What considerations will you consider in preparation for drafting your policy?
Identify 3 factors that could pose a disaster threat to health information along with suggestions for disaster recovery.
Explain how you will be guided by the AHIMA Code of Ethics by specifically identifying the relevant ethics principle(s) and interpreting it in your own words.
As a new HIM director of a large healthcare system composed of multiple sub-acute care facilities with locations in multiple states of the US. You could use the example of Atlantic Health System or other similar health care organization of your choice (the selected organization must extend health care operations in more than one state). The organization uses an EHR but has some paper records, as well. One of your tasks is to put together a health record retention policy for the entire organization.
Disaster Threats to Health Information
Natural Disasters 🌪️
Threat: Events like hurricanes, floods, or fires can physically destroy servers or paper records.
Recovery Suggestion: Implement a geographically diverse, off-site backup system for electronic health records (EHRs). For paper records, a detailed disaster recovery plan should include a process for storing vital records in secure, fireproof, and waterproof locations and a contingency for salvage and restoration.
Cyberattacks 💻
Threat: Malicious software like ransomware can encrypt or corrupt health data, making it inaccessible.
Recovery Suggestion: Maintain isolated, immutable backups of EHR data that are not connected to the main network. A robust incident response plan must be in place to contain the attack, restore data, and notify affected parties.
Human Error 🤦
Threat: Accidental deletion of data, improper handling of records, or misplacing files can lead to a significant loss of information.
Recovery Suggestion: Implement strict access controls and a detailed audit trail to track all activity within the EHR system. Regular employee training and a clear policy for record management can help mitigate these risks.
AHIMA Code of Ethics
I would be guided by the AHIMA Code of Ethics, particularly the principles of protecting health information and stewardship of health information.
Protect Health Information: In my own words, this means I have a fundamental ethical obligation to safeguard all patient data from unauthorized access, use, or disclosure. When drafting the retention policy, this principle dictates not just how long to keep records, but also how to securely destroy them at the end of their lifecycle. This includes outlining methods for both digital (e.g., data wiping, degaussing) and physical (e.g., shredding) record disposal to prevent data breaches.
Stewardship of Health Information: I interpret this to mean I am a guardian of patient data, ensuring it is managed as a valuable asset. The policy must balance the legal and operational needs to retain records for as long as they are necessary for patient care, research, and legal purposes, while also recognizing the risk of keeping them for too long. This principle guides me in setting clear, consistent, and justifiable retention periods that serve the best interests of the patients and the organization.
Sample Answer
To prepare for drafting a health record retention policy, I would consider the following key factors. First, I'd need to research all federal and state laws governing health record retention, as these can vary significantly and set minimum retention periods. I'd also have to consult with legal counsel to ensure compliance and mitigate risk. Second, I'd analyze the organization's operational needs, including the mix of electronic health records (EHRs) and paper records, and the associated costs and logistics of long-term storage and eventual destruction. Lastly, I'd gather input from key stakeholders, such as clinical leaders, IT security, and finance, to ensure the policy is both comprehensive and practical.To prepare for drafting a health record retention policy, I would consider the following key factors. First, I'd need to research all federal and state laws governing health record retention, as these can vary significantly and set minimum retention periods. I'd also have to consult with legal counsel to ensure compliance and mitigate risk. Second, I'd analyze the organization's operational needs, including the mix of electronic health records (EHRs) and paper records, and the associated costs and logistics of long-term storage and eventual destruction. Lastly, I'd gather input from key stakeholders, such as clinical leaders, IT security, and finance, to ensure the policy is both comprehensive and practical.