Last year, 527 healthcare organizations reported to HHS that more than 21 million individuals were affected by data breaches. Patients are becoming increasingly aware of the data security risks they face, and many health systems are working to assure them their personal information is in good hands.
Below, executives from three health systems share how they communicate their organization's data privacy and protection practices to patients.
Editor's note: Responses have been edited lightly for clarity and style.
Suzanne Bharati Hendery. Chief Marketing and Customer officer at Renown Health (Reno, Nev.). At Renown Health, we understand that any information about our patients and their health is personal and protected. We communicate our Privacy & Protection Pledge often and consistently via our website, practice locations and through regular and routine employee and provider trainings, blogs and articles.
We also safeguard personal genetics information in The Healthy Nevada Project, a population health research study with an informed consent process, through de-identification. We stress that federal and state laws are in place to safeguard protected health information and that the Healthy Nevada Project is a research study and all genetics information is de-identified for research purposes.
Hans Keil. Senior Vice President and CIO at Beaumont Health (Southfield, Mich). Beaumont Health considers its role as the custodian of patient data at the forefront of its responsibility. We consider the following strategies to communicate to our patients about their records:
Security awareness: All caregivers are required to attend annual security awareness training. Beaumont also communicates regularly with staff about how to safeguard health information.
Role-based access: All healthcare workers are provided access to the EMR based on role and cannot access information that is not relevant to the patient's stay and what the caregiver needs to know to ensure optimal care.
Cybersecurity controls: Multifactor authentication has been implemented for all administrative actions performed within the EMR. We also do regular cybersecurity testing and updates.
Privacy monitoring: Beaumont is partnered with a privacy monitoring solution to identify and alert us about behavior that violates any privacy regulations.
Patient portal protection: Communication with our patients for pertinent components of their care is supported through access to our patient portal, myBeaumontChart.com. This is a secure way to communicate to the patient several aspects of their critical data, from personal information related to billing, as well as results to testing, and direct messaging to their providers.
Erika Riethmiller. Chief Privacy Officer at UCHealth (Aurora, Colo.). Patients and protection of their personal information are of utmost importance to UCHealth, and we know this matters to our patients. We ensure that information regarding how we use and protect patient data is available through multiple touchpoints. Our goal is to put patients first with every interaction. Whether a patient is visiting a provider in person or through a virtual visit, messaging a provider through the UCHealth mobile app, or receiving the UCHealth patient newsletter — we strive to continuously promote our privacy practices in a manner that is easy to understand and easy to access as a seamless part of the interaction with UCHealth.