Honestmed

Wednesday, May 03, 2006

What is HIPAA?

HIPAA: Practical Application of the Federal Patient Privacy Act

Alan R. Spies, R.Ph., J.D., Ph.D. Cand.
Virgil Van Dusen, R.Ph., J.D.

The Health Insurance Portability and Accountability Act (HIPAA) took effect on April 14, 2003. This law is the first comprehensive federal regulation designed to safeguard the privacy and security of protected health information.1 As a result, virtually every pharmacy that conducts certain financial and administrative transactions electronically, such as billing and fund transfers, must be in compliance.

Confidentiality has always been an important aspect of the practice of pharmacy. To further encourage such professional behavior, ethical codes combined with some state statutes and regulations promote a high professional standard. The new HIPAA rules do not replace state regulations or other laws that may grant individuals even greater privacy protections. Furthermore, pharmacies are free to retain or adopt protective polices or practices more stringent than HIPAA if desired.

HIPAA is one of the most significant pieces of federal legislation to affect pharmacy practice since OBRA '90. HIPAA describes the framework for the use and disclosure of health information for treatment, payment, or health care operations at all covered entities, including pharmacies. But HIPAA does more than restrict what a pharmacy can do with patient health information. It gives important rights to patients, such as the right to access the information, the right to seek details of the disclosure of the information, and the right to view the pharmacy's policies and procedures regarding the confidential information (TABLE 1).

Compliance Requirements: Five Key Elements
Compliance with HIPAA is not optional. Fortunately, the Privacy Rule (the Rule) of HIPAA gives needed flexibility for pharmacies to create their own privacy rules and procedures, tailored to their needs. For instance, policies and procedures of an independent pharmacy may be more limited under the Rule than might those of a large chain or health plan, based on the volume of health information maintained and the number of interactions with individuals in the health care system.

Implementation and Posting of Policies and Procedures
The Privacy Rule requires each pharmacy to take reasonable steps to limit the use or disclosure of, and requests for, protected health information (PHI). PHI is defined as individually identifiable health information transmitted or maintained in any form and via any medium. Examples of PHI are prescriptions, patient record systems, or recorded pharmacist comments relevant to patient therapy.

To achieve these steps, a pharmacy must implement reasonable policies and procedures that limit how PHI is used, disclosed, and requested for certain purposes. Policies and procedures may be standard protocols that limit the PHI or disclosed or requested information to the minimum necessary for the particular type of disclosure or request. These minimum necessary policies and procedures must reasonably limit the number of individuals within the pharmacy who have access to PHI and specify conditions of such access, based on job responsibilities and need to access such information to perform their duties. The Rule recognizes that the pharmacy itself is in the best position to determine who needs access to PHI held in its own records.2

A pharmacy is also required to post its entire Notice of Privacy Practices at the facility in a clear and prominent location and on its Web site (if one exists). The pharmacy has discretion to design the posted notice in a manner that works best for its facility. This may include simply posting a copy of the notice pages that are provided directly to individuals.

Obtaining Patient Consent
The HIPAA Privacy Rule gives individuals a fundamental right to be informed of the privacy practices of the pharmacy, as well as their privacy rights with respect to their PHI (TABLE 2). As a result, pharmacies are required to develop and distribute a notice with a clear explanation of these rights and practices (TABLE 3). This notice must be given to every individual no later than the date of the first service provided (or when the first prescription is dispensed) and requires that a good faith effort be made to obtain the patient's written acknowledgment of receipt of the notice. This receipt must be maintained by the pharmacy for six years from the date that the document was signed or the last date that a patient received a prescription, whichever is later. To satisfy the acknowledgment requirement, the pharmacy can make a good faith effort by including a tear-off sheet or other document with the notice that requests that the acknowledgment be mailed back to the pharmacy. The pharmacy is not in violation of the Rule if the individual chooses not to mail it back.

A pharmacist is permitted to have customers acknowledge receipt of the notice by signing or initialing the logbook they currently sign when they pick up prescriptions, provided that the patient is clearly informed of the logbook and of what is being acknowledged. This acknowledgment may not be used as a waiver or permission for something else that also appears on the logbook (such as a waiver to consult with the pharmacist). The HIPAA Privacy Rule allows a pharmacy the discretion in designing an acknowledgment process that best works for its business. It is not necessary to provide notice to every family member; notice to the named insured of a policy under which coverage is provided is satisfactory. Therefore, children younger than 18 are not required to receive the notice.

