HIPAA Staff Training Manual This manual was developed by a member of Professional Medical Staff Association (PMSA) http://www.thepmsa.org/ based upon information from the Office for Civil Rights under the Department of Health and Human Services at http://www.hhs.gov/ocr/hipaa/ to be used by medical practices as a free teaching aid for the staff. PMSA did not play a part in the development of this manual or checking the authenticity of the material in the manual, this was done by the member. For this reason, PMSA would like to thank the member for sharing their information and being willing to share it with others as a free service and allowing them to use the information in their own practices. The member has agreed for PMSA to use their logo as a temporary replacement for their own practice logo and suggested that the user replace PMSA with their practice info to personalize the manual for the practice. Users may adapt the manual for their practice as long as they remain compliant to all legal issues. This manual should be used as a supplement to medical practices HIPAA Privacy and Security Manuals as only a training aid for staff. In order to be compliant practices will need practice manuals and protocols in place, this training guide should not be considered a replacement for the needed tools, but as an additional resource to them. Along with HIPAA standards, it is important to follow local and state regulations as they apply to medical records. The manual can be adapted to your individual practice needs with these considerations in mind. At the end of the manual are links to various forms on the internet to illustrate the different forms and demonstrate how healthcare organizations have adapted the required information for their individual needs. These are listed as suggestions for how others have developed resources and are only for examples. If you wish to use these examples or adapt them, you will need to contact the organization for permission. * At the time of this manual’s development, the Red Flag Rules and HIPAA were under development. Additional phrasing maybe needed once they are complete. For the HIPAA updates, it appears that this may affect notification of patient every time their records are released (to insurers, other providers, pharmacy, etc.). The Red Flag Rule will affect the practice if payment is not taken at the time of service. The user of the manual should check to see how these new regulations may affect their practice and will need to adjust the manual accordingly. Places to check on how this affects you include: http://www.hhs.gov/ocr/hipaa/ http://www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm http://www.mgma.com/policy/default.aspx?id=22590 http://www.aad.org/pm/_doc/FTCRedFlagsRulesFactSheet.pdf
Practice Staff’s Training Supplement to HIPAA
The PMSA provides this product as a free service to practices and has no financial gain for this product. This manual was developed by a member and PMSA was not involved in the development and does not offer any guarantee to the contents or should be held liable in any fashion for the contents. Inclusion of templates, guidelines or other modifications does not constitute an endorsement by or approval of the Professional Medical Staff Association. Modification of documents in some areas may create a policy or procedure that violates state and/or federal law. Before implementation of any policy, state/local and/or Federal law should be consulted . This manual and all manuals relating to HIPAA will require updating as the laws change.
HIPAA Staff Training Manual
How This Guide Works
Thank you for using this product. This guide was developed as a training tool for staff and should be a supplement for the practice’s HIPAA Privacy and Security Manuals. The guide has been developed with educational discussion points throughout the guide. The guide is followed by a summary and knowledge test with answers at the end. This guide is intended to be part of an on-going training process and should be reviewed on at the time of hire and at least annually. Many practices have found it useful to have some HIPAA training throughout the year as part of their continuing education process or during regular staff meetings. HIPAA is everyone’s responsibility and should be considered a high priority. We also suggest periodically reviewing the government website to ensure that you are current on updates. The updates can then be added to the manual as needed.
What is HIPAA?
HIPAA is the common term for the Health Insurance Portability and Accountability Act of 1996 as proposed by the Kennedy-Kassenbaum Bill. HIPAA, Title II required the Department of Health and Human Services (HHS) to establish national standards for electronic health care transactions. In August 1996, President Clinton signed the bill into law. Later provisions were added to the law to make it broader and more inclusive. Many states have added additional rules on health records including coping and charging for copies, for this reason it is necessary to check with state and local regulations as well as HIPAA rules. HIPAA was designed to focus on the portability between insurance plans. Later the Security and Privacy Standards were added and the inefficiencies in healthcare systems were addressed. With the advancement of electronic health records, HIPAA has become an important topic for all practice staff to become aware of ensure patient’s privacy. The Security portion of HIPAA ensures that health information is protected. The Security standards are to ensure administrative, technical and physical safety practices are put into place to protect the patient’s health information. HIPAA also requires that standards are developed to help the transfer of information for treatment, payment and operations to ensure coordination of benefits and timely treatment of patients with access to pertinent health information. The Privacy standards ensure the protection of patient privacy and address the use and disclosure of health information and the ability for patients to request changes and review the information. The purpose of HIPAA includes the establishment of Privacy standards and includes a set of standards for code sets for transactions, unique health identification numbers and a standard for electronic signatures and prescriptions. HIPAA was enacted to address the inefficiencies of paper charts and the over 400 different transmission formats that healthcare providers were using on a daily basis when insurance claims were sent in for payment. It became apparent that a paper-based system and the effectiveness of using so many different forms had to be addressed. At the same time in the news were many reports of healthcare providers selling celebrity records to
gossip papers. The need for standards and rules with punishment for breaking the rules became necessary.
Educational Scenarios for Group Discussions What would you do?
The new Nurse Practitioner has told the entire practice that HIPAA is not his responsibility. It is the staff’s problem and not to bother him with this training. He knows everything he needs to know, so just don’t bother him with your “silly updates” anymore. If you were the manager, what would you do? If you were the staff, what would you do?
What Does HIPAA Privacy Rules Accomplish?
