Last month in this column, I addressed the new HIPAA rule, which significantly expands certain obligations for health care providers and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In that article, I discussed the importance of updating your (or adopting a) HIPAA Compliance Plan. In light of the new HIPAA rule, the move into the technology age and the prevalent use of mobile devices, developing policies and procedures as part of your HIPAA Compliance Plan to address the security of patient information on your iPhone, iPad, Blackberry, etc., has become increasingly important if you are (or you represent) a health care provider or business associate.

The first step is deciding whether or not you will allow the use of mobile devices within your business for accessing, receiving, transmitting or storing patient health information. In making such determination, you should thoroughly review the risks (e.g., increased risk of theft of patient information) and benefits (e.g., convenience) associated with using mobile devices for such purposes.

If your business allows patient information to be stored, accessed, transmitted, etc. on a mobile device, policies and procedures addressing such use and the limits of such use should be established and made a part of your HIPAA Compliance Plan.

(Note that adopting such polices or procedures is also a good practice if you store, access, receive, or transmit other types of highly-sensitive information — e.g., bank records.)

In drafting and implementing mobile device policies and procedures, consider the following:

• Passwords. Requiring a password or other user authentication method to unlock mobile devices can prevent unauthorized users from accessing information stored on mobile devices. Passwords should be “strong” (at least six characters and a combination of letters and numbers), changed periodically (at least once every six months) and kept confidential.
• Encryption. Encrypting data is not only important to prevent hacking and unauthorized access, but it can also prevent you from having to report a breach of unsecured protected health information. Encrypted data is considered “secure” and therefore does not fall under the definition of unsecured protected health information for which a HIPAA breach notification is required. Since we are starting to see penalties imposed in connection with reported HIPAA breaches, it is prudent to take all possible steps to minimize the occurrence of a reportable breach. In addition, encryption becomes even more important when mobile devices are used to transmit data over a public Wi-Fi network, which is easier for savvy individuals to intercept and hack.
• Remote wiping and/or disabling. Remote wiping and disabling allows you to remotely erase any data stored on mobile devices or to remotely lock mobile devices. This is an extremely valuable tool in preventing an inappropriate use and/or disclosure of information (or mitigating the harm from such use and/or disclosure) if a mobile device is lost or stolen, which occurs all too frequently.
• Physically secure mobile devices. Although common sense, locking the screen and physically securing mobile devices can go a long way in protecting information. Set mobile devices to log out and lock after a certain number of minutes of inactivity (e.g., three minutes). Require employees to lock the device in a drawer or other secure place (rather than leaving it sitting out on a desk) when not physically with them and instruct employees not to let others use their mobile devices.
• Delete, delete, delete. As required by the HIPAA Security Rule, you must delete all patient information from a mobile device before discarding it or giving it to someone else for re-use. Methods of deletion include completely clearing the device, purging the data or physically destroying the device.
• Device ownership. Consider who actually owns the mobile device, the employee or the business. If the former, policies and procedures should be in place for terminating access to patient information from the device in the event the employee is no longer working with the business and no longer needs to access the information. If the latter, policies and procedures should be in place to ensure that the device is returned on the last day of employment and that the information stored on the device is not inappropriately copied or accessed by the terminated employee.

As technology evolves and HIPAA rules are more vigorously enforced, if you are a health care provider or business associate (or represent a health care provider or business associate) you must implement policies and procedures to address the use of mobile devices to access or transmit patient information.