Epic Automation For HIPAA Compliant File Transfers using Diplomat MFT

It can be daunting to set up a new integration when you’re dealing with file transfers and encryption processes that involve electronic health records, EPHI and other sensitive information. Diplomat, MFT makes it simple by streamlining the complexities down into an easy-to-follow process where you simply fill in the blanks and check the boxes from the top to the bottom.

For those parameters you need to accomplish the task. It can be very simple or it can be very complex. In this particular instance, we’re going to take an example where we’re trying to get information from, Emdeon or Change Healthcare, and we’re going to take that information that we get from them and send it to different places internally based on where that data needs to go.

And in this way, we’re actually going to tackle a number of different file transfers instead of simply one file in one location. We can do that because the source and the destination at the, at the very base of it, they’re the same SFTP server that we’re going to get files from. And there’s the same, share on the network that we’re going to send files to.

So in this case, you can see we are getting these, files from this particular directory structure. Right. We’re matching anything that ends in this information. So these 835 files, if you want to look at more information, we can decide if we wanted to process them recursively. So include sub folders if they need to be case sensitive or not.

and more you can do complex string manipulation and matching with RegX as well. In this particular case, we’re also deciding. Where those files should go because those files may be different than the similarly located, similarly named 835 files, but they’re in it. They’re coming from a different source, and they’re going to go to a slightly different destination, right?

It’s the same SFTP server, just a sub folder, and it’s the same network share just a different sub folder, and we can do that for all of our various matched items here. You will notice that we also have the box checked to use the modified date. And it’s doing that so that you can set the modified date of whenever the last successful execution was the last time Diplomat MFT successfully moved files within the context of this transaction.

So that means whether that was five minutes ago or five days ago, either way we’ll only accept and look for files that have a timestamp that’s newer than that moment in time. That way, you know, you’re not getting old stuff sent as well.

We also have the ability to clean up after ourselves and delete those files from the sftp folder, folder if they have been fully downloaded, successfully and sent to the in destination. We can also choose whether we desire to fail. If the files are not found, and that is a process question at that point, it’s not a question of technological failure that’ll fail anyway.

But if we can connect to the source, but there’s nothing to transfer, in some cases that may be a major problem. In other cases, not so much. I. In this case, if there are files, we downloaded them. If they’re not, we move on. We’ll try it again, soon. So we have to say, okay, fine. Where are those files going to be coming from?

That is where you go ahead and define your source partner profile. You can fill one in by hand or in the Diplomat MFT Enterprise Edition, you can define your partners, which is your various endpoints that we can use you. Then you simply select that partner from the list and you can then have all the details shown to you.

But you’ll notice they’re greyed out because these are, this is simply a reference to a defined endpoint, a partner. So we can see it’s going to go to this particular, SFTP server. We’re going to treat this as the source. All those different pathing are going to come under the outbound folder as it turns out.

Now, where are the files going to go once we get them? This is where you can define one or more different endpoints that they need to be shipped to. in this case, there’s only one destination. There could be many, but in this case there’s only one and it’s going to be. A particular UNC path. So in this case it’s going to a file server or NAS device or something along those lines called epic Fs, with an under, with a, a share called Epic DLA.

There’s some specific under, details underneath that and, that ends up allowing you to again, reference that one endpoint. for your various transactions, right? And if that changes for some reason, by the way, if the FF epic FS becomes epic FS two, you change it in one place and all the processes that leverage that partner are inherently updated immediately.

So we know where the file, what files we’re looking for, right? We know where the files. Are coming from, that’s the source. We know that the files are going to, that’s the destination. Then we can choose file handling. Now, file handling is primarily for either encrypting or decrypting files. If the files that we’re trying to process are encrypted, we’ll most likely want to decrypt them before sending the decrypted useful version of the file to the end.

Partner, so you can just check that box and select a key, or generally it’s already assigned to the partner anyway. if you need to verify a signature, you can do that as well. Notice this is a simple check box. There’s not really additional stuff to worry about there. So, okay, fine. How often are we going to do this?

How do we know when it’s time to run? It could be a scheduler. A diplomat has a built-in rich scheduler, including calendaring and so on. in this particular case, you can see that it’s set to run, every 30 minutes within a daily window from 1:15 AM to 11:30 PM whatever the server’s local time happens to be.

That’s a very quick and easy way to do it. There are additional ways of executing it if you want to integrate it with the other application processes, application, servers, let’s say different scheduling type capabilities as well. If you have a centralized scheduler, you can invoke these processes to run.

Programmatically rather than Diplomat MFT scheduling it. Keep in mind if the source is local, you can also use file monitoring, which is to say if the source is attached storage or UNC path, you can set diplomat to simply watch that folder, keep an eye on it, instead of having a set schedule. It’ll just run anytime a new file is appears.

