Privacy and information security programs in healthcare organizations have developed and matured to meet the requirements of HIPAA and other federal and state laws. In some organizations, providers and managers struggle to keep pace with the changes. Expanded focus on EHR technology and new threats to the security of personally identifiable information (e.g., healthcare, financial, educational, employment) will further affect privacy and information security programs in the future.
Small- to medium-size clinics often operate under the assumption that their outsourced IT shop or managed services provider (MSP) is providing a robust security solution, but this is not always the case. MSPs aren't necessarily falling down on the job, though; remember that just because something is outsourced doesn't mean the vendor will manage all of the risk. In the end, if you want additional services from your MSP, it costs money. RapidFire Tools® offers a solution MSPs can use to address risks that many small- to medium-size clinics may falsely assume are already managed.
Q: I work at a pediatric practice, and we receive a lot of holiday cards from our patients, many of which feature family photos. We hang them up because the patients love to see themselves displayed in our lobby. We have reached out to a HIPAA security officer at a nearby hospital who told us it is not a HIPAA violation to display holiday cards received from patients. Is this accurate?
