EMR Pros and Cons
Is It Time for Your Practice to Implement Electronic Medical Records?
Distributed courtesy of KeyMedical Software, Inc., authors and providers of KeyChart™ Electronic Medical
Records software, www.keymedical.net, 1-888-9KEYMED


Electronic medical records (EMR), computer-based patient records (CPR) or electronic health records (EHR) are
all names for the same type of computer software.   In this article, I'll refer to them as electronic medical records
or EMR.  EMR software allows for the input, storage, organization and retrieval of patients' charts.  Today EMRs
are on the minds of many physicians and administrators.  They are coming of age now the same way practice
management software did 10 to 15 years ago.  They will soon become an integral part of a practice just as
practice management software has.  

EMR software varies widely.  Each developer has ideas on how EMR software should work, so each package will
look different, will use different data structures in databases, and may have different means of input.  Some will
require mainly keyboard entry.  Others will use mostly mouse or stylus entry.  Some use voice input.  Others offer
handwriting recognition.  Some allow for scanning of paper documents.

In this article I will talk about features that seem to be available from a number of different EMR programs.  
However, you will find systems that don't have the features I mention, and you'll find systems that offer other
features I don't mention.  

PROS

With good EMR software physicians can enter exams as quickly as they can on paper, and sometimes they can
go even quicker than using paper.  There is, of course, a learning curve.  For the first few months, the physicians
are slower entering data in their EMR than they are on paper, but once physicians have gotten used to the way
their EMR works, they go back to being able to see the same number of patients in the same amount of time or
less than they saw before getting the EMR.

Physicians and staff save time on the things they used to do after the patients leave the office such as dictating
exams and referral letters.  The findings from exams won't need to be dictated because they will have been
entered at the time of service.  Referral letters can be generated from templates stored in the EMR software.  
They may be set up to pull in only certain findings or all positive findings.  Then the doctor can add free-form text
if he or she wishes in order to complete the letter.

Not only does the elimination of dictating offer time savings, but it also offers monetary savings.  The industry
average amount of dictation for an exam is 35 lines.   At 11 cents per line (which may be a low figure per line), the
average cost of dictation is $3.85 per visit.   With an average of 40 patients per day, that is $154 per day.  At 22
working days in a month, that is a savings of $3388 per month.

Prescriptions are another area of time savings. The average time to get a prescription written when patient a
patient call the office when paper charts are used is approximately 15 minutes based on searching for the patient
chart, getting the doctor's approval and calling the patient back.  With EMR, preparing prescriptions is much
quicker and easier.  Prescriptions can be printed while patients are still in the office during their exams, or they
can be faxed to pharmacies directly from the EMR computer.  The pharmacies' phone numbers can be stored in
the patients' records, so the prescriptions automatically go to the pharmacies the patients prefer.  

Of course when patients call in for prescriptions, the EMR is a real time saver.  Staff members record the phone
messages on in-office e-mails. These e-mail messages are automatically recorded in the patients' charts. This
allows for complete tracking of all patient phone calls.  Physicians simply receive the e-mails.  Then they can sign
and approve refills or create new prescriptions in the EMR and have them faxed to the appropriate pharmacies.

When Medicare rules require electronic prescriptions, an electronic medical records system would be the perfect
way to comply.  The prescriptions are already stored in the EMR, so the vendor will simply have to update the
software to put the prescription in the format Medicare requires.  That format has not yet been defined, so no
vendor can yet claim he is compliant.

Another area of real cost savings is chart pulls.  Charts are pulled for patient visits, telephone calls, prescription
refills and transcription.  The average time it takes to pull a chart is approximately 6 minutes.  Because charts are
pulled for approximately 3 times the number of office visits per day, if we use an average of 40 patients per day,
that gives us 120 charts pulled per day.  120 times 6 minutes equals 720 minutes.  720 minutes is 12 hours.  12
hours at the rate of $9 per hour for employees is $108 per day.  With 22 working days per month, chart pull
savings are $2376 with EMR.

