EXPERT RESPONSE
It's not clear to me whether any new versions of HIPAA have specifically disallowed the use of Social Security numbers, or whether it's just an informal guideline. The reality is that either way, it's a good idea to move away from using the SSN as a primary identifier.
In terms of tips, there are several things you can do to address this issue, especially for a resistant employee. You can conduct extensive employee training, which typically involves engaging a professional HIPAA training firm that specializes in ensuring that frontline healthcare personnel understand what sensitive data is and why it needs to be protected.
Also remove SSNs from forms, and as a last resort terminate employees who don't follow policy. If an organization has decided that it will no longer collect SSN information, and an employee continues to do so, then that person should be fired. After all, if an organization doesn't enforce its policies and suffers some kind of breach, it faces significant liabilities.
Content monitoring technology can help to index and search structured and unstructured data to look for SSN data and to get rid of it. Monitoring the content will prevent potential violations (which is a good thing), but doesn't really address the root cause, which is that the staff doesn't understand what data is private and how to protect it. Ultimately, it's a training issue.
For more information:
Ed Skoudis explains how creating a security awareness program can help thwart insider threats.
In this case study, learn how merging networks helped one medical facility with HIPAA compliance requirements.
|
