Taking aim at medical identity theft. Document security key element to comply with government regulations

Sensitive paper documents, such as patient records, customer data, and legal information, must be securely stored and destroyed when no longer needed. This is not only a good business practice that reduces costs and protects reputations, but also a legal and regulatory imperative. According to some experts, medical identity theft is the fastest-growing form of identity theft in North America. The Federal Trade Commission's Red Flags Rule, due to take effect June 1, 2010, requires banks; credit card companies; and, in some situations, retailers, hospitals, insurance companies, health clinics, and other organizations to store confidential personal information that can expose consumers to significant identity theft risks. This also includes healthcare providers and other organizations that are considered creditors according to their billing/payment procedures. This article highlights the steps healthcare providers must take to ensure data security.

Deterring and remedying employee theft

Employee theft of patient-related information for personal financial gain is a serious threat to the success and financial viability of many healthcare providers. You can safeguard your financial interest in your patient base by taking three preventative measures designed to dissuade your employees from stealing from you. The first step is the implementation of policies and procedures that inform your employees that patient-related information is a valuable business asset that you vigorously protect from misappropriation. The second step is strictly limiting and monitoring employee access to patient-related information. The third step is educating your employees of the potential legal consequences to them in the event they steal from you and, in the event of theft, pursuing all legal remedies available to you.

Embezzlement prevention--to catch a thief

So far, in part 1 of this 2-part article, the importance of the proper procedures that are needed to be performed in order to hire the best business/financial team members for your practice has been discussed. Utilizing these techniques will give you a fighting chance to eliminate the potential for embezzlement from your business. Also provided were some specific guidelines of embezzlement prevention that you must be alert for, along with the detection of a potential embezzler in the office, by listing the "red flags." Next, in part 2, I will complete the list of specific guidelines that are necessary to prevent embezzlement with the implementation of strong business systems designed to safeguard and control your practice financial system successfully.

Reducing theft and embezzlement by encouraging ethical behavior

Medical practices are often faced with employee embezzlement and theft. To protect themselves and their practices, physicians should have in place policies and procedures for identifying and handling unethical behaviors by employees. This article will deal with the need to set guidelines for what is considered ethical and professional conduct in the office.

Protection detail. Protecting against breach of electronic protected health information

Covered entities need to conduct risk assessments that cover the requirements of HIPAA, HITECH and Meaningful use, and create a process for steady and consistent mitigation of known gaps and vulnerabilities based on risk. Reducing risk of vulnerabilities of unauthorized access to your ePHI can be done via safeguards and controls, plus audits and monitoring. When reducing risk is outside of a covered entities control, audits and monitoring are required in order to demonstrate due diligence. Know where your ePHI is stored, where it is at risk, and take steps now to reduce or eliminate the risk. Encrypt vulnerable locations. Encrypt sensitive data. By doing so, you will be protecting your organization by reducing risk of breach of ePHI. Finally, don't forget what is sometimes considered to be the hardest part--documenting your compliance activities in order to demonstrate evidence of due diligence in and avoid major $$$$ penalties for negligence under the HITECH Act of 2009.

Employee embezzlement: a growing problem

Experts agree that the recession exposes all types of businesses, including medical practices, to a greater risk of employee fraud and embezzlement. There are many cases of employee embezzlement that can remain undetected for long periods of time, costing practices thousands of dollars from their top and bottom lines. In this article, we explore the reasons employees embezzle, the areas in which medical practices are at risk, and ways to safeguard your practice from this threat-in good times and in bad.

Exploring medical identity theft

The crime of medical identity theft is a growing concern in healthcare institutions. A mixed-method study design including a two-stage electronic survey, telephone survey follow-up, and on-site observations was used to evaluate current practices in admitting and registration departments to reduce the occurrence of medical identity theft. Survey participants were chief compliance officers in acute healthcare organizations and members of the Health Care Compliance Association. Study results indicate variance in whether or how patient identity is confirmed in healthcare settings. The findings of this study suggest that information systems need to be designed for more efficient identity management. Admitting and registration staff must be trained, and compliance with medical identity theft policies and procedures must be monitored. Finally, biometric identity management solutions should be considered for stronger patient identification verification.

Getting ready for identity theft rules: creating a prevention program for your medical practice

Identity theft worries have found their way into medical practices. By August 1, 2009, all "creditors" must have a written program to prevent, detect, and minimize damage from identity theft. Any medical practice that bills patients is considered a creditor. Like HIPAA, these new Red Flag guidelines will serve to protect your practice from lawsuits as well as protect your patients from identity theft of their financial, personal, and medical information.

The "red flags" rule in health care

Important questions for hospitals to ask regarding the Federal Trade Commission's identity theft "red flags" rule include: What is the compliance deadline? Who must comply? What is required for compliance? What about HIPAA? What are the consequences of failure to comply?