Of course this is after paper charts have been eliminated.  To do this, all old charts will need to be entered into
the EMR.  This can be done in a couple of ways.  One is scanning the old charts into the EMR. This won't happen
overnight.  In fact it will take a few years to do.  A very good way to scan in the charts in a methodical, practical
manner is to scan them in for patients who are coming for appointments in the next week. Then shred the charts
once they are scanned and saved.  Another option is to scan in or key in just the pertinent information, but since
the entire chart isn't entered, it would need to be saved for a while, but it could be moved offsite.

Either way, doing a few charts at a time prevents the job from being overwhelming.  Charts are pulled and
scanned or entered by the same people who are pulling them now.  After about 3 years, the number of charts for
existing patients who haven't been in the office for appointments will be very small.  The space needed for paper
charts will be reduced every day.

To be truly paperless, any new paper communications that come into the office will need to be scanned into the
patient's electronic chart.  

With an EMR you will also be saving money on the cost of supplies for paper charts.  The average cost of
supplies for a paper medical record is $6.  This cost will be completely eliminated.

Another benefit to electronic medical records is the neatness of the record.  It is well-organized and typewritten.  It
is easy to read.  No one has to try to decipher doctors' messy handwriting.  Prescriptions are clear for
pharmacists and opticians to read, so patients receive the proper medications and spectacles.  Charts are clear
for staff members, other physicians and insurance auditors.  Auditors appreciate the speed with which they can
review charts and finish audits because the charts are so neat and orderly.

EMRs can make money for practices by eliminating under coding.  The national average for the amount
physicians under code is $40,000 annually.  Based on what physicians have documented, EMRs can recommend
the appropriate CPT codes.   This helps physicians code properly by neither under- nor over-coding.

EMRs can help physicians improve patient care in a number of ways.  They can check for drug interactions.  
They can check that patients are not allergic to drugs physicians prescribe.  They can graph findings so doctors
can see trends more easily.  Physicians can connect to their EMRs from their homes, satellite offices, or hospitals
in order to see patients' records thereby knowing the patients' histories instead of relying on what patients are
telling them over the phone.  Depending on the type of system and the number of devices, DSL, cable, frame
relay, T-1s or other broadband communication solutions can be used to connect to the server.

Of course multiple office locations can be connected to the main office.  This is another big benefit.  Charts no
longer have to be carried in the trunks of the doctors' cars when then go from office to office.  When walk-in
patients need to be seen at one office and their charts are at another, their charts don't have to be faxed.  All
charts are instantly available at all locations.

EMRs can connect with practice management systems in order to improve staff productivity.  Patient
appointments and demographics can be sent from the practice management computer system to the EMR system
so they do not have to be keyed in twice.  Also, CPT and diagnosis codes can be sent back to the practice
management system.  This not only eliminates transcription errors but also speeds up check out by not requiring
double entry of data.

Good electronic medical records software will provide the physician software that is ready to use from day one
and will also allow users to tailor the exams to each practice or physician.  Being able to do this allows physicians
to perform exams the way they wish instead of the way computer programs force them.  Setting up exams can be
extremely time-consuming.  Physicians might prefer to start with a boilerplate exam and change it to suit them
rather than starting from scratch.  If set up takes too long and if the physicians are the ones who must set up the
exams, they may end up not using the EMR at all because they don't have the time to set up their exams.

EMRs may even reduce physicians' malpractice insurance premiums.  Carriers recognize the risk management
benefits of electronic medical records.   They realize that since EMRs offer doctors access to patients' charts
even when they are away from the office, the risk of physicians making mistakes due to not having the proper
information is greatly reduced.  They also recognized that EMRs provide better documentation for medical
records than paper charts do.

