|
Boat owners understand that the maintenance of any sea-faring vessel requires commitment and oversight of many different issues. Just as boat owners recognize the importance of ensuring the care and efficient running of their vessels, healthcare system executives need to understand the steps to ensuring proper disclosure management for the long-term health of their organizations. Minimizing problems that arise from improper management can be summed up into four major areas of focus: planning, maintaining, protecting and informing.
What's Your Plan?
The saying goes, "if you fail to plan, then you should plan to fail." Since boats are usually exposed to severely damaging elements and changes in environmental conditions year round, successful ownership means developing a comprehensive plan that includes proper checklists covering everything from correct motor maintenance to winterization, appropriate mooring and regular inspections.
 A similar set of administrative criteria applies to hospitals and their disclosure management systems and the requirement to meet stipulations outlined in the HITECH Act of 2009.1 Given the dynamism of laws and regulations affecting the industry, every healthcare organization needs to develop detailed plans, policies and procedures that put in place long-term strategies as well as short-term tactics that ensure the overall management of patient information. Even after these strategies and tactics have been identified and implemented, there should be regular review and revision that respond to and even anticipate change.
With the rise of the electronic health record, patient information has become infinitely more accessible, which means that it's also easier for patient information to be shared. As concerns mount surrounding protected health information, disclosure management gives hospitals the ability to ensure oversight and that they truly have a plan for ensuring the protection of patient information.
A key strategy is reviewing and evaluating the operational policies and workflows to assess what changes might be needed to optimize disclosure management. The hospital then needs to determine what measures and programs are needed to stop improper disclosures.
A Measure of Maintenance
There's truth in the expression that everyone wants to build, but no one wants to do maintenance. At sea, what defines a well-maintained boat changes from one season to the next as environmental factors change.
In an era defined by the evolving complexities of state and federal regulations relating to the disclosure of protected health information (PHI), hospitals must continually ensure that they have relevant, secure technology, advanced reporting functionality, comprehensive workflow and quality assurance checks on every disclosure being handled by every department throughout the hospital. A comprehensive approach to disclosure management must focus on database tracking, integration of information reporting and disclosure systems across all departments and all formats. It must also focus on periodically reviewing systems to make sure that they are keeping up with environmental realities.
Protecting Beyond PHI
What was an already difficult process has become exponentially more complex, and requires the sort of diligence required by boat-owners shoring up their vessels against even the potential for leaks. This includes ensuring the structural integrity of the disclosure management system, and indentifying areas that may be susceptible to PHI leaks and making certain those points are sealed with appropriate protection. On this level, it's important for healthcare systems to remember that protection must be expressed on multiple levels: protecting the patient's information against compromise, as well as protecting the institution against breach, financial risk, lawsuit and reputational damage.
On a minute-to-minute basis, hospitals are called on to balance the need to release health information to other healthcare providers and authorized users, with the need to protect patient privacy rights as guaranteed under HIPAA. In maintaining the privacy of patients, release of information is one area that is often of concern for hospitals. Effective management of all processes involved in releasing PHI requires an accurate understanding of the complexity of medical records.
The difficulty of today's PHI reality is that the components of medical records are often housed in different locations. This means that the organization needs to ensure that protection is expressed through enterprise-wide policies and procedures for accessing, disclosing and integrating patient information.
An important part of protecting patient information and the organization is ensuring that requests for information are handled with extreme care and efficiency. Each time information is released by a hospital, there is the potential for compromising the organization's protection.
Release of information becomes a significant component in the disclosure management system. An effective ROI process requires efficient management and total compliance oversight. Tracking and reporting also add complexity to the overall disclosure management process, as hospitals and health systems are required to track all aspects of the process from medical records requests to delivery and payment resolution.
Informing
Wise boaters are quick to recognize when they're out of their own depth, in terms of the waters in which they're boating, but also in terms of their knowledge of boat maintenance. For hospitals, staying informed about new regulations and their implications can mean the difference between effective and ineffective disclosure management. This means having the right specialists who can assess legislation and regulatory change, and analyze how the hospital should respond.
Being a responsible boat owner also means having an understanding of when to call in the professionals. For hospitals and healthcare systems, achieving successful disclosure management is all about understanding all the components of the processes involved, while understanding that without effective centralized oversight, it's easy to lose step with stringent ARRA and HIPAA disclosure compliance regulations that now affect the organization far beyond the HIM department. It is to the benefit of the entire institution that all resources are considered in building a "sea-worthy" disclosure management system that will protect both the hospital and its patients.
Reference
1. The Health Information Technology for Economic and Clinical Health Act (HITECH) Act of 2009; Improved Privacy and Security Provisions; Section 13405; "Restrictions on Certain Disclosures and Accounting of Certain Protected Health Information Disclosures."
Don Hardwick is director of compliance and field operations for MRO.
|