Secure Practice Management System for Small Healthcare Providers Kingdom Iweajunwa Saeed Rajput

Introduction Need to provide small practices with cost- effective patient management solutions that meets privacy and security standards of HIPAA Majority of the population receive health care through small practices In 2001, the Workgroup for Electronic Data Interchange (WEDI) estimated 400,000 small practices will be affected by HIPAA [1]

Impact of HIPAA on Small Practices All entities that exchange electronic data directly or through clearing houses are affected Medicare will not honor non-electronic claims Small practices must change existing PMS to handle HIPAA standardized transaction formats, new code sets,National Identifier scheme, privacy and security standards

Privacy: what needs to be protected Demographic data (age, sex, personal identifiers etc) Consultation and treatment records (doctor’s notes, prescription, immunization etc) Billing and payment information Provider data Patient visit schedules

Low network connectivity Small providers still use non-secure communication channels eg dial-up, faxes High volume paper correspondence Doctors’ apathy towards information sharing Doctors’ low budget for information technology Lack of personnel to handle HIPAA-mandated administrative tasks Obstacles to small practice Compliance

Security: methods to protect privacy  Authentication : users must be uniquely identified. Use of user id/password may be sufficient  Authorization: access to protected data must be on need-to- know basis  Audit Trails: all attempts to access, copy,create or modify protected data must be recorded concurrently with the attempts  Disclosure Log: disclosure of patient record must be authorized by patient and logged  Secure data storage and transmission: data exchange should be via secure channels and storage media physically secure  Disaster Prevention/Recovery: allow for regular data backup

Patient Registration Validate Billing Info. Patient Visit External Lab Work clerk Payer Nurse Doctor Lab services provider Release Medical Record Transcribe Prescription External Physician Transcription provider Patient Billing provider Billing for Services uses A few Use Cases

Authorization model Medical Record Patient > owns Rights read approveRelease TreatmentRecord 1 Transaction * AuditLog 1 Doctor > 1 1 * 1..* Rights read modify create delete release Payer > * * Rights read Nurse > Rights read modify create * * PersonalData 1 Clerk > * * Rights read create modify

Sequence Diagram: Releasing patient medical record to External Physician External Physician > RequestRecord Doctor > Patient > RequestRelease Authorized :Treatment Record :AuditLog writeDisclosure return sendRecord