The rules place a restriction on how an individual’s personal identifiable health information (PHI or when in electronic format ePHI) may be used and disclosed by certain organizations, which are usually referred to as “Covered Entities”. Some states have additional rules to protect patient’s health information, a national minimum standards ensures that all patients are offered protection. Based upon information obtained from the Office for Civil Rights under the Department of Health and Human Services http://www.hhs.gov/ocr/hipaa/ the patient data that may be shared on this need to know basis and limited access includes the following: 1. Patient name 2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code. 3. All elements of dates, except year, for dates directly related to the individual patient. This includes birth date, admission date, discharge date, and date of death. Ages over 89 and all elements of dates, including year, indicative of such age, may be aggregated into a single category of age 90 or older. 4. Phone numbers 5. Fax numbers 6. Electronic mail addresses 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers 11. Certificate/license numbers 12. Vehicle identifiers and serial numbers, including license plate numbers 13. Device identifiers and serial numbers 14. Web Universal Resource Locators (URLs) 15. Internet Protocol (IP) address numbers 16. Biometric identifiers, including finger and voice prints 17. Full face photographic images and any comparable images 18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data). Any other characteristic that could uniquely identify the individual
The regulations ensure: All patients are informed how their information will be used and disclosed Sets limits on how the PHI may be used and disclosed And imposes fines when the PHI is not protected or disclosed improperly
What Information Is Protected
Information doctors, nurses, and other health care providers put in the medical record
Conversations the doctor has about care or treatment with nurses and others Information about the patient in their health insurer’s computer system Billing information about the patient at your clinic
Covered Entities
The Administrative Simplification standards adopted by Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) apply to any entity that is a health care provider, clearing house, or health plan that conducts certain transactions.
Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid. Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists. Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.
What is a Health Care Provider Under HIPAA?
Doctors Clinics Psychologists Dentists Chiropractors Nursing Homes Pharmacies
...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
Educational Scenarios for Group Discussions What would you do?
Jennifer loves to take home coding to work on. It allows her to get so much done, and it is a great situation for all considered. It allows her to be able to stop and take care of things in the other room when she needs to and then go back to work when she is done with other things. That is until she hears her two kids talking in the room she left the charts in. “I didn’t know that David’s mother has a drinking problem.” What is wrong with this picture/ What should be done?
What is a Health Plan Under HIPAA?
This includes: Health insurance companies HMOs Company health plans Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs.
What is a Clearing House under HIPAA?
This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.
How Is This Information Protected
Covered entities must put in place safeguards to protect health information. Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose. Covered entities must have contracts in place with their contractors and others ensuring that they use and disclose your health information properly and safeguard it appropriately. Covered entities must have procedures in place to limit who can view and access health information as well as implement training programs for employees about how to protect health information.
Who Is Not Required to Follow This Law
Many organizations that have health information about you do not have to follow this law. Examples of organizations that do not have to follow the Privacy Rule include: life insurers, employers, workers compensation carriers, many schools and school districts, many state agencies like child protective service agencies, many law enforcement agencies, many municipal offices.
What Rights Does This Law Give PatientsOver Their Health Information
Health Insurers and Providers who are covered entities must comply with patient right to: Ask to see and get a copy of their health records Have corrections added to their health information Receive a notice that tells patient how their health information may be used and shared Patient can decide if they want to give their permission before their health information can be used or shared for certain purposes, such as for marketing Get a report on when and why their health information was shared for certain purposes As a patient -If you believe your rights are being denied or your health information isn’t being protected, you can File a complaint with your provider or health insurer File a complaint with the U.S. Government Patients have been encouraged to ask their provider or health insurer questions about their rights-and you will have to be able to answer their questions of find resources to answer their questions.
Educational Scenarios for Group Discussions What would you do?
Mrs. Jones has been a patient at the clinic for years. Over the years, the staff has come to know her neighbor who often brings her to her appointments and picks up her prescriptions. Mrs. Jones condition becomes worse and she passes away. Today a Ms. Brown is at the office requesting a copy of the patient’s records; she states she is the daughter. Can we give the records to her?
Who Can Look at and Receive Health Information
The law sets rules and limits on who can look at and receive health information To make sure that health information is protected in a way that does not interfere with the patient’s health care; their information can be used and shared: What patients are told about their records and who can see them: For treatment and care coordination and ensure good care is given To pay doctors and hospitals for your health care and to help run their businesses With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object To protect the public's health, such as by reporting when the flu is in your area To make required reports to the police, such as reporting gunshot wounds Your health information cannot be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot: Give your information to your employer. Use or share your information for marketing or advertising purposes. Or share private notes about your health care
Educational Scenarios for Group Discussions What would you do?
You are prepping an exam room and you can hear the doctor in the room next door, you realize that is your neighbor, the one that you can hear yelling at and have seen the police at their house. You hear the doctor talking about her many bruises and she tells him that she is just clumsy. What would you do?
What Does This Mean To You the Staff?
HIPAA is a law and not only is the practice required by law to protect and secure information, but as an individual, you are as well. The violations of non-compliance can include jail time, monetary or both. The Federal government can and will go after you personally if you violate the law. In cases where staff has been trained and act upon their own (ex. After training send out patient information via fax to “friend” or tossing information in trash that has not been de-identified or selling copies for personal gain) the practice may be not be liable, but you as a staff member might still be punished.
