HIPAA 101 HARMONY UNIVERSITY The Provider Unit of

HIPAA: Background To improve the efficiency and effectiveness of the health care system the

HIPAA: Background Required the Department of Health and Human Services (HHS) to adopt national

HIPAA: Background At same time Congress recognized that advances in electronic technology could erode

HIPAA: Background Following the passage of HIPAA two additional laws have been enacted that

HIPAA: Background Two Additional Laws Health Information Technology for Economic and Clinical Health Act

HIPAA: Background Two Additional Laws Patient Protection and Affordable Care Act of 2010 (ACA)

HIPAA Omnibus Update Published January 25, 2013 Effective March 26, 2013 Enforceable September 23,

What Is HIPAA? The Health Insurance Portability and Accountability Act (HIPAA) passed by congress

HIPAA Laws and Regulations Divided into Five Rules: Privacy Rule Security Rule Transaction Rule

HIPAA Privacy Rules Privacy Rule 45 CFR § 164. 5 xx Enforceable since 2003

HIPAA Privacy Rule The Privacy Rule establishes national standards to protect individuals medical records

HIPAA Privacy Rule What is PHI? Definition: Protected Health Information (PHI) is any information

HIPAA Privacy Rule What is PHI? For example, PHI is used in research studies

HIPAA Privacy Rule (continued) The HIPAA Privacy Rule requires appropriate safeguards to protect the

HIPAA Privacy Rule What is Protected Health Information (PHI)? Data are "individually identifiable" if

HIPAA Privacy Rule (continued) PHI 18 Identifiers: 1. Name 2. Address (all geographic subdivisions

HIPAA Privacy Rule (continued) PHI 18 Identifiers 3. All elements of dates (except year)

HIPAA Privacy Rule PHI 18 Identifiers (continued) 4. Telephone numbers 5. FAX numbers 6.

HIPAA Privacy Rule PHI 18 Identifiers (continued) 11. Certificate/license numbers 12. Vehicle identifiers and

HIPAA Privacy Rule PHI 18 Identifiers (continued) 16. Biometric identifiers, including finger and voice

HIPAA Privacy Rule Additional PHI Standards & Criteria To protect individual’s privacy from re

HIPAA Privacy Rule Additional PHI Standards & Criteria (continued) For Example: A subject’s initials

HIPAA Privacy Rule (continued) The Privacy Rule also gives patients rights over their health

HIPAA Privacy Rule (continued) The following HIPAA forms are associated with the Privacy Rule:

HIPAA Privacy Rule (continued) Business Associate Defined. In general, a business associate is a

HIPAA Privacy Rule: Privacy Practices for PHI The Notice of Privacy Practices (NOPP) allows

HIPAA Privacy Rule: Privacy Practices for PHI Examples of TPO The patient’s referring physician

HIPAA Privacy Rule: Privacy Practices for PHI (continued) Except for Treatment, the Minimum Necessary

HIPAA Privacy Rule: Privacy Practices for PHI (continued) When Should You? View PHI Use

HIPAA Security Rules Security Rule 45 CFR § 164. 3 xx Enforceable since 2005

HIPAA Security Rule The HIPAA Security Rule addresses the privacy protection of electronic protected

HIPAA Security Rule (continued) The HIPAA Security Rule addresses three aspects of security: Administrative

HIPAA Security Rule (continued) Covered entities need to perform a Risk Analysis and utilize

HIPAA Security Rule (continued) Hardware, Software and Transmission Security Organizations should have a hardware

HIPAA Transaction & Code Set Rule Per HIPAA regulations, a Code Set is any

HIPAA Transaction & Code Set Rule (continued) Medical data code sets used in the

HIPAA Transaction & Code Set Rule (continued) The following code sets are used in

HIPAA Identifiers Rule (Administrative Simplification) As part of the HIPAA Administrative Simplification regulation, there

HIPAA Identifiers Rule (Administrative Simplification) (continued) The unique identifiers under HIPAA regulations are: Standard

HIPAA Enforcement Rule The HIPAA Enforcement Rule stems directly from the ARRA HITECH Act

HIPAA Enforcement Rule (continued) ARRA describes "improvements" to existing HIPAA law, covered entities, business

HIPAA Enforcement Rule (continued) HITECH Act addresses five main areas of the HIPAA regulations:

HIPAA Enforcement Rule (continued) Creates new privacy requirements for HIPAA covered entities and business

HITECH ACT The American Recovery and Reinvestment Act of 2013 includes the Health Information

HITECH ACT (continued) HITECH Act provides over $30 billion for healthcare infrastructure and the

HITECH ACT (continued) ARRA describes "improvements" to existing HIPAA law, covered entities, business associates

HITECH ACT As part of the American Recovery and Reinvestment Act of 2009, the

HIPAA Breach Notification Rule Enforceable since February 2010 Final Rule in effect with new

What are the penalties for violating HIPAA? Failure to comply with the Health Insurance

What are the penalties for violating HIPAA? (continued) Section 13410(D) of the HITECH Act,

What are the penalties for violating HIPAA? (continued) Civil Monetary Penalties 1. Covered entity

What are the penalties for violating HIPAA? (continued) Tier Potential jail sentence Unknowingly or

HIPAA: What's New Individual rights of access Individual rights of restriction New restrictions on

Individual Rights to Access PHI Must have a process for individual to request access

Electronic Copy of PHI from EHR HITECH Act § 13405 (e) Individual may request

Electronic Copy of PHI from EHR (continued) Meaningful Use requirements for EHRs call for

Individual Preference for Communication Standard: Confidential Communications Requirements A covered health care provider must

Individual Preference for Communication (continued) Provision of Access Form of access requested The covered

