Compliance: strategies for healthcare
Spector 360 records and archives user activity, including applications that are run, files saved or printed, and e-mails and instant messages that are sent or received. It also provides screenshots of Web sites that are visited, and several dozen standard reports. “Employees are aware that we are monitoring their computer usage,” Counes says. “They understand the sensitivity of the information that we have, and why we need to be careful with it.”
Education tool
In cases where employees have taken action that is in conflict with the policies of the Hanley Center, Spector 360 allows Counes to document the infraction. He also works with the employees to redirect their behavior. “Although we first thought of Spector 360 as a watchdog, it has turned out to be an educational tool as well. Most people want to do the right thing.
Social networking provides a good example. The Hanley Center allows its employees to use social networking sites, but in moderation. Excessive usage will be flagged, and the potential impact on productivity discussed with the employee. Actions that are in conflict with HIPAA or other regulations can also be noted. “We balance security with the employees’ ability to get the work done,” says Counes.
The experience of the Hanley Center is typical of Spector 360 customers, according to Jim Fields, VP of sales at SpectorSoft. “What generally begins as an investigative process to discover problems often turns into a broader look at productivity,” he says. “It’s easy to assess how people are spending their time, and sometimes the insights gained are surprising.”
One company found, by reviewing Application Usage reports in Spector 360, that its best salespeople were spending less time on its customer relationship management system than the lower performers. After some conversations with the sales staff, the sales manager discovered that this high-performing group was more proficient in using the software. “So in this case, the monitoring actually helped identify a training opportunity,” Fields observes. The primary intent of Spector 360 is to monitor all online activity of employees for productivity, security and compliance purposes, but many customers benefit from its other uses.
Process and compliance
Business process management (BPM) solutions have played an important role in compliance in healthcare and other fields. Much as the UMass Memorial focused on the data that needed to be included in governance policies, BPM software can simplify reporting by including only those processes and data that are covered by regulations. “For Sarbanes-Oxley, only the processes that touch financial matters need to be included in the governance reporting strategy,” says Neal Lohmann, director of business transformation solutions at Metastorm.
The same, targeted approach can be used for the Health Insurance Portability and Accountability Act (HIPAA). “BPM software allows customers to track and control who has access to the information flow and how that occurs,” Lohmann says, “which is essential for HIPAA compliance.” Prior to HIPAA and in the days of paper files, the entire file would be circulated. “Now, medical information for an insurance claim might get split into multiple pieces, with the billing department getting some information but not all of it,” he explains. “Without an automated system, the cost of tracking is just too high, and in some cases, companies would rather just pay the fines.”
With a BPM system in place, the reporting is automated and the costs are much lower. However, Lohmann emphasizes that IT developers and business analysts must work together closely to ensure the right process flow, rules and content. “If IT does not have an accurate understanding through discussions with business users, the information could end up in the wrong place,” he cautions. “It’s important for both sides to be communicating well in order to create a system that is truly compliant, and BPM can help facilitate that collaboration.”