Integrity Medical Transcription
HIPAA Compliance
I strive to safeguard our entire transcription process -- from initial physician dictation to document retrieval -- to be secure and HIPAA compliant. I employ proper standards and practices for handling all client/patient procedures and transcription-related details, voice file storage, documented data storage and document management, adhering to or exceeding HIPAA standards.
Physical Security
My office is only accessible by authorized staff who are fully aware and trained in the HIPAA privacy requirements. Desktop and network access is restricted via auto-logoff, ID/password protection and a security-enabled OS; and only I have access to the server.
Information Security
I use a firewall and filter on incoming ports. In accordance with HIPAA regulations, a valid username and password is required to login and access my server, and files are encrypted through Secure Sockets Layer (SSL) as they are downloaded via the Internet. Regular redundant internal back-ups are performed, in addition to off-site data back-ups in case of any disaster, natural or otherwise.
Privacy
I are not responsible for, nor will I provide access to, any files on our system to any other person other than those authorized by the originator of the dictation. I will not release any files directly to patients. The responsibility for enabling patients to control their health records including access, disclosures, 'minimum necessary' standard, consent and authorization, etc. resides with the medical professional who initiated that document.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 standardized the electronic exchange of sensitive patient data to protect patients from unauthorized disclosure of their medical data. Our internal privacy and security procedures meet or exceed all HIPAA regulations related to Electronic Transmission of Protected Health Information (PHI).
What are the important requirements of HIPAA for a medical transcription company?
Medical Transcription Service Organizations (MTSOs) are expected to ensure the security and confidentiality of patient's PHI. MTSOs were further required to maintain an audit trail of all individuals who accessed patient's PHI.
Can the Internet be used for medical transcription and still meet HIPAA requirements?
Yes, any MTSO can meet HIPAA requirements using encryption and password protection, which prevents unauthorized access to PHI. Voice files recorded on portable recorders must be encrypted before transmission over the Internet, but telephone dictations do not require encryption. Encryption must be used to send transcribed documents to the healthcare provider, or documents may be faxed, but must be accompanied by a disclaimer statement explaining their confidential nature.
Can HIPAA regulations be met using tapes to record dictations?
No, creating and verifying a secure audit trail of who had the tape and who may have listened to the PHI on the tape could be an impossible task. In the event a tape is lost or misplaced, the security of the PHI is compromised.