Because of their conviction that EMRs equate to better care, several malpractice insurance carriers have chosen
to encourage the use of EMRs by offering premium credits of 5 to 10 percent for their insured physicians who
demonstrate appropriate use of electronic medical records.  Check with your carrier to find out if they offer a
discount like this.

CONS

Of course no new technology comes without a cost.  There is the price for software, hardware, installation,
training, wiring, communications and on-going support.  However, due to the cost savings outlined above, these
costs are quickly recovered.  An overall cost savings applies by using EMR.

One of the benefits listed above is the ability to access charts from all office locations.  This is accomplished
through communications lines. T-1 lines, frame relay, DSL and cable are all options.  The bandwidth required will
depend on the type of system and number of devices connected.   Sometimes wireless communication can be
used if there is a straight line of sight between your location and the carrier.  The downside to communication
lines is they sometimes are down.  What happens when that occurs?  The remote office can't access the main
office in order to see and update charts.  Some offices choose to have backup communications lines.

Of course a question many people ask is what do they do if the server goes down?  When the server is down,
charts will not be able to be accessed.  However, practices can choose to build in as much redundancy or
duplication as they wish.  Redundant hardware costs money, but if you never want your server to be unavailable,
the price is worth it.  Your practice has to determine how much down time you can tolerate and then build in the
redundancy to handle that.

Another question people ask is what if the electricity goes out?  If you wouldn't attempt to see patients when the
electricity is out because your lights, slit lamps and other electrical equipment wouldn't be operational, then it
really doesn't matter.  You would still want a battery backup, which might be called a UPS (uninterruptible power
supply) or an SPS (stand-by power supply), attached to your server to give you time to shut down the server in
an organized fashion.  A battery backup that would supply 15 minutes of power is sufficient for that.  If you need
to be sure electrical power is always available, then your office should invest in a backup generator.

OTHER ISSUES

In addition to the pros and cons listed above, there are other issues that you will need to consider when you
purchase and install an EMR.  Each has advantages and disadvantages.

When you install an EMR, what computer hardware should you use?  As you might imagine, there are many
options.  You can choose to have a PC in each examining room, or you could choose to have a tablet PC, which
you carry from room to room.  The advantage to having a PC in each room is that you don't have to carry it.  It is
always in place and ready for use.  The disadvantage is that it takes up space in the room.

The advantage to a tablet PC is that it doesn't require any more space in the exam room than a paper chart
does.  Of course you don't have to have as many tablet PCs as you would stationary PCs, but then tablet PCs
cost twice as much as stationary PCs.  Another disadvantage is that tablet PCs weigh about 3 pounds.

Some EMRs offer thin clients or terminals as options instead of PCs.  Terminals are smaller and less expensive
than PCs, but because they are not PCs, they can only run with EMR or other software that has been specifically
designed to run on them.  Thin clients are really PCs running special display protocol software that lets them act
like terminals.  Because they are PCs, they can also run locally installed programs as well as the applications that
are running on the server.  Thin clients and terminals use the server to do the processing.  Only the data you see
on the screen is transmitted to the thin clients and terminals.   Processing on the data you don't see at that
terminal, such as searching through databases or doing calculations on numbers, is done at the server and is
therefore not passed through the network to the terminal or thin client.  Using thin clients and terminals can
require less network bandwidth because less data is being passed over the network.

Another question you'll need to answer if you install EMR software is do you use hard-wired or wireless
connections?  Hard-wired connections have the expense of running cables under floors, through walls or over
ceilings plus the price of the cable and connections.  The connections are reliable and are HIPAA compliant.  
Wireless connections save the cost of the cables, but wireless routers, hubs and receivers are costly.  With
wireless connections you must be more careful to be HIPAA compliant.

