X
Accessing Data for QI

As adoption of EHRs has increased, so have the concerns about ability to access the data needed to drill down into quality improvement efforts or even reporting requirements. Depending on the type of system being used, data may be cloud based, on a remote server, or on a local server. Further, data may be accessible through preprogrammed, ad hoc, or custom reports, but there may be greater challenges to accessing raw data or data that can be analyzed for quality improvement purposes. Resources in this section address these challenges and provide actionable information for accessing the data needed.

Accessing your Data
Using non-traditional technology for telehealth during COVID-19 Pandemic
Using non-traditional technology for telehealth during COVID-19 Pandemic

Using non-traditional technology for telehealth during COVID-19 Pandemic

HHS Office of Civil Rights (OCR), the entity responsible for enforcing regulations under HIPAA, stated, effective immediately, it will exercise enforcement discretion and will not impose penalties for HIPAA violations against covered healthcare providers if patients are served on a good faith basis during the COVID-19 nationwide public health emergency. Find out what this means in implementation by accessing this issue brief.

Behavioral Health Consent Management
Behavioral Health Consent Management

Behavioral Health Consent Management

The timely exchange of health information between behavioral health providers and physical health providers to support care coordination is a critical element of the National Quality Strategy and health reform efforts. However, privacy and confidentiality concerns are currently limiting the inclusion of behavioral health data in electronic health information exchange efforts.

Strategic Cybersecurity Breach Protection and Incident Response
Strategic Cybersecurity Breach Protection and Incident Response

Strategic Cybersecurity Breach Protection and Incident Response

General cybersecurity guidance would suggest that Health IT breach should not be considered a matter of “if”, but rather a matter of “when”. How Health Centers prepare and respond to an episode of a breach is just as important as defending itself from the breach.

Health Center Defense Against the Dark Web Presentation
Health Center Defense Against the Dark Web Presentation

Health Center Defense Against the Dark Web Presentation

It is of critical importance to motivate and educate healthcare professionals on current critical privacy and security concepts and methods for defense of health data. Aspects of security awareness training, breach protection, incident response, and related topics all play a role toward organization-wide information protection. Healthcare cybersecurity is the ultimate team sport. The responsibility goes beyond the IT staff and includes front and back office staff, doctors and nurses, patients, executives, and the board of directors. The attached presentation is directed to all levels of the healthcare organization so that they may be proactive and aware.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients
Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients

The HIPAA Security Rule establishes the requirements for protection of electronic patient health information. The safeguards identified are made up of three domains that include administrative, physical, and technical safeguards that need to be addressed. The technical safeguards as defined within 45 CFR §164.312 of the HIPAA Security Rule can be some of the most difficult to comprehend and implement for smaller Health Centers with lower levels of IT and security staffing. Resources and tools that help Health Centers better process and implement these security requirements are much needed and require well-documented methods for planning and maintaining critical security controls.

Substance Abuse Confidentiality Regulations - 42 CFR Part 2
Substance Abuse Confidentiality Regulations - 42 CFR Part 2

Substance Abuse Confidentiality Regulations - 42 CFR Part 2

Frequently Asked Questions (FAQs) and Fact Sheets regarding the Substance Abuse Confidentiality Regulations. 

Two fact sheets include: 

FAQs about Applying the Substance Abuse Confidentiality Regulations, answers provided by Substance Abuse and Mental Health Services Administration (SAMHSA)

Creating and Managing Strong Passwords at Your Health Center
Creating and Managing Strong Passwords at Your Health Center

Creating and Managing Strong Passwords at Your Health Center

Is it acceptable/recommended for health centers to adopt the new password policy guidelines under NIST Special Publication 800-63B and will that still uphold the HIPAA security rule? This question had been posed to the HITEQ Center asking whether we had any guidance or recommendations on implementing the new NIST Guidelines regarding password security.  New Digital Identity Guidelines under NIST Special Publication 800-63-B presents new guidelines regarding password security that are much more user-friendly and consequently more likely to be observed by health center staff since constantly changing, complex password on multiple systems can be a source of frustration for the end user. 

The Health Center CIO’s Guide to HIPAA Compliant Text Messaging
The Health Center CIO’s Guide to HIPAA Compliant Text Messaging

The Health Center CIO’s Guide to HIPAA Compliant Text Messaging

This slide deck provides health centers with information and a presentation template overview of the HIPAA and electronic PHI risks related to texting and messaging that are important for health center leadership and IT managers to understand in making organizational decisions for these types of tools.

Online Reputation Management for Health Centers
Online Reputation Management for Health Centers

Online Reputation Management for Health Centers

A Health Center’s online reputation plays an ever-growing role in client satisfaction, as 6 out of 10 patients use online patient reviews before selecting a physician. This webinar and related handouts recommend three specific steps to managing your reputation online to improve patient engagement.