Individual Preference for Communication (continued) Process: Must accommodate reasonable request Provide ability to mail

Evaluating/ Calculating Risk Each Risk Issue has an Impact and Likelihood Impact: Is how

Evaluating/ Calculating Risk (continued) If risk level appears low, it may be acceptable to

Changes to Individual Access Rights & Impacts All kinds of electronic information in designated

Rights to Request Restrictions Must have a process for individuals to request restrictions on

Impact of Restriction of Disclosures to Insurers Must have a policy/procedure/process Required in your

Genetic Information Nondiscrimination Act (GINA) Numerous changes to labor laws New changes to HIPAA

Designated Record Set 1. A group of records maintained by or for a covered

Designated Record Set (continued) 2. For purposes of this paragraph, the term record means

Business Associates (BA): Expansion of Rules Security Rules applies Breach Notification Rules applies Privacy

Business Associates (BA): Expansion of Rules (Continued) BA will need to educate their Subcontractors

Business Associate ? Is an individual or entity, not acting as an employee: Creates,

Business Associate ? (continued) Anything a CE or BA could do itself but has

Individual Access of PHI Must have a process for individual to request access, for

Marketing Changes Marketing requires an Authorization; treatment and healthcare operations do not require an

Marketing Changes (continued) Exemption for Refill reminders or other info about a drug or

Revisions to the Notice of Privacy Practices HIPAA Notices of Privacy Practices must reflect

Breach Notification What is Breach? Breach is acquisition, access, use, or disclosure of unsecured

Breach Notification (continued) Not reportable if there is a “low probability of compromise” of

Reportable Breach All breaches not meeting an exception are reportable, unless there is a

Breach Notification Decision Tree 1. Was there acquisition, access, use, or disclosure of PHI

Breach Notification Decision Tree 2. Was the information secured according to HHS guidance, or

Breach Notification Decision Tree 3. Was the potential breach internal to your organization, and

Breach Notification Decision Tree 4. Is there no way the breached information can be

Breach Notification Decision Tree (continued) 5. If you’ve gotten here, you have a breach,

Breach Notification Decision Tree (continued) Breach Notification Risk Assessment: Not reportable if there is

Breach Notification & Report If a small Breach (less than 500 individuals affected”): Report

HIPAA Breaches: Large Statistics Reported Breaches 500 > individuals’ PHI in the first year

HIPAA Breaches: Large Statistics (continued) Servers not immune from physical or technical attack Business

Nursing Home Regulation HIPAA Privacy Rules: HIPAA privacy rules define the circumstances under which

Nursing Home Regulation HIPAA Security Rules: Facilities must implement administrative, technical, and physical safeguards

Nursing Home Regulation HIPAA Enforcement: The U. S. Department of Health & Human Services

How the HIPAA Laws Apply to You These Rules apply to you when you:

Who Uses PHI? Anyone who works with or may view health, financial or confidential

Question & Answer Question: Can a skilled nursing facility (SNF) display residents’ names and

Question & Answer: Residents’ names and pictures can be displayed outside their doors only

Question & Answer Question : Do I have the right as a Medicare beneficiary

Question & Answer: The Privacy Rule gives you the right to access records in

Confidentiality “ General rule is that patient authorization is required for any use or

Confidentiality Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 99

Confidentiality in Special Settings Long Term Care – In long term care residents have

Confidentiality Special Settings Psychiatric/ Chemical Dependency Units: The law requires much more stringent protection

Confidentiality Special Settings Other Special circumstances HIV Pregnancy Sexual Abuse Rape These patients are

Confidentiality Reporting Laws There are some exceptions to a caregiver’s obligation to keep information

Confidentiality Other Exceptions Criminal Wounds Gunshots Poisonings Communicable Diseases and Emergency Circumstances Deaths of

How Does it Affect Nurses and Caregivers Student Nurse Assignment sheets will no longer

How Does it Affect Nurses and Caregivers (continued) Computer screens should face away from

Question & Answer Scenario: 1 Question 1: I do not work with patients or

Question & Answer Scenario: 1 (continued) Answer 1: The correct answer is A. Information

Question & Answer Scenario: 2 I work in admitting and my friend, who works

Question & Answer Scenario: 2 (continued) Answer 2: The correct answer is C. It

Question & Answer Scenario: 3 Question 3: As a file clerk, it is my

Question & Answer Scenario: 3 (continued) Answer 3: The correct answer is C. There

Question & Answer Scenario: 4 Question 4: Because I have access to confidential patient

Question & Answer Scenario: 4 Answer 4: The correct answer is B. It is

Protecting Privacy Verbal exchanges Knowing where you left your paperwork Disposal of paper documents

Protecting Privacy (continued) Verbal Exchanges Patients may see normal clinical operations as violating their

Protecting Privacy (continued) Know Where You Left Your Paperwork Check printers, faxes, copier machines

Protecting Privacy (continued) Disposal of Paper Documentation Shred or destroy PHI before throwing it

Protecting Privacy (continued) Security of Electronic Patient information (e. PHI) Good security standards follow

Protecting Privacy (continued) Privacy Breach from Lost, Stolen, or Misdirected Information A privacy breach

Protecting Privacy (continued) Examples of Privacy Breaches Talking in public areas, talking too loudly,

Question & Answer Scenario: 5 Question 5: I called a patient’s phone number and

Question & Answer Scenario: 5 Answer 1: The correct answer is B. Patient name

Protecting Privacy (continued) Computer Security Ensure your computer and data are physically secured by

Protecting Privacy (continued) Portable Device Security Tips Always encrypt portable devices and media with

Protecting Privacy Question & Answer Scenario: 6 (continued) Question 6: A physician is very

Protecting Privacy Question & Answer Scenario: 6 (continued) Answer 6: The correct answer is

Protecting Privacy Question & Answer Scenario: 7 Question 7: As part of your job,

Protecting Privacy Question & Answer Scenario: 7 Answer 7: The correct answer is A.

