4 HIPAA Risks Hidden in Manual Mileage Tracking for HHC Workers

Home health agencies often rely on mileage tracking systems to support reimbursement, payroll, and oversight for their mobile employees, especially those workers who regularly travel in their personal vehicles as part of their day-to-day work responsibilities. Those agencies start courting trouble when that mileage data is solely treated as administrative or financial information, instead of as protected data. 

An operational difference that separates mileage tracking and reimbursement in the home healthcare industry from businesses in other industries is the need to remain compliant with the Health Insurance Portability and Accountability Act, or HIPAA. Under HIPAA, providers and workers in the healthcare industry must maintain the privacy of patients’ protected health information, or PHI. PHI consists of medical records and any other “individually identifiable” data (names, addresses, etc.) used or disclosed by a covered entity, such as a healthcare provider. 

However, healthcare entities aren’t the only ones that need to pay attention to HIPAA regulations. Any business that interacts with PHI at any point must comply with HIPAA, including when mobile employees log trips for reimbursement. After all, data doesn’t need to live in a clinical system to be considered PHI under HIPAA. Trip information can intersect with patient information through locations, timing, and the context of the visit. 

Using manual methods instead of secure tracking software can complicate HIPAA compliance, as it becomes harder to track, notice, or even prevent breaches. In this article, we’ll dig into those complications, discussing four of the biggest HIPAA risks in mileage tracking for HHC workers, and how CompanyMileage can help. 

Risk #1: Location Data That Can Reveal Patient Identity

In order for reimbursement to be accountable, and not subject to payroll taxes, the IRS requires up-to-date, compliant mileage logs from mobile employees. Those logs routinely capture the start and end points of HHC workers’ business travel, the route they used, and the time and date of the visit. 

To an outsider observing these mileage logs, looking at repeated travel patterns reported by HHC workers could indicate the locations of specific patient residences or care data. That data paired with the worker’s timeline for those visits could be used to narrow down the identity of that patient. 

According to HIPAA, location information is considered PHI when it can be reasonably linked to a specific individual receiving care. Businesses that rely on manual methods, like paper logs or manual-entry spreadsheets, rarely account for how vulnerable PHI is, and how easy these connections can be made. 

Risk #2: Patient Details Appearing in Mileage or Expense Notes

Methods for mileage logging and reporting, especially manual mileage and expense reports, often include free-text fields as a place for care professionals to add context or explanatory notes to justify a trip or an expense. Notes might include the patient’s name or initials, their conditions or symptoms, or other broader details of the visit. 

Once added into a mileage log, this information is technically PHI, but it has been logged in a system outside of formal documentation systems for clinical use. While often both useful and necessary, informal data entry without any oversight or accountability can constitute a HIPAA danger, because it increases the likelihood of inconsistent and uncontrolled PHI handling. 

Risk #3: Data Stored on Unsecured or Personal Devices

Manual methods for mileage tracking frequently rely on paper records, or on the use of the employee’s smartphone or personal computer. Keeping business mileage logs on a personal phone or laptop is already not the best way to manage reimbursement, but risk is increased exponentially when mileage information also overlaps with patients’ protected health information. 

Personal employee devices often lack encryption, strong authentication, or remote wipe capabilities. If that device is lost, gets stolen, or is even shared with a friend or family member, that data is at risk of exposure. Remember, whether a device is personally or employer-owned, HIPAA safeguards still apply! 

Risk #4: Limited Visibility Into Who Can Access Mileage and Expense Data

Manual workflows for mileage reimbursement often make use of spreadsheets, emails, or shared folders, which lack clear records showing who viewed, edited, or shared information. Those mileage records could be accessed by people other than authorized users or individuals who actually require that information. 

With no way to create or prove an audit trail, it becomes very difficult to assess exposure after an incident. This undermines HIPAA’s minimum necessary standard, which requires covered entities to take necessary precautions to “limit unnecessary or inappropriate access to and disclosure of protected health information.” 

Reduce Risk, Streamline Workflows, and Stay Compliant With CompanyMileage

Businesses that regularly interact with protected health information (PHI) still have to meet or exceed HIPAA standards, even when tracking and submitting reports for mileage reimbursement. CompanyMileage offers the perfect solution in SureMileage, an employee mileage tracking app that automates and streamlines everything from trip planning to expense reporting for mobile workers. 

Along with our app, SureMobile, we help HHC employees track their work-related travel and submit expense reports from their smartphones, all while meeting or exceeding HIPAA standards. Our suite of mileage reimbursement solutions also records all necessary information for EVV tracking, so workers can keep compliant without taking too much time out of their busy workdays.

CompanyMileage uses a three-tiered security approach, ensuring that all the data collected by our software is protected and secure at all times. We meet the highest standards for encryption when data is in transit and at rest. We also have robust access controls to protect the integrity of users’ accounts. 

CompanyMileage facilities and servers are securely maintained and monitored 24/7, and we have firewalls in place to prevent unauthorized access to the system. To guarantee our clients’ privacy, our library of policies and procedures safeguard against unauthorized disclosures and breaches of confidential information. A key part of these policies and procedures is the Business Associates Agreement, or BAA, that we sign with all of our clients in the healthcare industry.

 A BAA establishes accountability with any vendors or third-party services (such as mileage reimbursement software) being utilized by a covered entity. Not all software vendors are willing to sign one, leaving you, the covered entity, exposed in the event of any HIPAA breaches. But at CompanyMileage, we always have your best interests at heart, and we’re always ready to sign a BAA if necessary. 

If you’re ready to learn more about CompanyMileage and all the ways we can help you optimize the reimbursement process while maintaining the highest compliance standards, contact us for a demo today!