For More Information HIPAA ToolKit on CD-Rom Total HIPAA: CMA's No-Nonsense HIPAA Compliance Workshop HIPAA Product Comparison Chart
	NEED MORE HIPAA HELP? CMA members, if you can't find the information you need here, call CMA's HIPAA Hotline at 415/882-3311 or contact CMA's legal information specialists by email at legalinfo@cmanet.org.

 "Does HIPAA require that patient charts be filed in locked cabinets?" This is one of the most commonly asked questions at CMA’s Total HIPAA workshops. Clearly a locked chart cabinet provides the best protection against unauthorized access, especially after hours. However, HIPAA does not require locking file systems. Instead, the regulation requires that "the covered entity has in place reasonable safe-guards." Specifically HIPAA requires "appropriate administrative, technical, and physical safeguards" for protecting health information and limiting incidental use or disclosure of that information.

According to the Office of Civil Rights (OCR), "reasonable safeguards" will vary from one practice to another, depending on many factors. OCR has suggested that one way to safeguard files is to have a separate locked chart room. Some other "reasonable" ways to safeguard charts include:

• Physical barriers to access. Many offices have their chart files located behind the reception desk, not easily accessible to patients or nonoffice personnel.
• An inexpensive "authorized personnel only" sign that clearly indicates the chart area is off limits.
• Training staff to recognize when a patient, repair person, or other unauthorized individual is loitering by the chart files and to gently escort them to a less exposed area.
• Clearly communicating to janitorial staff that they are not for any reason permitted to take charts out of the file cabinets.

Do you have other questions about HIPAA compliance? Sign up for CMA’s Total HIPAA Compliance Workshop today and get the answers you need. Co-hosted by your local county medical associations, the workshops are being held from now through April 15th, 2003. To find a workshop near you, click here .

Contact: CMA's HIPAA Hotline, 415/882-3311 or legalinfo@cmanet.org.

Previous HIPAA Tips:

How Sharp are Your HIPAA Tools?

HIPAA Tip: Security Rule Delay

HIPAA Tip: Sign-In Sheets

HIPAA Tip: Using Patient Names

HIPAA Tip: Using Reminder Postcards

HIPAA Tip: Extension Does Not Apply to Privacy Rule

HIPAA Tip: Inpatient/Outpatient Privacy Notice Requirements Differ

HIPAA Tip: The Extension Deadline Has Passed—Now What?