Should a pharmacy change its policy regarding PHI, it would not be required to obtain new acknowledgments from patients. In addition, HIPAA does not require the pharmacy to mail revised notices or to otherwise notify patients by mail of changes to the notice.

Selecting a Compliance Officer
The privacy regulations require the pharmacy to designate an individual to manage compliance with the Act, provide training, institute safeguards for the release of health information, and address patient concerns. The pharmacy manager could be assigned the duties of the "privacy officer." However, since HIPAA and its rules contain hundreds of pages of "fine print," the sensible approach of larger groups of pharmacies is to designate one person to oversee the implementation of policies, procedures, and HIPAA compliance.

Training Requirements
One part of the compliance requirements of HIPAA is that all employees working in a pharmacy environment in which patient-specific health information is used must have received training on the new regulations before they went into effect. The training necessarily includes pharmacists, technicians, and any others who assist in the pharmacy. Documentation for this training must be maintained by the pharmacy. New employees hired after April 14, 2003, must be trained within a reasonable period of time, and retraining of all affected employees must be conducted if changes are made to policies and procedures regarding PHI.

Maintaining "Business Associate" Agreements
In some situations, it will be necessary for a pharmacy to allow disclosure of PHI to a person or an organization that is known under the Act as a "business associate" (BA). A BA is defined as a person or entity that performs certain functions or activities involving the use or disclosure of PHI on behalf of, or providing services to, a pharmacy. BA functions and activities may include claims processing or administration, data analysis, utilization review, quality assurance, billing, benefit management, and repricing. Other examples could include a CPA firm whose accounting services involve access to PHI or an accrediting organization.

Under HIPAA, a pharmacy is allowed to disclose PHI to a BA if the pharmacy obtains satisfactory assurances that the BA will use the information only for the purposes for which it was engaged by the pharmacy, that it will safeguard all such information from misuse, and that it will assist the pharmacy in complying with the required duties under the Privacy Rule. A pharmacy contract or other written arrangement with a BA must:

Describe the permitted use and required use of the PHI by the BA.
Provide that the BA will not use or further disclose the PHI other than as permitted or required by the contract or as required by law.
Require the BA to use appropriate safeguards to prevent a use or disclosure of the PHI other than as provided for by the contract.

Permitted/Incidental Disclosure of PHI
Many health care providers and professionals have long made it a practice to ensure reasonable safeguards for individuals' health information. Discreet professional discussions, locked file cabinets, and computer passwords are examples of these safeguards.

The Privacy Rule recognizes that oral communication often must occur freely and quickly in settings such as a pharmacy. The Rule also recognizes that overheard communications in these settings may be unavoidable and, as such, the Rule allows for these incidental disclosures. It is not expected that a pharmacy's safeguard guarantee the privacy of PHI from any and all potential risks in order to satisfy HIPAA standards. Some risks of incidental disclosure will always be present.

Pharmacist/Health Professional Disclosures: Health care professionals may engage in confidential conversations with other providers, even if there is the possibility they could be overheard. There is no prohibition of pharmacists' discussing patient issues with the physician over the phone. In these circumstances, reasonable precautions could include lowering one's voice or positioning oneself out of public earshot when sharing PHI.

Pharmacist/Patient Disclosures: Likewise, a pharmacist may discuss a prescription with a patient from the pharmacy counter or on the phone. Patients can request certain privacy protection, such as requesting that the pharmacist call only at the office, rather than at home. The pharmacy is obligated to accommodate such a request when it is made. Furthermore, a pharmacist or pharmacist technician may call out the patient's name over the public announcement system in the pharmacy when a prescription is ready, so long as the information disclosed is appropriately limited. These types of disclosures do not require documentation under HIPAA.

A pharmacist may leave a message at a patient's home, either on an answering machine or with a family member, stating that the prescription is ready. HIPAA permits pharmacists to communicate with patients at their homes, whether by mail, phone, or e-mail. However, the pharmacy should take care to limit the amount of information disclosed on an answering machine. When leaving a message with a family member, the pharmacist should use professional judgment to ensure that such disclosures are in the best interest of the individual.

