Data guard: The next HIPAA mandate

By this time next year, you will be required to guarantee the security of everything on your computer, from patient files to e-mail. Experts offer tips on getting started.

By Tyler Chin, AMNews staff. May 10, 2004.

Thought you were finished with HIPAA? You wish. The federal law that required you to use standardized formats when conducting certain health care transactions electronically and implement measures to protect patient privacy has an upcoming security mandate that will become effective April 21, 2005.

Under that rule, doctors and other covered entities must take steps to safeguard the confidentiality, integrity and availability of electronic health data in their offices.

To avoid the aggravation, hassles and stress many physicians went through last year when they waited until the last minute to comply with the HIPAA transactions and privacy rules, physicians should start their security compliance effort now, said David Kibbe, MD, director of the Center for Health Information Technology at the American Academy of Family Physicians.

"There's a bit of work here that needs to be done for the practice to get up to speed," Dr. Kibbe said. "I'd encourage people to start early, take a chunk at a time and chip away at it rather than do it at the last minute."

Here are answers to some key questions to help you get started:

Not if your practice is completely paper-based, meaning that you don't have any information systems, database or computers in your office. However, even if you have no computers but outsource billing to a vendor that electronically transmits any HIPAA standard transactions to payers on your behalf, then you're covered by the security rule, said Steve Lazarus, PhD, president of Boundary Information Group, a Denver-based consortium of health care technology consultants.