Attachment 24 - VASDHS MCM 136-32 Control and Monitoring of Medical Records.pdf

VA SAN DIEGO HEALTHCARE SYSTEM MEMORANDUM 136-32

SAN DIEGO, CA September 30, 2020

CONTROL AND MONITORING OF MEDICAL RECORDS

1. PURPOSE: To establish policy and procedures to ensure the security, confidentiality, and protection and control of the electronic health record (EHR), and define procedures for monitoring access to the record.

2. POLICY:

a. Access to medical records is limited to staff members with a legitimate “need to know” to perform official duties. Staff with access to medical records or medical information will receive training in maintenance or confidentiality and security of this information on initial employment and periodically thereafter.

b. Physical safeguards will be established to protect the security and confidentiality of EHRs against any threat to their integrity. These safeguards include controlling access to the Release of Information (ROI):

placing computer terminals and records in treatment areas so they are not accessible to unauthorized individuals: protecting patient information, and controlling record movement within and outside the facility.

c. Protected Health Information includes, but is not limited to, patient identifying information such as patient name, social security number (SSN), and any health information. All requests for information from the medical record (electronic or hard copy) and access to records will be processed in accordance with policy including the Privacy Act, Health Information Portability and Accountability Act (HIPAA), VA VHA regulations, and VA San Diego Healthcare System policy.

d. Electronic safeguards will be established to protect the security and confidentiality of the EHR and to assure that only those with a “need to know” access records.

1) Direct access to a patient's paper or EHR by an employee that is also a family member of the patient is prohibited. In the event a legitimate need for a family member's medical information is determined, a formal request should be submitted to the facility Release of Information office.

2) Employees are prohibited from accessing their own EHR in accordance with the Privacy Act. Software controls will be maintained and will prevent users from accessing their own electronic medical record.

Individuals requiring access to their medical records must present the request, in writing, to the Release of Information office in accordance with MCM 136-06. An employee should not ask another employee to access his/her medical record for the purpose of reviewing information contained therein. Such communication between coworkers does not constitute authorized access.

3) The EHR shall not be accessed by an employee, or any other user category, for the purpose of obtaining demographic information of a co-worker. This includes such information as home telephone number, home address or any other personal demographic information.

e. A patient is entitled to information in their medical record under provisions of the Privacy Act. Procedures in MCM 136-06 must be followed.

f. Removal of the medical record from Medical Center premises will be strictly controlled and will only be authorized for patient care purposes in accordance with procedures set forth in this memorandum. VA will relinquish custody of the original medical record of a patient in accordance with Federal law, or with a subpoena or court order from a United States Court. Unlawful removal or destruction of medical records will cause penalties to be enforced as provided by law (18 U.S.C. 234-235).

g. The VA San Diego Health care System will maintain paper medical records in a manner to prevent any form of damage. Should damage occur, all possible attempts will be made to restore the affected medical records to their original state.

h. Sensitive Record: In accordance with VHA Health Information Management and health record policy, the following categories of records are designated with a security level of “sensitive”. Such records will remain sensitive for the life of the record, including after termination of employment, retirement, or transfer.

1) Employees that are receiving care as a Veteran

2) Volunteers upon request

3) Individuals who are engaged in the presentation of claims before VA

4) Other records at the discretion of the Chief/Health Information Management (HIM).

3. DEFINITIONS:

a. Patient Demographics (DG).

b. Electronic Health Record (EHR)

4. RESPONSIBLITIES:

a. The Medical Center Director:

Responsible for ensuring adequate processes are in place to protect the security and confidentiality of data and information.

b. The Information Security Officer (ISO):

1) Responsible for monitoring access to sensitive medical records in accordance with facility information security standard operating procedures;

2) Providing appropriate training to users on applicable policies and procedures.

3) Sanitizing EHRs resulting from administrative requests, such as investigations, to ensure compliance with existing security requirements.

4) Investigating (with the Privacy Officer and Compliance Officer depending on the nature of the event) suspected violations regarding record access and reporting incidents in accordance with national and the facility Incident Reporting policy.

c. Privacy Officer or designee:

1) Is responsible for hospital-wide implementation, coordination, and administration of the provisions of the Privacy Act. Privacy Officer is also responsible for sanitizing, and de-sanitizing when appropriate, both electronic and paper records.

2) The Privacy Officer is also responsible for maintaining written requests for DG Security Log information, along with other data, in accordance with reporting requirements for the Annual FOIA Report.

d. Area Manager, Information Technology Service (ITS):

1) Responsible for ensuring that all mandated Privacy Act enforcing software is installed and activated.

