NURS 601B  Week 4 DiscussionAPRN Bridge course

As defined by the Center of Medicare and Medicaid Services (CMS), “an electronic health record (EHR) is an electronic version of a patient’s medical history, that is maintained by the provider over time, and may include all of the key administrative clinical data relevant to that person’s care under a particular provider, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports [].” While it is said that electronic health records are the next step in the evolution of healthcare, the cyber-security methodologies associated with the adoption of EHRs should also be thoroughly understood before moving forward []. Due to the sensitive nature of the information stored within EHRs, several security safeguards have been introduced through the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Confidentiality and security of protected health information (PHI), which is included in a patient’s electronic health record, is addressed in the Health Insurance Portability and Accountability Act (HIPAA). HIPAA was passed by Congress in 1996, however compliance with the sub-rulings regarding security was not required until April 20, 2005 for most covered entities and September 23, 2013 for business associates []. The three pillars to securing protected health information outlined by HIPAA are administrative safeguards, physical safeguards, and technical safeguards []. These three pillars are also known as the three security safeguard themes for healthcare. These themes range from techniques regarding the location of computers to the usage of firewall software to protect health information. A brief list of safeguards and their definitions is provided in the .

In 2009, the HITECH Act stressed the significance of reporting data breaches. The HITECH Act maintains specific protocol that is to be followed when reporting data breaches. For example, if an entity encounters a data breach in which the information of 500 or more individuals is compromised, the HITECH Act requires that the entity provide specific details of the breach based upon said protocol [, ]. The HITECH Act also mandated Centers for Medicare and Medicaid Services (CMS) recipients to implement and use EHRs by 2015 in order to receive full reimbursements. Incentives were offered to providers who adopted EHRs prior to 2015 and penalties are imposed for those who do not beginning this year. The Office of the National Coordinator (ONC) created the three “meaningful use” stages to be followed by healthcare organizations adopting EHRs. Meaningful use determines the extent to which an entity is utilizing EHRs in comparison to previous patient documentation methods []. Currently, the United States healthcare system is in stage two of the meaningful use stages.

There are many aspects of security for technology, which is the reason for HIPAA’s three-tier model of physical, technical, administrative. There are security techniques that fit each of these categories, but there is no panacea of technique to thwart spurious (or accidental) breaches. Technology security officers are trained by many different organizations such as SANS, Microsoft, and the Computer Technology Industry Association. In November 2016, SANS hosted a Healthcare CyberSecurity Summit and Training seminar in Houston, Texas where it provided an overview of the most pressing security issues in healthcare and how to adopt healthy cyber-hygiene habits in the server room. SANS hosts these specialized seminars regularly because the cybersecurity environment is fluid, and because there is no magic combination of security controls and habits that will repel all boarders from key business data. As a result, there is no measuring tool to assess the success of one tool over another: Instead, security professionals balance their security programs with physical, technical, and administrative security controls along with an ever-present eye on the security landscape to observe breaches experienced by others and enact further controls to mitigate the risk of the same breach occurring in their facilities.

Eligibility criteria and information sources

The research gathered for the purposes of this manuscript was obtained from three online databases: PubMed (MEDLINE), CINAHL, and ProQuest Nursing and Allied Health Source. In the initial research conducted on this topic to write the introduction for this work, we found several key terms germane to our objective, and they generated from the Medical Subject Headings (MeSH). The research contained within CINAHL, which stands for cumulative index to nursing and allied health literature, is originally hosted by EBSCO Information Services. The information obtained from PubMed (MEDLINE) originates from the National Center for Biotechnology Information. In PubMed the MeSH automatically links together “electronic health record” and “electronic medical record,” but this link is not established in CINAHL or ProQuest, so both terms were used when querying those databases. The key term of security generated a sufficient level of results for us to feel that it was an exhaustive term. MeSH automatically associated this term with cyber security, computer worms, data protection, data compromising, information protection, data encryption, computer viruses, computer hackers, and data security. The data methodology and criterion used in the researchers’ manuscript is illustrated below in Fig. . The three researchers analyzed each research article used in this manuscript.