09/01/2020
This will definitely date me, but one of the first consulting engagements I led was helping a prominent healthcare system in the Denver area prepare for Y2K, the year 2000. The millennium bug seemed primarily a financial industry issue, but there was also a concern that biomedical devices might also experience a failure as their internal clocks went from “99” to “00”.
Once the Y2K scare was behind us, I shifted my focus to Electronic Medical Records (EMRs); providers were starting to move away from paper charts and this seemed to be an area with great opportunity. This of course meant navigating U.S. laws around Protected Health Information (PHI), and the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
Obviously, as the years progressed, adoption of EMRs grew exponentially as today, two decades later, paper charts are considered archaic. Encouraged by various forms of legislation, i.e. the HITECH Act of 2009 and the phased introduction of Meaningful Use from 2011 – 2014, the healthcare industry continued to make tremendous strides with innovation. Health Information Exchange and Population Health Management platforms designed to improve clinical decision making and outcomes have become prevalent.
Years later, I found myself working at Sendero taking on more of a generalist role in management consulting, learning what working in other industries is like, and doing so in the local market. Within weeks of joining, that’s exactly what happened—a Dallas-based oil and gas company that Sendero had recently helped with an acquisition and international expansion reached out to us for additional help.
Our team quickly did some research on best practice for gaining compliance then assembled a governance platform comprised of HR, IT, and Legal resources. Though GDPR was new for me, as I learned more, I began to recognize the many similarities between GDPR and HIPAA. It also occurred to me that there may be scenarios where an organization may need to be in compliance with both.
