Data Management and Security

To ensure the privacy and security of patient information during remote care, telehealth protocols are governed primarily by the Health Insurance Portability and Accountability Act (HIPAA). Key measures involve a combination of administrative, technical, and physical safeguards.


HIPAA Compliance Requirements for Providers

Healthcare providers must implement comprehensive security safeguards to protect electronic protected health information (ePHI). A crucial first step is to perform a Security Rule risk analysis to assess potential vulnerabilities. 

  • Implement HIPAA-compliant technology: Providers must use secure communication platforms and EHR systems that meet HIPAA standards. These platforms are designed with built-in encryption and access controls.
  • Obtain a Business Associate Agreement (BAA): When using a third-party telehealth or software vendor, a BAA must be signed. This legally requires the vendor to uphold HIPAA security standards and share responsibility for protecting patient data.
  • Use encryption: All patient data, both "at rest" (when stored) and "in transit" (when sent over a network), must be encrypted. This prevents unauthorized parties from intercepting or accessing sensitive information.
  • Limit access: Restrict access to ePHI to only authorized personnel using role-based access controls. Providers must also use strong passwords and multi-factor authentication (MFA) to prevent unauthorized access.
  • Conduct regular training: Educate all staff on HIPAA and cybersecurity best practices, including how to identify and avoid phishing attacks and handle patient information securely.
  • Monitor and audit access: Regularly review access logs and conduct security assessments to identify any suspicious activity or vulnerabilities.
  • Secure communications: Only use encrypted channels for messaging and emails that contain patient information, such as secure patient portals. Advise patients that standard email and text messages are not secure. 

Security and Privacy Protocols During Telehealth Visits

During a telehealth appointment, both the provider and patient have roles to play in protecting the session's privacy.

For the provider

  • Verify patient identity: Before the session begins, confirm the patient's identity by asking them to verify personal information.
  • Ensure physical privacy: Conduct the session in a private, enclosed room where patient information cannot be overheard.
  • Use a secure connection: Always connect via a private, password-protected internet connection, never public Wi-Fi.
  • Disable recordings: Do not record the visit unless necessary and with explicit patient consent. 

For the patient

  • Find a private location: Conduct the call in a private space, such as a closed room or a parked car, and not in a public area.
  • Use headphones: Wearing headphones prevents others from overhearing the conversation and minimizes background noise.
  • Secure your connection and device: Use a password-protected home Wi-Fi network and avoid public networks. Use a personal device instead of a shared one and ensure its security software and operating system are up to date. 

After the telehealth visit

  • Secure documentation: Ensure all session notes and documentation are stored securely within the HIPAA-compliant EHR system.
  • Use secure communication for follow-up: If sending follow-up instructions or other information, use the secure messaging feature of the telehealth platform or patient portal.
  • Protect your device: Always sign out of all telehealth applications and turn off cameras and microphones after the session ends. 

Organizations should work with their local information security and data analytics teams to ensure proper data storage and handling. Electronic health records and other third-party health care technology have to comply with federal information security and privacy standards (e.g. HIPPA). Medical devices should be FDA approved, and all information technology tools should be examined and vetted prior to contracting and implementation. If data is extracted, transferred, and loaded from electronic health records to a central data storage site for analysis, the process for moving that data as well as that storage site needs to also be similarly secured. Data governance and management platforms (e.g. Alation, Informatica, Atlan, Collibra etc.) can also be implemented to help centralize data storage, ensure high quality data, and stay up to date with new legal requirements. For patient access to data, multifactor authentication should be implemented whenever feasible and can utilize methods such as text/email tokens, biometric verification, or physical tokens. Newer technologies like digital twins, blockchain, etc. can also be considered to balance data access and security.

References
Telehealth


ADVERTISEMENT