Protecting Privacy Question & Answer Scenario: 8 Question 8: Which workstation security safeguards are

Protecting Privacy Question & Answer Scenario: 8 Answer 8: The correct answer is D.

Protecting Privacy Reporting Privacy Breaches Immediately report any known or suspected privacy breaches (such

Protecting Privacy How to Report Security Incidents Report lost or stolen laptops, blackberries, PDAs,

Closing Remember All Patient information is Private This includes: Personal Information Financial Information Medical

Questions/Answers Harmony Healthcare Internationa 1 (800) 530 – 4413 Ebovee@harmony-healthcare. com Copyright © 2013

Harmony Healthcare International Have you Considered a Customized Complimentary HARMONY(HHI) MEDICARE PROGRAM EVALUATION or

Slides: 136

Download presentation

HIPAA 101 HARMONY UNIVERSITY The Provider Unit of Harmony Healthcare International, Inc. Presented by: Diane Buckley, BSN, RN RAC CT , CHC Vice President of Corporate Compliance

HIPAA: Background To improve the efficiency and effectiveness of the health care system the Health Insurance Portability and Accountability Act of 1996 (HIPAA) of 1996, Public Law 104 191 Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 2

HIPAA: Background Required the Department of Health and Human Services (HHS) to adopt national standards for Electronic Health Care Transactions Code Sets Unique Health Identifiers Security Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 3

HIPAA: Background At same time Congress recognized that advances in electronic technology could erode the privacy of health information. Congress incorporated into HIPAA provisions that mandated the adoption of Federal Privacy Protection for identifiable health information. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 4

HIPAA: Background Following the passage of HIPAA two additional laws have been enacted that add requirements to HIPAA and strengthen various aspects of administrative simplification. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 5

HIPAA: Background Two Additional Laws Health Information Technology for Economic and Clinical Health Act (HITECH) enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA) HITECH Act addresses the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 6

HIPAA: Background Two Additional Laws Patient Protection and Affordable Care Act of 2010 (ACA) ACA builds upon HIPAA with new and expanded provisions, including requirements to adopt operating rules for each of the HIPAA covered transactions A unique standard Health Plan Identifier A standard for electronic funds transfer ACA requires that health plans certify their compliance with the standards and operating rules and increases penalties noncompliance Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 7

What Is HIPAA? The Health Insurance Portability and Accountability Act (HIPAA) passed by congress in 1990 s is a federal law that specifies administrative simplification provisions that: Protect the privacy of patient information Provide for electronic and physical security of patient health information Require “minimum necessary” use and disclosure Specify patient rights to approve the access and use of their medical information Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 9

HIPAA Laws and Regulations Divided into Five Rules: Privacy Rule Security Rule Transaction Rule Identifiers Rule Enforcement Rule (HITECH Act) Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 10

HIPAA Privacy Rules Privacy Rule 45 CFR § 164. 5 xx Enforceable since 2003 Establishes Rights of Individuals Controls on Uses and Disclosures Baseline Privacy and Security Protection for PHI Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 11

HIPAA Privacy Rule The Privacy Rule establishes national standards to protect individuals medical records and other personal health information. The Privacy Rule applies to Health plans, Health care clearinghouses, and Health care providers that conduct health care transactions electronically. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 12

HIPAA Privacy Rule What is PHI? Definition: Protected Health Information (PHI) is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment. HIPAA regulations allow researchers to access and use PHI when necessary to conduct research. However, HIPAA only affects research that uses, creates, or discloses PHI that will be entered in to the medical record or will be used for healthcare services, such as treatment, payment or operations. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 13

HIPAA Privacy Rule What is PHI? For example, PHI is used in research studies involving review of existing medical records for research information, such as retrospective chart review. Also, studies that create new medical information because a health care service is being performed as part of research, such as diagnosing a health condition or a new drug or device for treating a health condition, create PHI that will be entered into the medical record. For example, sponsored clinical trails that submit data to the U. S. Food and Drug Administration involve PHI and are therefore subject to HIPAA regulations. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 14

HIPAA Privacy Rule (continued) The HIPAA Privacy Rule requires appropriate safeguards to protect the privacy of Personal Health Information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 15

HIPAA Privacy Rule What is Protected Health Information (PHI)? Data are "individually identifiable" if they include any of the 18 types of identifiers for an individual or for the individual's employer or family member, or if the provider or researcher is aware that the information could be used, either alone or in combination with other information, to identify an individual. These identifiers are: Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 16

HIPAA Privacy Rule (continued) PHI 18 Identifiers: 1. Name 2. Address (all geographic subdivisions smaller than state, including street address, city, county, or ZIP code) and their equivalent geocodes, except for the three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20, 000 people; and The initial three digits of zip code for all such geographic units containing 20, 000 or fewer people is changed to 000. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 17

HIPAA Privacy Rule (continued) PHI 18 Identifiers 3. All elements of dates (except year) for dates directly related to an individual, Including birth date, Admission date, Discharge date, Date of death, All ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 18

HIPAA Privacy Rule PHI 18 Identifiers (continued) 4. Telephone numbers 5. FAX numbers 6. Email address 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 19

HIPAA Privacy Rule PHI 18 Identifiers (continued) 11. Certificate/license numbers 12. Vehicle identifiers and serial numbers, including license plate numbers 13. Device identifiers and serial numbers 14. Web URLs 15. Internet Protocol (IP) address numbers Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 20

HIPAA Privacy Rule PHI 18 Identifiers (continued) 16. Biometric identifiers, including finger and voice prints 17. Full face photographic images and any comparable images 18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data) Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 21

