The IT staff at Loma Linda University Medical Center understands the serious consequences of reading patients' medical records without authorization and otherwise violating patients' privacy. In anticipation of the medical privacy regulations that will be enforced by the Health Information Portability and Accountability Act (HIPAA), Loma Linda is operating under strict new privacy rules, says Alvin Siagian, the center's information security administrator. Some IT staffers at the Loma Linda, Calif.-based hospital have been fired for bypassing audit trails or looking up their friends' and families' records, he says.

"We have to teach our IT staff to keep their curiosity in check," Siagian says.

In the face of an October 2002 compliance deadline for HIPAA's first phase -- standardizing data formats for electronic transactions -- IT leaders at health care organizations have been managing many changes in their departments. They have implemented new policies, like Loma Linda's strict privacy rules, and learned early lessons about best practices, such as when to involve IT personnel on HIPAA projects and how to cost-effectively implement HIPAA compliance projects.

Industry officials say that so far, HIPAA projects haven't been a large burden on IT departments, and their efforts are paying off with the beginnings of a privacy-focused cultural change within their companies. Officials are also confident that IT and the rest of their organizations will be ready when next year's deadline arrives for implementing standards and formats for electronic transactions. But their toughest challenge -- giving patients access to their records -- is yet to come, according to industry analysts.

After health care organizations finish their Phase 1 work,

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine