Everything new practices need to know about EHRs and HIPAA

Protecting your patients’ medical information is paramount to supporting their care and to building positive patient-physician relationships. Protecting electronic data is equally important and can, in fact, present new challenges for you and your clinical staff. A review of everything new practices need to know about EHRs and HIPAA can help ensure your patients’ privacy and security.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was originally designed to create national standards for protecting sensitive patient health information from being disclosed without the patient’s knowledge or consent. The HIPAA Privacy Rule implemented the requirements, and the HIPAA Security Rule protects a subset of information that is covered by the Privacy Rule.

HIPAA rules apply to every healthcare provider who electronically transmits health information in connection with transactions such as:

  • Claims
  • Benefit eligibility inquiries
  • Referral authorization requests
  • Other transactions covered by the HIPAA Transactions Rule.

Your independent practice stores electronic Protected Health Information (ePHI) in electronic health records (EHRs). The HIPAA Security Rule contains the administrative, physical, and technical safeguards that must be in place to ensure the security of this ePHI.

Ultimately, you and your team are responsible for taking the steps necessary to protect the integrity, confidentiality, and availability of ePHI maintained in your EHR system. EHR HIPAA rules impact the type and combination of safeguards you need to keep all of your patients’ health information confidential and protected.

Elation’s EHR solution gives you the trust and confidence that your new independent practice will remain HIPAA-compliant as you focus on providing the highest quality care for your patients.

The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law in February 2009, enacted as part of the American Recovery and Reinvestment Act. HITECH further promoted the adoption and meaningful use of health information technology such as EHRs. The HITECH Act also impacted EHR HIPAA regulations as it mandated national standards for processing electronic healthcare transactions and required healthcare providers to implement secure electronic systems to protect ePHI.

Cybersecurity is growing in importance as independent practices work to comply with EHR HIPAA requirements. A secure electronic system will minimize the possibility of compromising patient data, protecting against potential breaches and virus infections. Security steps that you can take as an independent physician include encrypting your electronic device and adjusting its settings so that a screensaver locks out unauthorized users when the electronic device is not in use.

In addition to security and confidentiality, the HIPAA rules address information portability. In December 2016, the 21st Century Cures Act (Cures Act) was signed into law. The Cures Act Final Rule, according to the Office of the National Coordinator for Health Information Technology (ONC), “supports seamless and secure access, exchange, and use of electronic health information.”

The Cures Act promotes EHR interoperability between healthcare providers and gives patients secure access to their own health information. When patients are able to easily communicate with their provider and review their own medical records, they are more likely to become engaged in their healthcare.

Under the Cures Act rule, patients must be able to electronically access their electronic health information at no cost to them. The rule also calls on healthcare providers and IT developers to adopt standardized application programming interfaces (APIs) that will help patients securely access their EHI with smartphone applications.

Supporting the access and exchange of electronic health information, the Cures Act includes information blocking provisions. The Information Blocking Final Rule prohibits healthcare providers from undertaking any practice that may prevent or discourage access to or exchange of a patient’s EHI.

EHI includes health data contained in an EHR. Currently, EHI classes include:

  • Patient demographics
  • Vital signs
  • Clinical notes

It also includes data elements:

  • Patient name
  • Heart rate
  • Lab reports

In October 2022, the definition of EHI will expand to include all ePHI in a patient’s record. 

Protecting your patients’ medical information is paramount to supporting their care and to building positive patient-physician relationships. Protecting electronic data is equally important and can, in fact, present new challenges for you and your clinical staff. A review of everything new practices need to know about EHRs and HIPAA can help ensure your patients’ privacy and security.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was originally designed to create national standards for protecting sensitive patient health information from being disclosed without the patient’s knowledge or consent. The HIPAA Privacy Rule implemented the requirements, and the HIPAA Security Rule protects a subset of information that is covered by the Privacy Rule.

HIPAA rules apply to every healthcare provider who electronically transmits health information in connection with transactions such as:

  • Claims
  • Benefit eligibility inquiries
  • Referral authorization requests
  • Other transactions covered by the HIPAA Transactions Rule.

Your independent practice stores electronic Protected Health Information (ePHI) in electronic health records (EHRs). The HIPAA Security Rule contains the administrative, physical, and technical safeguards that must be in place to ensure the security of this ePHI.

Ultimately, you and your team are responsible for taking the steps necessary to protect the integrity, confidentiality, and availability of ePHI maintained in your EHR system. EHR HIPAA rules impact the type and combination of safeguards you need to keep all of your patients’ health information confidential and protected.

Elation’s EHR solution gives you the trust and confidence that your new independent practice will remain HIPAA-compliant as you focus on providing the highest quality care for your patients.

The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law in February 2009, enacted as part of the American Recovery and Reinvestment Act. HITECH further promoted the adoption and meaningful use of health information technology such as EHRs. The HITECH Act also impacted EHR HIPAA regulations as it mandated national standards for processing electronic healthcare transactions and required healthcare providers to implement secure electronic systems to protect ePHI.

Cybersecurity is growing in importance as independent practices work to comply with EHR HIPAA requirements. A secure electronic system will minimize the possibility of compromising patient data, protecting against potential breaches and virus infections. Security steps that you can take as an independent physician include encrypting your electronic device and adjusting its settings so that a screensaver locks out unauthorized users when the electronic device is not in use.

In addition to security and confidentiality, the HIPAA rules address information portability. In December 2016, the 21st Century Cures Act (Cures Act) was signed into law. The Cures Act Final Rule, according to the Office of the National Coordinator for Health Information Technology (ONC), “supports seamless and secure access, exchange, and use of electronic health information.”

The Cures Act promotes EHR interoperability between healthcare providers and gives patients secure access to their own health information. When patients are able to easily communicate with their provider and review their own medical records, they are more likely to become engaged in their healthcare.

Under the Cures Act rule, patients must be able to electronically access their electronic health information at no cost to them. The rule also calls on healthcare providers and IT developers to adopt standardized application programming interfaces (APIs) that will help patients securely access their EHI with smartphone applications.

Supporting the access and exchange of electronic health information, the Cures Act includes information blocking provisions. The Information Blocking Final Rule prohibits healthcare providers from undertaking any practice that may prevent or discourage access to or exchange of a patient’s EHI.

EHI includes health data contained in an EHR. Currently, EHI classes include:

  • Patient demographics
  • Vital signs
  • Clinical notes

It also includes data elements:

  • Patient name
  • Heart rate
  • Lab reports

In October 2022, the definition of EHI will expand to include all ePHI in a patient’s record. 

Learn More