From Section 164.304 of the HIPAA definitions, we find the following definition, "Technical safeguards” means the
technology and the policy and procedures for its use that protect electronic protected health information and
control access to it."  Section 164.312 states that for transmission security, covered entities must "implement
technical security measures to guard against unauthorized access to electronic protected health information that
is being transmitted over an electronic communications network."  Exactly how that is to be accomplished is not
specified.  HIPAA will not be issuing exact technical standards for hard-wired or wireless communications, but
whatever is used must "guard against unauthorized access."

One wireless standard is IEEE802.1x.  This standard uses certificates to provide strong authentication for both
the client and server so that each must prove it is legitimate.  The Wired Equivalency Protocol Security (WEP)
has been found to have a flaw in the WEP algorithm.  A new security protocol, Wi-Fi Protected Access (WPA), is
expected to improve upon WEP and be used in the IEEE802.11i standard.  WPA consists of 2 components.  The
first component is Temporal Key Integrity Protocol (TKPI).  TKPI wraps around WEP to eliminate key weakness
and other integrity issues.  The second component is Extensible Authentication Protocol (EAP) which provides
authentication of the access points. Another option is a Virtual Private Network or VPN, which uses encryption
and authentication to insure only authorized access to data.  Encryption of data on any type of network is an
additional way to protect data.  128 bit encryption is the high standard many use.  To read more about wireless
networks and HIPAA compliance, see Implementing a HIPAA Compliant Wireless Network at http://www.giac.
org/practical/GSEC/Lynda_Moore_GSEC.pdf.


























































What are people saying about EMR?

Joy Newby of Newby Consulting, Inc., a consultant in Indianapolis, sees many practices, many without EMR and
some with EMR.  She has found that staff members do not like them when they start using them because EMR is
a big change.  However, once they become accustomed to EMR and the patients already have records stored
electronically, they love EMR.  

Practices Joy has seen which have had the most trouble implementing EMR had an unreasonable expectation
that this was going to be really easy from day one.  To make the implementation successful, Joy recommends
setting the expectation that this will be hard work.  There will definitely be a learning curve.  The staff needs to
believe that EMR is going to improve patient care once they get everything going.  They have to accept that it's
going to be tough at first.  

Michael Lockard, administrator at Tally Eye Care, says one way to start with an EMR is to start with new patients
only.   Then, once the doctors and staff are used to the EMR, start recording exams for existing patients.  
However Tally Eye Care did it with every patient who walked through the door.  They reduced their patient load
and slowly increased it back to former levels over about 3 months.  It took more than 3 months for some of the
doctors, so the time frame was variable.

Technicians keyed in some of the pertinent information (past surgeries, allergies, past ocular history) for existing
patients.  Since doctors are treating what is in front of them right now, they don’t have to see the entire old chart
most of the time.  They've retained their paper charts so they can refer to them, but he is unsure how long to
keep them.  They are pulling them less and less.

Vonda Syler, COE, administrator for McDonald Eye Associates in Fayetteville, Arkansas, found that their staff
needed about 3 months to get accustomed to using their EMR, too. She says, "For a successful EMR installation,
you need a lead physician involved who stands behind the EMR through thick and thin. You have to have a
physician champion for the EMR. If he or she doesn't stand behind it, it won't happen." She pointed out that the
doctor can't say things such as, "We're running behind or having some difficulties today, so let's go back to paper
for now," because the office will end up dropping the use of their EMR.

Two other things she found to be very important to a successful EMR implementation are staff buy-in and user
friendliness of the software. Staff members can help make an implementation successful or they can help it fail.
Also, user interfaces that are simple for the end user to navigate are critical. Most staff members don't care how
good the back end is, they just want the part they see and use to be easy.

McDonald Eye Associates has been using EMR since October 1997 and recently updated to KeyChart™. They
have been successfully using EMR for almost 7 years. They wouldn't want to go back to documenting exams on
paper. In fact Vonda went on to say, "Once doctors learn the system, they are faster on EMR than on paper. It's
faster to point and click than to use paper and a pen not to mention the documentation is more thorough.
Copying from the last exam and updating the data appropriately is faster than entering the data from scratch."
Their practice didn't lose any staff members, but each year when they budget for the coming year, they add more
appointments to the doctors' schedules without adding new staff. So, they have been able to increase the number
of patients they see without adding any additional staff members because they have EMR.

