HIPAA Compliance and Paging/Radio Communications

What Is HIPAA?

Initiating in 1996, the term “HIPAA” abbreviated for the “Health Insurance Portability and Accountability Act” is a commandment body of federal regulations that aims to establish national standards and protect sensitive patient health information. HIPAA intends to:

1. Provide high-quality medical care.
2. Protecting a patient’s health information.
3. Deal with the dissemination and use of personal health data.

HIPAA Compliance and Pagers

Since HIPAA’s Security and Privacy Rules were amended, HIPAA and pagers compliance has come under discussion. According to HIPAA journal, the healthcare organizations that still use pagers as a communication form should ensure that there is the capability to remotely delete messages from a pager to secure the PHI’s confidentiality which stands for “Protected Health Information)” if a pager is stolen or lost; likewise, all the communications are encrypted and a message accountability system should be in place. On rare occasions, electronic Protected Health Information (ePHI might be transmitted via the paging system.) However, on the analog and digital broadcasts, the system might not be encrypted.

Pagers Were Expensive and Ineffective:

Before the introduction of the rules regarding HIPAA and pagers compliance, pagers were seen as inefficient and time-consuming. Regardless of whether communication of PHI should be facilitated within a message pager, often the recipient has to call back the source of the message to determine its workflow’s priority and obtain further details. Although the creation of misunderstandings develops when messages are passed on second-hand and when 1 person is unavailable right away, the phenomenon could lead to phone tag. However, the absence of message responsibility is another pager communications problem.

Unencrypted Radio Communication Containing PHI:

The HIPAA Journal presented a report which highlights that several domains of the services including rehabilitation centers, clinics, medical centers, and hospitals monitored radio communication containing PHI but they are usually unencrypted. “Unencrypted pages and radio communications was found to be a systemic problem affecting most states in the US”, according to the report. However, when when patients are moved from one healthcare facility to another – especially in case of “Interfacility Transfers (IFT)”, then unencrypted radio communication containing PHI are being conveyed, They include the sensitive patient’s data including their medical diagnoses records, dates of birth, contact numbers, names, updates of patient status, treatment orders, preparation requests for in-facility transfer, bed requests, and emergency department. If the information is not encrypted then their might be a risk of hackers to steal the information. Therefore, in Public Safety PHI Radio communication Systems, proper Encryption techniques are required.

Radio Hobbyist View and Intercept Unencrypted Hospital Pager Messages:

According to HIPAA Journal published in 2018, today, many institutions of healthcare are in favor of encrypted messaging platforms which led to the abandoning of their antiquated pager systems. It is revealed that a recent security breach has hit the data of several hospitals which leads to interception of the private communications and private messages in Missouri by a “radio hobbyist” as they have employed Software Defined Radio (SDR) which is an easily obtainable hardware and they might have accessed it for around $30. In this regard, data on visits of 100’s the patient, some of which were for very delicate situations like alcohol withdrawal, suicidal ideation, and drug overdose were among the unencrypted information.

HIPAA’s Privacy Violations – HHS Investigation:

The Department of the United States “Health and Human Services (HHS)” is investigating the Monroeville, Pennsylvania 911 center dispatch because of the violations of federal privacy law i.e., a HIPAA breach that occurred in August 2012. In this case, the medical histories, birth dates, driver’s license numbers, and patients’ names were disclosed to non-authorized workers of Monroeville, rendering to the complaint received by the former police chief that the center sent protected health information.

To tackle the situation, Lynette McKinney, the Monroeville manager said, “Anyone who has called the police, called the fire department, used our [emergency medical service] who could be affected by the breach”.

Penalties for HIPAA Violations:

Certain fines for HIPAA violations can reach millions of dollars as non-compliance can be quite expensive for corporations. The HHS decided that only the most severe “Tier 4” Penalty Tier should be subject to the yearly maximum penalty of $1,919,173 (currently $1.5 million). However, as depicted in table 1, there are maximum and minimum fines for HIPAA violations with different Penalty Tiers, but with a Penalty Per Year (cap) of $1,919,173 for multiple violations of the same provisions of HIPAA.