Roles in a Practice
There are different roles in a practice and it is important to know who is responsible for what and how they affect everyone. In some cases, these roles will overlap. Some examples of roles include: Designated Security Officer- this person is responsible for defining and implementation of security policy and management controls that guide the staff behavior to address risks to information security and monitor system controls that protect the integrity of the PHI. Privacy Officer- This individual implements policies and guidelines that address and monitor the appropriate use, disclosure and storage of PHI. They establish required and preferred workforce member practices to support the privacy policy and standards. They monitor and investigate suspected problems and violations of PHI disclosure as well as manage patient inquires and complaints. System Manager-this person is responsible for defining and implementation of security for the information systems. They define, implement and monitor systems regularly to protect the confidentiality integrity and availability of health information. Caregiver-this applies to anyone that has patient contact, such as the physician, clinical staff. These individuals will have access to all of patient’ health information to provide care. Administrative staff-these are staff members that have no direct patient care contact, but need to have limited access to perform their job, such as insurance information.
Things That a Practice is Required to have:
Privacy Policies and Procedures. A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule.
Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices. Workforce Training and Management. Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity). A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions. A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule. Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule. Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure. For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes Complaints. A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule. The covered entity must explain those procedures in its privacy practices notice. Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS. Retaliation and Waiver. A covered entity may not retaliate against a person for exercising rights provided by the Privacy Rule, for assisting in an investigation by HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates the Privacy Rule. A covered entity may not require an individual to waive any right under the Privacy Rule as a condition for obtaining treatment, payment, and enrollment or benefits eligibility. Documentation and Record Retention. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented. FullyInsured Group Health Plan Exception. The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary
health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan. Other Provisions: Personal Representatives and Minors Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual’s protected health information, as well as the individual’s rights under the Rule. A personal representative is a person legally authorized to make health care decisions on an individual’s behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when a covered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual. Special Case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children. If State and other law is silent concerning parental access to the minor’s protected health information, a covered entity has discretion to provide or deny a parent access to the minor’s health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment.
Educational Scenarios for Group Discussions What would you do?
You have watched a fellow employee fax a male patient’s file to the patient’s cousin who works for the OB/GYN down the hall. This patient would have no reason to see this practice, but your co-worker wants her friend to see what is in her cousin’s file. What would you do? Whom would you report this to and what steps should they take? How would your practice handle this problem?
What is a Business Associate?
In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing. Business associate services to a covered entity are limited to legal, actuarial, accounting, and consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected
health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity. When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first.
Educational Scenarios for Group Discussions What would you do?
You open the newspaper. Headlines read the one of your Business Associates offices were broken into last night. The damages ad losses appear to be high. Computers were stolen. File cabinets were opened and the strewn all the facility. At this time, there are no suspects, but it is under investigation. What should be done?
What Information is Protected
Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." “Individually identifiable health information” is information, including demographic data, that relates to: the individual’s past, present or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.
De-Identified Health Information. There are no restrictions on the use or disclosure of deidentified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
Educational Scenarios for Group Discussions What would you do?
One of the providers makes notes about patients on little pieces of paper. When on the phone and then uses the information to update the patient’s charts. No one noticed that the doctor threw the paper into the trash. One of the patients work for the trash company and noticed slips of paper and called a local news station. The station sent someone out to go through the trash and then put the information on the news.
Permitted Uses and Disclosures
Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations. Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make. (1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information. (2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities. A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship. See additional guidance on Treatment, Payment, & Health Care Operations. Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another. Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual and activities of a health care
provider to obtain payment or be reimbursed for the provision of health care to an individual. Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity. Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below. Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities.24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent. (3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. Facility Directories. It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual’s informal permission to list in its facility directory the individual’s name, general condition, religious affiliation, and location in the provider’s facility. The provider may then disclose the individual’s condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation. For Notification and Other Purposes. A covered entity also may rely on an individual’s informal permission to disclose to the individual’s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person’s involvement in the individual’s care or payment for care. This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death. In
addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts. (4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule. (5) Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes. These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information. Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders). Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and postmarketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a workrelated illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence. Health Oversight Activities. Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule) for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs. Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is
through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided. Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime. Decedents. Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law. Cadaveric Organ, Eye, or Tissue Donation. Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue. Research. “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge. The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual’s authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals’ authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought. A covered entity also may use or disclose, without an individuals’ authorization, a limited data set of protected health information for research purposes. Serious Threat to Health or Safety. Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe
can prevent or lessen the threat (including the target of the threat). Covered entities may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal. Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs. Workers’ Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses. (6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed. A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set.
Authorized Uses and Disclosures
Authorization. A covered entity must obtain the individual’s written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. A covered entity may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances. An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual’s authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes. All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data. The Privacy Rule contains transition provisions applicable to authorizations and other express legal permissions obtained prior to April 14, 2003. Psychotherapy Notes. A covered entity must obtain an individual’s authorization to use or disclose psychotherapy notes with the following exceptions: The covered entity who originated the notes may use them for treatment.
A covered entity may use or disclose, without an individual’s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity’s compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law. Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service. The Privacy Rule carves out the following health-related activities from this definition of marketing: Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication; Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan’s enrollees that add value to, but are not part of, the benefits plan; Communications for treatment of the individual; and Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual. Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity’s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity’s receipt of direct or indirect remuneration from a third party must reveal that fact.
Limiting Uses and Disclosures to the Minimum Necessary
Minimum Necessary. A central aspect of the Privacy Rule is the principle of “minimum necessary” use and disclosure. A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request. A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary. When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose.
The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual’s personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules. Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of protected health information to which access is needed, and any conditions under which they need the information to do their jobs.