A patient can have a friend or family member pick up the prescription. However, a pharmacist should use professional judgment in making reasonable inferences in the patient's best interest. The fact that a relative or friend will pick up a prescription for a patient verifies that the person is involved in the patient's care, and the HIPAA Privacy Rule allows the pharmacist to give the filled prescription to the person. The patient does not need to provide the pharmacist with the names of such persons in advance. Mailing refill reminders to patients is permitted under the Privacy Rule, even if the pharmacy contracts with a mail house to do so and a third party provider pays for the mailing costs.

Pharmacist/Personal Representative: The Privacy Rule requires pharmacies to treat a patient's personal representative as the patient, with respect to the use and disclosure of the PHI, as well as the patient's rights under the Rule. State regulations or other laws should be consulted to determine the authority of the personal representative to receive or access the patient's PHI. If the personal representative is authorized to make health care decisions, then generally the personal representative can be granted access to the patient's PHI. In most cases under the Rule, the parent is the personal representative of a minor and can exercise the minor's rights with respect to PHI, because the parent usually has the authority to make health care decisions about the minor child.

Pharmacist/Public Health Activities: The HIPAA Privacy Rule recognizes the legitimate need for public health authorities and others responsible for ensuring public health and safety to have access to PHI to carry out their public health mission. An example of a public health authority is the FDA. It is permissible for a pharmacy to disclose PHI for public health purposes related to quality, safety, or effectiveness of an FDA-regulated product. Such purposes might include reporting adverse drug events, product defects (including problems regarding use or labeling), enabling product recalls, or conducting postmarket surveillance. In these situations, the pharmacy is permitted to disclose the minimum amount of PHI that is reasonable to assist the FDA in dealing with the problem.

Prohibited Disclosures
Generally, disclosure of PHI beyond use for treatment, payment, or health care operations requires a signed patient authorization. Unless authorized by the patient, conveying PHI to a telemarketer, using PHI in employment determinations, selling PHI to marketing agencies, or transferring names of patients with certain diseases to a pharmaceutical manufacturer are prohibited. Before a pharmacy transfers any information about a patient to a third party, it would be wise to ask, "Will such a transfer violate a patient's rights under HIPAA?"

Security
Security of protected health information is an important component of the Act. HIPAA security standards involve taking actions that a prudent person would agree were necessary to ensure the security of the protected information. A number of steps can be taken to ensure such security. First, the policy should reasonably limit access to the pharmacy area, especially to nonemployees. Second, adequate supervision of the pharmacy area should be made a priority. Third, software products and programs used by pharmacists should be reviewed to ensure security. Another step might include placing the prescriptions in bins outside of public view, rather than having health information about patients visible to anyone. These simple measures can prevent HIPAA security breaches.

Enforcement
The Department of Health and Human Services' Office of Civil Rights (OCR) is charged with enforcing the HIPAA privacy standards. Compliance is a top priority. Failure to timely implement these standards may lead to civil or criminal penalties. Violation of HIPAA regulations may lead to civil prosecution with penalties of $100 per incident to as much as $25,000 per year. Criminal acts set fines of $50,000 per violation or one year of imprisonment or both for wrongful disclosure, $100,000 per incident or five years of imprisonment or both for wrongful disclosure under false pretenses, and $250,000 or 10 years of imprisonment or both for wrongful disclosure with malicious intent.

Additional Information
The OCR is providing assistance to help pharmacies and other covered entities in complying with the Rule. For example, the OCR maintains a Web site with informative categories/sections, such as Guidance, Frequently Asked Questions, sample BA contract provisions, reference documents, and technical assistance. The National Association of Chain Drug Stores and the National Community Pharmacists Association have published compliance manuals for pharmacies, and numerous Web sites are also available to field questions (TABLE 4).

Conclusion
The Health Insurance Portability and Accountability Act is a federal law intended to protect the privacy and security of patient health care information. All pharmacies that electronically transmit patient information must comply with the Act, which went into effect on April 14, 2003. The Act gives patients certain rights regarding their health information and places responsibilities on pharmacies to guard that information. Unapproved dissemination of patient information can result in both civil and criminal penalties. Pharmacies must take immediate action to meet the requirements of the Act to avoid patient and/or government scrutiny and prosecution.

REFERENCES
1. Standards for privacy of individually identifiable health information, 67. Federal Register. 53182 (2002) (codified at 45 CFR §160, 164).
2. Bishop SK, Winckler SC. Implementing HIPAA privacy regulations in pharmacy practice. J Am Pharm Assoc. APhA, Washington, DC: 2002;42:836-846.

