Healthcare IT Solutions

Technology in health care for Skagit County and Northwest Washington providers, like the rest of the country, is becoming more complicated and more regulated on a regular basis.

Complex Electronic Medical Records regulations combined with HIPAA compliance can be confusing to your team, and leave your health care business vulnerable if not followed strictly. If you’re at a loss for whom to even trust with your systems, look no further.

We help hospitals, medical offices, and clinics throughout Skagit, Whatcom, and Snohomish Counties and beyond to navigate the complexities of software, hardware, and other infrastructure to ensure your facility remains strictly compliant, while maintaining productivity and efficiency in your day-to-day operations.

In health care practices in Northwest Washington, it’s easy to get caught up in complicated and frustrating IT issues and data regulations, and lose sight of the most important part of your organization, which is serving patients. With Interpreting Technology as your partner, you have the opportunity to eliminate the stress of compliance, while meeting or exceeding data storage, flow, and security standards at all times, ensuring your vulnerabilities are a thing of the past.

Contact Interpreting Technology today for a consultation to determine how we can focus on your technology so you can devote time for yourself and your staff to taking care of your patients.

“Adrian has MANY gifts! He got me through a transition when I purchased a fast-paced pediatric dental practice, and went from paper charts, traditional x-rays and land-line phones to essentially paperless, digital x-rays, and internet phone service. We needed a variety of solutions throughout the practice, and he has listened carefully and responded with creative solutions. He also facilitated my ability to have access from home, while maintaining security.

Adrian has a broad knowledge of almost ANYTHING technological, and a carefully selected network of other professionals (wiring, software developers, electricians, etc.) when the need is there for the project to run smoothly.

For a small company with few employees, I have found Interpreting Technology to be INCREDIBLY responsive, and UNDERSTANDABLE to a layperson. If Adrian is not available, he will respond and tell you when he will be. For me, that is worth waiting for, because it is always done right. He is quite resourceful, and can often resolve the problem remotely.

If you are in need of an IT expert, you are in the right place!”

Sarah Hill, DDS
Playhouse Dental Clinic

Summary of HIPAA Security Requirements

HIPAA Security Rules specifically outline US national security standards to protect health data created, received, maintained or transmitted electronically, also known as electronic protected health information (ePHI). The HIPAA Security Rules are divided into 3 distinct categories and below is a summary of each.

Security Management Process – A covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.

Security Personnel – A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.

Information Access Management – Consistent with the Privacy Rule standard limiting uses and disclosures of PHI to the “minimum necessary,” the Security Rule requires a covered entity to implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient’s role (role-based access).

Workforce Training and Management – A covered entity must provide for appropriate authorization and supervision of workforce members who work with e-PHI. A covered entity must train all workforce members regarding its security policies and procedures, and must have and apply appropriate sanctions against workforce members who violate its policies and procedures.

Evaluation – A covered entity must perform a periodic assessment of how well its security policies and procedures meet the requirements of the Security Rule.

Facility Access and Control – A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.

Workstation and Device Security – A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.  A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).

Technical Safeguards
Access Control – A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).

Audit Controls – A covered entity must implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use e-PHI.

Integrity Controls – A covered entity must implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed. Electronic measures must be put in place to confirm that e-PHI has not been improperly altered or destroyed.

Transmission Security – A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.

Required and Addressable Implementation Specifications
Covered entities are required to comply with every Security Rule “Standard”.  However, the Security Rule categorizes certain implementation specifications within those standards as “addressable”, while others are “required”. The “required” implementation specifications must be implemented. The “addressable” designation does not mean that an implementation specification is optional. However, it permits covered entities to determine whether the addressable implementation specification is reasonable and appropriate for that covered entity. If it is not, the Security Rule allows the covered entity to adopt an alternative measure that achieves the purpose of the standard, if the alternative measure is reasonable and appropriate.

Summary of the HIPAA Privacy Rule

The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.

A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.