Texas Specialty Clinics: Where Patient Data Hides in Phones, Fax and Portals

Briefing

The HIPAA Security Rule requires an accurate and thorough assessment of risks to electronic protected health information at 45 CFR 164.308(a)(1)(ii)(A). HHS guidance is clear that the analysis has to reflect your own environment. A template completed for a family practice does not describe a pain management clinic that prescribes controlled substances, or a pediatric office managing parent and guardian access.

In the specialty offices we wire and support, a large share of patient data moves through systems nobody lists on the asset inventory: voicemail boxes that transcribe messages to email, fax lines converted to email delivery, call recordings on the hosted phone platform, and patient portal accounts shared between parents and teenagers. Texas adds its own layer. Health and Safety Code Chapter 181 applies to a broader set of covered entities and requires training on state law as well as HIPAA.

Pain management and other practices that prescribe controlled substances electronically are also subject to DEA rules in 21 CFR Part 1311, which require two-factor authentication for signing those prescriptions. That identity system belongs in the risk analysis too.

What to do

1. Inventory every place patient information lands, including voicemail to email, fax to email, call recordings and texting tools.
2. OB-GYN: identify where sensitive reproductive and imaging data is stored and who can reach it, including ultrasound workstations and image exports.
3. Pediatrics: document how portal proxy access is granted to parents and guardians and how it changes when a patient reaches the age your policies and state law set.
4. Pain management: list the EPCS application, the two-factor method and who holds tokens, and confirm access is removed the day a prescriber leaves.
5. Set retention for call recordings and voicemail, and restrict who can download them.
6. Record each risk with likelihood, impact, owner and a target date, and repeat the analysis after any new system or major change.

How to verify

• Pick three patients at random and trace every system that holds their data. Compare the result to your inventory.
• Pull the user list from the phone platform and the EPCS application and match it to current staff.
• Confirm that the training records show Texas Chapter 181 content for each employee.
• Check that the risk analysis has a date in the last twelve months and a named owner.

Sources

• eCFR, 45 CFR 164.308, Administrative safeguards
• HHS, Guidance on Risk Analysis
• eCFR, 21 CFR Part 1311, Requirements for Electronic Orders and Prescriptions
• Texas Health and Safety Code Section 181.101
• HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?

Questions about your phones, network or IT? Contact Texwan.