AHIMA: Keep personal healthcare data safe, experts warn

Why should hospitals centralize their policies and procedures for disclosing protected health information?

[See also: AHIMA: Put patient at center, urges innovation guru]

At the American Health Information Management Association (AHIMA) convention Wednesday, Don E. Hardwick, client relations and compliance, MRO Corp., a document and disclosure management company in King of Prussia, Pa., told the story of one hospital client that left PHI management up to each department.

A few years ago, a man went to the radiology department trying to get imaging films for a patient injured in a car accident. The department started processing the request before realizing that the man responsible for the accident wanted to destroy the films so they couldn't be used in court.

[See also: AHIMA: CCHIT expects high bar for certification]

This particular situation did not happen at the Chester County (Pa.) Hospital and Health System, but Kimberly Hagerty, health information management leader at the 220-bed community hospital, saw the need to standardize PHI quality control and patient privacy practices. "It's getting a handle on information-release practices in your facility and looking outside," said Hagerty.

Proper PHI management can reduce liability for HIPAA violations and, in the case of the near-disclosure of images to the wrong party with malevolent intentions, prevent potential litigation. It also helps to improve patient satisfaction by making the health system more customer-friendly.

"We're presenting a good front to the patients," Hagerty said.

Chester County Hospital is in the midst of creating a unified, centralized PHI disclosure process. The hospital has met Stage 1 meaningful use with its Siemens inpatient electronic health record and has attached a patient portal to the EHR. Software from MRO automatically sends discharge summaries into the portal for easy, secure access by referring physicians.


Hagerty said the hospital has reduced turnaround time for providing outside physicians with patient records to just two days, compared to 10-14 days before the centralization. This streamlined service has allowed health information management to reduce staffing by one full-time-equivalent employee, justifying the expense of changing disclosure policies. "It's nice to be known as the ROI department," Hagerty said.

MRO's disclosure management technology provides advanced, one-click reporting functionality, including electronic disclosure request, but it had not been activated until Chester County Hospital made the decision to centralize PHI management. "It was just using the technology and working smarter, not harder," said Hagerty.