Educational Scenarios for Group Discussions What would you do?
A patient is being seen at a local work comp clinic and they have asked for the patient’s entire file, what should be released? What if the patient did not provide you with a release?
Disclosures and Requests for Disclosures
Covered entities must establish and implement policies and procedures (which may be standard protocols) for routine, recurring disclosures, or requests for disclosures, that limits the protected health information disclosed to that which is the minimum amount reasonably necessary to achieve the purpose of the disclosure. Individual review of each disclosure is not required. For non-routine, non-recurring disclosures, or requests for disclosures that it makes, covered entities must develop criteria designed to limit disclosures to the information reasonably necessary to accomplish the purpose of the disclosure and review each of these requests individually in accordance with the established criteria. It is permissible to charge for copies of records and the rate and policy is state dependant. Reasonable Reliance. If another covered entity makes a request for protected health information, a covered entity may rely, if reasonable under the circumstances, on the request as complying with this minimum necessary standard. Similarly, a covered entity may rely upon requests as being the minimum necessary protected health information from: (a) a public official, (b) a professional (such as an attorney or accountant) who is the covered entity’s business associate, seeking the information to provide services to or for the covered entity; or (c) a researcher who provides the d Notice and Other Individual Rights Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices. The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and
disclose protected health information. The notice must state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. Notice Distribution. A covered health care provider with a direct treatment relationship with individuals must have delivered a privacy practices notice to patients starting April 14, 2003 as follows: Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (for telephonic service delivery); By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; and In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates. Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request.52 A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information. The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement. Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement. A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the “named insured,” that is, the subscriber for coverage that also applies to spouses and dependents. Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice.54 The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient’s written
acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation. Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity’s designated record set. The “designated record set” is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider’s medical and billing records about individuals or a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems. The Rule accepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion. Covered entities may impose reasonable, cost-based fees for the cost of copying and postage. Amendment. The Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is inaccurate or incomplete. If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the information to the individual’s detriment. If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. The Rule specifies processes for requesting and responding to a request for amendment. A covered entity must amend protected health information in its designated record set upon receipt of notice to amend from another covered entity. Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity’s business associates. The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date. The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual’s personal representative; (c) for notification of or to persons involved in an individual’s health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and
law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities. Restriction Request. Individuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual’s health care or payment for health care, or disclosure to notify family members or others about the individual’s general condition, location, or death. A covered entity is under no obligation to agree to requests for restrictions. A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical emergency. Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs. For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card. Health plans must accommodate reasonable requests if the individual indicates that the disclosure of all or part of the protected health information could endanger the individual. The health plan may not question the individual’s statement of endangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled.
Educational Scenarios for Group Discussions What would you do?
A law enforcement presents himself to the practice. He has learned that in the past you treated someone he is investigating. The officer provides the persons name and asks if the patient has any identifying marks. What now?
Understanding Patient Safety Confidentiality
The regulation implementing the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act) was published on November 21, 2008, and was effective on January 19, 2009. (42 C.F.R. Part 3).The Patient Safety Act establishes a voluntary reporting system to enhance the data available to assess and resolve patient safety and health care quality issues. To encourage the reporting and analysis of medical errors, the Patient Safety Act provides Federal privilege and confidentiality protections for patient safety information called patient safety work product. Patient safety work product includes information collected and created during the reporting and analysis of patient safety events. The confidentiality provisions will improve patient safety outcomes by creating an environment where providers may report and examine patient safety events without fear of increased liability risk. Greater reporting and analysis of patient safety events will yield increased data and better understanding of patient safety events.
OCR works in close collaboration with the Agency for Healthcare Research and Quality (AHRQ), which has responsibility for listing patient safety organizations (PSOs), the external experts established by the Patient Safety Act to collect and analyze patient safety information.
Patient Safety and Quality Improvement Act of 2005 Statute and Rule
The Patient Safety Act establishes a voluntary reporting system designed to enhance the data available to assess and resolve patient safety and health care quality issues. To encourage the reporting and analysis of medical errors, the Patient Safety Act provides Federal privilege and confidentiality protections for patient safety information, called patient safety work product. The Patient Safety Act authorizes HHS to impose civil money penalties for violations of patient safety confidentiality. The Patient Safety Act also authorizes the Agency for Healthcare Research and Quality (AHRQ) to list patient safety organizations (PSOs). PSOs are the external experts that collect and review patient safety information.
Implementing Regulations
The Patient Safety Rule implements select provisions of the Patient Safety Act. Subpart C of the Patient Safety Rule establishes the confidentiality provisions and disclosure permissions for patient safety work product and the enforcement procedures for violations of confidentiality pursuant to section 922 of the statute. OCR enforces these confidentiality protections. AHRQ lists patient safety organizations pursuant to section 924 of the Patient Safety Act and has responsibility for common formats and network of patient safety databases pursuant to section 923.
Implementing Regulations
The Patient Safety Rule implements select provisions of the Patient Safety Act. Subpart C of the Patient Safety Rule establishes the confidentiality provisions and disclosure permissions for patient safety work product and the enforcement procedures for violations of confidentiality pursuant to section 922 of the statute. OCR enforces these confidentiality protections. AHRQ lists patient safety organizations pursuant to section 924 of the Patient Safety Act and has responsibility for common formats and network of patient safety databases pursuant to section 923. Subpart A defines essential terms, such as patient safety work product, patient safety evaluation system, and PSO. Subpart B provides the requirements for listing PSOs. These entities offer their expert advice in analyzing the patient safety events and other information they collect or develop to provide feedback and recommendations to providers. Subpart C describes the privilege and confidentiality protections that attach to patient safety work product and the exceptions to the protections. Subpart D establishes a framework to enable HHS to monitor and ensure compliance
with the confidentiality provisions, a process for imposing a civil money penalty for breach of the confidentiality provisions, and hearing procedures.