From talking with other practices and serving on panels at meetings, Vonda learned that many of the practices
who tried to implement EMR and failed were ones who either tried to write the EMR themselves or invested in a
company that was attempting to write EMR instead of choosing a package that was already working.

Of course EMR bring big changes for doctors just as they do for staff members.  Joy notes that physicians have
to adjust their thought processes about signing charts.  With paper charts the records are right there in front of
the doctor.  When paper charts stack up, the doctor realizes he is behind and signs them.  With EMR, sometimes
doctors may not notice how many charts need to be signed, out of sight out of mind.  They may not notice that
they are behind.  Doctors have to look at the list of unsigned charts in the computer.  They have to remind
themselves to sign charts on a regular basis.  Many EMR software packages encourage and make it easy for the
doctor to sign the chart at the end of the exam.  

Michael has a love/hate relationship with his EMR.  At first bringing doctors on board using EMR is an
overwhelming experience.  He says, “When you take away the doctor’s paper charts, he doesn't know what to
do.”  EMR is a big paradigm shift for the doctors, but eventually all doctors will all be using EMR.  Also it can be
overwhelming for people to switch from a DOS or UNIX system which uses only a keyboard to a Windows system
and using a mouse.  Just like their staff members, doctors love EMR once they are installed.

In order to make the shift to EMR easier, exams can be tailored to the way individual doctors or the entire group
of doctors practice medicine. Vonda recommends tailoring the exams to the practice and not to each doctor so it's
easier for maintenance and for technicians to go from doctor to doctor.

Along with that Vonda thinks it is important to be able to make changes themselves to the design of their exams
rather than having to call the software company to have customer service people make the changes. She
appreciates the speed of being able to do it themselves. By doing it themselves there is no charge from the
software company and no waiting for the company to do it. They can decide to make a change at lunch and have
it ready for afternoon clinic.

Of course keeping the cost down is always important. Vonda has found a way to mitigate the cost while getting
dual duty from her exam room PCs. Their exam room computers are leased from Optos North America, which
sells a type of scanning laser ophthalmoscope. These PCs are used to receive feeds of retina photographs as
well as to run their EMR software.

Joy points out that when doctors take calls for others in their practices over the weekend, they dial up their EMR
and can see the patients’ complete records.  They are then providing improved quality of care because they have
access to all of the needed information.

They experience the same type of benefit when they have satellite offices.  If the doctor is in location B but
normally sees this patient in location A, the patient can go to location B and the doctor will have all of this patient’
s records available.  There is no need to use a courier or to fax records.

From a billing standpoint, if the staff has any questions about whether or not a 25 modifier is needed, they don’t
have to go pull the file to look.  They simply pull up and view the records.  If they have questions about what tests
were performed, they view the records on their computer.  When they have to file a review for a patient, they don’
t have to dig for the patient’s record.

And a really, really big benefit is no lost charts.  This one is HUGE.

Doctors opening their practices for the first time love EMR.  It is so easy to start out electronically without ever
accumulating paper charts.  For old practices, it is a much bigger issue to make the transition from paper to
electronic records because either the old charts need to be scanned or pertinent information from the old charts
needs to be entered by technicians into the EMR.

Joy especially likes it for chart reviews.  The EMR software will print out the exams she wants to review so she can
write on them and review then with the doctors.  She doesn't have to take charts apart and make copies as with
paper charts.  

Michael wanted to learn how to do his own chart reviews.  He looked at reviewing paper charts versus reviewing
charts from their EMR and saw how much easier it was to review the charts from their EMR.  

