Virtual Setting Documentation, Including HIPAA

compliance hipaa management strategic management May 25, 2021
Virtual Setting Documentation, Including HIPAA

Documentation in a Virtual Setting

The rigor of a nonprofit organization’s documentation is critical for communicating within a virtual setting. It is an essential pillar in maintaining solid communication processes, transparency, and basic functionality. Thus, extra care must be taken to plan for and manage this critical issue. 

This is Part 3 of an ongoing special series of articles aimed to help nonprofits to transition their work into virtual spaces.

In the event you do not have your important documents on a shared drive or an intranet, which is quite frequent in nonprofits, this is the time to upload them. Before taking this step, though, delineating documentation priorities is critical to ensuring that everyone has access to the documents they need to do their job. Also, you must be clear beforehand on which documents require restricted access to ensure confidentiality.  

Documents that should be prioritized in a virtual setting include documents that stipulate legal requirements you must comply with, regularly accessed documents, information pertaining to existing projects, and essential policies and procedures. Depending on how much time you have, this could either be assigned to interns and/or administrative support staff. If you are short on time, the entire team may have to pitch in. In this process, though, a master directory should be created so that everyone knows where to find documents and how to categorize any new documents. Otherwise, accessing documents will become an unruly process that will result in the duplication of the same work and a lot of employee frustration.

If you do not have a shared drive, and rely instead on Google Drive or Microsoft, make sure that you ask employees to upload important documents onto the “Shared” Google or Microsoft Drive for the ORGANIZATION instead of their individual Google Drive attached to their email. If it is not a common practice in the organization, please take some time to discuss with your senior staff how staff members will be trained on which documents must be on this shared drive and how to upload them.

It cannot be emphasized enough, make sure you make it clear to employees that uploading a document in their own company email Google drive is NOT the same as uploading a document to the Organizational Google drive. 

Once the process for storing and sharing documents has been determined in a virtual setting, staff must receive clear instructions and guidance on how to follow the new protocols. A designated person or people must also be available to help staff navigate the process and to answer questions.

Most employees will follow through with the request for uploading documents in a virtual setting. However, in the event there are employees that prioritize convenience over compliance, additional incentives must be used. Tying annual evaluations to documentation is often helpful in increasing compliance with this necessary organizational function. 

Documentation and HIPAA Compliance 

If you work for an organization that must adhere to HIPAA, you should work with your internal compliance team and the technology team, if you do not already have remote access policies and procedures in place. Remember, internet access from any location must be encrypted as well as the exchange of Protected Health Information (PHI). Home wireless router traffic must be encrypted using WPA2-AES. Most routers come pre-configured, so this should be an accessible step. All personal devices must also be configured before allowing any employees to access the network. Passwords must be stored in a central location and all medical information must have a protection firewall. All login attempts must be recorded and tracked. Furthermore, a VPN device must stop more than 3 login attempts to protect the data of the patients. 

This is not something you can do on your own if you do not have an in-house technology team. You should consult with your technology provider in order to ensure compliance and the implementation of best practices. A global pandemic will not be considered by a court of law as an adequate excuse to not have all documents up to date, signed, and safely stored. 

In subsequent postings, we will cover effective virtual strategies for managing supervision and strengthening your culture while working remotely. We will also cover maintaining a strong communication flow and managing group projects online

Please Subscribe

Please subscribe to Third Sector News, which will also provide resources and toolkits for managing real-life situations that those working in the nonprofit field experience. For example, this week, we have included a “Nonprofit Website Toolkit”. However, these resources are only available to those that subscribe.

If you would like to schedule a pro-bono nonprofit session with me to facilitate the transition for remote workers, please email [email protected] with the heading “COVID-19 #Pro-bono.” I will be happy to help you during this very difficult time.


Join our mailing list to receive the latest news and updates from our team.

We hate SPAM. We will never sell your information, for any reason.