What and Why HITECH?
The HITECH Act's steps to make HIPAA compliance more successful are in place to ensure that health information technology adoption complies with the HIPAA Privacy and Security Rules.
It has number of objectives which seeks to enhance care coordination, eliminate inequalities in the ways healthcare is delivered, involve patients and their families in the decision-making process, and improve public health by setting the groundwork for a Nationwide Health Information Network by enhancing the quality, protection, and efficiency of healthcare in a HIPAA-compliant manner.
HITECH encourages healthcare organizations and healthcare providers to use health information technologies such as the electronic health record (EHR) system through the provision of incentives.
HITECH Audit
Structure administrative safeguards
- We implemented policies and procedures to prevent, detect, contain, and correct security violations
- We implement policies and procedures for authorizing access to electronic PHI consistent with the applicable requirements of the Privacy Rule
- We have a security awareness and training program for all members monthly once
- We have implemented policies and procedures to address security incidents
- We established policies and procedures for responding to an emergency or other occurrence (for example, fire, natural disaster) that damages systems containing electronic PHI
Structure physical safeguards
- We have implemented policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring properly authorized access is allowed
- We have implemented physical safeguards for all work stations with access to electronic PHI, restrict access to authorized users; and
- We have implemented policies and procedures governing the receipt and removal of hardware and electronic media containing electronic PHI into and out of a facility
Structure technical safeguards
- We have implemented technical policies and procedures for electronic information systems that maintain electronic PHI to allow access only to those persons or software programs that have been granted access rights;
- We have implemented hardware, software, and/or procedural mechanisms to record and examine information system activity that contain or use electronic PHI;
- We have implemented policies and procedures to protect electronic PHI from improper alteration or destruction;
- We have implemented procedures to verify a person or entity seeking access to electronic PHI is the one claimed; and
- We have implemented technical security measures to guard against unauthorized access to electronic PHI being transmitted over an electronic communications network.
Document handling safeguards
- Our staffs are trained in the secure handling of paper and electronic health records
- Our policies and procedures are providing employees with adequate and up-to-date guidance
- Our technology used is secure, has a vulnerability assessment system for the network