The Compliance and Ethics Blog

SCCE/HCCA

Governance Dual-Usability Obligation

by Leave a Comment

Angela GamalskiBy Angela I. Gamalski, MHSA, CHC
This post originally appeared on the Health Privacy & Security Compliance Lawg

Leaders in health care are likely familiar with the concept of a ‘dual-fiduciary role’. This administrative responsibility for senior leaders and organizational governance requires the balance of resources to assure the organization resources to provide high quality care to today’s patient in balance with maintaining reserves for tomorrow’s needs. This blog proposes that, as privacy and security is of equal weight to the organization’s financials, there is a requirement that administrators must balance in terms of IT security: the dual-usability role. This dual usability role requires that administrators and governance assure the following:

1. End-user accessibility of health care systems. Interoperability and integration are the latest buzzwords regarding the information systems that help health care professionals to provide high-quality medical care. The Meaningful Use program challenges health care technology platforms to certify their ability for users to demonstrate that the computer is not just a box in the room; rather, the computer and its systems are an active tool in use to provide high quality and timely patient care. The program requires providers demonstrate that patients can have access their own medical records through a portal, and to share information with others through information transfer between inpatient and outpatient care settings.

2. Physical and cyber security of information systems to prevent unauthorized access. The claim that privacy and security are equal to the bank account is a bold one; however, who would honestly trust a provider that was known to have lax security standards protecting the privacy of their medical record? The privacy of the doctor-patient relationship is essential; patients assume that office staff will not be gossiping to their friends and neighbors about their medical conditions, or allowing their medical information to fall easily into the hands of criminals and identity thieves. Again under Meaningful Use program requirements, providers must document that they have completed a security risk assessment during their attestation period. HITECH and the HIPAA Omnibus Rule require careful handling of PHI, analyzing breaches, and providing appropriate notification.

Health care providers, and their leadership, must carefully balance the two aspects of usability. Tipped too far to the side of security, with security protocols hindering a user’s abilities to access the patient information, usability is compromised. If a system is too accessible, and information is available without limitations based on patient assignment or job duties, then security is at fault. Health care administrators and governance can measure financial health and responsible fiduciary oversight through concrete metrics, for example: days cash on hand, operating margin. Security, conversely, is measured by what we do not have – breaches and angry individuals. Measuring and monitoring the balance of usability requires new metrics. Lawyers working in the healthcare space, with an understanding of technology, may be uniquely qualified to design these metrics given their training to minimize client risk within the limits of what today’s information system capabilities.

[bctt tweet=”Governance Dual-Usability Obligation #privacy #compliance @angelagamalski” via=”no”]

Angela Gamalski is a first year law student at Michigan State University College of Law.  Angela can be reached at gamalski@outlook.com.

 

Celebrating Corporate Compliance & Ethics Week: Is truth bad for business?

by 1 Comment

A new report by the Ethisphere Institute identifies areas companies should work on to enhance transparency across all operations.

The release of the 2014 Ethics Communications Best Practices Report coincides with SCCE’s Corporate Compliance & Ethics Week May 4-10, a national week-long event that recognizes the importance of ethics and compliance in the workplace. Many companies use this week to advance the dialogue surrounding compliance and ethics and engage employees in these hot button issues.

AECOM’s Susan Frank Divers, right, talks with Dr. Edward Queen, director of the Ethics and Servant Leadership Program, The Center for Ethics, Emory University, during last year’s Best Practices in Ethics Communications Workshop.

AECOM’s Susan Frank Divers, assistant general counsel for Ethics and Compliance, right, talks with Dr. Edward Queen, director of the Ethics and Servant Leadership Program, The Center for Ethics, Emory University, during last year’s Best Practices in Ethics Communications Workshop.

“We are excited to build on the momentum and energy coming out of our second-annual Best Practices in Ethics Communications Workshop by publishing the expert perspectives and successful strategies that were shared at the New York Stock Exchange in October,” said Paul Gennaro, AECOM’s senior vice president and chief communications officer, who also chairs the Ethisphere Institute’s Communications Advisory Board.

The report features insights and perspectives from several recognized leaders in communications, academia, and legal and compliance, including Paul Argenti, professor of Corporate Communication and Corporate Responsibility, The Tuck School of Business at Dartmouth; Roger Bolton, president of the Arthur W. Page Society, the leading global professional association for senior public relations and corporate communications executives; Gary Sheffer, vice president of corporate communications and public affairs at General Electric and chairman of the Arthur W. Page Society; and Dr. Edward Queen, director of the Ethics and Servant Leadership Program, The Center for Ethics, Emory University.

“There are times when silence is important, especially when you don’t know all the facts. Long-term silence is never the right answer, but you have to achieve a balance where you are not rushing out with potentially false information, which can really discredit the company in the long run,” said Gregory.

Dawn Werry, vice president, marketing, Milliken & Company, added that while it is important to know all the facts before communicating, a quick response is important to controlling an organization’s rumor mill.

“You can’t go too long without telling people something, or else they will fill in the blanks,” said Werry. “Immediate communication allows you to be in control of your story, which is better than the alternative.” Werry also added that social media provides a unique tool for hearing feedback. “During a crisis while working for a previous employer, the biggest turning point for us was when we started using social media to listen.”

Click here to download a full copy of the report.