Hipaa Policy: Fill & Download for Free

As a hand surgeon, no.As a breast surgeon, yes.For anything in between, you can probably figure it out.Why do you ask?Is this not PC? Is there some new HIPAA policy that I missed?PS reminds me of a joke…A guy walks into a doctors office complaining about a headache. The receptionist asks him to undress and take a seat in the waiting room. He protests.“It's a headache”, he says.“I understand”, she says. “"Take off your clothes and the doctor will be with you in a few minutes”.Reluctantly he takes off his clothes.He’s sitting naked in the waiting room when another naked guy comes and sits next to him.“Did you ever see anything so crazy?”, he asks. “"I came for a lousy headache and they make me undress”.“i know, it's nuts”, the other guy says. “"I just came to fix the air conditioning”.

I was 37 weeks pregnant with our second son. And I came down with the flu.Only nobody knew it was the flu yet. For the time being, I was a highly dehydrated gal who’d thrown up for hours and now had a fever and overall unwellness… plus a slightly stressed baby.The option to take our son via cesarean section was brought up as “if things don’t improve”. Simply put, I was sick. I was in a triage room in the maternity wing as the emergency department had delivered several babies already that week and really didn’t want another one incoming!Eventually they moved me to ICU overnight. That’s when a labor & delivery nurse came with me, solely to monitor our baby.For twelve hours - her entire shift - she sat by my side, watching our baby’s heartbeat on the monitor. Sometimes she helped me to the bathroom. Sometimes she woke me up and encouraged me to turn on my side; our son’s heartbeat always responded positively.She was so calm, so kind, and so gentle. I slept on and off, and she sat there… catching every tiny variation in the steady waves on the monitor. Not in her department, not with the tiny newborns and active labor Moms she’d normally be helping. Just sitting there, watching a sleeping woman and listening to a tiny baby tucked deep inside still.She was the best.Right up there with her was the awesome nurse who helped triage me in Labor & Delivery initially. She’d gone off shift while I was still looking pretty awful. I got to see her when she stopped in just to say hi on the following day, when they moved me back to the maternity wing for further observation.Turns out, she had felt so bad for me that she couldn’t stop thinking about me on her drive home that day. So she called up one of the nurses on shift after her, and without violating HIPAA policies she was able to communicate what patient she was referencing (apparently I was fairly conspicuous around there that day!). The fact was that my illness was still mysterious, and while driving home from the hospital she’d thought of a blood test nobody had run yet. So she called up to make sure they’d do that test on me.It meant so much to me to know that someone had cared enough to even think of me after a full shift.I could go on and on. The nurse who was so determined to get our baby to turn, and who bubbled me through some of the toughest contractions of my life. The nurse who held me as I passed out after our second son was born. The nurse who… oh, I’d better stop. So many were so outstanding!My only regret is that labor, illness, pain medications, and total lack of sleep left me unable to recall their names or even most of their faces.

Dan Munro is right, once you start dealing with PHI acquired from a covered entity, you're effectively bound by the strict standards of data protection required implicitly or tacitly by HIPAA.You mentioned a bit about if storing or not storing some data would reduce your security risk. You could de-identify data for patients for research, but this effectively scrubs most identifiers from a person. There are 18 pieces of data which are always considered to be PHI, which you can read about here: UC Berkeley Committee for Protection of Human Subjects.The best way to reduce risk would be to partner with a vendor who would sign a Business Associates Agreement in which they would share liability for any intrusions/improper accessibility to your data store. You'll always be liable for your own application security (e.g., Dr. smith can't pull up any patient chart in the system), but working with someone on the infrastructure can go a long way. This is something we offer where I work at Catalyze.io and you can see our open-source HIPAA policies regarding this and other data access here: Catalyze