: +2 Bill Lambert Concuity 847-941-9206 -----Original Message----- From: Erik Goldoff [mailto:[email protected]] Sent: Tuesday, June 16, 2009 4:02 PM To: NT System Admin Issues Subject: RE: HIPPA help + 1 HIPAA is a set of *recommendations* for the standard of security, but there are few, if any granular, detail level requirements ... Erik Goldoff IT Consultant Systems, Networks, & Security -----Original Message----- From: Ben Scott [mailto:[email protected]] Sent: Tuesday, June 16, 2009 4:40 PM To: NT System Admin Issues Subject: Re: HIPPA help On Tue, Jun 16, 2009 at 3:40 PM, Bob Fronk <[email protected]> wrote: > I am in the middle of a HIPPA compliance review. One of the > consultants is suggesting that all our email be encrypted because it > may contain HIPPA related information. HIPAA is a mess, and it's been a while for me, but as I recall, the regulations generally don't require specific mechanisms like encryption for particular tasks. You have to take steps to protect it. You don't have to be crazy. Chances are they're just talking out of their rectum. Consultants do that a lot. It's especially common when it comes to compliance; the consults go for overkill "to be safe". Ask them to quote chapter and verse from an actual law or regulation. When they can't, thank them for the suggestion and move on to the next item. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ _________________________________________________________________ Insert movie times and more without leaving Hotmail®. http://windowslive.com/Tutorial/Hotmail/QuickAdd?ocid=TXT_TAGLM_WL_HM_Tutorial_QuickAdd_062009 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
