We bleed data constantly. Data hemorrhage! Why? Because it is self-propagating. The more important the data, the faster it seems to reproduce. Important data has to be backed up. It will end up in the cloud, actually multiple clouds. I’ll print a copy and store it in my file cabinet, just in case. Probably be good to burn it on a CD ROM as well for my long term records. High quality data is used for analysis via a spreadsheet, to project future business trends, revenue, and sales projections. You can make some pretty slick graphs which will be embedded into a presentation. A picture is worth a thousand words! Business partners will want copies. Data propagation is routine, almost spontaneous and not well controlled or tracked. Every time I pick up one of the dozen or so thumb drives in my office, I hold it up to the light and wonder, “What the heck is in here? Data gets lost, more and more over time; data hemorrhage.
Now think about your practice’s Protected Health Information (PHI and the electronic format, ePHI). Highly sensitive and personal. Long lasting as it is important throughout each of your patient’s life-spans. Comprehensive beyond just health information; with financial, insurance, residential, family and contact information, and therefore highly valuable. Used by other physicians to assist treatments, by diagnostics companies, billing, insurance and a variety of other business associates.
All create copies, probably multiple copies; data propagation. This is why the HIPAA risk assessment requires that creation and flow of ePHI is mapped throughout your organization.
Any process that creates, manipulates, stores and transmits ePHI must be documented and systems
inventoried. Because, we all know, data gets lost, forgotten, and left behind on copy and fax machines, printers, CD ROMs, thumb drives, obsolete PCs and disk drives. Data that lives a long time is highly valuable. Data intended to improve the quality of life, but if stolen and abused can have a devastating impact on the lives of many people. Performing your annual risk assessment will “tighten” your control of ePHI and “harden” your security. You will better protect your patients, your business, and yourself.