2) Ensuring menu options and security keys associated with such software are limited to appropriate ISO and/or HIM staff.

e. Chief, Voluntary Services:

Responsible for ensuring that all volunteers are aware that their EHR may be sanitized upon request.

f. Service Chiefs:

1) Responsible for ensuring the security and confidentiality of data and information under their control.

2) Responsible for following up on the legitimacy of access to a sensitive patient by an employee and work with ER/LR to determine appropriate disciplinary action.

g. All VASDHS employees (paid, voluntary, or contracted):

1) Must ensure patient data/information in their possession is secure from unauthorized intrusion.

2) Ensure the confidentiality of sensitive information

3) Accessing electronic medical records on a need to know basis only for the purpose of assigned duties

4) Reporting known and suspected security violations to the facility ISO

5. PROCEDURES:

a. Flagging of Sensitive Records:

1) Facility leadership will notify the facility Information Security Officer (ISO) or Chief, HIM and/or Privacy Officer, or alternate, of the Veteran patient health record to flag as “sensitive” upon discovery in a high profile incident, i.e., those that attract a lot of attention and interest from the public, media or a Congressional Oversight Committee requests, e.g. Senate Veteran Affairs Committee, such as a suicide or shooting.

2) The facility Information Security Officer (ISO) and Privacy Officer will control the designation of records as sensitive. This designation will apply to both "hard copy" and the electronic record.

a) Access keys allowing the Security Level of the Electronic medical record to be modified will be limited to the Privacy Officer and the facility ISO. This access includes the Patient Demographics (DG) Security Enter/Edit menu option and the DG SENSITIVITY security keys.

b) The DG SECURITY OFFICER menu and the DG SECURITY OFFICER Security key will be limited to the Facility ISO.

3) The DG Security Log file tracks every access event involving a sensitive electronic medical record. Reports of Sensitive Record Access activity will be compiled and reviewed by the facility ISO. The ISO will notify the Respective Service Chief or designee of any access that appears inappropriate. Access to records tracked in the DG Security Log file will be kept for six years. Electronic health records contained in VistA/CPRS will be designated as Sensitive or Non-Sensitive as determined by the Privacy Officer. Guidelines for designating records as sensitive include

a) All employees and Compensated Work Therapy staff records are sensitive Indefinitely;

b) All records of high-profile persons shall be sensitive indefinitely, unless otherwise deemed necessary by the Privacy Act Officer;

c) Records may be designated as sensitive at the request of the patient upon concurrence by the Privacy Officer for as long as deemed necessary based on the surrounding circumstances;

such cases will be managed on an individual basis.

4) Requests to designate records as sensitive or undo the designation will be submitted in writing to the Privacy Officer for review and action.

Upon approval, the request will be processed, and notification sent to the facility ISO when circumstances require monitoring. Such requests apply to non- employee patients, as the EHR of patients with a primary or secondary eligibility of "Employee" is automatically designated as sensitive the first time the patient is entered into the Patient File (#200).

Volunteers who wish to have their EHR designated as sensitive will submit a request to the Privacy Officer. Once designated, a volunteer's electronic medical record will remain sensitive indefinitely.

5) Violations that occur as a result of inappropriate justification for access to a sensitive record will be reported to the user's Service Chief/supervisor to determine appropriate disciplinary action. Follow up on action taken will be provided to the ISO in a timely manner.

a) Facility procedures for reporting security incidents will be followed if a violation occurs. This includes notification to the facility HIM Chief and to the VA Computer Incident Response Capability

(CIRC).

b) The MAS Parameter Entry, Restrict Patient Record Access, will always be set to YES. The DG RECORD ACCESS security key circumvents this parameter and therefore will not be assigned to any user unless for extraordinary circumstances and with approval from the ISO.

b. All Requests for Medical Information:

1) All record requests pertaining to direct patient care will be routed to Release of Information (ROI). If the hard copy record is requested, HIM staff will request the hardcopy record from offsite records storage facility and scan the documents that are needed for the patient care into Vista Imaging.

2) All employees will ensure that medical records are secure.

