The role of ERP in PHI and financial data security

Protected Health Information (PHI) is commonly associated with clinical care but its influence extends into healthcare financial management, especially in non-acute settings like ambulatory clinics, radiology centers and nursing facilities. For financial teams, PHI is essential for billing, refunds, and revenue cycle management.

A recent study by Sage Intacct and Porter Research uncovered a significant knowledge gap among finance professionals in non-acute healthcare settings, heightening HIPAA violation risks. One major finding was that many finance teams don’t fully grasp which types of information are considered PHI.

While most respondents understood that clinical records like images or prescriptions fall under PHI, far fewer recognized that financial records can also be classified as such under HIPAA.

While it’s easy to think of PHI as clinical in nature, HIPAA defines PHI as any individually identifiable health information used in treatment, payment and healthcare operations.

Understanding this broad definition is crucial as even standard tasks like issuing patient refunds or verifying billing accuracy often require PHI. In fact, 71% of respondents mistakenly believed their financial systems did not utilize PHI.

Companies currently rely on policies and training over technology

82% of non-acute organizations primarily rely on written policies and staff training as their main defense against data breaches. However, human error remains a significant risk, with research showing people make 100x more data errors compared to automated data entry, proving policies alone cannot prevent accidental or intentional data misuse.

Without software systems to enforce these policies even the most well-trained staff may mishandle PHI. Modern, HIPAA-compliant accounting systems or modules can minimize these risks by automating aspects of data security, such as enforcing access controls, logging interactions with PHI, and alerting administrators to unusual access patterns.

The role of finance teams for PHI

Financial teams handle PHI for various operational reasons, routinely engaging with patient data in their daily tasks. The study found that 47% of finance teams now use PHI, a trend that is only expected to grow as the financial side of healthcare becomes more intertwined with patient outcomes and care delivery data. Some of these essential functions include:

• Billing and collections: Accurate billing and collections are dependent on detailed access to patient information, including diagnoses and treatments.
• Patient refunds: Processing refunds requires knowledge of the specific services provided, which involves PHI.
• Revenue cycle management: Non-acute facilities rely on PHI to measure financial performance tied to healthcare outcomes, particularly in value-based care models.

As data becomes increasingly integral to finance, comprehending and protecting PHI is crucial in preventing costly data breaches and compliance issues.

Some of the most common threats to PHI security include:

• Human error: Misidentification or mishandling of PHI often occurs when staff lacks comprehensive training; sending sensitive data to incorrect recipients is a common example of an unintentional HIPAA violation.
• Other internal threats: Inside threats where employees misuse access to PHI are significant risks. Misuse includes viewing PHI unnecessarily or improperly sharing information with unauthorized parties.
• External cybersecurity threats: Healthcare data is a prime target for cybercriminals, and non-acute facilities must guard against attacks like ransomware and phishing.

Strategies for safeguarding PHI in financial settings

To protect PHI effectively, non-acute healthcare finance teams need more sophisticated solutions. Relying solely on written policies and employee education is insufficient to mitigate all risks.

Implementing technology-based security measures can help ensure HIPAA compliance and minimize exposure to data breaches.

1. HIPAA-compliant ERP accounting systems: A modern, HIPAA-compliant accounting system or ERP finance module is crucial. These platforms can automatically enforce data protection policies and maintain detailed records of PHI access. Systems with built-
   in data encryption, role-based access controls and automated audit trails offer substantial protection and reduce reliance on human judgment alone.
2. Data audits and access monitoring: Regular data audits help identify unusual activity and prevent unauthorized access. Access monitoring tools built into modern ERP systems allow administrators to track who accessed PHI, when, and for what purpose. This monitoring is essential as it deters misuse and provides an evidence trail for compliance audits.
3. Comprehensive staff training and incident response plans: While technology is essential, training finance staff on proper handling of PHI and creating an effective incident response plan are equally vital. Training helps employees recognize and securely manage PHI. A response plan outlines how to manage a data breach,
   minimizing damage from HIPAA violations.
4. Limiting data access based on roles: Limiting PHI access based on job roles minimizes unnecessary exposure; while a billing clerk may need access to certain patient information, other financial staff may not. Role-based access built into most ERP systems allows organizations to reduce risk by ensuring only authorized personnel can view or handle PHI.

The consequences of HIPAA violations in financial settings

Violating HIPAA in financial settings can have severe repercussions, including substantial fines, reputational damage and costly lawsuits. HIPAA violation penalties can range from $100 to $50,000 per violation, with annual caps reaching $1.5 million. Class-action lawsuits and regulatory investigations can escalate these costs further.

While most financial leaders understand the reputational and financial consequences of HIPAA violations, fewer are aware of the full range of liabilities, with nearly half of the organizations surveyed lacking an incident response plan in case of a data breach.

For a deeper look into how modern, compliant financial management systems can support the secure handling of PHI, you can view this free webinar on Physician Fee Schedule Changes with Sage.