Describe the application of learning theories

/in /by
Discussion
Module 5 DQ 1 and DQ 2
Tutor MUST have a good command of the English language
These are two discussion questions
Your DQ1 and DQ2 posts must be at least 150 words and have at least one reference cited for each question. In-text citation, please
Tutor MUST have a good command of the English language
These are two discussion questions
Your DQ 1 and DQ 2 posts must be at least 150 words and have at least one reference cited for each question. In-text citation, please
DQ 1
Learning theories have implications for advanced practice nurses outside the classroom. Share an example describing the application of learning theory or theories to develop a program targeting change to a specific organizational issue, patient lifestyle, or specific unhealthy behaviors
DQ 2
Learning theories have implications for advanced practice nurses outside the classroom. Share an example describing the application of learning theory or theories to develop a program targeting change to a specific organizational issue, patient lifestyle, or specific unhealthy behaviors

Discuss the security components, vulnerabilities, and security mitigation strategies.

/in /by

Discussion
THE HEALTH CARE ORGANIZATION’S SECURITY PROGRAM
The realization of any of the threats discussed in the previous section can cause significant damage to the organization. Resorting to manual operations if the computers are down for days, for example, can lead to organizational chaos. Theft or loss of organizational data can lead to litigation by the individuals harmed by the disclosure of the data and HIPAA violations. Malware can corrupt databases, corruption from which there may be no recovery. The function of the health care organization’s security program is to identify potential threats and implement processes to remove these threats or mitigate their ability to cause damage. The primary challenge of developing an effective security program in a health care organization is balancing the need for security with the cost of security. An organization does not know how to calculate the likelihood that a hacker will cause serious damage, or a backhoe will cut through network cables under the street. The organization may not fully understand the consequences of being without its network for four hours or four days. Hence, it may not be sure how much to spend to remove or reduce the risk. Another challenge is maintaining a satisfactory balance between health care information system security and health care data and information availability. As we saw in Chapter Two, the major purpose of maintaining health information and health records is to facilitate high-quality care for patients. On the one hand, if an organization’s security measures are so stringent that they prevent appropriate access to the health information needed to care for patients, this important purpose is undermined. On the other hand, if the organization allows unrestricted access to all patient-identifiable information to all its employees, the patients’ rights to privacy and confidentiality would certainly be violated and the organization’s IT assets would be at considerable risk. The ONC (2015) publication Guide to Privacy and Security of Electronic Health Information for health care providers includes a chapter describing a seven-step approach for implementing a security management process. The guidance is directed at physician practices or other small health care organizations, and it does not include specific technical solutions. Specific solutions for security protection will be driven by the organization’s overall plan and will be managed by the organizations IT team. Larger organizations must also develop comprehensive security programs and will follow the same basic steps, but it will likely have more internal resources for security than smaller practices. Each step in the ONC security management process for health care providers is listed in the following section.
Step 1: Lead Your Culture, Select Your Team, and Learn This step includes six actions:
1. Designate a security officer, who will be responsible for developing and implementing the security practices to meet HIPAA requirements and ensure the security of PHI.
2. Discuss HIPAA security requirements with your EHR developer to ensure that your system can be implemented to meet the security requirements of HIPAA and Meaningful Use.
3. Consider using a qualified professional to assist with your security risk analysis. The security risk analysis is the opportunity to discover as much as possible about risks and vulnerabilities to health information within the organization.
4. Use tools to preview your security risk analysis. Examples of available tools are listed within Step 3.
5. Refresh your knowledge base of the HIPAA rules.
6. Promote a culture of protecting patient privacy and securing patient information. Make sure to communicate that all members of the organization are responsible for protecting patient information.
Step 2: Document Your Process, Findings, and Actions
Documenting the processes for risk analysis and implementation of safeguards is very important, not to mention a requirement of HIPAA. The following are some examples cited by the ONC of records to retain:
• Policies and procedures
• Completed security checklists (ESET, n.d.)
• Training materials presented to staff members and volunteers and any associated certificates of completion
• Updated business associate (BA) agreements
• Security risk analysis report
• EHR audit logs that show utilization of security features and efforts to monitor users’ actions • Risk management action plan or other documentation that shows appropriate safeguards are in place throughout your organization, implementation timetables, and implementation notes
• Security incident and breach information
Step 3: Review Existing Security of ePHI (Perform Security Risk Analysis)
Risk analysis assesses potential threats and vulnerabilities to the “confi dentiality, integrity and availability” (ONC, 2015, p. 41) of PHI. Several excellent
Table 9.3 Resources for conducting a comprehensive risk analysis

