Thomas Jefferson University Hospitals Clinical Laboratory HIPAA Privacy Risk Analysis

• Building/Room number

• Site

• Manager/Supervisor

• Conducted on

  Date

• Prepared by

• Personnel assisting inspection

Disposal and retention of protected health information.

• Document containing are shredded prior to disposal or they are placed an appropriate disposal containers?

  Yes

  No

  N/A

• Regular trash cans are free of paper, labels, and any items that contain PHI

  Yes

  No

  N/A

• Are any computer screens visible from individuals not employed by the clinical lab ?

  Yes

  No

  N/A

• Documents with phir secured in close files or turn face down on work surfaces?

  Yes

  No

  N/A

• Patient information cannot be overheard in public areas hallways core doors or elevators or within earshot of visitors?

  Yes

  No

  N/A

Clinical Areas

• How are patients called to the room?

  Yes

  No

  N/A

• Do providers and/or staff discuss patient information in or near clinical areas where other patients can overhear?

  Yes

  No

  N/A

• Are telephone calls made to other providers, labs, pharmacies, hospitals, managed care administrators, or case managers in which patient information is discussed and other patients can overhear?

  Yes

  No

  N/A

• Are telephones used in exam rooms?

  Yes

  No

  N/A

• Are lab specimen logs kept covered to prevent PHI from being visible?

  Yes

  No

  N/A

• Are patients escorted from the waiting room to draw area?

  Yes

  No

  N/A

• Are orders given to patients privately or in a low voice as to not be overheard during their check out process?

  Yes

  No

  N/A

• Is any PHI visible in the clinical workstations while unattended?

  Yes

  No

  N/A

• Are PHI shred bins emptied and not overfilled?

  Yes

  No

  N/A

• Are passwords of any kind visible in the clinical workstations?

  Yes

  No

  N/A

Front Office and Business Office

• Is the fax machine located in a secure place?

  Yes

  No

  N/A

• Are there any security passwords visible?

  Yes

  No

  N/A

Medical Records

• Are all staff members allowed access to the medical records department?

  Yes

  No

  N/A

• Are medical records (requisitions, reports, etc) transferred between locations?

  Yes

  No

  N/A

• Is the patients written authorization received before release of PHI?

  Yes

  No

  N/A

• Are authorizations filed in the patients medical record?

  Yes

  No

  N/A

• Does the practice have a staff member who is trained to answer patient questions about their records?

  Yes

  No

  N/A

Methods of Conveying PHI

• How can medical records be sent to specialists or other providers the patient is being referred to?

  Yes

  No

  N/A

• Can patients and providers communicate by e-mail?

  Yes

  No

  N/A

• Can test results and other information be given to patients over the telephone?

  Yes

  No

  N/A

All Areas

• Are computer monitors positioned away from public areas to avoid observation by visitors or patients?

  Yes

  No

  N/A

• A screens on unattended computers turned to the log-on screen or have a password enabled screen protector?

  Yes

  No

  N/A

• Does staff protect their ID and passwords and never share them?

  Yes

  No

  N/A

• Are paper records stored behind locked rooms when not staffed?

  Yes

  No

  N/A

• Confidential patient information is not left on an unsecured printer, photocopier, or fax machine unless these devices are in a secure area.

  Yes

  No

  N/A

Personnel Policies

• Does the practice have HIPAA privacy policies written and incorporated in the employee handbook?

  Yes

  No

  N/A

• Are the privacy policies and procedures up to date?

  Yes

  No

  N/A

• Do new employees receive privacy training as part of their orientation?

  Yes

  No

  N/A

• Has all existing staff undergone Privacy Training?

  Yes

  No

  N/A

• Is employee training documented?

  Yes

  No

  N/A

Signatures

• Add signature

  Sign