TJC Information Management Readiness Standards – What You Need to Know

The Joint Commission has updated and expanded its information management accreditation readiness standards for hospitals and related organizations. New readiness standards for information management and technology risk management are requiring hospitals to rethink how they will protect and secure sensitive information, audit, and improve continuity of operations and disaster recovery planning.

The Joint Commission evaluates the quality and safety of care for more than 15,000 healthcare organizations. To maintain and earn accreditation, organizations must have an extensive on-site review by a team of Joint Commission healthcare professionals, at least once every three years. The purpose of the review is to evaluate the organization’s performance in areas that affect care. Accreditation may then be awarded based on how well the organizations met Joint Commission standards.

Hospitals who have not met the challenge of enabling compliance with these newly enhanced standards risk the loss of reimbursements from Medicare and increased liability of insurance costs.

A healthcare organization’s IT infrastructure is at the foundation of delivering quality care. TJC recognizes this in the enhanced information management (IM) readiness standards. Among numerous other topics, TJC specifically addresses three key areas of IT risk management in the new IM standards. These include:

1. Patient record security
2. System security from intrusion and data tampering
3. Continuity of operations and disaster recovery capabilities

Now let’s take a closer look at these three TJC IM Readiness Standards.

Plan for Continuity of IM Processes (IM.01.01.03)

The hospital must have a written plan for managing interruptions to its information processes (paper-based, electronic, or a mix of paper-based and electronic). The hospital’s plan for managing interruptions to information processes must address the following:

• Plan for scheduled and unscheduled interruptions of electronic information systems
• Provide training for staff and licensed independent practitioners on alternate procedures to follow when electronic information systems are unavailable
• Have a back-up of electronic information systems
• Plan for managing interruptions to information processes is tested for effectiveness according to time frames defined by the hospital
• Implement its plan for managing interruptions to information processes to maintain access to information needed for patient care

Protect Privacy of Health Information (IM.02.01.01)

• Use health information only for purposes as required by law and regulation or further limited by its policy on privacy
• Disclose health information only by authorization from the patient or as otherwise consistent with law and regulation
• Monitor compliance with its policy on the privacy of health information

Maintain Security & Integrity of Health Information (IM.02.01.03)

• Protect against unauthorized access, use, and disclosure of health information
• Protect health information against loss, damage, unauthorized alteration, unintentional change, and accidental destruction
• Control the intentional destruction of health information
• Monitor compliance with its policies regarding the security and integrity of health information

TJC’s move to enhance its information management readiness standards is consistent with the growing number of ID theft incidents and regulatory pressures from many government and private sources. A typical hospital, for example, is subject to HIPAA regulations, PCI compliance (credit card), and often Sarbanes Oxley.

Common among these regulations and other information security best practice standards is the need to protect all patient, credit card and other confidential data from intrusion, tampering, and theft – at all times.