Should you even take the risk?
 |
| By: Tod Ferran |
The biggest security risk these sign-up sheets pose is directly related to other people in the waiting room. There are family members, neighbors, friends, and other patients in that waiting room.
As ridiculous as it sounds, patients stalking other patients can happen. It’s as easy as looking at the visitor sign up sheet and Googling a last name, address, or phone number. Don’t let your organization become the poster child for what not to do!Does the HHS allow patient sign-in sheets?
Luckily, this age-old question has been answered by the Department of Health and Human Services (HHS) FAQ.“Yes, covered entities…may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited.”
So what does ‘appropriately limited’ mean?
The HHS goes on to say, “These incidental disclosures are permitted only when the covered entity has implemented reasonable safeguards and the minimum necessary standard, where appropriate. For example, the sign-in sheet may not display medical information that is not necessary for the purpose of signing in (e.g., the medical problem for which the patient is seeing the physician).”SEE ALSO: What Are Addressable HIPAA Requirements?
Why even take the chance of a HIPAA violation?
Here’s my opinion as a security professional: Why even take the chance of a potential problem? Covered entities are responsible for limiting incidental disclosure, right? In many cases, the nature of a physician’s specialty may inappropriately disclose a patient’s condition. For example, a woman signing in at an obstetrician’s office, or someone signing in at a psychiatrist’s office.Alternatives to patient sign-in sheets
If there is a business case for signing patients in, such as to provide proof of attendance for the collection of co-pays, there are a variety of options I consider more secure that don’t involve the traditional patient sign-in. I’ve seen receptionists check patients in on the EMR system, or even open up an Excel file and type each patient’s name in as they arrive.I believe it’s only a matter of time before patient sign-in sheets are no longer compliant.As soon as something bad happens due to one, we will see the HHS change their stance. From purely a security standpoint, it is an easy vulnerability to mitigate. So why even take the chance?Tweet
TweetDid this post help you? If so, please share!
Tod Ferran (CISSP, QSA) is a Security Analyst for SecurityMetrics with 25 years of IT security experience. He provides security consulting, risk analysis assistance, risk management plan support, and performs HIPAA and PCI compliance audits. Check out his other blog posts.