Enforcement of the Confidentiality Provisions of the Patient Safety Act
Enforcement of the confidentiality of patient safety work product is crucial to maintaining an environment for providers to discuss and analyze patient safety events, identify causes and improve future outcomes. The enforcement provisions are found at Subpart D of the Patient Safety Rule. OCR seeks voluntary compliance with the confidentiality provisions by providers, patient safety organizations (PSOs) and responsible persons that hold patient safety work product. OCR may conduct compliance reviews and investigate complaints alleging that patient safety work product has been disclosed in violation of the confidentiality provisions. If OCR determines that a violation has occurred, OCR may impose a civil money penalty of up to $10,000 per violation. OCR provides technical assistance to persons seeking to comply with the confidentiality provisions and public information regarding the administration of the enforcement program.
Educational Scenarios for Group Discussions What would you do?
The manager has given notice that today is his last day. You notice that he has gone into the chart room and is now carrying a box of stuff out of the room. What should you do?
State Law
Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply. “Contrary” means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA. The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits. Exception Determination. In addition, preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law: Is necessary to prevent fraud and abuse related to the provision of or payment for health care, Is necessary to ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation, Is necessary for State reporting on health care delivery or costs,
Is necessary for purposes of serving a compelling public health, safety, or welfare need, and, if a Privacy Rule provision is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.
Enforcement and Penalties for Noncompliance
Compliance. Consistent with the principles for achieving compliance provided in the Rule, HHS will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Rule. The Rule provides processes for persons to file complaints with HHS, describes the responsibilities of covered entities to provide records and compliance reports and to cooperate with, and permit access to information for, investigations and compliance reviews. Civil Money Penalties. HHS may impose civil money penalties on a covered entity of $100 per failure to comply with a Privacy Rule requirement. That penalty may not exceed $25,000 per year for multiple violations of the identical Privacy Rule requirement in a calendar year. HHS may not impose a civil money penalty under specific circumstances, such as when a violation is due to reasonable cause and did not involve willful neglect and the covered entity corrected the violation within 30 days of when it knew or should have known of the violation. Criminal Penalties. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA faces a fine of $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to ten years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm. Criminal sanctions will be enforced by the Department of Justice.
Overview Section
Privacy and Security Threats
Privacy and security breeches can occur in a variety if ways or places, Sometimes accidental, or even more dangerous, sometimes intentional. We group these into four general categories. Physical damage, human actions, technology, and non-compliance. Physical damage-such as facility damage or destruction. Includes fire, water, equipment failure, unauthorized physical access to systems or data. Human Threats-can be accidental or on purpose. They include destruction, modification or disclosure of information either accidental for personal gain. Personal gain can include fraud, threat, selling, malicicious as in disgruntled
workers, mischievous as in novice hackers with unexpected access, eavesdropping (in person, phones, recorded messages, etc). network sniffing, rubbish (PHI in trash bin). It can be in the form of intruders, either in person or thru electronic means. This can take the form of external attacks from individuals posing as staff, patients, visitors or vendors. Alternatively, internal attacks from workforce members, this can include unauthorized access of PCs and network stations, the use of external systems, deliberate loss or damage to equipment. This includes attacks on facilities, equipment or staff, sabotage, terrorism and random acts of violence. Technology Threats-This includes Malicious Code which are destructive programs that is inside, attached to, or masquerading as beneficial software objects. Malicious code is downloaded, carried on mobile media, attached to email or developed internally. These include: Viruses Time bomb Logic bomb Trojan Horse Technology Based attacks: Backdoors, administration accounts, password cracking, hijacked sessions, redirection of e-mail. Reading information in cahe memory and systems log files Faulty Technology Introduction of unauthorized software or hardware, inadequate information systems security, incorrect systems design errors, operating system design errors. Non-Compliance Current workforce members this includes: disgruntled and curious members, dishonest workers, bribed workers, contractors/vendors who have access, former employees. It can come in many forms and have different levels of threat to the practice. Source of threats Sources of threats can be hard to identify at times and can come from a variety of areas, a few include: Current and former employees both full and temporary, or contracted vendors Natural disasters Private investigators, free lancer organizations that are paid by finding errors Law enforcement and governmental agencies Computer hackers Faulty construction or equipment such as defective hardware, cabling or communication system Commercial or political espionage Organized crime (blackmail, extortion)
Data Classification Data classification is import so that informative is protected at the same level as the sensitive data it contains. The more sensitive it is then the tighter the controls. Public Information Public information is the information that is available to the public at large. It is often thought of as “non-classified information” That is health information known, printed or in information systems could be made public, such as data that is not confidential. Data integrity is not vital Loss of service due to malicious attacks is an acceptable risk Internal Information Internal information is the first level of data classification requiring special consideration and protective action by the practice staff. The consequences of disclosure are not critical should this data become public. It is unlikely to influence the Provider Office’s operational effectiveness, causes financial loss or affect patient’s confidence. Mitigation of Privacy Breaches Staff members should stop all activity that contributes to the unauthorized disclosures (without complicating the situation by creating safety, contractual or legal risk. The privacy and security officers should be notified. All information should be secured and retrieved. An accurate and through investigation should be conducted that includes ways to prevent from future breaches and corrective actions put into place any actions. When appropriate the attorney should be contacted. Risk Assessment and Management Strategy The execution, development and implementation of risk management programs are the joint responsibilities of the of the designated security authority and privacy official staff is required to cooperate fully with any risk assessment being conducted on systems for which they are users workforce member are also expected to work with the privacy and security officials in the development and use of a risk reduction plan. Risk Assessment and Management Reducing the Risks Creating a “Culture of Accountability” This is done by knowledge of HIPAA regulations, workforce practices that audit privacy and security education, workforce practices that audit privacy and security compliance. Monitoring contractors and vendors who have access to systems and facility. Making patient confidentiality a high priority.