HIPAA Privacy Rule Additional PHI Standards & Criteria To protect individual’s privacy from re identification Any code used to replace the identifiers in datasets cannot be derived from any information related to the individual and the master codes, nor can the method to derive the codes be disclosed Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 22

HIPAA Privacy Rule Additional PHI Standards & Criteria (continued) For Example: A subject’s initials cannot be used to code their data because the initials are derived from their name. Additionally, the researcher must not have actual knowledge that the research subject could be re identified from remaining identifiers in the PHI used in the research study. In other words, the information would still be considered identifiable if there was a way to identify the individual even though all of the 18 identifiers were removed. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 23

HIPAA Privacy Rule (continued) The Privacy Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 24

HIPAA Privacy Rule (continued) The following HIPAA forms are associated with the Privacy Rule: Notice of Privacy Practices (NPP) Form Request for Access to Protected Health Information (PHI) Form Request for Restriction of Patient Health Care Information Form Request for Accounting Disclosures Form Authorization for Use or Disclosure Form Privacy Complaint Form Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 25

HIPAA Privacy Rule (continued) Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing. 9 Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 26

HIPAA Privacy Rule: Privacy Practices for PHI The Notice of Privacy Practices (NOPP) allows PHI to be used and disclosed for purposes of TPO Treatment (T), Payment (P), Operations (O) TPO includes teaching, medical staff/peer review, legal auditing, customer service, business management and releases mandated by law Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 27

HIPAA Privacy Rule: Privacy Practices for PHI Examples of TPO The patient’s referring physician calls and asks for a copy of the patient’s recent exam: Treatment A patient’s insurance company calls and request a copy of the patient’s medical record for a specific services date Payment The Quality Improvement office calls and asks for a copy of an operative report Health Care Operations For these TPO purposes, patient information may be provided Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 28

HIPAA Privacy Rule: Privacy Practices for PHI (continued) Except for Treatment, the Minimum Necessary Standard Applies For patient care and treatment, HIPAA does not impose restrictions on use and disclosure of PHI by health care providers Exception: Psychotherapy information, HIV test results, and substance abuse information For anything else, HIPAA requires users to access the minimum amount of information necessary to perform their duties Example: A billing clerk may need to know what laboratory test was done, but not the result Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 29

HIPAA Privacy Rule: Privacy Practices for PHI (continued) When Should You? View PHI Use PHI Share PHI Remember Use information only when necessary to perform your job duties Use only the minimum necessary to perform your job duties Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 30

HIPAA Security Rules Security Rule 45 CFR § 164. 3 xx Enforceable since 2005 Applies to all electronic PHI Flexible, customizable approach to health information security Uses Risk Analysis to identify and plan mitigation of security risks Calls for Policies and Procedures Now being enforced more, including identity theft cases Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 31

HIPAA Security Rule The HIPAA Security Rule addresses the privacy protection of electronic protected health information (PHI). Similar to the Privacy Rule, the Security Rule also deals with identifiable health information as defined by 18 HIPAA identifiers. The Security Rule defines standards, procedures and methods for protecting electronic PHI with attention to how PHI is stored, accessed, transmitted, and audited. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 32

HIPAA Security Rule (continued) The HIPAA Security Rule addresses three aspects of security: Administrative Safeguards Assignment of a HIPAA security compliance team. Physical Safeguards Protection of electronic systems, equipment and data. Technical Safeguards Authentication & encryption used to control data access. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 33

HIPAA Security Rule (continued) Covered entities need to perform a Risk Analysis and utilize Risk Management methodologies so vulnerabilities and possible risks can be reduced. Organizations should assign a security analyst or officer who is responsible or maintaining and enforcing the HIPAA standards within the organization. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 34

HIPAA Security Rule (continued) Hardware, Software and Transmission Security Organizations should have a hardware firewall in place. Transmission of personal information should be encrypted and comply with HIPAA rulings. Operating Systems should be hardened and up to date. Policies should cover the updating of hardware, firmware, operating systems and applications. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 35

HIPAA Transaction & Code Set Rule Per HIPAA regulations, a Code Set is any set of codes used for encoding data elements, such as: Medical terms Medical concepts Medical diagnosis codes Medical procedure codes. Code sets for medical data are required for administrative transactions under HIPAA for diagnoses, procedures, and drugs. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 36

HIPAA Transaction & Code Set Rule (continued) Medical data code sets used in the health care industry under HIPAA include: Coding systems for health related problems and their manifestations; Causes of injury, disease or impairment; Actions taken to prevent, diagnose, treat, or manage diseases, injuries, and impairments; And any substances, equipment, supplies, or other items used to perform these actions. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 37

HIPAA Transaction & Code Set Rule (continued) The following code sets are used in HIPAA transactions: ICD 9 CM codes ICD 10 CM codes HCPCS Codes CPT 3 Codes CPT 4 Codes NDC Codes Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 38

HIPAA Identifiers Rule (Administrative Simplification) As part of the HIPAA Administrative Simplification regulation, there are currently three unique identifiers used for covered entities in HIPAA administrative and financial transactions. The use of these unique identifiers will promote standardization, efficiency and consistency. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 39

HIPAA Identifiers Rule (Administrative Simplification) (continued) The unique identifiers under HIPAA regulations are: Standard Unique Employer Identifier The same as the Employer Identification Number (EIN) used on an organization's federal IRS Form W 2. This identifies an employer entity in HIPAA transactions. National Provider Identifier (NPI) NPI is a unique 10 digit number used for covered health care providers in all HIPAA administrative and financial transactions. National Health Plan Identifier (NHI) The NHI is a Centers for Medicare & Medicaid Services (CMS) proposed identifier to identify health plans and payers. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 40