Something Joy recommended that physicians be wary of is EMR software that automatically plugs in data.  For
instance, if the physician were to enter data in the review of systems and if he just put in the positive findings,
beware of software that automatically adds in all the negatives.  It might be OK for the negatives of “no wheezing”
and “no shortness of breath” to be filled in, but you would not want the software to fill in that a female patient
didn't have problems with her prostrate and that a male patient had no problems with periods.  She urged that
doctors need to resist the temptation to have EMR software automatically fill findings in because it is obvious that
it wasn't really examined.

Kevin Corcoran, president of Corcoran Consulting Group says, "The Office of Inspector General does not like
EMR systems that contain features to automatically complete the record. Such systems encourage a lazy
approach to the medical record that might be dangerous or misleading."

Similarly, Joy states, if data from previous examinations is just copied forward, it is hard to determine what is truly
medically necessary.  For instance if a complete review of systems is copied forward from a previous exam when
a patient returns for a follow-up on his corneal abrasion, the CPT code for the visit is still a level 2 even though
there is additional documentation.

Having the EMR software suggest CPT codes can be great, because it helps physicians understand coding.  But
by the same token, it doesn't relieve the physician of his responsibility of selecting the level of care.  We all look
for quicker ways to get paperwork done.  Joy's biggest fear is that software can't have enough artificial
intelligence to do it all.

Kevin is not a fan of computer systems that automatically select the CPT code for the physician based on the
EMR contents. He says, "We feel this is likely to be a dangerous idea and that the liability problem for the doctor
and the software company is unacceptable." He, too, thinks the artificial intelligence can't be created to
automatically select the code based solely on the chart entries. Another reason artificial intelligence won't work
for code selection is that the software doesn't know how to judge eye codes versus E&M codes and when they
are appropriate.

However, if the doctor is asked to rate his level of medical decision making, that changes the process entirely.
The software can get part way to selecting the CPT code for the office visit, and then if the doctor is allowed to
rate those parts of the equation the software can’t possibly know, the software can complete the job of assigning
an appropriate level of service and the corresponding E&M code.

Michael points out that there is no industry standard yet for storing EMR.  He tells people to be aware of how the
EMR data is stored and to ask themselves if the way they are storing their data today will be accessible tomorrow,
will it be convertible to whatever new format comes along.  Your best option here is to make sure your data is on
a well known database i.e. Microsoft SQL, Oracle or Sybase to name a few.

Michael thinks implementing EMR for ophthalmologists is easier than for some other specialties.  However, he
points out that adding diagnostic findings can be difficult.  Some automated equipment hooks directly into the
computers while some findings from equipment have to be scanned.  Some big vendors of equipment don't play
well with other for integrating outside software.  Every diagnostic machine is different.  HL7 and XML didn't solve
those issues.  Practices have to pay for the integration, or sometimes they benefit from someone else's
integration program.  He finds that visual fields and autorefractors are the most often integrated devices.  

A different type of medical record on computer

There are also instrument interfaces to another type of computerized medical record, one that allows doctors to
scan in their paper chart notes as well as all other documents generated during patient encounters.  According to
Evan Steele, President of SRS, Freedom Chart Manager™ doesn’t change the way the doctors practice because
doctors still write their documentation on paper.  Therefore the adjustment for physicians is minimal.  More than ½
their clients are ophthalmologists.

The Eye Specialists Center, LLC is one of their clients. Dan Smocke, their administrator, says his impression of
using the scanned imaging software is favorable. Regarding the images on computer, he says they are easier to
work with and save time as compared to hard copy because doctors and staff can pull them up more quickly. In
order to use the scanned images, he points out that users have to have the images in the exam rooms on
computer screen. That can be cumbersome because the doctor is working on a hard copy of today's visit while
looking at a computer image of previous visits. So, the doctor has to go back and forth. It seems more sensible to
him to have today’s visit as well as the previous visits all on a computer screen. The screens they use are 17 inch
on a pivoting device that allows them to view the image in portrait format (like a piece of paper) instead of
landscape format. The doctors in his practice like the imaging software. It is a good entry-level system to a
paperless office. Their staff scans in everything. He points out that at the beginning of the transition period from
paper to scanned images he has to pay extra just for scanning which includes the front desk employees and
some part time employees who work 2 hours a day 5 days per week. Once all of the paper charts are scanned
then the need for part time scanners will be eliminated but there is a payroll cost for these part-time scanners that
needs to be budgeted as part of the software investment. They've been able to eliminate their paper chart cost
and can access records remotely, so it is a huge step up from paper.