Whistle Blowers Suspected violations specifically require all workforce members to report when an event is observed that may indicate a violation has occurred. Should be reported to the officials whistleblowers must act in good faith, no retaliation in any way shall occur from workforce members or management.
Educational Scenarios for Group Discussions What would you do?
Candy finds herself in the manager’s office being asked why a pornographic e-mail was sent from her computer. The printout shows that it was from Candy’s e-mail and shows that it was at 12:10. Candy says that it would have been at lunch. Would Candy still be in trouble? She then remembered that she had been sharing her password with other staff, was this alright? Is there still a problem?
Destruction of Records
This is an area that can cause the largest concern for practices. It is easy to just toss a message into the trash, but does it have patient information on it? Did the patient leave their name, date of birth and information for you to call back? If this is on the message than the message must be destroyed of properly and not tossed into the trash where someone can find it. Printed records can be destroyed by burning or shredding by staff or by a bonded service. Electronic records must also be destroyed of properly. Many practices have sold or tossed out old computers without using a file eradication system to ensure that all records had been removed to find themselves in trouble later on. This can be easily avoided.
Educational Scenarios for Group Discussions What would you do?
The office got a new computer and put the old one out for trash pick-up. Later it was discovered that someone picked up the computer and had been able to download patient information including dates or birth and social security numbers and had sole them on the internet.
Phone Manners and the HIPAA Police*
Going the extra distance makes a good company a great one. One of the first areas that patient contact is made is on the phone; this can set the tone of the visit long before the patient ever arrives. If you are rude on the phone or just abrupt, this can create a lasting impression of you to the patient. Many people do not mean to be rude, but come across as rude to others by their abruptness, perception is the key. It might be helpful to record a few conversations to hear what you sound like to others, you might be surprised. How do you feel when you get a tele marketer on the phone? Don’t they always call at the worst times? When you call a patient how do you know that it is not a bad time for them? When you call someone, even if calling them back always ask if it is a good time. People appreciate the courtesy that you have shown by doing so, let them know who you are and where you are calling from and then ask if it is a good time. Since they know you
are calling from the physician office, they will usually have time for you, if you are calling them at work or maybe at their house or cell it is possible that they need to get to a private place to hear you conversation. The problem is that you should always use professional, you never know who is really on the line. Due to HIPAA and common courtesy, we should be very cautious about what information is given over the phone. I can say that I am anyone, but how can I prove it? Name and date of birth are easy to obtain. Ask the patient to identify something on the chart, such as whom they have as their contact. If permission was given to another person to give information to, they should be able to give information about the patient, such as date of birth or Social Security number. Have a plan that follows office and HIPAA guidelines on what information is to be given and how to give it. Things to consider when on the phone: Can anyone overhear this conversation? If you are calling patients and other patients might overhear personal information about your patient, you might need to consider moving when making calls. Are you sure that the person on the phone is entitled to the information? Is it the patient on the phone or a family member? Do you have permission from the patient to speak to this person? Is this highly personal material? Is this PHI (Personal Health Information) something of a confidential nature, such as communicable disease, mental illness, disability, related to abuse or addiction of any kind? If so, take extra precautions when discussing information. A few guidelines that should be considered for phone conversations include: Did you check the patient’s chart to make sure they have not given a preferred method of communication or have limited what can be given? Did the patient give permission for another person to have access to any information? Is it alright to leave a message? It is hard to tell if it is a secured answering machine or if others have access to it, when leaving messages it is best to give to leave your company’s name or abbreviations if applicable, and number to call back. For appointment reminders leave the date of appointment and a call back number. Often staff leave the reason for the appointment, such as mammogram, x-ray, labs, etc. Don’t do that, what if the person listening did not know that your patient was scheduled for labs for STD, they may not want them to know. Use common sense when leaving messages. If there are instructions or results, have them call you back. Before giving out information establish who the person is and if they are entitled to the information by using the patient’s social security, birth date, and home address
Your telephone policies can set you apart from others, in a good way or a bad way depending on how you handle them. Evaluate how yourself and see how you are doing. Then see what can be done differently to improve the phone conversations. Some phone tips include: Be pleasant; do not ever be rude or abrupt. Remove all food, gum, cough drops or other items from your mouth Does not type, talk to others, or only give partial attention to the caller. People can often hear you when you are typing or speaking with others. How would you feel if they did this to you? If you have to transfer the call, put them on hold, or call them back once you have the answers let them know. Know one expects you to know everything; people will appreciate if you tell them that you want to verify something before you answer their question. If the person on the phone is rude to you, try to stay clam. Try to remain diplomatic and polite. Getting angry will only make them angrier. Always show willingness to resolve the problem or conflict. Try to think like the caller. Remember, their problems and concerns are important. Patients are often sick, in pain, or scared keep in mind that this may be a bad time for them. Offer to have your supervisor talk to the caller or call him/her back if the caller persists. Speak slowly and calmly. Be firm with your answers, but understanding. By having a polite consistent phone manner, you can set yourself apart from others. You can be a leader and professional in part by the image that you project.
