51. Has the physician practice implemented procedures X to comply with the health information privacy rule under HIPAA? 51.1. Do these procedures include the following: a. A notice of privacy practices and authorization form describing the uses and disclosures of protected health information (PHI) that the physician practice may make, as well as the X patient's rights and providers' responsibilities with respect to PHI, which should be provided to patients with a goodfaith effort to obtain patients' signatures acknowledging receipt of the notice before providing care b. A process for keeping records of documented X disclosures of PHI and for accounting of and responding to requests for disclosures made 51.2. Has the physician practice addressed the security of individually identified protected health X information that is stored or transmitted electronically, as required under the HIPAA security rule? 51.3. Is there a security plan that includes X administrative, physical, and technical safeguards for PHI that is collected, maintained, used, or transmitted? 51.4. Does the security plan include remote access to X office information systems and the use of portable computers such as personal digital assistants? 51.5. Does each provider and staff member who is X authorized to access office information systems have a unique password? 51.6. Are electronic data systems backed up periodically X (e.g., nightly) to avoid loss of information? Communication and Teamwork 52. Is there a process for tracking pending lab and other X test results, consultation reports, and other pertinent documents to ensure their receipt by the practice? 52.1. Is there a mechanism to ensure that lab and other X test results, consultation reports, and other pertinent documents are acknowledged and documented by the physician before filing? 52.2. Is there a mechanism for reporting urgent X information to the physician immediately?
51. Has the physician practice implemented procedures to comply with the health information privacy rule under HIPAA? X 51.1. Do these procedures include the following: a. A notice of privacy practices and authorization form describing the uses and disclosures of protected health information (PHI) that the physician practice may make, as well as the patient's rights and providers' responsibilities with respect to PHI, which should be provided to patients with a goodfaith effort to obtain patients' signatures acknowledging receipt of the notice before providing care X b. A process for keeping records of documented disclosures of PHI and for accounting of and responding to requests for disclosures made X 51.2. Has the physician practice addressed the security of individually identified protected health information that is stored or transmitted electronically, as required under the HIPAA security rule? X 51.3. Is there a security plan that includes administrative, physical, and technical safeguards for PHI that is collected, maintained, used, or transmitted? X 51.4. Does the security plan include remote access to office information systems and the use of portable computers such as personal digital assistants? X 51.5. Does each provider and staff member who is authorized to access office information systems have a unique password? X 51.6. Are electronic data systems backed up periodically (e.g., nightly) to avoid loss of information? X Communication and Teamwork 52. Is there a process for tracking pending lab and other test results, consultation reports, and other pertinent documents to ensure their receipt by the practice? X 52.1. Is there a mechanism to ensure that lab and other test results, consultation reports, and other pertinent documents are acknowledged and documented by the physician before filing? X 52.2. Is there a mechanism for reporting urgent information to the physician immediately? X
2a._ECRI-Risk_Management_September_2013.docx