HIPAA Series Part Two: How to Protect PHI Through Physical Safeguards
Basic steps to protect PHI through physical safeguards include collecting a terminated employee’s badge and keys. Most organizations plan for this, but PHI protections should go above and beyond basic.
A covered entity paid HHS Office of Civil Rights (OCR) a settlement of over $200,000 because it failed to provide even the most basic physical safeguards. According to the OCR’s investigation, the covered entity terminated an employee. Eight days later, the former employee and a union representative entered the covered entity’s offices with a work key and locked herself and the union representative inside her office. Then, she logged into her old computer with her username and password and downloaded information from her computer onto a USB drive. She grabbed boxes containing personal items and paper documents before she and the union rep exited the building.
These actions resulted in the impermissible disclosure of nearly 500 individuals’ PHI.
Would these things have happened if the organization had taken the former employee’s work key? Probably not. Like dominos falling, if the physical security of the premises had been tighter, the former employee and union representative would not have been able to gain physical entry into the offices, preventing other actions from taking place.
Download this eBrief, “HIPAA Security Rule Series Part 2: Protecting PHI Through Physical Safeguards,” to learn everything you need to know to protect your organization right now. This eBrief covers:
- Tips to protect PHI through physical safeguards
- Details on the $200,000 settlement
- In-depth explanations of physical safeguards
- The importance of facility access control
- Ways to improve workstation and device security
In our other eBriefs on this series, we covered other essential elements of the HIPAA Security Rule. You can download those in the links below.