Patient Information Confidentiality
Despite the benefits of offshore medical transcription services, the debate over sending physicians' dictation overseas continues. Those who oppose sending dictation overseas express concern that patient information confidentiality will be compromised. As such, we have implemented multiple levels of security to ensure confidentiality of patient information. Our clients may choose among the following options:
Level 0 – Nominal Transcription (Not Recommended)
Nominal transcription is a procedure in which the transcribed medical reports are linked to the patient by a personal identifier (e.g., first & last name, address, telephone number). Some or all individually identifiable health information about the patient are included in the physician's dictation. This is currently being practiced by medical transcription companies operating locally or internationally. Some companies employ strong encryption measures to conceal the patients' personally identifiable information.
Level 1 – Non-Nominal Transcription
Non-nominal transcription is a procedure in which transcribed medical reports can be linked to the patient by a code (which does not include personal identification of the patient) known to the physician. The medical transcriptionist also knows the identity of the patient, but the transcribed medical reports remain confidential. The medical transcription company keeps its own patient database, and is updated whenever the physician offers new information (usually upon introduction of patient to the medical transcription service). Companies employ this setup for physicians who require long-term archival and easy retrieval of transcribed medical reports.
Level 2 – Anonymous Transcription (Recommended)
Anonymous transcription is a procedure whereby transcribed medical reports can be linked to the patient by a code known only to the physician. Neither the medical transcriptionist transcribing the report nor anyone else knows the identity of the patient.
Organizational Security
Employee policies are in place. These include procedures regarding security, confidentiality, information use and flow, release of information, established mechanisms for responding to security breaches, structures for determining and granting/revoking access privileges to the file server and MT workstations.
HARDWARE SECURITY
Two firewalls protect our file server. The first firewall is provided by our internet service provider (ISP) which serves as our first line of defense from the general public. No entity (not even us) can receive e-mail unless connected directly to our ISP and has the correct user passwords. The second firewall is installed at our file server which serves as our second line of defense from malicious subscribers of our ISP. This firewall redundancy ensures our file server security.
Because no internet system is absolutely secure, we opted not to use the 24 hour / 7 day secure FTP operation. To circumvent possible attacks from web hackers, we decided to make use of the best security available -- to physically disconnect our file server from the internet. Whenever an e-mail arrives, our ISP automatically notifies us via pocket pagers. Upon notification, we connect into our ISP and retrieve the e-mail. After retrieval, our file server is physically disconnected from the internet. This physical disconnection prevents computer viruses or trojan horses from dialing directly into the internet. Also, the pocket pager approach reduces the time an e-mail resides in the ISP's e-mail server thus significantly reducing the risk from "man-in-the-middle" type of attacks. As a result, our file server, e-mail, dictation files, as well as medical records archives are completely safe from unauthorized access.
SOFTWARE SECURITY
We are highly hardware secure, but what about the dictation files or e-mail in transit? What encryption scheme should you use? Although we are not governed by health care legislation in the United States, we abide by the security principles laid down in the November 24, 1998 HCFA Internet Security Policy (for more information visit http://www.hcfa.gov/security/isecplcy.htm ). We strongly suggest to our customers to encrypt their e-mail, authenticate, and not to indicate in any way individually identifiable data in the body of the unencrypted mail message.
Several encryption schemes are available in the market. Two of the most powerful are SSL - Secure Sockets Layer (sometimes referred to as Transport Layer Security - TLS) level Version 3.0 (or better) implementation using Netscape Messenger Version 6.0 or better (for more detailed information visit http://home.netscape.com/security ) and PGP - Pretty Good Privacy Version 7.0.3 (or better) implementation (for more information visit http://www.pgpi.org ).
We prefer PGP's full 128-bit key encryption technology implementation. Unlike PGP, SSL international (so called "export version") encryption implementations using Netscape Messenger is only limited to 40-bit key encryption technology (the more powerful 128-bit key version is for exclusive use in the U.S.).
Important note: If you desire to use or are already using the internet for transmittal of HCFA Privacy Act-protected and/or other sensitive HCFA information, you must notify HCFA. An e-mail address is provided below to be used for this acknowledgment. An acknowledgment must include the following information:
1. Name of Organization
2. Address of Organization
3. Type/Nature of Information being transmitted
4. Name of Contact (e.g., CIO or accountable official)
5. Contact's telephone number and e-mail address
For submission of intent, send an e-mail to: internetsecurity@hcfa.gov .
AM Accuscripts (Phils.) Accurate Medical Transcription Services (Phils.) Principal offices are located at the country's premier financial district -- Makati City , Philippines . (more)