JCAHO Regulations for the Management of Information

Health care organizations that receive accreditation from The Joint Commission, a nonprofit body formerly known as the Joint Commission on Accreditation of Healthcare Organizations that certifies more than 18,000 facilities in the United States, must comply with strict information management practices that keep patient information safe from traditional threats to security and privacy as well as newer ones from emerging technologies. Maintaining Joint Commission accreditation is important to health care facilities' business profiles as well as to insurers, who use The Joint Commission's ratings in determining premiums. The Joint Commission's Information management standards are expressed in its standards and compliance manuals.

Information Management Planning

• Information management planning standards require that organizations develop a comprehensive process to address internal and external needs for access to information, including long-term and annual operating needs. This planning process should also incorporate hardware and software, network infrastructure, confidentiality and security, data management and analysis, and reporting.

Confidentiality and Security

• The Joint Commission's standards on information management require that organizations establish procedures addressing the capture, storage and retrieval processes for data and information in a timely, comprehensive and accurate manner while also assuring protection of privacy and confidentiality. Organizations typically satisfy these requirements by implementing in-depth training and policy making for orientation and training of staff, using audit logs to track access to and use of data and information, working with third parties who can handle personal health data, providing security after business hours and removing personally identifying information from health records.

Information Management Processes

• Joint Commission-accredited organizations must also create information systems to effectively manage reporting, processing, retrieving, dissemination and display of clinical and nonclinical data. These processes should support specific activities related to the organization's planning, management and control functions.

Information-Based Decision Making

• An accredited organization's information management systems must be able to support decision making related to other standards and requirements of The Joint Commission, including those on patient rights, provision of care and medication management, as well as typical organization functions, such human resources and environmental protection. The systems must also be equipped to record long-term and cross-sectional data on the facility's performance over time to support decision making.

Knowledge-Based Information

• The Joint Commission requires that organizations' information management systems be able to keep up with staff education requirements and their fulfillment. In addition, hospitals frequently provide patient education and must keep health curricula updated; therefore, the standards also incorporate patient education. The hospitals' systems must keep track of staff members' training, licensing and certification, and they can also serve as a warehouse for course libraries.

Client-Specific Information

• The client-specific function of information management standards addresses documentation requirements for clinical records. This is a substantial undertaking, as it applies information management to nearly every aspect of the delivery of patient care, from basic demographics to treatment plans and medications.