*Excerpt from PMSA Training Modules
Sources
U.S. Department of Health & Human Services http://www.hhs.gov/ocr/hipaa/ Indian Health Service http://www.ihs.gov/AdminMngrResources/PrivacyAct/index.cfm?module=pao_medrec_ qa#20: Center for Medicare and Medicaid Services Security Education Materials http://www.cms.hhs.gov/EducationMaterials/04_SecurityMaterials.asp
Sample Forms from the Internet
Examples of Incidental Disclosures of Patient Information http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalusesanddi sclosures.html http://hipaa.bsd.uchicago.edu/incidental_disc.html http://www.mc.vanderbilt.edu/root/vumc.php?site=hipaa&doc=11529 http://www.cmich.edu/HIPAA/Frequently_Asked_Questions/Incidental_Uses_and_Discl osures_FAQs.htm http://www.uihealthcare.com/depts/hipaa/qanda.html http://www.umkc.edu/Research/Support/HIPAA/Documents/OCR%20Guide%20Pages/I ncUse&Disclos.pdf Release of Information http://injury.findlaw.com/personal-injury/personal-injury-help/le24_4_1.html http://www.protectorplan.com/pdfs/RiskManagement/Records%20Release%20Form.pdf http://www.download3k.com/Business-Finance/Project-Management/Download-PatientIntake-Form-Sample.html Personal Representative https://www.covercolorado.org/documents/Personal%20Rep%20Form.doc https://www.wship.org/Docs/Personal%20Rep%20Form%202008.pdf http://www.hipiowa.com/docs/personal_rep_form.pdf ABN Form http://www.cms.hhs.gov/BNI/Downloads/CMSR131G.pdf Misc Forms http://www.aafp.org/fpm/20030200/29theh.html http://www.ouhsc.edu/hipaa/forms.asp http://www.worldchiropracticalliance.org/hipaa/introduction.htm http://www.hfs.illinois.gov/hipaa/forms.html http://www.portlandonline.com/omf/index.cfm?c=38340
Additional Training Resources
http://www.hhs.gov/ocr/privacy/hipaa/understanding/training/index.html http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/smallbusiness.html
Suggested Additional Information for Managers
PDAs http://www.aafp.org/fpm/20030400/ask.html Electronic Records http://www.aafp.org/fpm/20010700/37apro.html http://www.wedi.org/snip/public/articles/index.cfm http://www.aafp.org/fpm/20010300/43what.html
http://www.aafp.org/online/etc/medialib/aafp_org/documents/prac_mgt/hipaa/implication s.Par.0001.File.tmp/HIPAA_Privacy_Rule_Research.pdf http://www.aafp.org/fpm/20021100/35theh.html On-line Communication http://www.aafp.org/fpm/20040300/93comm.html Electronic Controls http://www.aafp.org/online/etc/medialib/aafp_org/documents/prac_mgt/hipaa/step4.Par.0 001.File.dat/sample_step4.pdf\ EHR http://www.aafp.org/fpm/20020100/50look.html Standards http://www.aafp.org/online/en/home/publications/news/news-now/governmentmedicine/20070424kibbetestimony.html http://www.aafp.org/fpm/20010700/37apro.pdf Compliance http://www.aafp.org/fpm/20050400/43tens.html http://www.aafp.org/fpm/20070400/58heal.html Book Resources http://www5.mgma.com/ecom/Default.aspx?action=INVProductDetails&args=511&tabi d=138 http://www.aafp.org/online/en/home/practicemgt/regulatory-compliance/hipaa.html NPI https://nppes.cms.hhs.gov/NPPES/Welcome.do http://www.aafp.org/online/en/home/practicemgt/regulatorycompliance/hipaa/natlproviderid.html
Appendix Terms
HIPAA The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Department of Health and Human Services (HHS) to establish national standards for electronic health care transactions and national identifiers for providers, health plans, and employers. It also addressed the security and privacy of health data. As the industry adopts these standards for the efficiency and effectiveness of the nation's health care system will improve the use of electronic data interchange. The purpose of HIPAA includes the establishment of Privacy standards to address the use and disclosure of health information and the ability for patients to request changes and review the information. The Security standards are to ensure administrative, technical, and physical safety practices are put into place to protect the patient’s health information. HIPAA also requires that standards are developed to help the transfer of information for treatment, payment, and operations to ensure coordination of benefits and timely treatment of patient with access to pertinent health information. HIPAA also include a set of standards for code sets for transactions, unique health identification numbers, and a standard for electronic signatures and prescriptions. Covered Entity The Administrative Simplification standards adopted by Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) apply to any entity that is a health care provider, clearing house, or health plan that conducts certain transactions. Culture of Accountability Accountability is being answerable or responsible for something and in this case HIPAA. In a medical practice, everyone is responsible for protecting the patient’s confidentiality. ePHI ePHI stands for Electronic Protected Health Information. It is any protected health information (PHI) which is created, stored, transmitted, or received electronically. This can include but is not limited to personal computers, external portable hard drives, including iPods, USB memory sticks/keys, CDs, DVDs, and floppy diskettes PDA’s, and smartphones. Electronic transmission includes data exchange (e.g., email or file transfer) via wireless, ethernet, fax, modem or cable network connections.
