Miller explained that health care providers and business partners often rely on the representations of the hardware and software providers as to their products' HIPAA compliance, as well as accept the HIPAA certifications that the vendors have obtained. "With the recent law changes and the high cost of failure, we recommend using an independent qualified consultant to review compliance and even do 'dry run throughs' to see how well an IT system fulfills HIPAA privacy and security basics and if the system has any Achilles heels in this regard."

The developing use of technology is compatible with information security; the challenges are in implementation. "HIT systems are usually designed to specifically address HIPAA concerns of privacy and security, but it's often left to the vendors to figure out what needs to be included. One of the difficulties of complying with the HIPAA security rule is that the rule establishes standards like requiring access security but doesn't provide any specifics as to how to achieve this." Miller says that the ARRA now requires CMS to provide specifics, however, the specifics may take many months to develop. "In the meantime, providers should be aware of the basic interventions that they can do to make sure the privacy and security attributes of HIT are most effective, like changing and using strong passwords, preventing people from circumventing security measures, and migrating the same measures on portable devices like on laptops and iPhones."


The new administration's support of HIT is expected to have significant impact. It is well publicized that the ARRA sets aside $20 billion for HIT, and health reform proposals are expected to include further financial and other incentives to adopt electronic records, Miller says.

"A central belief of the new administration is that information technology is critical to making the health care system work better and more efficiently. Beyond funding and plans, the administration should focus on at least three areas in order to have maximum impact on widespread adoption of HIT: 1) making HIT more affordable for solo and small physician groups and community hospitals even after applying the incentives, 2) promoting approaches that enhance the flow of information between providers and patients; and 3) encouraging the adoption of a single 'parent' system or approach to HIT from among the many vendors and systems."

Back to HCB News

More Industry Headlines