HIPAA Enforcement Rule The HIPAA Enforcement Rule stems directly from the ARRA HITECH Act provisions that distinguishes between violations occurring before, and on or after the compliance date of Feb. 18, 2013 "with respect to the potential amount of civil money penalty and the affirmative defense available to covered entities, " according to the rule. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 41

HIPAA Enforcement Rule (continued) ARRA describes "improvements" to existing HIPAA law, covered entities, business associates and others will be subject to more rigorous standards when it comes to protected health information (PHI). The HITECH Act expands the scope of the HIPAA Privacy and Security Rules and increases the penalties for HIPAA violations. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 42

HIPAA Enforcement Rule (continued) HITECH Act addresses five main areas of the HIPAA regulations: Applies the same HIPAA privacy and security requirements (and penalties) for covered entities to business associates Establishes mandatory federal privacy and security breach reporting requirements for HIPAA covered entities and business associates Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 43

HIPAA Enforcement Rule (continued) Creates new privacy requirements for HIPAA covered entities and business associates, including new accounting disclosure requirements and restrictions on sales and marketing Establishes new criminal and civil penalties for HIPAA non compliance and new enforcement methods Mandates that the new security requirements must be incorporated into all Business Associate contracts Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 44

HITECH ACT The American Recovery and Reinvestment Act of 2013 includes the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act provides Medicare and Medicaid monetary incentives for hospitals and physicians to adopt electronic health records (EHRs) and also provides grants for the development of a health information exchange (HIE). These incentives and grants were created to stimulate health care providers to adopt technology necessary to improve the efficiency of patient healthcare. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 45

HITECH ACT (continued) HITECH Act provides over $30 billion for healthcare infrastructure and the adoption of electronic health records (EHR). According to the Act, physicians are eligible to receive up to $44, 000 per physician from Medicare for "meaningful use" of a certified EHR system starting in 2013. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 46

HITECH ACT (continued) ARRA describes "improvements" to existing HIPAA law, covered entities, business associates and others will be subject to more rigorous standards when it comes to protected health information (PHI). The HITECH Act expands the scope of the HIPAA Privacy and Security Rules and increases the penalties for HIPAA violations Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 47

HITECH ACT As part of the American Recovery and Reinvestment Act of 2009, the Health Information Technology for Economic and Clinical Health (HITECH) Act updated federal HIPAA privacy and security standards. Updates Include: Breach notification requirements Fine and penalty increases for privacy violations Right to request copies of the electronic health care record in electronic format Mandates that Business Associates are civilly and criminally liable for privacy and security violations Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 48

HIPAA Breach Notification Rule Enforceable since February 2010 Final Rule in effect with new changes in how to determine if a Breach must be reported Works with Privacy and Security Rules Requires reporting of all PHI breaches to HHS and Individuals HHS Wall of shame: Post all large Breaches 500 or more Extensive/expensive obligation Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 49

What are the penalties for violating HIPAA? Failure to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) can result in Civil and Criminal penalties. These civil and criminal penalties can apply to both Covered Entities and Individuals. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 50

What are the penalties for violating HIPAA? (continued) Section 13410(D) of the HITECH Act, which became effective on February 18, 2009, revised section 1176(a) of the Social Security Act by establishing: Four categories of violations that reflect increasing levels of culpability; Four corresponding tiers of penalties that significantly increase the minimum penalty amount for each violation; and A maximum penalty amount of $1. 5 million for all violations of an identical provision. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 51

What are the penalties for violating HIPAA? (continued) Civil Monetary Penalties 1. Covered entity or individual did not know $100 -$50, 000 for each violation, up to a maximum Tier Penalty (and by exercising reasonable diligence would not have known) the act was a HIPAA violation. 2. The HIPAA violation had a reasonable cause and was not due to willful neglect. of $1. 5 million for identical provisions during a calendar year 3. The HIPAA violation was due to willful neglect but the violation was corrected within the required time period. $10, 000 -$50, 000 for each violation, up to a maximum of $1. 5 million for identical provisions during a calendar year 4. The HIPAA violation was due to willful neglect and was not corrected. $50, 000 or more for each violation, up to a maximum of $1. 5 million for identical provisions during a calendar year Copyright © 2013 All Rights Reserved $1, 000 -$50, 000 for each violation, up to a maximum of $1. 5 million for identical provisions during a calendar year Harmony Healthcare International, Inc. 52

What are the penalties for violating HIPAA? (continued) Tier Potential jail sentence Unknowingly or with reasonable cause Up to one year Under false pretenses Up to five years For personal gain or malicious reasons Up to ten years Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 53

HIPAA: What's New Individual rights of access Individual rights of restriction New restrictions on use of genetic information by health plans Change in the way to determine whether or not a breach must be reported New restrictions on disclosures for marketing, sale of PHI; changes to rules for use of PHI for fundraising Notices of Privacy Practices must be updated to reflect new individual rights and privacy practices Expansion of rules to Business Associates PHI not protected > 50 years after individual’s death Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 54

Individual Rights to Access PHI Must have a process for individual to request access and for a reasonable cost based fee Must provide the entire record in the Designated Record Set if requested: Medical and billing records used in whole or in part to make decisions related to health care New Information kept electronically must be available electronically if requested. Exceptions for Psychotherapy notes, CLIA, others Changes to HIPAA and CLIA proposed to allow access of lab information by individuals (not finalized yet) New 30 day extension to provide records held off site no longer allowed must retrieve within 30 days Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 55

Electronic Copy of PHI from EHR HITECH Act § 13405 (e) Individual may request electronic copy of EHR information, now in § 164. 524(c) Includes all electronic data in the Designated Record Set Request goes to Covered Entity Business Associates may need to provide the information depending on role, arrangements, contract Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 56

