Electronic Medical Billing Software, HIPAA Compliance, and Role Based Access Control

HIPAA compliance requires special focus andHIPAA process must include clearly stated policy,
effort as failure to comply carries significant riskeducational materials and events, clear
of damage and penalties. A practice with multipleenforcement means, a schedule for testing of
separate systems for patient scheduling,HIPAA compliance, and means for continued
electronic medical records, and billing, requirestransparency about HIPAA compliance. Stated
multiple separate HIPAA management efforts.policy typically includes a statement of least
This article presents an integrated approach toprivilege data access to complete the job,
HIPAA compliance and outlines key HIPAAdefinition of PHI and incident monitoring and
terminology, principles, and requirements to helpreporting procedures. Educational materials may
the practice owner to ensure HIPAA complianceinclude case studies, control questions, and a
by medical billing service and software vendors.schedule of review seminars for personnel.
The last decade of the previous centuryTechnology Requirements for HIPAA Compliance
witnessed accelerating proliferation of digitalTechnology implementation of HIPAA proceeds in
technology in health care, which, along withstages from logical data definition to physical data
reduced costs and greater service quality,center to network.
introduced new and greater risks for accidental1. To assure physical data center security, the
disclosure of personal health information.manager must
The Health insurance Portability and Accountability2. Lock data center
Act (HIPAA) was passed in 1996 by Congress to3. Manage access list
establish national standards for privacy and4. Track data center access with closed circuit
security of personal health data. The Privacy Rule,TV cameras to monitor both internal and external
written by the US Department of Health andbuilding activities
Human Services took effect on April 14, 2003.5. Protect access to data center with 24 x 7
Failure to comply with HIPAA risks accreditationonsite security
and reputation damage, lawsuits by federal6. Protect backup data
government, financial penalties, ranging from $1007. Test recovery procedure
to $250,000, and imprisonment, ranging from oneFor network security, the data center must have
year to ten years.special facilities for
Protected Health Information (PHI)1. Secure networking - firewall protection,
The key term of HIPAA is Protected Healthencrypted data transfer only
Information (PHI), which includes anything that can2. Network access monitoring and report auditing
be used to identify an individual and anyFor data security, the manager must have
information shared with other health care1. Individual authentication - individual logins and
providers or clearinghouses in any media (digital,passwords
verbal, recorded voice, faxed, printed, or written).2. Role Based Access Control (see below)
Information that can be used to identify an3. Audit trails - all access to all data fields tracked
individual includes:and recorded
4. Data discipline - Limited ability to download data
1. NameRole Based Access Control (RBAC)
2. Dates (except year)RBAC improves convenience and flexibility of
3. Zip code of more than 3 digits, telephone andsystems management. Greater convenience helps
fax numbers, emailreducing the errors of commission and omission in
4. Social security numbersgranting access privileges to users. Greater
5. Medical record numbersflexibility helps implement the policy of least
6. Health plan numbersprivilege, where the users are granted only as
7. License numbersmuch privileges as required for completing their
8. Photographsjob.
Information shared with other healthcareRBAC promotes economies of scale, because the
providers or clearinghousesfrequency of changes of role definition for a single
user is higher than the frequency of changes of
1. Nursing and physician notesrole definitions across entire organization. Thus, to
2. Billing and other treatment recordsmake a massive change of privileges for a large
Principles of HIPAAnumber of users with same set of privileges, the
HIPAA intends to allow smooth flow of PHI foradministrator only makes changes to the role
healthcare operations subject to patient's consentdefinition.
but prohibit any flow of unauthorized PHI for anyHierarchical RBAC further promotes economies of
other purposes. Healthcare operations includescale and reduces the likelihood of errors. It allows
treatment, payment, care quality assessment,redefining roles by inheriting privileges assigned to
competence review training, accreditation,roles in the higher hierarchical level.
insurance rating, auditing, and legal procedures.RBAC is based on establishing a set of user
HIPAA promotes fair information practices andprofiles or roles according to responsibilities. Each
requires those with access to PHI to safeguard it.role has a predefined set of privileges. The user
Fair information practices means that a subjectacquires privileges by receiving membership in the
must be allowedrole or assignment of a profile by the
administrator.
1. Access to PHI,Every time when the definition of the role
2. Correction for errors and completeness, andchanges along with the set of privileges that is
3. Knowledge of others who use PHIrequired to complete the job associated with the
Safeguarding of PHI means that the persons thatrole, the administrator needs only to redefine the
hold PHI mustprivileges of the role. The privileges of all of the
users that have this role get redefined
1. Be accountable for own use and disclosureautomatically.
2. Have a legal recourse to combat violationsSimilarly, if the role of a single user is changed, the
HIPAA Implementation Processonly operation that needs to be performed is the
HIPAA implementation begins upon makingreassignment of the user profile, which will
assumptions about PHI disclosure threat model.redefine user's access privileges automatically
The implementation includes both pre-emptive andaccording to the new profile.
retroactive controls and involves process,Summary
technology, and personnel aspects.HIPAA compliance requires special practice
A threat model helps understanding the purposemanagement attention. A practice with multiple
of HIPAA implementation process. It includesseparate systems for scheduling, electronic
assumptions aboutmedical records, and billing, requires multiple
separate HIPAA management efforts. An
1. Threat nature (Accidental disclosure by insiders?integrated system reduces the complexity of
Access for profit? ),HIPAA implementation. By outsourcing technology
2. Source of threat (outsider or insider?),to a HIPAA-compliant vendor of vericle-like
3. Means of potential threat (break in, physicaltechnology solution on an ASP or SaaS basis,
intrusion, computer hack, virus?),HIPAA management overhead can be eliminated
4. Specific kind of data at risk (patient(see companion papers on ASP and SaaS for
identification, financials, medical?), andmedical billing).
5. Scale (how many patient records threatened?).