Emergency Situations: Preparedness, Planning, and Response
Emergency Situations: Preparedness, Planning, and Response

Emergency Situations: Preparedness, Planning, and Response

From the OCR: The Privacy Rule protects individually identifiable health information from unauthorized or impermissible uses and disclosures. The Rule is carefully designed to protect the privacy of health information, while allowing important health care communications to occur. These pages address the release of protected health information for planning or response activities in emergency situations.  In addition, please view the Civil Rights Emergency Preparedness page to learn how nondiscrimination laws apply during an emergency.

Limited Waiver of HIPAA Sanctions and Penalties During Declared Emergency
Limited Waiver of HIPAA Sanctions and Penalties During Declared Emergency

Limited Waiver of HIPAA Sanctions and Penalties During Declared Emergency

From the OCR: Severe disasters – such as Hurricanes Harvey, Irma, and Maria – impose additional challenges on health care providers. Often questions arise about the ability of entities covered by the HIPAA regulations to share information, including with friends and family, public health officials, and emergency personnel. As summarized in more detail below, the HIPAA Privacy Rule allows patient information to be shared to assist in disaster relief efforts, and to assist patients in receiving the care they need. In addition, while the HIPAA Privacy Rule is not suspended during a public health or other emergency, the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.

42 CFR Part 2 Final Rule and Health Center Compliance
42 CFR Part 2 Final Rule and Health Center Compliance

42 CFR Part 2 Final Rule and Health Center Compliance

The conference will explore the history and recent changes of 42 CFR Part 2, review common definitions, and how the changes may affect integrated medication-assisted treatment (MAT) and Screening, Brief Intervention, and Referral to Treatment (SBIRT) programs, and discussion on LifeLong Medical Care’s experience.

HIPAA and Telehealth
HIPAA and Telehealth

HIPAA and Telehealth

Fact Sheet outlining a three-step process to make sure you’re in compliance with HIPAA and if not, the steps that can be taken to make sure you are. This fact sheet also includes questions to ask potential business associates and things to keep in mind in case there is a breach.

Sharing Behavioral Health Data over an HIE
Sharing Behavioral Health Data over an HIE

Sharing Behavioral Health Data over an HIE

This is a recent presentation by the Substance Abuse and Mental Health Services Administration's Health IT effort that provides an overview of their Consent2Share project. Consent2Share is a tool for consent management and data segmentation that is designed to integrate within existing electronic health record (EHR) and Health Information Exchange (HIE) systems.

This overview is provided to health center leadership and staff to help them better understand new practices and technologies in the field that can assist in compliance with HIPAA 42 CFR Part 2 regulations when trying to participate in health information exchange activities.

Minor and Parental Access to Patient Portals
Minor and Parental Access to Patient Portals

Minor and Parental Access to Patient Portals

This guide provides examples and overviews of patient portal considerations for minors as it relates to Meaningful Use, HIPAA. state consent laws and associated policies. The articles and presentations included for download and linked to from related websites include use cases and examples from multiple states and national level guidelines.

Security Implications of BYOD in Health Care
Security Implications of BYOD in Health Care

Security Implications of BYOD in Health Care

This article from Optum provides a breakdown on Bring Your Own Device (BYOD) policy considerations based on the mix of devices your organization is trying to support, the size of your healthcare organization and implementation factors that may have an impact on success.

Guidance on the HIPAA Privacy, Security, and Breach Notification Audit Program
Guidance on the HIPAA Privacy, Security, and Breach Notification Audit Program

Guidance on the HIPAA Privacy, Security, and Breach Notification Audit Program

The HHS Office for Civil Rights has started its next phase of audits of covered entities and their business associates. The 2016 Phase 2 HIPAA Audit Program will review the policies and procedures adopted and employed by covered entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. 

Mitigating Office for Civil Rights Auditing Risks
Mitigating Office for Civil Rights Auditing Risks

Mitigating Office for Civil Rights Auditing Risks

The Office for Civil Rights (OCR) has recently announced the release of a new set of FAQs that seeks to address whether business associates of a HIPAA covered entity may block or terminate access by the covered entity to the protected health information maintained by the business associate for or on behalf of the covered entity.

Theme picker

Acknowledgements

This resource collection was compiled by the HITEQ Center staff with guidance from HITEQ Advisory Committee members and collaborators of the HITEQ Center.

Search HITEQ Content
Need Assistance?
Would you like more assistance regarding Health IT Enabled QI strategies or support in using any of the included resource sets?

  Request Support

 

The Quadruple Aim
Quadruple Aim

A Conceptual Framework

Improving the U.S. health care system requires four aims: improving the experience of care, improving the health of populations, reducing per capita costs and improving care team well-being. HITEQ Center resources seek to provide content and direction aligned with the goals of the Quadruple Aim

Learn More >