¶ 7:22 PM 0 comments

Electronic Health Records

The Electronic Health Record: Will It Become a Reality?

By Randa Upham, Principal, Phoenix Health Systems
April 2004

The past few years have been busy ones for those involved with automation of processes within the healthcare industry. IT professionals dedicated much of their time at the end of the last century addressing the Y2K crisis and then moved into the 21st century to take on the challenge of HIPAA. With the Y2K bug resolved and HIPAA becoming a way of life within the industry, is it now possible to reinvest energies into improving one of healthcare's biggest challenges establishing an electronic healthcare record?

First, let's understand what we mean by "electronic healthcare record."

How Many Acronyms Does It Take to Make an Electronic Health Record?

The electronic health record (EHR) is an acronym used extensively in the healthcare industry, but often with ambiguous meanings. What exactly is an EHR? To answer that question, let's first consider its evolution. The term EHR has been around for about three decades and yet is still being defined. A brief summary of its history may help to clarify its meaning.

Paper Medical Records
All current versions of the electronic records of the care provided to patients are based on the traditional medical record the paper version. The phrase "medical record" may be applied in differing ways based on the actual healthcare practitioners providing the care, but most persons understand the medical record to be a history of the care they received from various clinicians. An important characteristic to keep in mind is that EACH practitioner keeps its own medical record for each of its patients. There is no integration of the data from the various clinicians treating the patient. Therefore, as a patient, you most likely have many different medical records.
Computerization of Patient Records
The original objective for computerization of an individual's health record can be found in the Computerized Patient Record (CPR), which was defined as a computer-based record that includes all clinical and administrative information about a patient's care throughout his or her lifetime. The documentation of any practitioner ever involved in a person's healthcare would be included in the CPR, extending from prenatal to postmortem information. One of the expectations for the CPR included its role in decision support. Over a decade ago, the term CPR was used to distinguish the concept from the more traditional medical record to incorporate administrative and financial data often excluded from the patient medical record.
Evolving Terminologies
Over the past few decades, similar acronyms have evolved representing changes in the industry perception of what should be the actual make-up of the computerized "record" of the patient's healthcare experience. The industry has embraced models for the Computerized Medical Record (CMR), the Electronic Patient Record (EPR), the Continuity of Care Record (CCR), the Digital Medical Record (DMR), and the Personal Health Record (PHR). Of particular importance is Patient Medical Record Information (PMRI) in that the legislative act that made HIPAA a law (the Health Insurance Portability and Accountability Act of 1996) charged the National Committee for Vital and Health Statistics (NCVHS) to "study the issues related to the adoption of uniform data standards for patient medical record information and the electronic exchange of such information." To that end, NVCHS has been steadily working to establish PMRI standards for the information and terminologies that would comprise a universal electronic patient health record. Each of these concepts (and acronyms) exists as a building block in the current understanding of EHR. For an in-depth discussion of the evolution of industry terminology relating to what is now known as the EHR, see: Waegermann, C. Peter, Status Report 2002: Electronic Health Records Why EHRs?

The EHR Today

Although no standardized acronym has been established by the industry or the government, EHR is often considered the term most reflective of the actual patient experience of receiving healthcare. The EHR incorporates all provider records of encounters where the patient has received medical care.

Documentation of many events occurs with the inpatient experience recording of encounters with clinicians, treatment received, test results, and medications ordered. Following his or her discharge, the patient may have office visits with practitioners and receive ongoing care ordered by these practitioners. The aggregate recording of these encounters and interactions with the patient (across all involved healthcare enterprises) comprises the EHR.

In addition to serving as documentation of the clinical care provided to the patient, the EHR exists as a business record for all the providers who provide care to the patient. The provider uses the EHR to communicate with other practitioners about the delivery of care, as reference for the patient's history, to support its operations and billing, and for medical-legal purposes. It is the aggregate of the total experiences related to patient care that is currently understood to be the contemporary EHR.

Considering the decades of development that resulted in the current concept of EHR, it would be logical to assume that the industry has established a sound foundation for universal implementation of an electronic health record. Unfortunately, we know that the healthcare industry has yet to accomplish this objective. Yet there is general industry consensus that an EHR is essential to the well-being of the healthcare environment. Why does the vision of an industrywide HER seem so far from reality? What are the factors that have prevented universal adoption of EHR?

