I am a compliance associate at my company, which is a small call center. My problem is that two of our clients will have to share floor space. One client is tech support for high-end action cameras, while the other is a healthcare account that deals with ePHI.
My concern is that the setup is not HIPAA-compliant. The tech support client requires their equipment to be on the floor so that agents can replicate customer problems. I am worried that a breach might occur if one of the agents from the tech support team takes a picture with their equipment and accidentally captures an image with electronic protected health information (ePHI) from the healthcare team.
I brought this up with my superiors, but they seem to think that granting an exemption to the tech support equipment is enough to remain HIPAA compliant. For me, an exemption is just a piece of paper - it doesn't change the fact that there are unsecured cameras on the floor which could capture ePHI at any moment.
Can any HIPAA experts help out? I need facts to back up my concern. Or, if I'm wrong, at least my mind will be put at ease.Thanks in advance, everyone. Cheers!
To answer @john deters questions:
- I report to a compliance officer, our department reports to the CEO. Our department can make suggestions, which needs approval from the executive committee (excom) before they are deployed.
- We recently hired an external auditor for HIPAA compliance, and we passed the audit. Rather than consult with them, I want to resolve my concern internally because I don't want to make a big fuss out of this until I am certain that it is indeed a HIPAA breach or a potential one.
- I want to be proactive, rather than wait for a breach to occur. I really do not want those two teams to share floor space for fear of a breach occurring. If I have facts or references to back up my claim, excom will be forced to move the healthcare team to another floor.