In this case, we’re going to leave it on the schedule.

Now we can also define our notifications should we need to raise Slack or teams notifications. Those are very simple and easy to do. we can also have some one-off different, notifications. These are generally either business users or other it, users or group email addresses that are not part of the global.

Recipient list for all transactions when they run, whether they succeed or fail. But rather you can choose in this particular case to say, Hey, listen, this one particular team for this one particular process should be notified. And there may be several of those going to that same team, but not all the processes all the time.

So you can pick and choose. How to do those notifications, those email notifications as alerting also in Slack and Teams. and you can add little, little bits of additional information, as needed as well. Notice by the way that the global recipients, what we call the IT support. Email notification recipients will get not only a detailed summary of what happened, but then also the full debug log for that job run will be included in the email itself, whether that’s to your inbox or to a ticketing inbox, for example.

So the ticket itself will have the debug log data already in it. It’s delivered to you on a silver platter.

moving on. We do have archiving options. Diplomat automatically takes an archive copy of every file. but you can, in addition to keeping an archive copy, you may want to do an additional item or skip it all together and do it in a different item instead, with different rules, different regulations, different locations.

If you want to, it’s available to you. You also have the ability before and after. A transaction is completed to run an arbitrary process as desired, as well as to, either before or after zip or unzip a given file and run additional items and link these items, link these different transactions together.

On rare occasion, you may be asked to turn on advanced troubleshooting if there’s some sort of strange issue that you’re encountering that our support team is helping you with. But most of the time you leave that alone so that additional debug information is not created unnecessarily. But generally speaking, that’s about as complex as it really gets.

You have the ability then to say where, what files we’re handling, like what they’re called, where they should come from, and then you, if it’s a specific sub folder where it should go to, and lots of different options about how you handle all of that. Right. But basically they’re just the blanks for you to fill in, in the boxes to check as needed.

And then we’re going to say where those files are coming from, where those files are going to. We’re going to choose any kind of file handling details, which primarily means that, openPGP encryption or decryption, we can figure out a job execution and the rest of our details. We make it very easy for you then to then simply save your changes.

Diplomat MFT is trusted by top hospitals and healthcare organizations to keep sensitive healthcare information and electronic healthcare records secure and to support their HIPAA compliant data management programs. You can trust us too. Click the link to reserve some time with an expert in Diplomat MFT.

Diplomat MFT offers a straightforward yet highly secure integration with your existing Epic system, establishing reliable pathways for transferring a wide array of electronic health records. This seamless connection utilizes industry-standard secure protocols like SFTP and encryption to ensure the integrity and confidentiality of PHI during all transfer processes, a critical aspect of meeting HIPAA’s technical safeguards.

Diplomat MFT provides a robust set of features specifically designed to automate and secure file transfers with Epic while directly addressing HIPAA’s stringent requirements for protecting PHI. For instance, automated PGP encryption and SFTP support ensure data confidentiality during transit and at rest (Technical Safeguards). The robust scheduler automates transfers, reducing manual errors and ensuring timely delivery. Multi-factor authentication (MFA) and role-based privileges control access to sensitive data (Access Control). Comprehensive process data capture provides detailed audit trails, crucial for demonstrating accountability and compliance (Administrative Procedures).

Diplomat MFT is instrumental in helping healthcare organizations achieve and maintain HIPAA compliance for file transfers involving Epic. Its comprehensive audit trails meticulously record all transfer activities, providing the necessary documentation to demonstrate adherence to HIPAA’s accountability requirements and facilitating investigations if needed. Furthermore, Diplomat MFT employs robust security measures such as automated SFTP, SSH Client Key Authentication, and strong encryption protocols like OpenPGP to protect PHI from unauthorized access and disclosure, directly addressing HIPAA’s technical safeguards.

By automating EHR transfers with Epic, Diplomat MFT offers significant benefits. It dramatically increases efficiency by reducing manual processing time and freeing up valuable staff resources. Automation inherently minimizes the risk of human errors, which can lead to costly compliance violations and data breaches. The complete workflow visibility provided by Diplomat MFT ensures you have a clear understanding of all transfer activities, allowing for proactive monitoring and immediate identification of any potential issues, strengthening both operational control and compliance posture.

Coviant Software provides exceptional, industry-leading support specifically tailored to the needs of healthcare organizations implementing and managing Diplomat MFT for secure and HIPAA-compliant file transfers with Epic. Our expert technical support team, comprised of the product developers themselves, possesses a deep understanding of both the software and the unique regulatory landscape of healthcare. They are readily available to assist with everything from initial setup and integration to navigating complex workflows and ensuring your file transfer processes align with HIPAA’s stringent security and privacy regulations.