An important step to take as your planning to close your medical practice is to make sure the vendors you are using are able to provide the required services to ensure proper support for closing a practice. There are criteria that you can use to help assess whether a vendor provides all the necessary support for closing a practice and properly handling that practice’s records management program. Furthermore, using this criteria will also ensure that your health information management program is, and will remain, HIPAA compliant.
Validate and verify HIPAA compliance
Verifying HIPAA compliance is undeniably important and non-compliance is costly. Furthermore, you are not exempt of responsibility just because you close your medical practice’s doors.
In order to avoid these issues, as well as protect your patients and your reputation, you’ll want to ask your vendor a lot of questions.
Are there safeguards to restrict physical access to the records?
Can the release of records be tracked and managed to ensure that only the minimum information necessary is provided and only to authorized requestors?
What controls and processes are in place to protect PHI at rest, in transit or upon retention expiration?
Does the vendor have a standard Business Associate Agreement and experience in negotiating these types of contracts?
Inquire about health information management and closing practice expertise
It’s important to qualify the vendors’ records management knowledge as well as their healthcare-specific expertise. This will help you make sure your patients’ information will be protected but also readily accessible.
Make sure to ask:
How many patient records do they manage?
What healthcare facilities across the country do they work with?
Have they ever supported a closed practice records management program before?
Take patient care into consideration
It’s important that your patients are informed of the process of requesting their records from a third party. Therefore, it’s important to know whether your records management vendor has dedicated teams with experience in Release of Information in order to assist a patient through the authorization and fulfillment process. It’s also important to know that your records management vendor will ensure that patients receive their records in a timely manner as well as if there will be any costs to the patient for receiving copies of their record.
The information formats and types stored and managed
In addition to paper, health information lives in digital format in your electronic medical record (EMR), radiology systems, mammography systems as well as other systems. Because of this it’s important to inquire about the experience the vendor has managing information in a variety of formats.
Ask your vendor how they can help you manage EMRs while also maintaining security and protecting from cyber threats. Make sure your vendor offers solution to store other types of records such as X-rays, lab specimens and medical images.
Consider the full information management lifecycle
Personal health information (PHI) must be protected throughout each stage of the information lifecycle. This means PHI must be protected in storage, in transit, as well as securely destroyed once the retention period has expired.
Make sure you ask your records management vendor about the specifics on how they protect PHI at each stage of the lifecycle.
Learn more about best practices for closing your medical practice.