3) Any satellite file holding areas must meet the following criteria:

a) Access, username, menu option used to access the record and patient name.

b) The facility ISO is required to monitor sensitive record access and will review the DG Security Log file in accordance with the facility's information security standard operating procedures.

c) Accessing of electronic medical records defined as Sensitive will be challenged by the ISO.

d) Users identified as accessing a sensitized electronic medical record may be asked to provide justification to the Service Chief, who in turn will be required to respond to the ISO and/or HIM Chief. Each inquiry will be handled on an individual basis.

4) Requests for security log tracking, information contained in the DG Security Log file is covered under VistA Records-VA, 79VA10P2, System of Records, and both the Privacy Act and Freedom of Information Act (FOIA). Title 38 CFR 1.526 and HIPAA require requests for copies of any records in the custody of VA to be furnished in writing.

a) The written request should contain the name and social security number of the individual of whom the log pertains

b) Reason or purpose for which the copy of the log is requested

c) Dates of the log requested and signature of the requesting individual.

d) The Privacy Officer must maintain a file of all written requests for information from the DG Security Log file for Privacy Act reporting purposes.

5) A request from an employee for copies from the log file that tracks access to their sensitive record will be processed in accordance with the Privacy Act, the Freedom of Information Act (FOIA) and HIPAA.

a) Either a written request or VA Form10-5345A (Individuals’ Request for A Copy of Their Own Health Information) must be signed by the employee and kept on file with HIM.

b) The Privacy Officer or designee will obtain the requested information from the ISO and provide it to the employee.

c) The employee should not contact an employee(s) that is listed as accessing his/her record. The ISO should be notified if the employee suspects that a violation has occurred.

6) A request from a Veteran who is not an employee for copies from the log file that tracks access to the sensitized record should be handled through Release of Information

a) Release of Information will handle all communications from and to the patient and will ensure request is coordinated with the Privacy Officer and the ISO as appropriate.

b) Either a written request or VA Form 10-5345A (Individuals’ Request for A Copy of Their Own Health Information) must be signed by the Veteran and kept on file with HIM.

c) The Privacy Officer or designee will obtain the requested information from the ISO and provide it to the Patient Advocate to submit to the Veteran.

d) The patient should be advised in writing that they may not contact any individual directly concerning the need for access to their record. All concerns should be directed to the Privacy Officer or designee for further action.

7) A request from a user's manager for copies from the log file that tracks access to the sensitized record will be directed to the ISO.

a) A manager may obtain information concerning one of their employees in accordance with the Privacy Act, 5 USC 552a(b)(1).

b) When a request is made from a VA employee in performance of their official duties, such as the manager investigating inappropriate behavior, tracking for Privacy Act reporting purposes is not required. However, a written request should be submitted to the ISO for incident reporting purposes.

8) Requests from third parties, any individual other than the person to whom the log pertains, including non-VA investigative bodies such as the GAO, will be directed to the facility ISO for review and coordination with the Privacy Officer or designee.

a) A record of the release of information for FOIA reporting purposes is required for all non- VA third party requests.

b) If the individual requesting the information is a VA employee, such as the IG, and the information is required in the performance of their official duties, FOIA reporting is not required.

9) No medical records or portions of medical records may be taken from the medical center without written approval of the facility Director.

c. Hard Copy Medical Record:

1) The consolidated health record will be identified by the social security number and name. Hard copy medical records are stored in offsite records storage facility.

2) Records are retrieved from storage facility if needed by clinical staff for patient care and for copying at the request of veteran.

3) Records that are no longer needed will be returned to Health Information Management for storage/archive in accordance with RCS 10-1.

4) Only authorized personnel will be allowed in Release of Information area.

5) Physical safeguards consist of the continuous presence of a staff member in any area where medical records are located or locking the area during non-duty hours.

6) Records are not to be left unattended or easily accessible to unauthorized users.

7) In the event there is a risk to the records storage area, records will be evacuated to the extent that lives are not endangered and there is not risk of serious disability. If the medical record is destroyed as a result of a natural disaster (flood, fire, etc.) or other water damage (leaking pipes, fire sprinkler activation), the record will be recreated as much as possible using information contained in VISTA/CPRS. If the medical record is salvageable, every effort will be made to restore the records to its original condition. This may include shipping the record to a professional water damage restoration company and/or using other media to restore the record to a useable and presentable condition. For detailed water damage procedures see Attachment A. In the event of a fire alarm condition (Code Red), the R.A.C.E procedures will be followed.

