This is the second article in my series on EHR / Cloud-Based Practice Management Systems.  In this article, I discuss some of the  important facets of the software that should be evaluated when considering them for use. For a more detailed discussion, as well as a five-stop process for selecting an EHR, check out the Guide to Choosing an EHR.

A primary concern for HIPAA Covered Entities when evaluating cloud based applications is whether they are HIPAA compliant. The short version is, if you file insurance claims electronically, you are likely a HIPAA Covered Entity. In addition, most state laws have their own privacy laws that require businesses to protect identifying information.  At this writing, there are three core things that need to be in place for HIPAA compliance when it comes to software:

The software:

• Must meet HIPAA specifications (including the policies and practices of the software vendor)
• Vendor must sign a Business Associate Agreement (BAA) with you
• Data must be encrypted through a method that is compliant with FIPS 140-2 standards  **(in order to be excluded from the Breach Notification rules)

The first and third items are important, however to truly seal the deal, the vendor should be willing to enter into a Business Associate Contract.  This contract is a legal document that clearly states how they are in compliance with HIPAA and what steps they are responsible for taking to ensure continued compliance.

In my next article, I begin to cover various features of Practice Management Systems.

Next article:   Notes
Return to the Table of Contents