Common breaches of patient confidentiality include leaving sensitive information accessible, unsecure passwords, and discussing patients with unauthorized employees. To prevent breaches, organizations should implement audit trails to track password and database access, encrypt stored information using approved encryption programs, and implement access controls through secure passwords, pins, and limiting desktop access. Physical safeguards like locking doors, security cameras, and securing laptops and desktops also help maintain privacy and security of patient health information like names, dates of birth, addresses, and social security numbers. Maintaining privacy and security requires a focus on people in addition to technology and must evolve to address both internal and external threats.

1. Preventing Privacy and
Confidentiality Problems
Therese Santana
MHA 690 Health Care Capstone
Training presentation

2. Common Breaches in Patient Confidentiality
• Leaving sensitive patient information open for third party access
• Not ensuring the proper security of passwords for the HIT system
• Discussing patient information with other employees not involved in the case
• Noncompliance with HIPPA laws because of misinformation or lack of
understanding

3. Keeping Information Safe
• 1. audit trails: allows for the proper personnel to track the usage of specific
passwords and databases that have been accessed by staff.
• This feature allows for management to ensure only key personnel are accessing the
appropriate information. The recent changes that were made to a patient’s file can also
be viewed and the person who made the changes is recorded in the system.
• If there has been a breach, the patient must be notified and in the event of involving
500 or more residents within a certain jurisdiction by law the healthcare organization
must inform the proper media outlets. As of August 2009, the rule implements section
13402 of the Health Information Technology for Economic and Clinical Health
(HITECH) (Murphy, 2012).

4. Keeping Information Safe
• 2. Encryption of the stored information is key to making sure that
information is kept confidential.
• In any form and especially electronically, information must be encrypted.
• HIPPA specifies the type of encryption programs that are approved for use.
• The encrypted information can only be decrypted using a key in order to read and
access the patient’s health record.
• Encryption is essential for today’s digital advances including using webmail, messaging
and smartphones (hhs.gov, 2013).

5. Keeping Information Safe
• 3. Access control is central to the concept of keeping information
safeguarded from those who do not need to access a patient’s information.
• Passwords, pins, and desktops that control the access into the HIT system have to be
protected and maintained at all times.
• Hardware, software, and firmware need to have limited access at all times
(hhs.gov, 2013).

6. Patient Health Information
• Pertinent data that needs to be kept safe and which is commonly mishandled:
• Name
• Date of birth
• Address
• Telephone number and workplace information
• Social security numbers

7. Patient Health Information
• Physical safeguards include:
• Locking doors to the doctor’s offices, file rooms, and facility.
• Utilizing security cameras and key control
• Laptops should be locked in a safe place out of plain view when not in use
• Desktops should be locked up and attached to a wall unit
• Any problems or suspicious behaviors should always be reported to management

8. Privacy and Security
• Must be focused on people not just the technology
• Always evolving due to the threats; both internal and external
• Must be standard based
• Must take into consideration the users (Oulette, 2013).

9. Resources
• http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/privacy-
security-electronic-records.pdf
• Murphy, K. (2012). Retrieved from
http://healthitsecurity.com/glossary/breach-notification-rule/
• Oulette, P. (2013). Going beyond HIPAA compliance: CISO security
principles. Retrieved from http://healthitsecurity.com/2013/09/24/going-
beyond-hipaa-compliance-ciso-security-principles/