Health Information Compliance Alert

Question:

"It depends," says Robert Markette, an attorney with Gilliland & Caudill in Indianapolis, IN.

In Section 160.103, the Department of Health & Human Services knocked basic paper-based fax machines out of the security rule running "because the information being exchanged did not exist in electronic form before the transmission," Markette notes. But that exclusion doesn't apply to fax machines that have a hard drive or are part of your network, he cautions.

Your multifunction printer's large memory doesn't push you into security rule territory, Markette says. If your machine's memory can hold on to a week's worth of PHI, however, you should take steps to keep that information out of unauthorized hands. Try this: Limit -- don't disable -- the amount of information your machine can store, he suggests.

"Multifunction printers with permanent storage capabilities, such as a hard drive, do fall under the security rule," and the information stored on them must be protected just like any other electronic protected health information (ePHI), Markette says.

Good idea: Set your multifunction printer to erase stored information at the end of each day or week, Markette suggests. And you should program the machine not to print out reports containing stored information at the press of a button, he says.

The Bottom Line: "Do a risk assessment of the machine before you decide which rule should apply," recommends Lee Kelly, senior security consultant at Fortrex Technologies in Frederick, MD. Strategy: Kick off your risk assessment with these questions:

And remember, even if the security rule doesn't apply, the privacy rule still mandates that you protect all machines in your office from inappropriate use and access, Markette notes.