HIPAA Privacy Risk Analysis

• Audit Title

• Document No.

• Client / Site

• Conducted on

  Date

• Prepared by

• Location
  Address

• Personnel

Check-in Procedures

• Is a sign in sheet used?

  Yes

  No

  N/A

• New Patient information form - Is there completion assistance?

  Yes

  No

  N/A

• Do we verify insurance and how do we verify insurance?

  Yes

  No

  N/A

• How do we verify demographic information?

  Yes

  No

  N/A

• Is the appointment schedule in plain view of the patients?

  Yes

  No

  N/A

• Are any computer screens visible from the waiting room or by patients at the check out counter?

  Yes

  No

  N/A

• Is there a signed consent form in the patient record to use and disclose information for TPO ( Treatment, Payment, or Heathcare Operations)?

  Yes

  No

  N/A

• Has the patient signed the Notice of Privacy Practices Acknowledgement?

  Yes

  No

  N/A

• A appointments confirmed over the phone? What information is left on voicemail?

  Yes

  No

  N/A

• Are postcards used as reminders?

  Yes

  No

  N/A

• Does the practice verify the identity of patients upon arrival and on the phone?

  Yes

  No

  N/A

Clinical Areas

• How are patients called to the room?

  Yes

  No

  N/A

• Do providers and/or staff discuss patient information in or near clinical areas where other patients can overhear?

  Yes

  No

  N/A

• Do Physicians dictate at a workstation central to patient care areas?

  Yes

  No

  N/A

• Are telephone calls made to other providers, labs, pharmacies, hospitals, managed care administrators, or case managers in which patient information is discussed and other patients can overhear?

  Yes

  No

  N/A

• Are all exam room doors kept shut during patient encounters?

  Yes

  No

  N/A

• Are telephones used in exam rooms?

  Yes

  No

  N/A

• Are lab or X-ray logs kept covered to prevent PHI from being visible?

  Yes

  No

  N/A

• Are X-ray films, folders, and requisitions kept out of public view?

  Yes

  No

  N/A

• Are patients escorted from the waiting room to exam room, exam room to X-ray, exam room to lab, etc?

  Yes

  No

  N/A

• Are orders given to patients privately or in a low voice as to not be overheard during their check out process?

  Yes

  No

  N/A

• Is any PHI visible in the clinical workstations while unattended?

  Yes

  No

  N/A

• Are PHI shred bins emptied and not overfilled?

  Yes

  No

  N/A

• Are passwords of any kind visible in the clinical workstations?

  Yes

  No

  N/A

Front Office and Business Office

• Does the practice have a telephone policy to identify callers when asking for their clinical or billing information?

  Yes

  No

  N/A

• Is the fax machine located in a secure place?

  Yes

  No

  N/A

• Is the a log on/log off policy?

  Yes

  No

  N/A

• Are there any security passwords visible?

  Yes

  No

  N/A

Medical Records

• Are all staff members allowed access to the medical records department?

  Yes

  No

  N/A

• Is the an out-guide system or other mechanism for flagging charts that a pulled?

  Yes

  No

  N/A

• What is the physical security of medical records?

  Safe

  At Risk

  N/A

• Are medical records transferred between locations?

  Yes

  No

  N/A

• Does the practice have a records release policy?

  Yes

  No

  N/A

• Is the patients written authorization received before release of PHI?

  Yes

  No

  N/A

• Are authorizations filed in the patients medical record?

  Yes

  No

  N/A

• Does the practice document disclosure of PHI for non-TPO activities? Is this tracked in the event of a request for accounting of disclosures?

  Yes

  No

  N/A

• Does the practice have a staff member who is trained to answer patient questions about their records?

  Yes

  No

  N/A

• Is an outside vendor used for microfilm, storage and shredding?

  Yes

  No

  N/A

• Can PHI be destroyed after the expiration of the retention period?

  Yes

  No

  N/A

Methods of Conveying PHI

• How can medical records be sent to specialists or other providers the patient is being referred to?

  Yes

  No

  N/A

• Can patients and providers communicate by e-mail?

  Yes

  No

  N/A

• Does the practice allow patients to access information over their website? For example, test results.

  Yes

  No

  N/A

• Can test results and other information be given to patients over the telephone?

  Yes

  No

  N/A

All Areas

• Are computer monitors positioned away from public areas to avoid observation by visitors or patients?

  Yes

  No

  N/A

• A screens on unattended computers turned to the log-on screen or have a password enabled screen protector?

  Yes

  No

  N/A

• Does staff protect their ID and passwords and never share them?

  Yes

  No

  N/A

• Are paper records and medical charts stored or filed to avoid observation by patients and visitors?

  Yes

  No

  N/A

• Are paper records stored behind locked rooms when not staffed?

  Yes

  No

  N/A

• Confidential patient information is not left on an unsecured printer, photocopier, or fax machine unless these devices are in a secure area.

  Yes

  No

  N/A

• Are visitors and patients appropriately escorted to ensure they do not access staff areas, dictating areas, chart storage, etc.?

  Yes

  No

  N/A

Personnel Policies

• Does the practice have HIPAA privacy policies written and incorporated in the employee handbook?

  Yes

  No

  N/A

• Are the privacy policies and procedures up to date?

  Yes

  No

  N/A

• Do new employees receive privacy training as part of their orientation?

  Yes

  No

  N/A

• Has all existing staff undergone Privacy Training?

  Yes

  No

  N/A

• Is employee training documented?

  Yes

  No

  N/A

Signatures

• Add signature

  Sign

• Add signature

  Sign