6. REFERENCES:

a. Privacy Act of 1974

b. VHA Handbook 1907.01, Health Information Management and Health Records

c. VA Directive 6500, Automated Information Systems (AIS) Security

d. HIPAA 164.308a4iiB, 164.312d.

e. Release of Information Privacy Act and Freedom of Information Act.

f. MCM ITS-14, AIS Security Incident Response

g. MCM ITS-17, Access to Automated Information System Policy

h. MMC 136-06, Privacy and Disclosure of Individually Identifiable Health Information

i. VA Regulations 500 through 584

j. VHA Handbook 1605.1; RCS 10-1

7. REVIEW DATE:

8. FOLLOW-UP RESPONSIBILITY: CHIEF/HIM (136C3SV)

9. RESCISSION: MCM 136-32 dated July 29, 2017

10. DATE APPROVED BY MEC: November 4, 2020.

11/30/2020

X Kathleen Kim

Kathleen Kim, MD, MPH

Chief of Staff

Signed by: Kim, Kathleen M.

11/30/2020

X Robert M. Smith

Director

Signed by: Robert M Smith 134261 Attachment: A Distribution: SharePoint

Attachment A September 30, 2020

PROTECTION OF MEDICAL RECORDS FROM WATER

DAMAGE

1. PURPOSE: Paper medical records may be subjected to widespread or localized damage from rising water, as in the case of flood or broken water mains, or falling water, such as from leaking or broken pipes or fire sprinkler activation. Following such an emergency, water-damaged records require special attention to restore them to their original state. Even though it is the policy of this Medical Center to maintain medical records in such a way as to prevent any form of water damage, this appendix details procedure to follow in the event of such an occurrence.

2. PROCEDURE:

a. Rising Water. Widespread damage may be caused to medical records housed on the ground level due to flooding during or following extreme rain conditions or broken water mains.

1) Medical records will be maintained in an area that is unlikely to flood or be subjected to damage from water.

2) Upon notification that it is likely that the surrounding vicinity will be subject to flooding, and the medical record file room is likely to be flooded:

a) All efforts within human possibility will be made to move records to an area that is unlikely to be subjected to water damage.

Personnel will not be subjected to conditions that would expose them to danger to their life or health.

b) All electronic equipment will be turned off. Equipment will be moved to a dry location that is unlikely to be affected by water damage.

c) To protect the confidentiality of medical records during a flooding crisis, the area will be secured, and only authorized personnel will have access to the area.

d) Floodwaters are often mixed with sewage, animal waste, fertilizers and/or industrial waste, and should be considered a biohazard.

Employees will not be allowed to re-enter the flooded area until all freestanding water has been removed and the area is thoroughly cleaned by the Environmental Service.

b. Falling Water. Widespread or localized damage may be caused to medical records due to a leaking or burst pipe or malfunctioning fire sprinkler.

1) Upon notification of a leak or malfunctioning fire sprinkler:

a) Computer equipment and any other machinery or furniture may also be covered with plastic to minimize damage, as time permits after the threat to medical records has been minimized.

Attachment A September 30, 2020

b) The Environmental Service will be contacted to supply appropriate receptacles to catch water, absorbent materials to soak up water, vacuum water, and thoroughly clean and dry the affected area.

c. Recovery/Restoration. Should paper medical records sustain water damage, a quick response will be required to recover their contents intact. Paper records left wet for any significant length of time are at risk of unrecoverable damage due to disintegration, tearing, smearing, or mildew/mold growth.

Depending on the volume of records involved, full recovery may be realized with a local effort only, or may require more extensive measures, such as a contract with a water damage restoration company.

1) If a small quantity of records is wet from a clean water source, authorized personnel must respond immediately to:

a) carefully remove the records from the shelves and gently pat dry as much as possible

b) in a secure location, separate each record on a clean, dry, flat surface for the paper to thoroughly dry

c) print any electronic documentation that may be required to reconstruct damaged pages

d) reassemble each record in the approved filing sequence

e) thoroughly dry the file shelves

f) replace the records on the shelves in the correct terminal digit order

2) If a large quantity of records is wet or if the water source may be contaminated, such as in the case of flood water:

a) a water damage restoration company should be contacted immediately upon discovering the damage and an emergency purchase order be secured for their services

b) any contract for water damage restoration services should specify the method of recovery, the time that will elapse between acquisition and return of the records, and safeguards against breaches in confidentiality

3. REFERENCES:

a. Journal of AHIMA, Practice Brief, Disaster Planning for Health Information, 2016.

b. BMS Catastrophe, a Guide for Contingency Planners, Disaster Restoration Guide for Disaster Recovery Planners, September 1999.