Policy and Procedure Manual, Term Paper Example

Kaiser Permanente’s employment policies and practices vary based on the particular job assignment. The particular policies and practices that will be discussed pertain to their postdoctoral residents, although a majority of these practices also apply to employees in other positions. Throughout the postdoctoral training, employees will be evaluated and supervision sessions will comment upon their progress on the job. At the beginning of employment, employees will enter a training program that lasts for several weeks. Residents are expected to incorporate what was learned in training into their daily practices. All employees are expected to maintain professional conduct, and if this is not met, remedial and disciplinary actions may be taken. In extreme cases, this can result in probation or termination. Throughout their employment, it is essential that they use proper documentation when visiting with patients and keep patient information confidential. In addition, residents are provided with scenarios in which they will be asked for this information and are provided with explanations for when it can and cannot be given (Arden, 2014).

Kaiser Permanente’s employment policies and practices are consistent with the security policies and practices covered by the administration domain. The employment policies emphasize the need to protect sensitive patient data, which is also a primary concern of security policies and practices. Their privacy statement specifically notes, “Our use and disclosure of an individual’s personal information is limited as required by state and federal law. We do not sell or rent personal information about visitors to this site or customers who use the site” (Kaiser Permanente, n.d.). Although Kaiser Permanente will use patient data for statistical analysis and for treatment of patients, they will not provide this information to third parties according to HIPAA and HITECH compliance. However, they have the right to provide certain third parties with de-identified patient information to organizations such as law firms, other doctors, the government, and insurance companies. To ensure that this information remains protected, the data is password protected and only authorized individuals may access it. While this is generally effective, Kaiser Permanente is a large organization and this protection could be improved. It may be helpful to track the individuals who access this information and for how long so if there is an information leak, the company can determine who is at fault. In addition, computers with sensitive patient information should have blocked e-mail functions so users cannot easily transfer this data.

To ensure that employees are aware of security policies and measures, they implemented an online training program that “includes a corporate website dedicated to security awareness and geared to the non-technical employee, featuring advice on home computer security and how to keep kids safe online, along with information on legislation like HIPAA and company security policies” (Search Security, n.d.). This tool is effective because while it is a requirement for all employees to complete, it also serve as a reference that individuals can access when they have doubts about what should be done in certain situations.

While Kaiser reports that this security policy is effective, I believe that there are other methods that can be used to ensure these procedures are followed. I support the concept that Kaiser Permanente allows their employees to access this information at all times to serve as a guide, but I believe that they should be provided with a printout that summarizes these policies for quick reference. Furthermore, it is difficult for Kaiser Permanente to ensure that their employees read all of this information carefully, or at all, since it is posted online.

It would be beneficial for Kaiser Permanente to implement an in-person training seminar that details the privacy policy in the form of a lecture. This lecture should be repeated at least once every year so the information is fresh in the minds of the employees. Attendance should be mandatory for everyone who will have access to patient information, whether patient identifiers are included or otherwise. In addition, employees should be asked to complete a ten question quiz at the end of this workshop to verify understanding. Those with a score of 70% or greater will be considered to have passed the training course, while those with a lower score will be asked to repeat the lecture within a week after studying the policies in a provided handbook. Furthermore, managers will be responsible for reminder their employees of these policies throughout the year.

Additional ways that managers can assist to ensure that the privacy policy is carried out is to make sure that sensitive information is adequately password protected. To ensure safety through these means, it would be useful to have the password contain a combination of numbers, letters, and symbols, and be changed every few months. Furthermore computers and other technology that contains the data should be set to lock the information from access if the system does not detect use for five minutes. Doing so will prevent individuals without authorized access from obtaining this information. A second method to prevent this would be to create a unique login for each employee with programs blocked as necessary.

References

Arden JB. (2014). Policy and Procedure Manual. Retrieved from http://info.kaiserpermanente.org/info_assets/psychtraining/pdfs/PD_P&P_Manual.pdf

Kaiser Permanente. (n.d.). Privacy Practices. Retrieved from http://www.kaiserpermanentejobs.org/privacy-practices.aspx

Search Security. (n.d.). Security Awareness Employee Training Essential to Infosec Program. Retrieved from http://searchsecurity.techtarget.com/magazineContent/Security-Awareness-Employee-Training-Essential-to-Infosec-Program