UPI Study › Courses › Healthcare Organization and Management › Free lessons › Lesson 10.4 Free with a free account
Data Quality, Security Policies, and Breach Management
Healthcare Organization and Management · Chapter 10: Health Informatics and Technology ManagementSection 10.4 · lesson 62 of 10511 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Healthcare Organization and Management.
Lesson complete
Earn the 3 college credits for Healthcare Organization and Management
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Safeguarding Patient Privacy in Digital Healthcare →← Electronic Health Records: Adoption and Patient SafetyNext lesson: Safeguarding Patient Privacy in Digital Healthcare →
In this lesson
Keeping health data accurate and secure, and responding to breaches.
- Describe six dimensions of data quality and the role of a data dictionary
- Explain the HIPAA Security Rule's administrative, physical, and technical safeguards
- Distinguish a security incident from a reportable breach
- Outline a manager's first steps and the HIPAA breach notification deadlines
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,402 words). Read along, or search it.
Opening Case
A Report Sent to Forty People
Thursday afternoon. Gwen Harper, Larkfield's director of care management, learns that this morning's monthly report went to the wrong email list. It includes a patient-level appendix. It should have gone to six people. It went to about forty, picked from a list with a similar name. Her first thought: they're all employees, all bound by confidentiality, and nobody outside saw it. So surely it isn't really a breach? Is she right, and is it even her call?
Data Quality
Fitness for the Intended Use
That report already had trouble the week before. Its readmission count didn't match the one from Farah Siddiqui's quality department. Data quality is how fit data is for the purposes it's used for. It's defined against use, so a record can be fine for the visit and wrong for next year's report. A widely used set of six dimensions makes this precise: accuracy, completeness, consistency, timeliness, validity, and uniqueness.
Six Dimensions
Valid Data Can Still Be Wrong
Accuracy: does the value match the fact? Completeness: is what should be there, there? Consistency: is one fact recorded the same way everywhere? Timeliness: is it available soon enough to use? Validity: does it fit the field's format and range? Uniqueness: does each real patient appear once, and only once? Validity and accuracy get confused most. A birth date of March 3, 1961, for a patient born in 1916, is perfectly valid, and wrong. Systems can enforce validity automatically. They can't enforce accuracy at all, which is why validation rules give false comfort.
Costs of Poor Data
Reporting, Billing, and Clinical Harm
Poor quality costs in three places. In reporting, numbers mislead both ways. Once a report is shown to be wrong, people discount every report after it, even accurate ones. In billing, incomplete or inconsistent capture gets claims rejected or underpaid, so a data problem shows up as a finance problem, and gets investigated as one. And in clinical decisions, a partial or duplicated record gives someone an incomplete picture they reasonably think is complete. That's the most serious, and the hardest to trace.
Data Governance
Dictionaries, Owners, and Stewards
Gwen's mismatch is definition drift: the same term slowly meaning different things in different places. Her team counts any hospital return within thirty days. Quality counts only returns to Larkfield. The control is a data dictionary: each element's agreed definition, allowed values, source, owner, and rules. A disputed number is settled by what was agreed, not by who argues longest. Behind it sits data governance. A data owner, a senior leader, approves definitions and new uses. A data steward handles day-to-day quality and the dictionary entries. And there must be a process for approving new uses of existing data, where governance most often fails.
Quick Check
Vital Signs Entered Too Late
Quick check. On 4 North, vital signs are entered correctly, but in one batch at the end of each shift. So the morning bed meeting's report still shows overnight patients as unstable. Which dimension fails? Pause, and decide. Timeliness. The values are right once entered, but they arrive too late for the meeting that uses them. Accuracy is tempting, because the report looks wrong. But every value matches the fact it records. The problem is when it shows up.
HIPAA Security Rule
Administrative, Physical, and Technical Safeguards
Now security. Kenji Watanabe walks through the HIPAA Security Rule, which protects electronic health information and organizes safeguards in three categories. Administrative safeguards are the policies, assigned responsibilities, risk analysis, training, and sanctions that govern how people handle information. A risk analysis is required. Physical safeguards control access to buildings, workstations, devices, and media: locked areas, screen placement, and safe disposal. Technical safeguards are built into systems: unique user IDs, authentication, access controls, audit logs, and protection in transmission. Under the rule, encryption is addressable, not automatically required. Much of the protection is administrative and physical, run by operational leaders. And a suspected technical weakness gets reported through the defined route, not investigated by the manager.
Access Control
Role-Based Access and Periodic Reviews
Access is where managers matter most. Role-based access grants permissions by what a job requires, so access can be reviewed, and joiners and leavers are routine. The minimum necessary standard says people should see only the information their role needs, with exceptions in the law, such as sharing for treatment. The real failure isn't the first assignment. It's accumulation. Staff change roles, old access is rarely removed, and long-serving people collect permissions nobody intended. The control is a periodic access review: each manager confirms, person by person, that access matches the current role. It's dull, unpopular, and the most effective tool a manager has.