OCR’s Guidance on Risk the HIPAA Rule Analysis Requirements under HIPAA rules http ://www.hhs.gov/hipaa/for-professionals/security/ guidance/final-guidance-risk-analysis/index.html
OCR Security Rule Frequently Asked Questions (FAQs) http://www.hhs.gov/hipaa/for-professionals/faq
ONC SRA (Security Risk Assessment) Tool for small security-risk-assessment practices https://www.healthit.gov/providers-professionals/security-risk-assessment
National Institute of Standards and Technology (NIST) HIPAA Security Rule Toolkit https://scap.nist.gov/hipaa/

government-sponsored guides and toolsets available for conducting a comprehensive risk analysis are listed in Table 9.3 with a corresponding web address. The three basic actions recommended for the organization’s first comprehensive security risk analysis are as follows:
1. Identify where ePHI exists.
2. Identify potential threats and vulnerabilities to ePHI.
3. Identify risks and their associated levels.
Step 4: Develop an Action Plan
As discussed, the HIPAA Security Plan provides flexibility in how to achieve compliance, which allows an organization to take into account its specific needs. The action plan should include five components. Once in place, the plan should be reviewed regularly by the security team, led by the security officer.
1. Administrative safeguards
2. Physical safeguards
3. Technical safeguards
4. Organizational standards
5. Policies and procedures
Table 9.4 lists common examples of vulnerabilities and mitigation strategies that could be employed.
Table 9.4 Common examples of vulnerabilities and mitigation strategies

Security component Examples of vulnerabilities Examples of security mitigation startigies
Administrative safeguards No security officer is designated.
Workforce is not trained or is unaware of privacy and security issues.		 Security offers is designed and publicized.
Workforce training begins at hire and is conducted on a regular and frequent basis.
Security risk analysis is performed periodically and when a change occurs in the practice or the technology
Physical safeguards Facility has insufficient locks and other barriers to patient data access.
Computer equipment is easily accessible by the public.
Portable devices are not tracked or not locked up when not in use		 Building alarm system are installed.
Offices are locked.
Screens are shielded from secondary viewers.
Technical safeguards Poor controls enable inappropriate access to EHR.
Audit logs are not used enough to monitor users and other HER activities.
No measures are in place to keep electronic patient data from improper changes.
No contingency plan exists.
Electronic exchanges of patient information are not encrypted or otherwise secured.		 Secure users’ IDs, passwords and appropriate role-based access are used.
Routine audits of access and changes to EHR are conducted.
Anti-hacking and anti-malware software are installed.
Contingency plans and data backup plans are in place.
Data are encrypted.
Organizational standards No breach notification and associated policies exist.
BA agreements have not been updated in several years.		 Regular reviews of agreements are conducted, and updates made accordingly.
Policies and procedures Generic written policies and procedures to ensure HIPAA security compliance were purchased but not followed.
The manager performs ad hoc security measures.		 Written policies and procedures are implemented, and staff members are trained.
Security team conducts monthly review of user activities.
Routine updates are made to document security measures.

