If workstations are connected to the Internet, firewalls, gateways, or other mechanisms are in place to protect against unauthorized access. If confidential information is transmitted via the Internet, it is encrypted to protect it during transmission. If an outside transcription vendor has modem access to the organization's dictation system, that access is limited appropriately. If an outside vendor has access to the organization's computer system, the vendor can access only the information needed to perform the required service, and that access is limited to read-only. If dictated information is transported on cassette tapes or other media, procedures are in place to protect it from loss or unauthorized access.
Dictation is erased when no longer needed.
If employees transcribe, code, or handle other patient information from home-based offices, procedures are in place to protect the confidentiality of that information. The confidentiality of billing information is protected. Billing tapes and printed copies of billing forms, which identify the patient and contain confidential diagnostic and procedural codes, are protected from unauthorized disclosure. If the billing staff has access to patient records or copies from them, procedures are in place to protect the confidentiality of these records and assure their proper disposal when they are no longer needed. If physician offices are connected to the organization's computer system, security measures are in place for these offices.