Should you implement EMR?

Joy Newby pointed out that when practices get new phone systems, the staff members hate the change because
they have to push new buttons.  The same is true with EMR.  As with any technology, whether it is a new billing,
phone, or word processing system, it takes time to get used to it.  But after a while, the staff wonders how they
ever lived without it.  Everyone lives for that day, and it does come.

Vonda Syler pointed out that they had a deaf patient and had to communicate by writing notes. The staff wished
they could just point and click like they can do with their EMR instead of writing the notes. Using EMR has become
such a part of their procedures that they wouldn't want to ever go back to paper.

Electronic medical records is the future. Tally Eye Care is trying to do it slowly and do it right the first time, says
Michael.  He would advise people that no matter how well they plan things, they can never plan it well enough.  In
other words, there will always be surprises.  However, EMR does pay off in the long term.  Practices have to give
it time to pay off.


HIPAA Section 164.312 Technical safeguards.


A covered entity must, in accordance with Sec.  164.306:
(a)   (1)   Standard: Access control. Implement technical policies and
procedures for electronic information systems that maintain                         
   electronic protected health information to allow access only to those
persons or software programs that have been granted access rights as
specified in
Sec.  164.308(a)(4).
Sec.  164.308(a)(4).
(2) Implementation specifications:
(i) Unique user identification (Required). Assign a unique name
and/or number for identifying and tracking user identity.
(ii) Emergency access procedure (Required). Establish (and
implement as needed) procedures for obtaining necessary electronic
protected health information during an emergency.
(iii) Automatic logoff (Addressable). Implement electronic
procedures that terminate an electronic session after a predetermined
time of inactivity.
(iv) Encryption and decryption (Addressable). Implement a mechanism
to encrypt and decrypt electronic protected health information.
(b) Standard: Audit controls. Implement hardware, software, and/or
procedural mechanisms that record and examine activity in information
systems that contain or use electronic protected health information.
(c)(1) Standard: Integrity. Implement policies and procedures to
protect electronic protected health information from improper alteration or
destruction.
(2) Implementation specification: Mechanism to authenticate
electronic protected health information (Addressable). Implement
electronic mechanisms to corroborate that electronic protected health
information has not been altered or destroyed in an unauthorized
manner.
(d) Standard: Person or entity authentication. Implement procedures
to verify that a person or entity seeking access to electronic
to verify that a person or entity seeking access to electronic
to verify that a person or entity seeking access to electronic
protected health information is the one claimed.
(e)(1) Standard: Transmission security. Implement technical
security measures to guard against unauthorized access to electronic
protected health information that is being transmitted over an
electronic communications network.
(2) Implementation specifications:
(i) Integrity controls (Addressable). Implement security measures
to ensure that electronically transmitted electronic protected health
information is not improperly modified without detection until disposed
of.
(ii) Encryption (Addressable). Implement a mechanism to encrypt
electronic protected health information whenever deemed appropriate.

This section was updated, commented on and responded to in the Federal
Register: February 20, 2003 (Volume 68, Number 34)] [Rules and
Regulations] [Page 8333-8381] From the Federal Register Online via GPO
Access [wais.access.gpo.gov] [DOCID:fr20fe03-4], 45 CFR Parts 160, 162,
and 164 Health Insurance Reform: Security Standards; Final Rule.