Data Security: HIPAA

In efforts to protect the videoconferencing session, as well as any documentation arising from the clinical work, providers must be knowledgeable of data security protocols. Security regulations and laws vary by location. For example, the General Data Protection Regulation (GDPR) directs practice within the European Union (EU); and the Personal Information Protection and Electronic Document Act (PIPEDA), or a similar province/territory- specific legislation, guides private-sector providers within Canada. Specific to the United States, HIPAA guides professional work. As expanded and finalized in accordance with the HITECH Act through what was termed the Omnibus Rule, HIPAA has four primary rules applicable to videoconferencing: (a) Privacy Rule, (b) Security Rule, (c) Enforcement Rule, and (d) Breach Notification Rule. Combined rules are implemented to govern and ensure the privacy of a patient’s PHI, whether physical or electronic (i.e., e-PHI). Related to the use of technology in clinical practice, protected information can include, but is not limited to, the patient’s name, address, phone numbers, fax numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary number, web addresses containing names or personal information, biometric identifiers such as fingerprints or vocal prints, full-face photos, or unique identifying numbers or codes (Sivilli, 2018b). HIPAA regulations apply to any covered entity. Per the US Health and Human Services (HHS, 2013g), covered entities include health plans, healthcare clearinghouses, and healthcare providers who conduct certain financial and administrative transactions electronically. Thus, under most circumstances, psychological providers can be considered a covered entity. The following is a summary of HIPAA rules and applications. Providers are encouraged to review the full guidelines presented on the HHS website (https://HHS.gov).

Privacy Rule

The Privacy Rule serves two primary functions. First, it allows patients access to their PHI. It also defines and limits the circumstances in which an individual’s PHI may be used or disclosed by covered entities (HHS, 2013f). As such, the rule requires covered entities to enact privacy policies and procedures, to designate privacy officials responsible for developing and implementing the policies, to train any individual who comes into contact with the protected information, to mitigate any challenges, and to safeguard data. To fully comply with this rule for telepsychology, providers may have to redesign their policies and procedures, as well as update the training of any team members, to ensure understanding of how e-PHI may differ from traditional PHI.

70 Factors to Consider in Videoconferencing Security Rule

The Security Rule protects a subset of information covered by the Privacy Rule, focusing on e-PHl (HHS, 2013g). Broadly defined by HHS (2013g), the rule ensures that covered entities must ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain, or transmit; identify and protect against reasonably anticipated threats to the security or integrity of the information; protect against reasonably anticipated, impermissible uses or disclosure; and ensure compliance by their workforce. To conform to the Security Rule, providers must enact standards for physical, administrative, and technical safeguards (HHS, 2013g).