[ Tuesday, May 27, 2003 ]
Faxes.
There's been some recent commentary on some of the HIPAA boards (HIPAAlive, I think) about when sending or receiving a fax constitutes the use of electronic medium for purposes of HIPAA. It is useful if you look back at the original intentions of HIPAA and why/how we got into this mess. Medical records have always been treated as much more confidential than other personal records. Going back to Hippocrates, providers have always been ethically bound to keep the information private. So why the new emphasis on medical record privacy in HIPAA? Technology.
Because of new technology, there is a greater risk to the privacy and confidentiality of medical records. In the old days, say 20 years ago, if someone with evil intent wanted to rummage through medical records to find information, they'd have to physically break into physician offices and hospital medical record rooms, find the information they were looking for, make copies, reassemble the files so nobody would know they had been there, and sneak back out. Or they'd have to fraudulently convince doctors and hospital records personnel to hand over the information. In either case, the quality and completeness of the information would be suspect, since there would be no assurance that they got all the relevant information on the target or community they were looking for. You would have to be pretty lucky for such a breach of privacy to yeild any results.
However, when medical records are kept in electronic format, the ability of a clever miscreant to get the information is geometrically increased. By hacking into a hospital electronic medical record room, a clever 14-year-old can search an entire database, taking what information is useful and leaving the rest, usually getting away with little if any evidence of the hack ever occurring. By improperly intercepting medical record communications, a drug company representative can find out who is using their own drug or a competing drug, and can effectively target-market. With medical information being stored or transmitted electronically, the risk to privacy is greatly increased, because it is easier to get the information and easier to use the information.
What accounts for this increase in risk? The digitization of the information. With paper records, human eyes must search for the information (in a form recorded by human hands). There are potential operator errors, or the seeking eyes might not be able to read what the writing hand wrote. With electronic records, computers can search for 1s and 0s in particular sequences, without the need for human intelligence (other than giving the search instructions). Computers can be set to search without the need for human intervention. This streamlines the process so much that the value of time invested in finding the information is reduced to near nothing, making the searching that much more valuable.
Now, how does this all relate to faxing? And when are faxes "electronic media" for HIPAA purposes? If you take a page our of my medical record, put it on a fax machine and fax it to someone else's fax machine, the sending fax machine converts the ink-on-paper image to a series of dots on paper, converts that to an electronic format grid, sends the grid information to the receiving fax machine, which reconverts it to inkdots-on-paper. Nowhere is the information changed to the 1s and 0s that can be searched by a computer. Even if it is being sent to a computer as the receiving fax maching, what is received is not the standard digital format; it's just dots on a grid. However, many computers have fax sending capabilities built in; you can send whatever is up on your screen to someone else's fax machine. If the information on your screen is 1s and 0s, then that might be what is being sent to the receiving fax. In the first instance (fax to fax or fax to computer), the information is never in true digital format; rather, it's in electronic format but not in a customary digital format. In the second instance (computer to fax or computer to computer), the information is at least at the beginning in digital format, and is converted to dot format. In the first instance, the risk of the information being searched by computer is minimal; in the second, it is substantially greater. That's where the confusion in faxing comes in.
So, when trying to determine if faxing makes for an electronic transmission, keep in mind the original purposes of HIPAA privacy.
OF COURSE, this doesn't mean that if you only use fax-to-fax transmission, you don't need to comply with HIPAA, and you can keep your fax machine out in the waiting room. There are many other factors at play; this part of the fax conundrum only relates to the instances where faxing constitutes use of electronic transfer of information (in other words, when is faxing like snail-mailing, and when is it like e-mailing).
Jeff [2:10 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
