Physicians Practice - October 2008 - (Page 77)

THE TECH DOCTOR E-MAIL ABUSE PRIMER WHY IT’S IMPORTANT TO KNOW WHAT YOUR EMPLOYEES AND COLLEAGUES ARE SENDING OUT OF YOUR COMPANY’S E-MAIL SYSTEM. B Y J O N AT H A N M c C A L L I S T E R As a provider or administrator, you care about the security of your practice’s assets. You diligently double-check your security alarm at night before you leave the ofﬁce. You had your ofﬁce manager install door locks on your medical records area. You installed security cameras at your ofﬁce’s entrances and exits. Even your most basic sample medications are under lock and key. Unfortunately, all of these precautions still leave you vulnerable to the fastest way to move valuables out of your ofﬁce: E-mail! In practices large and small, having a documented e-mail use and abuse policy and ensuring staff are well versed in that policy are critical to protecting the practice, as well as your employees. Misuse of e-mail at work can lead to lost productivity, clinical liability, and human resources nightmares, among other risks. WHAT’S THE WORST THAT COULD HAPPEN? the Internet? What if a staffer emails an unencrypted transcribed note to the wrong e-mail address; accidentally sending it to her friend’s e-mail address, rather than the intended recipient at another doctor’s ofﬁce? The ramiﬁcations of simple e-mail errors could cost you big. MAKE IT CLEAR! Have all new hires (and existing staff, including your physician peers) sign off on an E-mail Use and Abuse Policy. Use any Internet search engine to track down free example policy documents that you can then ﬁne tune for use in your own practice. I would even suggest having the document reviewed by your attorney. Often, staff seem to feel more of a sense of accountability when they have signed off on a speciﬁc policy, rather than it simply being part of an employee handbook they may never fully read. SOME GENERAL GUIDELINES personal use, and insist ofﬁce e-mail be used for work purposes only. • Specify and document exactly what is and is not acceptable to send via e-mail. While sending protected health information via traditional plain text e-mail is a risky proposition at best, create a deﬁned list for your practice (with the guidance of your attorney) of what components of practice information can safely be sent via e-mail. Perhaps your practice finds it to be an acceptable risk to send a list of patient names awaiting operating room scheduling to the local hospital via encrypted e-mail. Your documents should be speciﬁc enough to deﬁne that this is acceptable if encrypted, but not acceptable if sent unencrypted. • Teach your staff to use the password protection utilities in word process- Think about your practice and what information you have in electronic format: Spreadsheets of provider/staff pay rates and bonus incentives, tax documents, photos of patients’ dermatological symptoms, transcribed chart notes, and thousands of patient records — all ripe for the picking by an identity thief. Every one of these items can likely escape your secure grasp into the wilds of the Internet, all via simple e-mail attachments. What is your liability if one of your patient’s “before and after” photos of breast augmentation starts making the “Funny photos, forward this e-mail to at least three people” circuit on WWW.PHYSICIANSPRACTICE.COM Thanks to HIPAA and increasing awareness regarding general Internet security concerns, many technologysavvy physicians and staff are aware that caution is the name of the game. While HIPAA does not specify a particular technology tool for securing e-mail communications, users can to protect themselves by following a few simple rules: • Establish policies about personal use. ing and spreadsheet application software. Even though this isn’t foolproof protection, this at least prevents the unintentional recipient of an attached document from being able to easily open it (without the associated password). • Do not allow staff to export e-mail Enforce a rule limiting use of ofﬁce e-mail to just that, ofﬁce matters. Explain to users that this is purely an effort to protect them, as well as the practice. If you as an owner want to be flexible, then allow staff to access their SEPARATE Web mail accounts for to CD/USB Key, or other external media. Often, users will accumulate large archives of e-mail, which needs backing up to make space on drives. Be sure this action is carried out by an ofﬁce/IT manager, who is responsible for not only making the backup archive, but is also responsible for password protecting that archive, making sure of it’s physical security during storage, and ensuring that a copy doesn’t make it’s way out of the ofﬁce. OCTOBER 2008 | PHYSICIANS PRACTICE | 77 http://WWW.PHYSICIANSPRACTICE.COM

Table of Contents Feed for the Digital Edition of Physicians Practice - October 2008

Physicians Practice - October 2008 Contents Another Reason to Go Cash-Only? Letters How ’Bout Them Gas Prices? Second Opinion: Oh, Canada! Noteworthy Cover Story: Fixing the Leaks: How to Tighten Your Money Spigot Navigating a Lawsuit Ask the Experts The Administrators Desk: What’s Your Mission? EMR: Help or Hindrance? Dealing with Dr. Dangerous E-Mail Abuse Primer The Road to EMR Interoperability Don’t Let Staff Costs Stifle Profits Coding Classifieds Advertiser Index

Physicians Practice - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.