You'll have an audit trail of who has accessed the data or made changes to records. Some companies have already implemented technology that brings them into compliance with the new rules. Noteworthy Medical Systems Inc. In addition to managing patient records, Kadambi says, the system can control access and prevent unauthorized data disclosure. But even the most modern of medical IT systems may not comply with the health-insurance act. EMed Technologies Corp., a Lexington, Mass., company that delivers X-ray images and reports from hospitals to radiologists, built its eMed.net system with the government regulations in mind.
Many companies have hundreds of compliance issues.
Still, the eMed.net system needs improvement in the area of privacy, admits Kelly Pickard, director of strategic alliances at eMed. Once people have passwords and are in the system, you have to have access controls to limit the amount of information available to them based on what is appropriate for their work roles. Doctors and nurses often chat about patients in public spaces, such as elevators and hallways, for example. Under the act, such discussions are forbidden. Other patients now can't see who else signed in and at what time.