Health Information Compliance Alert

Use a security questionnaire to iron out your vendor's security rule wrinkles.

If your medical transcription vendor sends completed work to you via e-mail, your security rule compliance could be at stake. Try these field-tested tips to protect your transcribed patient information from Internet hacks.

You may trust your security rule compliance program to protect patients' PHI, but your vendor's security standards are a different story. First step: Evaluate your transcription company's security efforts.

"We found that several of our vendors didn't have the same security provisions in place that we did," says Grace Upleger, HIPAA manager at Vanderbilt University Medical Center in Nashville, TN. Solution: Vanderbilt created a security questionnaire that all transcriptionists must fill out before any work changes hands, she says.

Get started: Kick off your questionnaire development by tracking how the information you'll send to a transcriptionist leaves your organization. For example, do you e-mail it to your vendor? Do you mail it? Do they pick it up? Next: Nail down the best ways your vendor can protect the information in whatever form they receive it. Do this for each step your patients' PHI takes in the transcription process, Upleger suggests.

For guidance on creating a questionnaire that will work for your organization, check out an excerpt of Vanderbilt's vendor security form later in this issue.

Before you turn your patients' PHI over to a transcription company, you must ensure that the company understands and agrees to your contract based on your terms, Upleger notes. That way, there will be no confusion if the vendor violates the contract.

Here are some of the terms you should define up front:

•-Turnaround time requirements on all document types;

•-Standard document codes;

•-Charge penalties for late or lost documents;

•-Notification requirements for lost documents;

•-Accuracy requirements;

•-Required applications and interfaces;

•-Tracking and auditing requirements;

•-Physical security standards.

How to proceed: Attach an explanation of your terms to your business contract. When your vendors sign and date the contract, they acknowledge that they will abide by your terms -- and that they understand the chain of communication they should follow if there is a problem, stresses Stephen Priest, a security consultant with Professor Steve & Associates in Bedford, NH.

Smart: Provide a contact list in your document that notes the names, departments, telephone numbers and e-mail addresses of key staff members in your organization, Priest offers.You could also provide a sample scenario of when the vendor would contact each person. See the box below for an example to help you get started.