HIPAA privacy and security concerns with the government's EHR certification program are so great that hundreds of practitioners have called for the program's cancellation, the Department of Health & Human Services (HHS) announced in its final rule on meaningful use released Tuesday.
It hasn't happened, of course.
The final rule, issued through the Centers for Medicare & Medicaid Services (CMS), defines "meaningful use" for the first two years (2011 and 2012) of a long-term financial incentive plan through Medicare and Medicaid under the Health Information for Economic and Clinical Health (HITECH) Act, signed into law by President Barack Obama February 17, 2009.
HHS released a second final rule the same day, through the Office of the National Coordinator for Health Information Technology (ONC). It establishes an initial set of standards, implementation specifications, and certification for EHR technology for vendor products.
Through its technology standards final rule, HHS addresses privacy and security concerns by requiring organizations to perform risk analyses and correct security deficiencies and by requiring the EHR technology to include among other security functions:
- Encryption capabilities
- Auditing capabilities including read-only access to patient records
- Automatic log-off capabilities
- File and message integrity checking
"It's good to finally see an explicit requirement for auditing even read-only access to patient records and another explicit requirement for encryption of health information," said Kate Borten, CISSP, CISM, president of The Marblehead Group, which provides privacy and security assessments, regulatory compliance audits, and program development guidance. "Both points were a bit fuzzy under the security rule, and some organizations skirted those requirements. So requiring these features in the EHR systems makes it much more likely they'll be used."
Those requirements—encryption and audits on access to patient records—apply to the technology itself, Borten notes. "It will still be up to the eligible provider to implement the security technologies in a reasonable manner," she says.
In all, Borten calls the security standards in the EHR certification program "all good security controls."
"Most are basic and have been required by the security rule since 2005 (like unique user IDs)," she adds. "Some that are 'addressable' in the security rule are required to be built into the EHR technology such as automatic logoff."
Georgina Verdugo, director of the Office for Civil Rights (OCR), which enforces the HIPAA privacy and security rules, said her organization is viewing the new EHR program as an opportunity to strengthen privacy and security.
"The EHR certification rules are an outstanding opportunity for providers to revisit their privacy and security programs and improve the safeguards of health information," Verdugo said in an e-mail to HealthLeaders Media when asked about providers' concerns with privacy and security. "While adoption of EHRs poses new privacy and security challenges, we view this as an opportunity for improvement in these areas."
Dom Nicastro is a contributing writer. He edits the Medical Records Briefings newsletter and manages the HIPAA Update Blog.