Almost 30 percent of hospitals out of compliance with HIPAA requirements for contingency plans for their EHRs
Testing and revision plans lacking, as well as staff training on how to deal with EHR system downtime, Office of the Inspector General report says.
While most hospitals have contingency plans in place in case something happens to their electronic health records, less than three-quarters of those surveyed by the Department of Health and Human Services' Office of the Inspector General have plans that address testing and revision procedures -- a requirement under the Health Insurance Portability and Accountability Act.
About 68 percent of hospitals had contingency plans that complied with all four HIPAA requirements: testing and revision procedures, an emergency mode operations plan, a disaster recovery plan and a data backup plan. Ninety-five percent of hospitals had plans addressing disaster recovery and emergency mode operations; 83 percent had a data backup plan.
Findings in the OIG report underscore the importance of more hospitals adopting testing and revision procedures. The government, healthcare and information technology sectors have raised concerns about vulnerabilities in networked medical devices that have the potential to put hospital networks and EHR systems at risk, the OIG found.
[Also: CMS calls for 90-day reporting in 2016, easing Stage 3 EHR objectives]
For instance, in January, a California hospital reported that it suffered a ransomware attack that disabled its network and EHR system for about a week, leading to delayed patient care and the need to divert patients to other facilities. And in March, MedStar Health reported a suspected ransomware attack that forced it to take computer systems offline throughout its entire system, including 10 hospitals.
In fact, over half of hospitals reported an unplanned EHR disruption, and about a quarter of those experienced delays in patient care as a result.
Of the 73 percent of hospitals who reported having testing and revision procedures in place, only 45 percent of them said they trained staff through recommended drills on how to deal with EHR system downtime. One hospital reported it avoided drills because of the risk to patient safety from unnecessarily shutting down EHR systems.
[Also: Boston Children's awarded $275,000 by ONC for EHR apps discovery site]
The Office for Civil Rights enforces HIPAA's security rule, but the OIG report found that the OCR considers HIPPA compliance broadly, and doesn't target EHRs when reviewing a covered entity's contingency plans. Oversight of HIPPA compliance is generally triggered when the OCR becomes aware of specific problems, such as breached and complaints.
Based on those findings, the OIG repeated its previous recommendation that the OCR fully implement a permanent audit program to assess compliance with HIPPA requirements.
Twitter: @JELagasse
