Best practices

Since protecting your patient data is your responsibility, it’s ultimately up to you to inventory your capabilities, your budget, and your manpower to decide how you will put into place your own protocols to ensure peace of mind.

Yes, you’ll want to equip yourself with the appropriate software and hardware to secure your data. But establishing best practices for your office, educating your staff about them, and enforcing a “no tolerance” policy may be the most effective steps you can take.

Give your staff unique user IDs and passwords and regularly change them; enable “unlocking” functions on other portable computers, such as Blackberries, that require the user to enter a unique PIN to gain access; regularly audit your electronic assets to ensure they are accounted for and in the right hands; regularly upgrade your antivirus software.

Establish a “shutting down” protocol when you close your clinic each night; do not give your employees unauthorized permission to remove any hardware from your office; take measures to lock down your office when you are not there; and, if you are in a larger commercial building, talk to your landlord about their after-hours security to ensure you are comfortable with the protection provided.

If you can’t afford fancy new anti-theft hardware and software solutions, look into lower-cost options that can add new layers of protection to the equipment you already possess. Keep a watchful eye on all of your paper-based and electronic assets that contain patient information, but remember that laptops in particular have proven to be the Achilles heel of many data theft victims.

“The data on your laptop is a controlled substance,” says Sprague. “Treat it as such. Is it under lock and key, and how can you be sure?”

Barbara A. Gabriel, a former associate editor for Physicians Practice, has served as editor and writer for numerous healthcare publications over the past 10 years. Barbara can be reached via editor@physicianspractice.com.

This article originally appeared in the 2008/2009 Physicians Practice Technology Guide.