Patient Health records

1) Within your Health organization (or if you would to work in one) with regards to PKI (Public key infrastructure) and HIPAA, what steps, procedures, methods and security measure do you and your organization take/use when handling Patient Health records or Protected Health information (PHI) within your use of Information System resources and technology/tools/Software applications (ex. Email or EMR)/devices (ex. laptops, printers, smart phones) at work? Explain in details how you and your organization handle sensitive information.
2) And what some examples of disciplinary actions your organization/department or IT security would take if any HIPAA rules had been violated or breached.

Steps, procedures, methods, and security measures that my organization takes to handle PHI:
  • Physical security: Our organization has strict physical security measures in place to protect PHI. This includes locking file cabinets, using keycard access to restricted areas, and shredding paper records when they are no longer needed.
  • Electronic security: Our organization uses a variety of electronic security measures to protect PHI, including:
    • Password protection: All electronic PHI is protected by strong passwords.
    • Encryption: PHI that is transmitted electronically is encrypted.
    • Firewalls: Our organization's network is protected by firewalls to prevent unauthorized access.
  • User training: All employees who have access to PHI are required to undergo HIPAA training. This training covers the importance of confidentiality, the proper handling of PHI, and the consequences of HIPAA violations.
In addition to these general security measures, my organization also uses PKI to further protect PHI. PKI is a technology that uses digital certificates to authenticate users and encrypt data. This helps to ensure that only authorized users can access PHI, and that PHI is protected from unauthorized access, modification, or disclosure. If any HIPAA rules were violated or breached, my organization would take disciplinary action against the responsible party. This could include termination of employment, civil penalties, or criminal prosecution. Here are some specific examples of disciplinary actions that my organization might take:
  • Termination of employment: If an employee was found to have intentionally violated HIPAA rules, they could be terminated from their employment.
  • Civil penalties: The U.S. Department of Health and Human Services (HHS) can impose civil penalties on organizations that violate HIPAA rules. The amount of the penalty will depend on the severity of the violation.
  • Criminal prosecution: In some cases, individuals who violate HIPAA rules may be subject to criminal prosecution. This is typically reserved for the most serious violations, such as selling PHI or using PHI for identity theft.

Sample Solution

Steps, procedures, methods, and security measures that my organization takes to handle PHI