As described in previous chapters, the Real-Time Glucose Monitoring (RTGM) system will include processing components on servers and on mobile devices with data exchange via 3G and 4G phone networks. Users will include patients, physicians, nurses, and physician assistants. In the United States, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates certain responsibilities regarding the privacy and security of electronic protected health information (ePHI). The law applies to what are collectively called covered entities—that is, health plans, health-care clearinghouses, and any health-care providers who transmit health information in electronic form. More information can be obtained from the U.S. Department of Health and Human Services Web site ( http://www.hhs.gov).
In general, covered entities should do the following:
■ Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.
■ Identify and protect against reasonably anticipated threats to the security or integrity of the information.
■ Protect against reasonably anticipated, impermissible uses or disclosures of the information.
■ Ensure compliance by their workforces.
Specifically, covered entities should implement policies, procedures, and technologies that do the following:
■ Specify the proper use of and access to workstations and electronic media.
■ Regard the transfer, removal, disposal, and reuse of electronic media to ensure appropriate protection of ePHI.
■ Allow only authorized persons to access ePHI.
■ Record and examine access and other activity in information systems that contain or use ePHI.
■ Ensure ePHI isn’t improperly altered or destroyed.
■ Guard against unauthorized access to ePHI that is being transmitted over an electronic network.
Answer these questions in light of HIPAA requirements:
Consider the issues related to health-care professionals accessing server data by using workstations and mobile devices within a health-care facility. How will the system meet its duty to record and examine access to ePHI? If a healthcare professional uses a mobile device outside a health-care facility, what protections must be applied to the device and/or any data stored within it or transmitted to it?