Understanding the Realities

Healthcare has lagged behind other industries in adopting Enterprise Resource Planning (ERP) as an essential business strategy. The many departments within a hospital setting typically implement and use computerized systems according to their own established data conventions. Changing to standardized protocols for charting patient care within an automated system requires an enormous and expensive effort. Some of the barriers that are typically noted include:

lack of clinician acceptance
concerns about inability to align workflow with a standardized EHR
concerns that automation of clinical charting requires more time than paper charting
lack of uniform standards for documentation of clinical services
lack of standardized technical platforms to support EHR
lack of support for startup expenses or reimbursement for implementation costs

Several observations can be made about these perceived issues. Studies abound concerning the resistance of physicians and other clinicians relative to their willingness to embrace the EHR. Although clinician acceptance is indeed an important factor in adoption of the EHR, the myth of universal physician resistance should be debunked. There is much literature evidencing that physicians support EHR when the benefits of EHR can be demonstrated to them. The industry's energies should be focused on establishing the value of adopting EHR across all aspects of our delivery of healthcare not merely conducting studies measuring the time spent charting (paper vs. electronic).

Many of the other identified hurdles involving lack of standardized terminology, charting requirements and technical platforms are being increasingly reduced as definite barriers. Across the nation, initiatives to address lack of standardization issues are in process. A search on the Internet on "electronic health record" (or any of its alternative monikers) yields more than an abundance of active EHR and standardization initiatives. Of course, the industry closely watches the activities of NCVHS relative to standardization of the components and terminologies for an EHR.

The barrier to adoption of the EHR that is probably the most difficult to overcome is the lack of easily apparent return on investment (ROI). Many writers on the subject have noted that healthcare decision makers find it difficult to readily demonstrate ROI or justify the expenditure of dollars and time to undertake a comprehensive EHR within their organizations, particularly while healthcare costs continue to spiral out of control. A review of the literature yields an abundance of information from vendors and healthcare professionals about how to measure the ROI for and implementation of EHR. In fact, the NCVHS has suggested turning to the vendors to obtain experiential information on ROI. However, the literature has not yet produced the universal guarantee for ROI that healthcare enterprises would like to have when they are conducting strategic planning related to the huge initiative of establishing an EHR for their organizations. In spite of this major hurdle, the national healthcare environment does not appear ready to give up the vision of a universal EHR. Across the industry, initiatives in support of the adoption of an electronic health record remain alive and well.

Arguing the Benefits of the EHR

Quite frankly, there is little argument over the other potential benefits of EHR. Most healthcare professionals agree that if the industry could finally implement a universal EHR, there would be considerable clinical and administrative benefits to be recognized. Among them are:

immediate and universal access to the patient record
easier and quicker navigation through the patient record
no lost charts
standardization of care among providers within the organization
clinical data that is formatted to be easy to read and analyze
reduction of paperwork, documentation errors, filing activities
coding efficiency and efficacy
alerts for medication errors, drug interactions, patient allergies
ability to electronically transmit information to other providers (assessments, history, treatments ordered, prescriptions, etc.)
availability of clinical data for use in quality, risk, utilization, ROI analyses

For a discussion on how some physicians view the advantages of the EHR, see: David Smith, MD and Lucy Mancini Newell, MBA, A Physician's Perspective: Deploying the EMR, Journal of Healthcare Information Management, Volume 16, No. 2.

Getting on the EHR Bandwagon

Many respected national healthcare associations and advocacy groups have issued mission statements and established initiatives in support of the EHR. As healthcare professionals, we can make EHR a reality in this country through active involvement in a variety of initiatives to support the adoption of a universal (and comprehensive) electronic health record. Just a few of them are noted below, as examples of the very solid commitment that our industry is making to achieve this milestone in healthcare information:

