Email-fax-phi-v1.0-22310.doc Page 1 of 18
How To Communicate with the HIS Project Team
This guide is intended to provide you with support for communicating with the HIS Project Team. There may be instances where the HIS Project Team will require additional information from your local agency. This additional information may include protected health information (PHI); therefore, this resource will provide the necessary steps for submitting PHI to the HIS Project Team.
In this document, you will learn how to:
Identify what is Protected Health Information Communicate with the HIS Project Team Email Protected Health Information Fax Protected Health Information
Download TrueCrypt encryption software Encrypt files using TrueCrypt
Protected Health Information (PHI)
Before discussing the process of communicating with the HIS Project Team, it is important that you understand what constitutes Protected Health Information (PHI).
According to ConsumerAllianceUSA.org, protected health information means “individually identifiable health information collected electronically, orally, or via paper. Protected health information includes information such as the patient’s name, social security number, telephone number, medical record number, address, including ZIP code as well as medical records.”
The Privacy Rule protects certain information that covered entities use and disclose. This information is called protected health information (PHI), which is generally individually identifiable health information that is transmitted by, or maintained in, electronic media or any other form or medium. This information must relate to 1) the past, present, or future physical or mental health, or condition of an individual; 2) provision of health care to an individual; or 3) payment for the provision of health care to an individual. If the information identifies or provides a reasonable basis to believe it can be used to identify an individual, it is considered individually identifiable health information.
Email-fax-phi-v1.0-22310.doc Page 2 of 18
Communicating with the HIS Project Team
All communication directed to the HIS Project Team must be initiated through the DHHS Customer Service Center so that a Remedy ticket can be created for this issue/question. The Remedy ticket ensures a streamline mechanism for capturing and addressing issues/questions, and helps to minimize the risk of your issues/questions not being addressed. The steps below outline the communication process.
1. Submit your HIS comment/question/issue to the DHHS Customer Service Center. Email: DHHS.Customer.Support.Center@dhhs.nc.gov
2. Telephone Number: 919-855-3200, option 5
3. DHHS Customer Service Center will input your request in the Remedy system, which will generate a ticket. This ticket will be assigned to the appropriate HIS Help Desk person. You will receive notification that a Remedy ticket has been created.
4. If additional information is needed, you will be contacted by the HIS Project Team.
NOTE: If the HIS Project Team requires additional information, a Help Desk member will contact you via email or phone.
Email-fax-phi-v1.0-22310.doc Page 3 of 18
Emailing PHI
Due to privacy rules, protected health information (PHI) cannot be distributed through email or online file sharing sites without being protected. At a minimum, you MUST password protect your files using the password protection feature in Microsoft Word. The HIS Project Team encourages that you encrypt PHI as this provides a greater level of security. To ensure that encrypted PHI is accessible to all necessary persons, the HIS Project Team has identified a free encryption software (TrueCrypt) to be used.
NOTE: If the information requested does not contain PHI, you do not need to password protect or encrypt the file.
1. Protect/encrypt your file if the additional information requested contains PHI.
NOTE: See the steps below for protecting your file using MS Word Password Protection option or using the recommended encryption option.
2. Respond to the email submitted to you requesting the additional information. 3. Attach the encrypted PHI file to the email.
4. Submit the email.
Emailing PHI – Password Protected document 1. Open the MS Word document to be protected. 2. Select Tools > Options from the menu. The
Options dialog box will display.
3. Select the Security tab in the Options dialog box.
4. In the Filing Sharing Options section, enter a password in the Password to open field. Note: Use the “standard” password. If you are not familiar with the “standard” password, contact DHHS Customer Service.
5. Click OK.
6. Re-enter the password in the Confirm Password dialog box and click OK. 7. Save and close the document.
Emailing PHI – Encryption procedure (Recommended)
1. Download and install TrueCrypt.
Email-fax-phi-v1.0-22310.doc Page 4 of 18
Faxing PHI
All agencies, including the HIS Project Team should have internal procedures for handling faxes in a timely manner and the physical location of the fax machine should be in a secured area.
HIS Project Fax: 919-870-4851
1. Prepare a cover letter that identifies the following: Contact Person
Contact Number and/or Email Number of pages included in the fax 2. Submit the fax to the HIS Project Team.
3. The requesting member of the HIS Project Team will contact you with receipt of the requested fax. If you have not received confirmation, please contact the DHHS Customer Service Center.
TrueCrypt - Download
TrueCrypt is a free open-source disk encryption software for Windows (7, Vista, and XP), MAC OS X and Linux.
Visit the TrueCrypt website to download the executable file. http://www.truecrypt.org/downloads
CAUTION
Email-fax-phi-v1.0-22310.doc Page 5 of 18
TrueCrypt – Step-by-Step Instructions
TrueCrypt is a free encryption software application that is used by the HIS Project Team and the HIS vendor. The intent of TrueCrypt is to allow local agencies, the HIS Project Team and the HIS vendor to communicate and troubleshoot issues as needed.
The steps outlined below will provide you instructions on how to use TrueCrypt. For more detail information, please visit the TrueCrypt – Documentation page.
1. Double-click the TrueCrypt shortcut icon on your Desktop. The TrueCrypt main window displays.
NOTE: If no shortcut exists, go to Start > Programs > TrueCrypt > TrueCrypt to initiate the application.
Email-fax-phi-v1.0-22310.doc Page 6 of 18 2. Click . The TrueCrypt Volume Creation Wizard displays.
