While it’s not uncommon to expect that most health systems will have multiple environments in which Healthcare IT partners can develop and test, it’s nevertheless important that technical resources understand the complexities involved with exchanging PHI (Protected Health Information). Even in the most prudently managed and designed staging environment, it’s possible for “production” patient data to find its way into the folds, be it a poor job masking records or a snafu in a bulk load process. Regardless, one of the best ways that EHR Integration and Testing experts can bolster the security and confidence of their clients or organization is to participate in voluntary HIPAA Training.
We know: Resources are working in Dev; Production data is siloed; everything is de-identified, etc. We hear loud and clear that the recommendation for extraneous training can raise concerns of time wasted on an already resource-heavy project. But whether EHR integration specialists are contract or on the company payroll, a hawk-like protection of PHI and awareness of how health information can and cannot be handled (both in IT solutions and in systems testing) is never a bad thing.
Here are a few more compelling reasons why you should consider HIPAA training for EHR integration projects and testing partners:
BAA, If You Please
Beyond the contracts and SOWs, healthcare IT partners are often expected by hospitals and large health systems to engage in a BAA, or “Business Associate Agreement.” As an extension of their org, in a manner of speaking, Business Associates are recognized as service providers to a covered organization under HIPAA (the Health Insurance Portability and Accountability Act of 1996). And while it may be possible to limit access to patient information -- which includes names, dates of birth, MRNs, driver’s license numbers, and more -- it’s also prudent to account for the unexpected and get training for the resources most likely to encounter PHI, even if rare or unplanned.EHR Implementation Reality: Testing In Production
It seems like an oxymoron to test in a production or “live” environment, but it’s also sometimes a necessity given limitations in certain integration solutions. For example, there may be certain periphery components that can’t be tested exactly as expected with dummy data, or for which there is no corollary staging system, and so testing in production becomes a necessity to validate data integrity. In cases such as these, having HIPAA training under your QA resources belt from the onset is a great way to tackle this need without causing a delay or risking a costly breach to the EHR project sponsor.
Healthcare Data Is A Special Kind of Complicated
Much like IT firms that work with financial data, those that support clients who exchange healthcare information should understand the unique aspects (and liabilities) that come with PHI. To be able to represent a full roster of integration specialists, DevOps, testers, trainers, and more who are ready to get as in the weeds as is necessary to roll out a stable environment, including accessing data up to the “minimum required” threshold to complete their tasks for EHR implementation with great care and awareness of the regulations that govern it, is a huge value add. It’s also necessary when less-than-ironclad data warehousing structures and environments muddy the waters and leave contractors vulnerable to tripping onto data they wouldn’t otherwise be in a position to navigate well.
Best Practices Come From Many Sources
As complicated and often vague as are the rules that comprise HIPAA and even HITRUST in the healthcare IT realm, there are many aspects of these guidelines that are, in general, good practice for anyone dealing with data. Even if you don’t in the course of an IT implementation touch financial or healthcare data, it’s worthwhile to assume that the information to which you have access is as valuable. After all, wouldn’t you expect that level of care if you were the patient or customer on the other side? With that view in mind, EHR integration and testing resources can deliver a supreme level of service that begins to elevate the entire industry, one Dev and QA resource at a time.