Office Technology and Electronic Data

This is Unit Twenty-Five of Medical Assistant Prep. Unit Twenty-Four kept the front desk safe with structure. This unit does the same for the computers behind it: the electronic health record, the safeguards federal rules require, and the devices that carry patient information. Carry one idea through this lecture. Security in a practice is mostly made of small habits repeated every day by everyone, and a single shared password or unlocked screen can undo the technical protections. Two constructed scenes at the end show those habits. By the end you will be able to enter and retrieve data accurately. To name the three kinds of safeguards. To protect logins, screens, messages and devices. And to report a security problem at once.

Three entries on the record: what it holds, accurate entry, and retrieving the right patient's record.

Entering and retrieving.

MAS 601 The Electronic Health Record

The electronic health record holds a patient's health information, and everything entered in it is part of a legal document. Medical assistants enter and retrieve data such as demographics, vital signs, medications, results and appointments. An entry in the wrong patient's record is a serious error; confirm identity before you type.

Every later decision.

MAS 602 Accurate Data Entry

Data entry must be accurate, because every later decision relies on what was entered. Confirm spellings, numbers and dates as you enter them, especially names, dates of birth, phone numbers and insurance details for new patients. A single wrong digit in a date of birth can attach information to the wrong person.

Two identifiers.

MAS 603 Retrieving the Right Record

Before you view or add to a record, confirm that it belongs to the patient in front of you. Match at least two identifiers, such as full name and date of birth, especially when patients share similar names. Open only the records you need for your work.

Four entries on safeguards: the three kinds, your own login, automatic logoff, and audit trails.

Administrative, physical, technical.

MAS 604 Three Kinds of Safeguards

Federal security rules require three kinds of safeguards for electronic health information: administrative, physical and technical. Administrative safeguards are policies and training; physical safeguards protect equipment and buildings; technical safeguards are protections built into the systems, such as logins. All three work together; a strong password does not help if the computer room is left open.

Unique to you.

MAS 605 Your Own Login

Every person using the system must have a unique user name, so their activity can be identified and tracked. Your login records what you view and change; sharing it means someone else's actions are recorded as yours. Never share a password, and never use someone else's login, even to help.

Lock when you leave.

MAS 606 Automatic Logoff

Systems can end a session automatically after a set period of inactivity. Automatic logoff protects information on a screen left unattended; workstation policies govern how staff secure computers when they step away. Do not wait for automatic logoff; follow the practice's policy for locking or logging off whenever you leave the workstation.

Every view logged.

MAS 607 Audit Trails

Security rules require systems that record and examine activity involving electronic health information. Audit logs show who viewed or changed a record and when, so inappropriate access can be detected. Assume that every record you open is logged under your name, and open only the records your work requires.

Six entries on data and devices: backups, encryption, mobile devices, patient portals, workstations and physical security.

Tested, offsite.

MAS 608 Backups

Electronic records must be backed up so that information survives a failure or disaster. Federal guidance advises storing routine backups offsite and testing them periodically to confirm that the data can be retrieved. A backup that has never been tested may not work when it is needed.

Unreadable without a key.

MAS 609 Encryption

Encryption scrambles electronic information so it cannot be read without the proper key. Federal guidance warns against emailing health information unless it is encrypted, and lost devices holding unencrypted information can lead to a reportable breach. Use only the practice's approved, secure methods for sending patient information.

Easily lost.

MAS 610 Mobile Devices

Smartphones, tablets and laptops that access health information need the same protection as office computers. Federal health information technology guidance provides tips for securing these devices, because they are easily lost or stolen. Never store patient information on a personal device unless the practice's policy allows it.

Secure messaging.

MAS 611 Patient Portals and Secure Messaging

Patients increasingly want to communicate electronically, but ordinary email and texts may not be secure. A secure patient portal, which requires the patient to log in, or an encrypted email system lets the practice meet security requirements. Redirect patients to the portal for health questions, rather than replying with health details by ordinary email.

Every device.

MAS 612 Every Device Falls Under the Safeguards

Security rules define a workstation as a computer or similar device along with the electronic media around it. Scanners, printers, tablets, kiosks and other devices that handle patient information fall under the practice's access and security policies. Collect printouts and scans of patient information promptly; an unattended page is an unprotected one.

Locks and doors.

MAS 613 Physical Security for Equipment

Physical safeguards protect computer equipment and buildings from damage and unauthorized entry. Simple measures include keeping the server in a locked room, protecting equipment with surge strips, and controlling who can enter areas where computers hold patient data. Report broken locks, propped-open doors or missing equipment at once, before the gap is used.

Five entries close the unit: downtime, scheduling software, training and reporting, and two constructed scenes.

Emergency access.

MAS 614 Emergency Access to Records

Practices must have procedures for obtaining necessary electronic health information during an emergency, such as a system outage. Know your practice's downtime procedure, including how to record care and how to enter it once the system returns. Downtime is not a reason to skip documentation.

Schedules and slips.

MAS 615 Scheduling and Practice Software

Practice software often handles scheduling as well as records. It can print daily or weekly schedules, appointment reminders and billing slips, and copies of the schedule are shared with the staff who need them. When the schedule changes, update every copy, not only the screen.

Malware and incidents.

MAS 616 Training, Malware and Reporting Problems

Every member of the workforce receives security awareness training, and practices have procedures for security incidents. Training covers protecting against malicious software, monitoring logins and managing passwords; suspected incidents are reported and responded to. Report a suspicious email, a lost device or a possible breach at once; practices also have sanctions for staff who break security policy.

An afternoon at the workstation.

MAS 617 Stepping Away From the Workstation

A constructed afternoon pays off the opening idea. Called away mid-entry, the assistant locks her screen rather than trusting automatic logoff. A coworker with an expired login asks to borrow hers; she declines and points him to the help process, since anything he did would be recorded as hers. She collects a printed list of lab results from the printer at once. At day's end, an email claiming to be from the software vendor asks her to confirm her password; she does not click and reports it as trained. Each act took seconds and closed a gap: an open screen, a shared login, an unattended page, a phishing attempt. One shared password or unlocked screen can undo every technical protection, which is why everyone is trained.

A missing check-in tablet.

MAS 618 A Tablet Left Behind

A second constructed scene follows a missing tablet. The assistant notices one gone from its waiting-room stand, checks the obvious places, and reports it to her supervisor at once by the incident procedure, noting when she last saw it and who was there. The person responsible for security checks whether it was encrypted and can be locked or wiped remotely, and whether patient information was stored on it, since a lost unencrypted device can be a reportable breach. The practice then moves the tablets where the desk can see them. Her quick report kept every option open. Hesitating out of embarrassment or hope wastes the hours when protective steps work best.

Look at what you can now do. You can enter and retrieve data accurately, matching two identifiers before you type. You can name administrative, physical and technical safeguards, and explain why your login is yours alone and every view is logged. You can explain backups and encryption and protect devices, portals, workstations and equipment. And you can follow downtime procedures and report a problem at once. Unit Twenty-Six turns to insurance, coding and prior authorization.