Figure 2: TrueCrypt Volume Creation Wizard
3. Leave the default selection Create an encrypted file container selected. 4. Click . The Volume Type window displays.
Figure 3: TrueCrypt Volume Type window
Email-fax-phi-v1.0-22310.doc Page 7 of 18 6. Click . The Volume Location window displays.
Email-fax-phi-v1.0-22310.doc Page 8 of 18 7. Click . The Specify Path and File Name dialog box displays.
NOTE: Consider a volume to be equivalent to a folder. You must create a volume to store files that you want encrypted. In Figure 5, My Documents is where we will be creating our volume. You are not required to use the My Document folder. The key is to remember where you save your volume.
Figure 5: Specify Path and File Name dialog box
8. Enter the name of your volume file in the File name field. NOTE: For these steps, a volume called “Instruction” is created.
Email-fax-phi-v1.0-22310.doc Page 9 of 18 9. Click . The Volume Location window displays with the volume location noted.
Figure 7: TrueCrypt Volume Location window
10. Click . The Encryption Options window displays.
Figure 8: TrueCrypt Encryption Options window
Email-fax-phi-v1.0-22310.doc Page 10 of 18 12. Click . The Volume Size window displays.
NOTE: The Volume Size window is where you will specify your volume size. For our example 1 GB will be used. Your volume size is dependent upon the files you place within the volume. Remember, your volume is a container. You will eventually place the files that require
encryption within this container.
Figure 9: TrueCrypt Volume Size window
Email-fax-phi-v1.0-22310.doc Page 11 of 18 14. Click . The Volume Password window displays.
Figure 9: TrueCrypt Volume Password window 15. In the Password field, enter the “standard” password. 16. In the Confirm field, enter the “standard” password again.
NOTE: If you are not familiar with the “standard” password, please contact the Customer Service Center at 919-855-3200 option 5.
17. Click . The TrueCrypt Volume Created Wizard dialog box displays due to the short password entered in steps 15 and 16. Click the Yes button to continue. The Volume Format window displays.
Email-fax-phi-v1.0-22310.doc Page 12 of 18 18. Move your mouse randomly over the Volume Format window.
NOTE: This mouse movement strengthens the encryption keys for your volume. You only need to move your mouse for approximately 5 – 10 seconds over the Volume Format window.
Figure 11: TrueCrypt Volume Format window 19. Click .
NOTE: In the Volume Format window, the system will begin formatting your newly created volume. Once complete, you will receive a TrueCrypt Volume Creation Wizard dialog box indicating the process is successfully complete. Click the OK button to continue.
Email-fax-phi-v1.0-22310.doc Page 13 of 18 20. The Volume Created window displays, which indicates that you have successfully created a
volume. Click to close the TrueCrypt Wizard. NOTE: The TrueCrypt Main Window is now visible. 21. Select a Drive from the TrueCrypt Main Window.
NOTE: For this example, the “M” drive is selected. You can select any drive listed in the Main window when performing these steps.
Email-fax-phi-v1.0-22310.doc Page 14 of 18 22. Select . The Select a TrueCrypt Volume window displays.
NOTE: Return to the location where you created your volume. In the earlier steps, we created a volume in My Documents. In Figure 15, the “Instruction” volume is now available to add any files that require encryption. Again, your volume is a container. All files that require encryption should be included within the volume.
Figure 15: Select a TrueCrypt Volume window 23. Select your volume file.
Email-fax-phi-v1.0-22310.doc Page 15 of 18 24. Click . The TrueCrypt Main Window displays.
NOTE: In the Volume field, the volume file location path is now visible.
Figure 16: Select a TrueCrypt Main Window
25. Click . The Enter password dialog box displays.
NOTE: Mounting allows you to add files to the volume. You will not be able to add files unless the volume file is mounted. This is an important step as this is how your files become encrypted.
Email-fax-phi-v1.0-22310.doc Page 16 of 18 26. Enter the password you created for this volume in step 15 and click .
NOTE: The TrueCrypt Main Window displays. The virtual disk is entirely encrypted (including file names, allocation tables, free space, etc.) and behaves like a real disk. You can save (or copy, move, etc.) files to this virtual disk and they will be encrypted on the fly.
Email-fax-phi-v1.0-22310.doc Page 17 of 18 27. Save the file(s) that require encryption to the “virtual” drive. .
NOTE: Once mounted, a new “virtual” drive is available on your computer. Saving a file to this “virtual” drive follows the same process as if you were saving a file to your C: drive or shared network drive. You can access this “virtual” drive only when you have mounted the “virtual” drive. The “M:” drive was selected for this instruction. You may have a different “virtual” drive letter depending upon the “virtual” drive you selected in step 21.
Email-fax-phi-v1.0-22310.doc Page 18 of 18 28. After saving all files to the “virtual” drive that require encryption, click .
NOTE: When you dismount, you close your “virtual” drive. When the “virtual” drive is closed, the files within your volume are now inaccessible. The TrueCrypt Main Window displays.
Figure 19: TrueCrypt Main Window
29. You may now distribute your volume file, which contains PHI to the appropriate person or team. NOTE: In the earlier steps provided, the “Instructions” volume was saved in the My Documents folder. You can access the volume and attach it to either an email, burn to a CD/DVD or upload the volume file to an online file sharing site as the PHI information is now encrypted. All files placed within the encrypted Volume will automatically be included. Access to the encrypted volume can be done outside of TrueCrypt; however, no one will be able to enter the encrypted volume without TrueCrypt and correct password.