cool blue dog. As this thread is 2 years old, are there any newer, updated programs anyone can suggest?
I would suggest a piece of paper with a table of the de-identified information (patient initials instead of MRN or name) you need including "to do." Anything else is like painting a big bullseye on your back with a text box containing the large bold letters: "Hello, My name is ____. Call OCR at 1-866-627-7748 to make me an example of a HIPAA screwup today!" written underneath.
Although it is a rare accusation, all it takes is one technology challenged individual (from the hospital valet parking attendant or 7th grade volunteer on up) to turn you in, and, like in most situations where accusations are made, you, as med student, would instantly become a hospital security guard's chance to be a hero as they confiscate your iPhone or whatever PDA and turn you in to the federal Office of Civil Rights (OCR) for obviously violating patient privacy and for possible civil and criminal penalties because you were using a personal electronic gadget to store patient information. For the next several years, the working assumption will be that you have been making millions on eBay and then been buying boats for a large band of Somali pirates hijacking container ships with food bound for starving kids in Kenya by selling 85 yo JB's hemorrhoids diagnosis and the amazing factoid that JB needs a UA and a F/U appt in a few days.
In such a situation, you will certainly be considered guilty until proven innocent as people who have their secretaries type their e-mail in ALL CAPS because they cannot see lower-case typed letters with their +4's (or how to turn on a computer) meet with expensive hospital lawyers to figure out how much money they could possibly extract from you and whether it means a bigger bonus or promotion. Eventually they would probably conclude you did nothing wrong (because it would involve kicking sand into the eyes of someone with real power, and ... because you, as a med student, don't even officially work at the hospital except perhaps when you are making countless photocopies of illegible/skewed forms or getting coffee and bagels for the "team" except under the 24/7 ever-watchful eye of a master physician). Even so, by then you'll have been appropriately lynched, tarred, and feathered (not to mention all the time you wasted with your time-saving device) while no one below the dean level will be able to bail you out. You don't want to be that HIPAA victim/ example (I would personally rather gouge my eyes out with an ice-pick or use a piece of paper with a table as I suggested above).
How can this be? Don't the HIPAA posse know that encrypted data can be safer and more efficient than what most hospitals are doing? Even though you can protect the data very well electronically and de-identify it, it's currently too big a risk at the med student level to work with patient data using post-1920s technology unless the equipment is issued by the hospital (in which case the passwords are just blank or perhaps on a post-it stuck to the edge of the screen). Although rotations can be entertaining, it's important never to lose sight of the fact that a med student on rotation is a bottom-feeder who fits in just below the $2/hr undocumented temporary slave labor and 11 yo volunteer in the respect hierarchy, and thus his/her species non-extinction strategy needs to be 100% defense no matter what the cost in efficiency might be.
It's a not a fair/helpful/beneficial/private/secure/modern system we work with, but rather one in which inefficiency means justification of a higher billing cost and the fact that with the errors inherent in an antiquated medical system help increase the number of improperly diagnosed and treated (but legally undetected) patients who can be billed for many $$ because the never-ending treatments ensure countless adverse effects and thus "customers" for life.
Combine even a tiny amount of that inefficiency+incompetence = more profit business model with hospital staff exposed to weekly or even daily virus hysteria stories, the not-too-distant year 1999->2000 Armageddon portrayals, a multi $100s of millions legal "jackpot" judgment against the VA for a stolen laptop with vet SSN's that were never accessed nor used by anyone outside the VA, stereotypical and distorted portrayals of big screen criminals breaking into secure U.S. defense computer systems or bank security systems with the electronic equivalent of a kid's toy plastic can-opener defeating a fully deployed M1 Abrams battle tank in in a desert head-on confrontation, and you can make sense of the current distorted reality that most staff at most hospitals across the U.S. will almost certainly think that an unattended stack of 1000 patient demographic sheets or billing records with credit card numbers, addresses, and SSN's laying on a counter at the nurse's station or output tray of a copier/printer or an unattended wheeled cart of 50 paper charts surrounded by a dozen felons 20 yards from a hospital exit is more secure (as long as the pages are turned over to blank side up or are in a cute brown, blue, or red folder/binder with lots of stickers on them) than an encrypted microchip with the same information in a de-identified form and protected by a combination of retina scan, finger-print sensor, a physical key, remote real-time monitored by a dedicated police officer, time-sensitive self-erase, and a code that one must call in to the NSA to obtain.
Most hospital staff members would assume that information encrypted on a PDA is fairly easily accessed even though it may be effectively impossible for anyone except the >=80 IQ PDA owner to access it. With time, a new reality might set in, but until then, play it safe.
Until U.S. hospitals fully upgrade to 1950s (or later) technology, personal PDA's are still wonderful for use with Epocrates, Lexi-Comp, reference guides, electronic books, looking up phone numbers and addresses that are "blocked" on hospital terminals for unknown reasons, remote access to medical databases, personal e-mail, texting, and storage of non-patient/non-confidential information. That's what I use my personal gadgets for and they are very helpful and typically non-risky for that. Until 10-20 years from now, when the bankrupt & broken U.S. medical system is finally required to upgrade to at least Soviet Cold-War/ Sputnik era electronic technology in working with all patient information, you'll need to stick to the tried and true ballpoint pen (invented AD 1938) and paper (invented AD 105) ... anything newer than that is just too expensive, couldn't possibly be compatible with other systems, and can't be trusted with our precious patient data.