By Iseman Cunningham Riester & Hyde LLP
Covered Entities must implement procedures for terminating access to protected health information when the employment of a workforce member ends. This is an “addressable” requirement, which means the Covered Entity must implement it unless it is an inappropriate or unreasonable standard and cannot be met through an alternative measure. For all but the smallest health care providers, the termination procedures standard is reasonable and must be implemented.
Keep in mind that “workforce” under HIPAA is much broader than the traditional notion of “employees.” Besides employees, workforce include volunteers, trainees and other individuals under the direct control of the Covered Entity – regardless of whether the Covered Entity pays them. For example, a temp employed by the temp agency but under control of the Covered Entity is part of the workforce and their departure must be handled like the departure of any other employee.
Covered entities should examine their existing termination procedures to ensure that all aspects of PHI access are addressed. Consider developing a comprehensive checklist of items that must be completed whenever someone leaves the “workforce” – including volunteers and long-term consultants that might not be thought of as employees. All login IDs should be disabled, keys and access cards returned, passwords changed as needed. The timeframes for completing these tasks may be different when employees are terminated involuntarily.
HIPAA Security Tips are written by the attorneys of Iseman, Cunningham, Riester & Hyde, LLP. ICR&H is known for legal work on complex legal problems and transactions for businesses and individuals in the healthcare, construction, and financial industries, among other areas.
(c) 2004 Iseman Cunningham Riester & Hyde LLP. License is granted for all attributed reproduction.
