HIPAA and Handhelds

Although there are, in fact, more than 500 healthcare-specific applications for PDAs, most function as either reference databases or calculators. Since these types of applications don’t typically use protected health information (PHI; i.e., such patient information as diagnoses, encounter reports, procedures, prescriptions, and lab and test results), there is no HIPAA impact. In those cases in which nursing home employees use PDAs to record PHI, safeguards must be put in place to ensure that the information is not compromised. Reasonable safeguards should include:

Password protection. Most PDAs have a password-protection utility, requiring the user to enter a password before accessing any of its functions. All nursing home em-ployees who use PDAs to access patient information should be required to use the password-protection feature. This simple safeguard ensures that patient information is protected in the event that the PDA is lost, stolen, or accessible by someone other than the nursing home employee.

Synchronization. Many PDAs are equipped with the capacity to upload information from the device to a personal computer (PC) via a communication port, a process called “synchronization.” Protected health information uploaded to a PC can be vulnerable to inappropriate disclosure; remind nursing home staff engaging in synchronization that PHI uploaded to a PC should be password protected and, if possible, encrypted. Also, the PDA user should maintain an auditable log of all data uploaded to a PC. In those cases in which a nursing as-sistant uploads the information on behalf of a more senior member of the medical staff, again, he/she should make sure that the data uploaded are password protected, encrypted, and reflected on a tracking log.

PDA repairs. PDAs, like any electrical device, can and will malfunction and require repairs. Before sending the PDA for repair, make sure that any PHI it contains has been erased from storage and rendered completely inaccessible to service technicians.

Beaming. Many PDAs have the ability to transmit or “beam” information to another PDA via an infrared information stream. When beaming in the presence of other PDAs, it is possible for another device to inadvertently pick up the transmission. We recommend that beaming take place in the presence of only two PDAs, and that they be held two inches apart for the duration of the transmission.

Wireless transmissions. Increasingly, PDAs are equipped with the capacity to send and receive information via wireless transmission. In those cases in which PHI is sent over any form of open network, it needs to be encrypted, and a mechanism established to ensure that the intended recipient received it. NH