Need to Know and Minimum Necessary Access HIPAA requires that PHI be communicated on a Need to Know and Minimum Necessary basis to protect the patient’s health information. Instead of the entire chart being sent to another entity only requested information that is part of the treatment, payment, or for organizational administration should be given.
NPI The National Provider Identifier (NPI) is a Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification Standard. The NPI is a unique identification number for covered health care providers. Covered health care providers and all health plans and health care clearinghouses will use the NPIs in the administrative and financial transactions adopted under HIPAA. The NPI is a 10position, intelligence-free numeric identifier (10-digit number). This means that the numbers do not carry other information about healthcare providers, such as the state in which they live or their medical specialty. Beginning May 23, 2007 (May 23, 2008, for small health plans), the NPI must be used in lieu of legacy provider identifiers in the HIPAA standards transactions. As outlined in the Federal Regulation, The Health Insurance Portability and Accountability Act of 1996 (HIPAA), covered providers must also share their NPI with other providers, health plans, clearinghouses, and any entity that may need it for billing purposes.
PHI Protected health information (PHI) is any information in the patient’s medical record or designated record set that can be used to identify an individual. This information may be used by the provider, but must be protected. This data includes 18 means of identification of a patient: List of 18 Identifiers 1. Name 2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. 3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; 4. Phone numbers; 5. Fax numbers; 6. Electronic mail addresses; 7. Social Security numbers; 8. Medical record numbers; 9. Health plan beneficiary numbers; 10. Account numbers; 11. Certificate/license numbers; 12. Vehicle identifiers and serial numbers, including license plate numbers; 13. Device identifiers and serial numbers; 14. Web Universal Resource Locators (URLs); 15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints; 17. Full face photographic images and any comparable images; and 18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data) Any other characteristic that could uniquely identify the individual Privacy Rule The Privacy Rule governs Protected Health Information (PHI), Business Associate agreements, protection of patient records, providing a copy of the practice’s privacy rule to the patient, filing a privacy complaint or other patient record issues. The standards address the use and disclosure of information including patient’s consent and allows for patient’s to review and request edits of their information. Security Rule The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Department of Health and Human Services (HHS) to establish national standards for the security of electronic health care information. The final rule adopting HIPAA standards for security was published in the Federal Register on February 20, 2003. This final rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality of electronic protected health information and to protect against security breaches of information. TPO Personal health information (PHI) may be used for treatment, payment, and operations (TPO). Treatment is the provision, coordination or management of the patient by one or more providers. Payment includes activities involved in reimbursement of health care (billing, collections, claims management, verification of benefits, and review of health services with respect to medical necessity coverage. Health Care Operations of a covered entity include conducting quality assessment and improvement activities such as arranging for medical or legal review, along with general business management.
This information was based upon information obtained from the Office for Civil Rights under the Department of Health and Human Services http://www.hhs.gov/ocr/hipaa/
Test Your Knowledge (answers on next page)
1. What does HIPAA stand for? 2. What is a covered Entity under HIPAA? 3. What is a clearing house? 4. Do patients have any rights under HIPAA? 5. If you answered yes to number 4, what are their rights? 6. What is a Designated Security 7. What is TPO? 8. What is a Minimum Necessary Access? 9. What is PHI? 10. What is Public Information
Answers
1. What does HIPAA stand for? HIPAA is the common term for the Health Insurance Portability and Accountability Act of 1996 as proposed by the Kennedy-Kassenbaum Bill.
2. What is a covered Entity under HIPAA? Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid. Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists. Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data 3. What is a clearing house? This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa. 4. Do patients have any rights under HIPAA? Yes 5. If you answered yes to number 4, what are their rights? a. Ask to see and get a copy of their health records b. Have corrections added to their health information c. Receive a notice that tells patient how their health information may be used and shared d. Patient can decide if they want to give their permission before their health information can be used or shared for certain purposes, such as for marketing e. Get a report on when and why their health information was shared for certain purposes f. As a patient -If you believe your rights are being denied or your health information isn’t being protected, you can g. File a complaint with your provider or health insurer h. File a complaint with the U.S. Government
6. What is a Designated Security Officer- this person is responsible for defining and implementation of security policy and management controls that guide the staff behavior to address risks to information security and monitor system controls that protect the integrity of the PHI
7. What is TPO? Personal health information (PHI) may be used for treatment, payment, and operations (TPO). Treatment is the provision, coordination or management of the patient by one or more providers. Payment includes activities involved in reimbursement of health care (billing, collections, claims management, verification of benefits, and review of health services with respect to medical necessity coverage. Health Care Operations of a covered entity include conducting quality assessment and improvement activities such as arranging for medical or legal review, along with general business management. 8. What is a Minimum Necessary Access? Need to Know and Minimum Necessary Access HIPAA requires that PHI be communicated on a Need to Know and Minimum Necessary basis to protect the patient’s health information. Instead of the entire chart being sent to another entity only requested information that is part of the treatment, payment, or for organizational administration should be given.
9. What is PHI? Protected health information (PHI) is any information in the patient’s medical record or designated record set that can be used to identify an individual. This information may be used by the provider, but must be protected. This data includes 18 means of identification of a patient 10. What is Public Information Public information is the information that is available to the public at large. It is often thought of as “non-classified information” That is health information known, printed or in information systems could be made public, such as data that is not confidential.