Electronic Copy of PHI from EHR (continued) Meaningful Use requirements for EHRs call for access by individuals Portal Logon Password Flexibility in encryption of PHI e mailed to individuals Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 57

Individual Preference for Communication Standard: Confidential Communications Requirements A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or locations Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 58

Individual Preference for Communication (continued) Provision of Access Form of access requested The covered entity must provide the individual with access to the protected health information in the form or format requested by the individual, if it is readily producible in such form or format; or, if not, in a readable hard copy form or such other or format as agreed to by the covered entity and the individual If PHI is electronic, individual may request electronic copy (new) Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 59

Individual Preference for Communication (continued) Process: Must accommodate reasonable request Provide ability to mail to alternate addresses, not receive telephone calls, etc May refuse if request is unreasonable Individuals may want to use texting, e mail, social media Use Risk Analysis to determine suitability, obtain agreements Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 60

Evaluating/ Calculating Risk Each Risk Issue has an Impact and Likelihood Impact: Is how great the damage would be (more information about more people with more details has greater impact) Likelihood: Is how likely it is that the risk issue would become a reality Risk = Impact x Likelihood Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 61

Evaluating/ Calculating Risk (continued) If risk level appears low, it may be acceptable to both the entity and the individual An informed risk decision can be made about the importance of mitigating certain risks Rights can not be given under HIPAA, but individuals can make an informed risk decision Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 62

Changes to Individual Access Rights & Impacts All kinds of electronic information in designated record set, not just HER Have you performed an inventory of your electronic PHI? Are access procedures in place? Who responds to request for access? How will you provide electronic access of PHI? Will need to update policy to include new rights and remove allowance for extra 30 days to provide offsite records Will need to update the Notice of Privacy Practices Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 63

Rights to Request Restrictions Must have a process for individuals to request restrictions on use and disclosure Need not honor request Do what you reasonably can New Individual may request no information shared with insurer if paid in full out of pocket: MUST honor the request Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 64

Impact of Restriction of Disclosures to Insurers Must have a policy/procedure/process Required in your HER to meet the law Can you flag such encounters? Create non billable procedure codes for self pay What about pass through effects? Issues with aggregated data What about contracts with insurers? May need to update BA Agreements Will need to update the Notice of Privacy Practices Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 65

Genetic Information Nondiscrimination Act (GINA) Numerous changes to labor laws New changes to HIPAA § 164. 502(a)(5)(i) Genetic information not to be used in health plan underwriting, enrollment, eligibility, premium computation, consideration of pre existing conditions, etc. . Must be noted in Health Plan Notice of Privacy Practices Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 66

Designated Record Set 1. A group of records maintained by or for a covered entity that is: A. The Medical records and billing records about individuals maintained by or for a covered health care provider; The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used, in whole or in part, by or for the covered entity to make decisions about individuals Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 67

Designated Record Set (continued) 2. For purposes of this paragraph, the term record means any items, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by for a covered entity Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 68

Business Associates (BA): Expansion of Rules Security Rules applies Breach Notification Rules applies Privacy Rule Use (How they use the information) and Disclosure provision apply BA responsible for having contracts with Covered Entities and Subcontractors BA directly liable for compliance and violations Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 69

Business Associates (BA): Expansion of Rules (Continued) BA will need to educate their Subcontractors Contracts signed since January 25, 2013 must meet new standard by September 23, 2013 Older, complaint contracts signed before January 25, 2013 have until September 23, 2014 to comply Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 70

Business Associate ? Is an individual or entity, not acting as an employee: Creates, receives, maintains, or transmits protected health information for a function or activity regulated by HIPAA on behalf of a Covered Entity (CE) or another BA Provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services and needs PHI to do it Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 71

Business Associate ? (continued) Anything a CE or BA could do itself but has someone else do it for them, involving creation, receipt, maintenance, or transmission of PHI Now includes subcontractors, HIEs, Patient Safety Organizations Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 72

Individual Access of PHI Must have a process for individual to request access, for a reasonable cost based fee Must provide the entire record in the Designated Record Set if requested: Medical and billing records used in while or in part to make decisions related to health care Information kept electronically must be available electronically if requested Exception for Psychotherapy notes, CLIA, others Changes to HIPAA and CLIA proposed to allow access of lab information by individuals, not yet finalized 30 Day extension to provide records held off site no longer allowed Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 73

Marketing Changes Marketing requires an Authorization; treatment and healthcare operations do not require an authorization, except: Authorizations are required for all treatment and healthcare operations where the Covered Entity receives financial remuneration from third party whose product or service is being marketed Notice of Privacy Practices may not have to include notice, if authorization Face to Face communication is still exempted from authorization requirements Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 74

Marketing Changes (continued) Exemption for Refill reminders or other info about a drug or biologic that is currently prescribed Communication promoting health in general and that do not promote a product or service from a particular provider, do not constitute marketing and do not require individual authorization Communication about government and government sponsored programs do not fall within the definition of “marketing” Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 75

Revisions to the Notice of Privacy Practices HIPAA Notices of Privacy Practices must reflect individual rights and controls on uses and disclosures New right of access to electronic PHI New right of restriction of disclosures New right to be notified in the event of a breach Changing to marketing Changes to Fundraising GINA notice for health plan NPPs Must update policies and NPP together, by deadline Start using (and post) new version; no requirement for providers to redistribute to all patients Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 76

Breach Notification What is Breach? Breach is acquisition, access, use, or disclosure of unsecured PHI in violation of Privacy Rule; exception by law if: PHI is secured or destroyed Unintentional, in good faith, with no further use (within your organization) Inadvertent and within job scope(within your organization) Information cannot be retained Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 77