People and Partners
Training and Business Associates
A large share of exposures involve people, not technology: information sent to the wrong person, discussed where it's overheard, or left on view. So training matters, but annual click-through training mostly fails. What counts is whether staff recognize a situation as the one the policy was written for. And obligations don't stop at the hospital's edge. A business associate creates, receives, keeps, or sends protected information on the hospital's behalf, under a written agreement with safeguards and breach-reporting duties. The usual gap is a convenient local tool or arrangement that never went through that process. A manager's best move is routing it there before it starts.
Incident vs. Breach
The Presumption of a Breach
Back to Gwen's Thursday. A security incident is any suspected or actual unauthorized access, use, or disclosure. A breach is the subset that requires notification under the law. Under HIPAA, an impermissible disclosure is presumed to be a breach, unless a documented risk assessment shows a low probability that the information was compromised. That assessment weighs these factors: what information was involved, who received it, whether it was actually viewed, and how far the risk was reduced. And it belongs to a designated official, here Samuel Ndiaye as privacy officer. Not to the person who found the problem, and not to their manager. An internal disclosure isn't automatically safe.
First Hour
Report, Contain, and Preserve
So Gwen acts in the first hour. She reports it to Samuel through the defined route: what was sent, to whom, when, and what it contained. She takes containment steps within her authority. She asks the email team about recall, and tells the forty recipients to delete it unopened and confirm. It's imperfect, but it creates a record. She preserves the sent message and the list, instead of tidying anything. And she tells her team member what happens next, with no discipline attached, so her department keeps reporting. What she doesn't do: decide the outcome, investigate who opened what, or wait for a fuller picture before reporting.
Notification Rules
Deadlines for Breach Notification
If Samuel concludes it is a breach, the law sets deadlines. Affected individuals must be told without unreasonable delay, and no later than sixty calendar days after discovery. HHS must be told too: alongside the individuals if five hundred or more people are affected, otherwise in a yearly log. Media notice applies above five hundred residents of a state. State laws can add duties or shorter deadlines, so the hospital's own procedure governs. The reasoning is documented either way, even when no notice is needed. And the notice itself counts. It should be fast, plain, honest about what's known and not yet known, and offer a way to reach a real answer. Defensive first statements do lasting damage.
Quick Check
A Discharge Summary Faxed to a Dentist
Quick check. A Larkfield nurse faxes a discharge summary to a wrong number, a local dental office. The office says it shredded the pages. What should her manager do first? Pause, and decide. Escalate it now, to the privacy officer. The shredding helps the risk assessment, but the manager doesn't get to run that assessment. Finding out who saw it first is tempting, because it feels thorough. But it delays the report while the notice clock is already running.
Case Resolved
Renamed Lists and a Secure Folder
So, was Gwen right? Her first thought, all employees, no harm done, was exactly the reasoning she wasn't entitled to finish. Samuel runs the assessment, and documents his reasoning, whatever the answer. The review then asks what condition allowed it. Two email lists had nearly identical names, and the patient appendix traveled as an attachment. The fix: renamed lists, and the appendix moves to a secure folder, with access limited to the six people who need it. Gwen's math was simple. Reporting a non-breach costs Samuel a little time. Not reporting a real one misses a legal duty, with the clock already running.
Key Takeaways
Quality, Safeguards, and Incident Steps
To recap. Quality means data fit for its use, across six dimensions. Validity isn't accuracy, and a data dictionary stops definitions drifting. Administrative, physical, and technical safeguards protect electronic information, mostly through people and places. Review access regularly against each person's current role. And in an incident: report, contain, and preserve. The privacy officer decides.
About Healthcare Organization and Management at UPI Study
Healthcare Organization and Management (Health 302) is a self-paced online course of 105 video lessons in 18 chapters, from health systems and the law to ethics, leadership, teams, strategy, informatics, finance, quality, human resources, marketing and evidence-based practice. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Health courses Every course with PRO →
Why take it here
Why students take Healthcare Organization and Management with UPI Study
Where the credit goes
Universities that work with NCCRS
Healthcare Organization and Management carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Data Quality, Security Policies, and Breach Management
What are the six dimensions of data quality?
What are the three types of safeguards in the HIPAA Security Rule?
Is an accidental disclosure to other employees a HIPAA breach?
What are the HIPAA breach notification deadlines?
About the Healthcare Organization and Management course
How many college credits is Healthcare Organization and Management?
How much does Healthcare Organization and Management cost and what is included?
Which universities accept UPI Study credits?
How long does Healthcare Organization and Management take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Healthcare Organization and Management.
105 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →