TJC Information Management Readiness Standards – What You Need to Know

Published: 03rd November 2009
Views: N/A

The Joint Commission has updated and expanded its information management accreditation readiness standards for hospitals and related organizations. New readiness standards for information management and technology risk management are requiring hospitals to rethink how they will protect and secure sensitive information, audit, and improve continuity of operations and disaster recovery planning.



The Joint Commission evaluates the quality and safety of care for more than 15,000 healthcare organizations. To maintain and earn accreditation, organizations must have an extensive on-site review by a team of Joint Commission healthcare professionals, at least once every three years. The purpose of the review is to evaluate the organization's performance in areas that affect care. Accreditation may then be awarded based on how well the organizations met Joint Commission standards.



Hospitals who have not met the challenge of enabling compliance with these newly enhanced standards risk the loss of reimbursements from Medicare and increased liability of insurance costs.



A healthcare organization's IT infrastructure is at the foundation of delivering quality care. TJC recognizes this in the enhanced information management (IM) readiness standards. Among numerous other topics, TJC specifically addresses three key areas of IT risk management in the new IM standards. These include:





  1. Patient record security


  2. System security from intrusion and data tampering


  3. Continuity of operations and disaster recovery capabilities








Now let's take a closer look at these three TJC IM Readiness Standards.



Plan for Continuity of IM Processes (IM.01.01.03)



The hospital must have a written plan for managing interruptions to its information processes (paper-based, electronic, or a mix of paper-based and electronic). The hospital's plan for managing interruptions to information processes must address the following:





  • Plan for scheduled and unscheduled interruptions of electronic information systems


  • Provide training for staff and licensed independent practitioners on alternate procedures to follow when electronic information systems are unavailable


  • Have a back-up of electronic information systems


  • Plan for managing interruptions to information processes is tested for effectiveness according to time frames defined by the hospital


  • Implement its plan for managing interruptions to information processes to maintain access to information needed for patient care






Protect Privacy of Health Information (IM.02.01.01)





  • Use health information only for purposes as required by law and regulation or further limited by its policy on privacy


  • Disclose health information only by authorization from the patient or as otherwise consistent with law and regulation


  • Monitor compliance with its policy on the privacy of health information






Maintain Security & Integrity of Health Information (IM.02.01.03)





  • Protect against unauthorized access, use, and disclosure of health information


  • Protect health information against loss, damage, unauthorized alteration, unintentional change, and accidental destruction


  • Control the intentional destruction of health information


  • Monitor compliance with its policies regarding the security and integrity of health information






TJC's move to enhance its information management readiness standards is consistent with the growing number of ID theft incidents and regulatory pressures from many government and private sources. A typical hospital, for example, is subject to HIPAA regulations, PCI compliance (credit card), and often Sarbanes Oxley.



Common among these regulations and other information security best practice standards is the need to protect all patient, credit card and other confidential data from intrusion, tampering, and theft - at all times.



Katherine Janiszewski plays a crucial role as Marketing Manager of netForensics. Founded in 1999, netForensics is based on a culture of excellence and innovation. Their team of leading experts understands the ever-evolving security threat and compliance needs of today's organizations, including HIPAA data. For more information, visit netForensics.com.

Report this article Ask About This Article


Loading...
More to Explore