Step 5: Manage and Mitigate Risks
The security plan will reduce risk only if it is followed by all employees in the organization. This step has four actions associated with it.
1. Implement your plan.
2. Prevent breaches by educating and training your workforce.
3. Communicate with patients. 4. Update your BA contracts.
Step 6: Attest for Meaningful Use Security Related Objective
Organizations can attest to the EHR Incentive Program security-related objective after the security risk analysis and correction of any identified deficiencies.
Step 7: Monitor, Audit, and Update Security on an Ongoing Basis
The security officer, IT administrator, and EHR developer should work together to ensure that the organization’s monitoring and auditing functions are active and configured appropriately. Auditing and monitoring are necessary to determine the adequacy and effectiveness of the security plan and infrastructure, as well as the “who, what, when, where and how” (ONC, 2015, p. 54) patients’ ePHI is accessed.
Assignment:
The healthcare organization’s security program (Wager et al., 2017, pp. 1-5), is a critical component to compliance with regulations as well as HIPAA.
· Describe the steps involved in a security program.
· Evaluate the risk analysis requirements for HIPAA using the websites furnished in the text.
· Discuss the security components, vulnerabilities, and security mitigation strategies.
· Summarize the management action plan and the ultimate goal of conducting such an assessment.
Outline:
· Introduction
· Team Selection
· Documentation
· Security Risk Analysis
· Action Plan
· Manage and Mitigate Risks
· Conclusion
Your paper should include the following:
· 3-5 pages in length, not including the title and reference pages.
· 4-6 references cited in the assignment.
· All facts must be supported; in-text references used throughout the assignment.
· Formatted according to APA writing guidelines
· No plagiarism

Evaluate the healthcare information system acquisition process

/in /by

CASE STUDY:
Replacing an EHR System
Valley Practice provides patient care services at three locations, all within a fifteen-mile radius, and serves nearly one hundred thousand patients. Valley Practice is owned and operated by seven physicians; each physician has an equal partnership. In addition to the physicians, the practice employs nine nurses, fifteen support staff members, a business officer manager, an accountant, and a chief executive officer (CEO). During a two-day strategic planning session, the physicians and management team created a mission, vision, and set of strategic goals for Valley Practice. The mission of the facility is to serve as the primary care “medical home” of individuals within the community, regardless of the patients’ ability to pay. Valley Practice wishes to be recognized as a “high-tech, high-touch” practice that provides high-quality, cost- effective patient care using evidence-based standards of care. Consistent with its mission, one of the practice’s strategic goals is to replace its legacy EHR with an EHR system that adheres to industry standards for security and interoperability and that fosters patient engagement, with the long-term goal of supporting health fitness applications. Dr. John Marcus, the lead physician at Valley Practice, asked Dr. Julie Brown, the newest partner in the group, to lead the EHR project initiative. Dr. Brown joined the practice two years ago after completing an internal medicine residency at an academic medical center that had a fully integrated EHR system available in the hospital and its ambulatory care clinics. Of all the physicians at Valley Practice, Dr. Brown has had the most experience using EHR applications via portable devices. She has been a vocal advocate for migrating to a new EHR and believes it is essential to enabling the facility to achieve its strategic goals. Dr. Brown agreed to chair the project steering committee. She invited other key individuals to serve on the committee, including Dr. Renee Ward, a senior physician in the practice; Mr. James Rowls, the CEO; Ms. Mary Matthews, RN, a nurse; and Ms. Sandy Raymond, the business officer manager. After the project steering committee was formed, Dr. Marcus met with the committee to outline its charge and deliverables. Dr. Marcus expressed his appreciation to Dr. Brown and all of the members of the committee for their willingness to participate in this important initiative. He assured them that they had his full support and the support of the entire physician team. Dr. Marcus reviewed with the committee the mission, vision, and strategic goals of the practice as well as the committee’s charge. The committee was asked to fully investigate and recommend the top three EHR products available in the vendor community. He stressed his desire that the committee members would focus on EHR vendors that have experience and a solid track record in implementing systems in physician practices similar to theirs and that have Office of the National Coordinator for Health Information Technology (ONC)–certified EHR products. He is intrigued with the idea of cloud-based EHR systems provided they can ensure safety, security, and confidentiality of data; are reliable and scalable; and have the capacity to convert data easily from the current system into the new system. The vendor must also be willing to sign a business associates’ agreement ensuring compliance with HIPAA security and privacy regulations. Dr. Marcus is also interested in exploring what opportunities are available for health information exchange within the region. He envisions that the practice will likely partner with specialists, hospitals, and other key stakeholders in the community to provide coordinated care across the continuum under value-based reimbursement models. Under the leadership of Dr. Brown, the members of the project steering committee established five project goals and the methods they would use to guide their activities. Ms. Moore, the consultant, assisted them in clearly defining these goals and discussing the various options for moving forward. They agreed to consider EHR products only from those vendors that had five or more years of experience in the industry and had a solid track record of implementations (which they defined as having done twenty-five or more). Dr. Ward, Mr. Rowls, and Ms. Matthews assumed leadership roles in verifying and prioritizing the requirements expressed by the various user groups. The five project goals were based on Valley Practice’s strategic goals. These project goals were circulated for discussion and approved by the CEO and the physician partners. Once the goals were agreed on, the project steering committee appointed a small task group of committee members to carry out the process of defining system functionality and requirements. Because staff time was limited, the task group conducted three separate focus groups during the lunch period—one with the nurses, one with the support staff members, and a third with the physicians. Ms. Moore, the consultant, conducted the focus groups, using a semi-structured nominal group technique. Concurrently with the requirements definition phase of the project, Mr. Rowls and Dr. Brown, with assistance from Ms. Moore, screened the EHR vendor marketplace. They reviewed the literature, consulted with colleagues in the state medical association, and surveyed practices in the state that they knew used state-of-the-art EHR systems. Mr. Rowls made a few phone calls to chief information officers (CIOs) in surrounding hospitals who had experience with ambulatory care EHR to get their advice. This initial screening resulted in the identification of eight EHR vendors whose products and services seemed to meet Valley Practice’s needs. Given the fairly manageable number of vendors, Ms. Moore suggested that the project steering committee use a short-form RFP. This form had been developed by her consulting firm and had been used successfully.


