HIPAA’s position on use of mobile devices and maintaining privacy and security

[Roger Steven]

HIPAA has regulations concerning the use of the mobile devices to access Protected Health Information PHI). Secure technologies for communications and storage of data should also be considered when using portable technologies. Due to these requirements, the use of portable devices by patients and staff can be complex. It requires careful consideration of the regulations, about how the devices will be used and secured, and what the patient desires.

At the same time, both HHS compliance audit activity and enforcement penalties have been increased, especially in instances of willful neglect of compliance. An organization that hasn’t adequately considered the impact of mobile devices on its compliance stands to get penalized. The use of mobile devices as a means of accessing patient information may be going up greatly, but these devices are prone to breaches of PHI. It thus becomes imperative and essential to consider these devices and how their use affects the privacy and security of PHI. Not doing so or not getting it right is sure to invite enforcement action by HHS.

Guidance is available

Those who use mobile devices to interact with medical records systems have guidance in the form of the NIST SP 1800-1, the draft guidance issued by The National Institute of Standards and Technology. This guidance concerns the use of, including recommendations on how to secure communications and how to vet HIPAA Business Associates providing communications.

So, when healthcare entities communicate with patients using portable devices, they have to consider the issues of privacy and security, as well as those of triaging incoming communications and documenting conversations. Only plain texting is not readily adaptable to the requirements of patient care and documentation, but secure, appropriate solutions are available.

Learn the ways of handling patient information using mobile devices

The ways of handling patient data using mobile devices while keeping all the guidance documents and regulatory requirements in mind will be the content of a webinar that MentorHealth, a leading provider of professional trainings for the healthcare industry, will be organizing. Professionals in the healthcare industry, who want to derive value out of this learning, can enroll for this webinar by visiting http://www.mentorhealth.com/control/w_product/~product_id=800801.

Jim Sheldon Dean, who is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm, will be the speaker at this webinar.