Breach Notification (continued) Not reportable if there is a “low probability of compromise” of the data, based on a risk assessment “Harm Standard” for evaluations of need to report was removed Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 78

Reportable Breach All breaches not meeting an exception are reportable, unless there is a “low probability of compromise” of the data, based on a risk assessment including at least: What was the information, how well identified was it, and is its release “adverse to the individual” To whom it was disclosed Was it actually acquired or viewed The extent of mitigation Right to notification of breaches must be listed in the Notice of Privacy Practices Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 79

Breach Notification Decision Tree 1. Was there acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule? If No, not a breach, end of process If an incident, document the incident and the determination of “not a breach” If yes, Go on to Step 2 Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 80

Breach Notification Decision Tree 2. Was the information secured according to HHS guidance, or destroyed? If Yes, not a reportable breach, end of process; document the incident and determination of “not a reportable breach” If No, may be able to use lower security encryption in the evaluation of risk later in step 5; go to Step 3 Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 81

Breach Notification Decision Tree 3. Was the potential breach internal to your organization, and unintentional, in good faith, with no further use, or inadvertent and within job scope? If Yes, not a breach, end of process, document the incident and determination of “not a breach” If No, go on to step 4 Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 82

Breach Notification Decision Tree 4. Is there no way the breached information can be retained? If no way the PHI was retained, not a breach, end of process, document the incident and determination of “not a breach” If the breached information may be retained in some way, go to Step 5 Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 83

Breach Notification Decision Tree (continued) 5. If you’ve gotten here, you have a breach, and now the only way to keep from having to report it is to do a risk assessment to see if there is a “low probability of compromise” If there is a low probability of compromise, it is not reportable, end of process, document incident and determination of “not a reportable breach” If not a low probability of compromise, Must report Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 84

Breach Notification Decision Tree (continued) Breach Notification Risk Assessment: Not reportable if there is a “low probability of compromise “ of the data, based on a risk assessment of: What was the information and how well identified was it To whom it was disclosed Was it actually acquired or viewed The extent of mitigation Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 85

Breach Notification & Report If a small Breach (less than 500 individuals affected”): Report to the individual within 60 days Report to HHS no later than 60 days after the end of the year If a large Breach ( 500 or more affected): Report to the individual within 60 days Report to HHS when you notify the individual If more than 500 individuals in any jurisdiction, notify major media Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 86

HIPAA Breaches: Large Statistics Reported Breaches 500 > individuals’ PHI in the first year of reporting requirement: 76% of breaches involve loss (15%), theft (56%), improper disposal (5%) 17% are caused by unauthorized access or disclosure 6% are caused by hacking Portable data, laptops, smart phones, memory sticks the leaders for breaches of PHI Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 87

HIPAA Breaches: Large Statistics (continued) Servers not immune from physical or technical attack Business Associates are an increasing source of breaches (57%) HHS Wall of Shame for large breaches Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 88

Nursing Home Regulation HIPAA Privacy Rules: HIPAA privacy rules define the circumstances under which a resident's electronic health care information can be disclosed to third parties. With few exceptions, a facility must have the resident's written authorization to disclose specific medical information. Residents must be provided with a written notice as to how health information is used and shared. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 89

Nursing Home Regulation HIPAA Security Rules: Facilities must implement administrative, technical, and physical safeguards to ensure that electronic protected health care information is not disclosed to unauthorized persons. Specific electronic security systems and requirements are not defined in the HIPAA security rules, allowing nursing homes to select and tailor the security systems and equipment that is appropriate to their organization and facilities. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 90

Nursing Home Regulation HIPAA Enforcement: The U. S. Department of Health & Human Services Office for Civil Rights, or OCR, investigates complaints of possible violations of HIPAA security and privacy rules. The OCR also conducts compliance reviews and provides outreach and educational programs. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 91

How the HIPAA Laws Apply to You These Rules apply to you when you: Look At Use or Share Protected Health Information (PHI) Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 92

Who Uses PHI? Anyone who works with or may view health, financial or confidential information with HIPAA protected health identifiers Everyone who uses a computer or electronic device which stores and/or transmits information Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 93

Question & Answer Question: Can a skilled nursing facility (SNF) display residents’ names and pictures on a plaque outside their doors? Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 94

Question & Answer: Residents’ names and pictures can be displayed outside their doors only if the SNF obtains authorization from residents. If a resident is not capable of authorizing the display of his or her name and picture, the SNF would need to seek authorization from a personal representative of the resident. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 95

Question & Answer Question : Do I have the right as a Medicare beneficiary to access the UB 04 form that a hospital submits as a bill for payment to Medicare? May I access and receive a copy of my coding abstract? I understand that these documents are part of the electronic data that is part of my record, which is considered part of the designated record set. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 96

Question & Answer: The Privacy Rule gives you the right to access records in the designated record set. This is defined as information used by a covered entity to make decisions about individuals. For providers, the designated record set includes medical and billing records. For health plans, the designated record set includes enrollment, payment, claims adjudication, and case management records. The UB 04 form is a billing record, so it is part of the designated record set to which you have access. The coding summary is an administrative record and may not be considered part of your medical record. If the covered entity defines the medical record to exclude administrative records, such as coding summaries, the covered entity may deny your request to access your coding summary. However, codes that were submitted for billing will appear on the UB 04. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 97

Confidentiality “ General rule is that patient authorization is required for any use or disclosure or protected information that is not directly related to treatment, payment or health operations” This is to prevent unauthorized disclosure to anyone outside the agency or within the agency Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 98

Confidentiality in Special Settings Long Term Care – In long term care residents have gotten to know one another, there may be questions about another resident. AVOID discussing a resident’s condition with another resident. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 100