Requirements:

(From the case study “Replacing an EHR System” on pages 1, 2)

· Evaluate the healthcare information system acquisition process as if you were preparing to initiate those activities

· Use this study as a background for developing the hypothetical project scope, vendor selection process, determine the system goals and requirements, discuss the RFP process, vendor evaluation process including the evaluation criteria and a cost-benefit analysis.

· Discuss project management tools that will help you accomplish this task and conduct a risk analysis of what can go wrong during a healthcare information system acquisition.

Outline:

· Introduction

· Project Steering Committee

– Scope

– System Requirements

· Request for Proposal (RFP)

· Vendor Proposals

· Cost-benefit Analysis

· Recommendations

· Conclusion

Your paper should include the following:

· 3-5 pages in length, not including the title and reference pages.

· Provide 4 or more references to support your statements.

· All facts must be supported; in-text references must be used throughout the assignment and must be included in an APA-formatted reference list.

· Formatted according to APA writing guidelines

· No plagiarism

Cost and staff involved in using Telehealth technology

/in /by

Discussion
Case Study Topic: Meeting The Health Needs For Mrs. Smith

Directions:
1. To complete this assignment:
· Read the case study above.
· Assume the role as the Public Relations Director for Purple Cross of North Carolina.
o The CEO directs you to interview the Telehealth Director regarding the use of Telehealth with Mrs. Smith. The CEO directs you to create one thought-provoking question for each of the following topics:
· Meeting the health needs of Mrs. Smith
· Decision-making process for technology selected for Mrs. Smith
· Benefits and risks in using Telehealth technology for Mrs. Smith
· Cost and staff involved in using Telehealth technology for Mrs. Smith
o Note: Your questions must be original; not copied or modified from any source, including your textbook. Your questions cannot simply rephrase the topic.
o For each question, the CEO requires that you provide your rationale. Describe how the question will yield a thorough response, and not simply a “yes” or “no” answer.
· Any cited sources to support your rationale statements must be identified, using APA formatting.
· Prior to submission, review your responses to ensure that they contain no spelling or grammatical errors.
2. Submit the Week 4 Assignment via Blackboard by clicking on the “Week 4 Assignment” link.
3. Include the proper file naming convention:
· CMP105_wk4_assn_jsmith_mmddyyyy.
For each topic, write your question and rationale.
Topic: Meeting the health needs for Mrs. Smith
Your question:
[Write your response here.]
Rationale:
[Write your response here.]
Topic: Decision-making process for technology selected for Mrs. Smith
Your question:
[Write your response here.]
Rationale:
[Write your response here.]
Topic: Benefits and risks in using Telehealth technology for Mrs. Smith
Your question:
[Write your response here.]
Rationale:
[Write your response here.]
Topic: Cost and staff involved in using Telehealth technology for Mrs. Smith
Your question:
[Write your response here.]
Rationale:
[Write your response here.]