Avoid Breach Notification - Experior helps PHI Encryption » Add new tag http://www.experiordata.com/blog Encrypt your PHI, and avoid breach notification Tue, 18 May 2010 04:09:33 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 Security for Meaningful Use: Part 2 – Electronic Access to Protected Health Information (PHI) http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-2-electronic-access-to-protected-health-information-phi/ http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-2-electronic-access-to-protected-health-information-phi/#comments Thu, 31 Dec 2009 17:34:34 +0000 admin http://www.experiordata.com/blog/?p=352 Standards Set for Providing Secure Access to Patient Records


Sample patient record view from VistA Imaging
Image via Wikipedia

According to the Initial Set of Standards for Electronic Health Records patients must be provided with their health information (most certainly protected health information -PHI- under HIPAA) electronically and securely within 96 hours.


“Consistent with the HIT Policy Committee’s recommendations, we propose the following additional clarification of this objective. Electronic copies may be provided through a number of secure electronic methods (for example, personal health record (

PHR), patient portal, CD, USB drive).


Provide patients with timely electronic access to their health information (including lab results, problem list, medication lists, allergies) within 96 hours of the information being available to the EP. Also, consistent with the HIT Policy Committee recommendations, we propose the following additional clarification of this objective. Electronic access may be provided by a number of secure electronic methods (for example, PHR, patient portal, CD, USB drive). Timely is defined as within 96 hours of the information being available to the EP either through the receipt of final lab results or a patient interaction that updates the EP’s knowledge of the patient’s health. We judge 96 hours to be a reasonable amount of time to ensure that certified EHR technology is up to date. We welcome comment on if a shorter or longer time is advantageous.”

How to Secure Health Records

USB Vacuum Cleaner, a giveaway from an IBM event
Image via Wikipedia

You may be wondering how can patient information be secured. The best way to secure information is by encrypting the media. However, note that patients must be able to decrypt the information on their own computer equipment. One of the product Experior Data implements is called PGP Portable. For example, the patient provides a USB drive for you to copy the PHI onto it. PGP Portable encrypts the entire USB device after the information is copied to it. The patient must provide a passphrase during the encryption process. When the patient goes home he/she inserts the USB drive into their home computer and is prompted for the passphrase. After the passphrase is entered access to the patient information is provided.

Related articles by Zemanta
Reblog this post [with Zemanta]









]]> http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-2-electronic-access-to-protected-health-information-phi/feed/ 0 Security for Meaningful Use: Part 1 – Web services http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-1-web-services/ http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-1-web-services/#comments Thu, 31 Dec 2009 06:48:19 +0000 admin http://www.experiordata.com/blog/?p=343
A graphical depiction of a very simple xml doc...
Image via Wikipedia

Web Services At Forefront


If you intend on implementing electronic records and apply for the Electronic Health Record Incentive Program (EHRIP) you must demonstrate “meaningful use” of the electronic health record system. One of the provisions in EHRIP is information sharing. The authors of the EHRIP specifically set out to standardize on two protocols for information sharing:

Both of these technologies are know as web services. Essentially, web services provide information sharing capabilities using structured data files called XML. The purpose is to use these open standards so that applications developed by different vendors could communicate and share information.


Securing Web Services


In terms of security it is important to ensure that the transmission between applications using these web services is properly encrypted using SSL technology. In addition, considerations should be made to implement network and host intrusion prevention systems to ensure the security and integrity of the systems transmitting the shared information. For example, accepting SOAP requests will require you to set  up a DMZ infrastructure. Servers sitting in the DMZ will need to accept SOAP requests and send them. It is the traffic to and from these servers, and the servers themselves, that need to be protected.


Related articles by Zemanta
Reblog this post [with Zemanta]









]]> http://www.experiordata.com/blog/2009/12/31/security-for-meaningful-use-part-1-web-services/feed/ 0 Oldie but Goodie – Nurses fired for posting photo of X-Ray http://www.experiordata.com/blog/2009/12/29/oldie-but-goodie-nurses-fired-in-for-posting-photo-of-x-ray/ http://www.experiordata.com/blog/2009/12/29/oldie-but-goodie-nurses-fired-in-for-posting-photo-of-x-ray/#comments Tue, 29 Dec 2009 04:00:26 +0000 admin http://www.experiordata.com/blog/?p=329
Image representing Facebook as depicted in Cru...
Image via CrunchBase

Filed under “you just can’t make this stuff up” from our friends in Lake Geneva, Wisconsin:

‘ ‘There were two nurses that independently took a picture each of an X-ray of a patient,’ Walworth County Undersheriff Kurt Picknell said.
The patient was admitted to the emergency room with an object lodged in his rectum. Police said the nurse explained she and a co-worker snapped photos when they learned it was a sex device. Police said discussion about the incident was posted on her Facebook page, but they haven’t found anyone who actually saw the pictures.”

Well, contrary to common sense one has to wonder at what point do you say to yourself, “hey, I probably shouldn’t take a picture of an X-Ray belonging to a patient and post it on Facebook”. Although its not known if the X-Ray contained protected health information (PHI), we would venture to say that posting the X-Ray is probably not a good idea. I mean they could have encrypted it!

Related articles by Zemanta
Reblog this post [with Zemanta]


]]> http://www.experiordata.com/blog/2009/12/29/oldie-but-goodie-nurses-fired-in-for-posting-photo-of-x-ray/feed/ 0