Provider IDs and patient IDs were the most significant and caused the most angst in determining our approach. In contrast, the security rule is easier to get your arms around. It deals more with the typical system security components that we have concerned ourselves with for years. It will require that an agreement be in place for every party with which we exchange information. The privacy rule introduces many practices that are probably not in place at many organizations today.
Most companies safeguard patient identifiable health information.
But these rules require much more rigor around authorizing disclosure of patient information and the rights of the individual to know how and to whom their information is shared. Start at the executive level and work down from there. Executives at the top of the organization have to accept the project and the importance of compliance. Then it's easier to start the education process among the employees. Then an analyst comes in behind me to conduct information security awareness training.