Passcodes, Passwords, and Secure Work Environment
Key Takeaways
- Passwords and passcodes are individual credentials and should never be shared.
- A secure work environment protects PHI on screens, printers, desks, phones, email, portable media, and conversations.
- Workstations should be locked or logged off when unattended.
- Security safeguards support confidentiality by reducing unauthorized access.
Secure daily habits
Passcodes and passwords identify the user who accessed PHI. Sharing a login, writing a password on a monitor, borrowing a coworker's credentials, or letting someone chart under another user's account defeats audit controls and creates privacy risk.
A secure work environment includes physical, technical, and administrative safeguards. Physical safeguards include locked areas, privacy screens where needed, controlled printers, badge practices, and clean desks. Technical safeguards include unique user IDs, automatic logoff, encryption where required, audit logs, and secure messaging tools.
Administrative safeguards include policies, training, sanctions, role-based access, incident reporting, and procedures for remote or hybrid work. A coder working from home or in a shared space must still protect PHI from household members, visitors, public Wi-Fi risks, and unsecured storage.
Common exam traps
| Unsafe behavior | Better answer |
|---|---|
| Share a password so work can continue | Contact IT or a supervisor for proper access |
| Leave EHR open during lunch | Lock or log off before leaving |
| Discuss a case in an elevator | Move the discussion to a private work area |
| Put paper notes in regular trash | Use approved confidential disposal |
Security is not only an IT responsibility. CCA-level staff are expected to use assigned access, protect devices and paper records, report suspicious activity, and avoid workarounds that expose PHI.
A coder's account is locked, and a coworker offers to share a password so the coder can finish claims. What should the coder do?
Which action best protects PHI at a workstation?
A coder prints a worksheet containing patient names and diagnoses. How should it be discarded when no longer needed?