The Healthcare Information and Management Systems Society (HIMSS) has announced its support of EHR in many ways. For example, it has proposed an EHR Summit to convene the leading vendors, consultants, clinicians, HIT provider executives, payers, government agencies, pharmaceuticals, standards development organizations, associations, and others to develop a realistic action plan. The HIMSS Electronic Health Record Committee has been established to explore the definition and essential attributes for the EHR. HIMSS conferences have consistently offered an electronic medical records track for presentations (http://www.himss.org).
The American Health Information Management Association (AHIMA) believes that "for the United States' healthcare industry to meet the current and future needs of the nation, a properly funded and maintained national healthcare information infrastructure should be established" (http://www.AHIMA.org).
The Medical Records Institute's (MRI) mission is "to promote and enhance the journey towards electronic health records, ehealth, & mobile health, and related applications of information technologies (IT)" (http://www.medrecinst.com).
The Foundation for the Advancement of Electronic Health Records (FAEHR) is a non-profit organization dedicated to addressing several of the most urgent needs facing the healthcare delivery system today, including quality of care, reducing medication errors, and cost of healthcare reduction.
NCVHS recommends that the federal government recognize a "core set" of PMRI terminologies as a national standard (http://www.ncvhs.dhhs.gov).
The stated mission of the eHealth Initiative (eHI) and the Foundation for eHealth Initiative is that "(c)onsumers, healthcare providers, and those responsible for population health will have ready access to timely, relevant, reliable, and secure information and services through an interconnected, electronic health information infrastructure to support better health and healthcare" (http://www.ehealthinitiative.org).
The EHR Collaborative is a group of organizations representing key stakeholders in healthcare which has established the following goal: "to facilitate rapid input from the healthcare community in this and other development initiatives that advance the adoption of information standards for healthcare." This collaborative effort includes the following organizations: AHIMA, eHI, HIMSS, American Medical Association (AMA), American Medical Informatics Association (AMIA), College of Healthcare Information Management Executives (CHIME), and National Alliance for Health Information Technology (NAHIT) (http://www.ehrcollaborative.org).

It is important to note that support for the EHR comes from both the private and public sector. Endorsement of and commitment to adoption of the EHR can be observed in numerous activities and initiatives within the federal government:

The current administration's budget includes funding to the Agency for Healthcare Research and Quality (AHRQ) for IT Demonstration Projects. One of the stated missions of the AHRQ is to advance the use of information technology for coordinating patient care and conducting quality and outcomes research.
President Bush announced his support for interoperable electronic health records in his March 2003 address to the American Medical Association (AMA).
The Centers for Medicare and Medicaid Services (CMS) has taken a leadership position in improving the quality and efficiency of healthcare through IT. For example, it has strongly supported the adoption of data standards within the federal government through the Consolidated Health Informatics Initiative. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 recognizes the critical role that IT has in improving healthcare outcomes and reducing medical errors within the Medicare program. And, of course, CMS plays an active advisory and regulatory role in the implementation of the HIPAA Transactions and Code Sets (TCS) standards.
The HIPAA TCS standards must be recognized as a huge step in the evolution of the EHR. Once fully implemented, standardized transactions and code sets will serve as a major cornerstone of the EHR.
Many of our country's legislators actively promote the EHR as evidenced by some of the speeches at the 2004 HIMSS annual conference. Former Speaker of the House, Newt Gingrich, in the keynote speech, talked about the need for changes in healthcare such as e-prescribing, electronic health records, and an electronically-connected healthcare structure. Later in the week, Patrick Kennedy, US Representative from RI, discussed his plan to introduce new legislation, termed "QUEST" (Quality, Efficiency, Standards and Technology) Act that uses technology to address many of healthcare's woes. The act will call for a fully wireless, paperless EHR.
The Department of Health and Humans Services (HHS) has commissioned the Institute of Medicine (IOM) to design a standardized model of the EHR and also asked the healthcare standards development organization, HL7, to evaluate the model. The proposed model is expected to be revealed in 2004.
In March 2003 HHS, and the Departments of Defense and Veterans Affairs announced the first set of uniform standards for the electronic exchange of clinical health information to be adopted for federal agencies.
The Centers for Disease Control (CDC) created the Public Health Information Network (PHIN), to support communications for public health labs, the clinical community, and state and local health departments.

Commitment to Collaborate

These and other initiatives advocating and/or expanding on the concept of the EHR indicate that the momentum towards an EHR is increasing in intensity. In particular, the coordinated efforts of such affiliations as the EHR Collaborative offer a persuasive call to action to which healthcare provider organizations are increasingly paying attention. Is the industry, in fact, moving closer towards the long-standing goal of a true, universal EHR? We think it is. Watch HIPAAlert for further reports, as we continue to track future progress in the establishment of an industry electronic healthcare record.

Randa Upham, M.A., Principal, is in charge of Program Development at Phoenix Health Systems. Ms. Upham has 23 years' experience in the Healthcare and Information Services industries with an extensive background in product development, clinical services, organizational management, software design, and educational planning.

¶ 2:52 PM 0 comments