Confidentiality Special Settings Psychiatric/ Chemical Dependency Units: The law requires much more stringent protection of privacy in these settings. It is a violation of federal law to reveal or even confirm the identity of a patient in any psychiatric setting or chemical rehabilitation. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 101

Confidentiality Special Settings Other Special circumstances HIV Pregnancy Sexual Abuse Rape These patients are or may be at risk for Breach of confidentiality. Normally parents of minors are automatically given information regarding their child's condition, but law varies from state to state. Know your state law. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 102

Confidentiality Reporting Laws There are some exceptions to a caregiver’s obligation to keep information confidential…Threats and Suspected Abuse Patients in a psychiatric setting sometimes make threats to harm others. Report to staff. When you encounter any patient who appears to have been physically abused, you have a duty to report your suspicions. As a nurse you should contact your supervisor, social services and police. Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 103

Confidentiality Other Exceptions Criminal Wounds Gunshots Poisonings Communicable Diseases and Emergency Circumstances Deaths of an Uncertain Nature Report to your supervisor and follow agency/state guidelines

How Does it Affect Nurses and Caregivers Student Nurse Assignment sheets will no longer have patient names Patient information should NEVER be left visible to the public Charts, MAR, Kardex, etc should always be closed DO NOT Leave your PAPERs Visible to others Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 105

How Does it Affect Nurses and Caregivers (continued) Computer screens should face away from public view while charting Never leave patient’s computer screen up if you must leave to care for patient Never leave information on computer screens for unauthorized persons to gain access Log Off Do NOT share computer codes Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 106

Question & Answer Scenario: 1 Question 1: I do not work with patients or have access to medical records, however I see patients pass by my desk in the clinic. Can I talk about the patients with my coworkers, family and friends even if it has nothing to do with my job? A. You may not discuss any patient information with anyone unless required for your job B. You may only talk about the patient with your coworkers C. You may only talk about the patient with your family and friends Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 107

Question & Answer Scenario: 1 (continued) Answer 1: The correct answer is A. Information can only be used as needed for your job. A. You may not discuss any patient information with anyone unless required for your job Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 108

Question & Answer Scenario: 2 I work in admitting and my friend, who works in the Emergency Department, told me that she just saw a famous movie star get on the elevator. My friend read in the paper that the movie star has cancer and asked me to find out what floor that star is on. Can I give my friend the information? A. It is okay as I am only looking up her location, not her medical condition B. I already have approval to access patient clinical systems, so no one will know that I accessed it C. It is not necessary for my job, so I would be violating the patient’s privacy by checking on her location and by sharing this information with my friend Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 109

Question & Answer Scenario: 2 (continued) Answer 2: The correct answer is C. It is not part of your or your friend’s job, even if you are a system user. Your access to the record will automatically be recorded and can be tracked. Both you and your friend are not protecting the privacy of this patient. There could be serious consequences to your employment. C. It is not necessary for my job, so I would be violating the patient’s privacy by checking on her location and by sharing this information with my friend Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 110

Question & Answer Scenario: 3 Question 3: As a file clerk, it is my job to see PHI, but while opening lab reports, I saw my manager’s pregnancy test results. Her pregnancy test was positive! I congratulated her, but found out that I was the first person to tell her. Did I do the right thing? A. It is okay as it was part of my job to see PHI B. She is an employee, so it is okay to look at other employee records C. I should not have used the information as it was not my job to discuss lab results, to provide a diagnosis, or to use her information outside my job duties Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 111

Question & Answer Scenario: 3 (continued) Answer 3: The correct answer is C. There was impermissible disclosure of her information. C. I should not have used the information as it was not my job to discuss lab results, to provide a diagnosis, or to use her information outside my job duties Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 112

Question & Answer Scenario: 4 Question 4: Because I have access to confidential patient information as part of my job, I can look up anybody’s record, even if they are not my patient, as long as I keep the information to myself. A. True, as long as I do not share this information B. I can only look at records when it is required by my job C. I can access hard copy medical charts, but not electronic records, anytime I want Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 113

Question & Answer Scenario: 4 Answer 4: The correct answer is B. It is acceptable only when it is necessary for your job and only the minimum information necessary to do your job. Idle curiosity can jeopardize the patient’s privacy and your employment. B. I can only look at records when it is required by my job Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 114

Protecting Privacy Verbal exchanges Knowing where you left your paperwork Disposal of paper documents Security of Electronic Patient Information (e. PHI) Privacy breach from lost, stolen, or misdirected information Incidents from any format of information Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 115

Protecting Privacy (continued) Verbal Exchanges Patients may see normal clinical operations as violating their privacy Be aware of your surroundings when talking Do not leave PHI on answering machines Ask yourself. “What if it was my information being discussed like this? ” Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 116

Protecting Privacy (continued) Know Where You Left Your Paperwork Check printers, faxes, copier machines when you are done using them Ensure paper charts are returned to applicable areas in nursing stations, medical records, or designated file rooms Do not leave hard copies of PHI laying on your desk; lock it up in your desk at the end of the day Seal envelopes well when mailing Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 117

Protecting Privacy (continued) Disposal of Paper Documentation Shred or destroy PHI before throwing it away Dispose of paper and other records with PHI in secured shredding bins. Recycling and Trash bins are Not secure. Shredding bins work best when papers are put inside the bins. When papers are left outside the bin, they are not secured from: Daily gossip Daily trash The public Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 118

Protecting Privacy (continued) Security of Electronic Patient information (e. PHI) Good security standards follow the “ 90/10” Rule: § 10% of security safeguards are technical § 90% of security safeguards rely on the computer user (YOU) to adhere to good computer practices Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 119

Protecting Privacy (continued) Privacy Breach from Lost, Stolen, or Misdirected Information A privacy breach can occur when information is: § Physically lost or stolen § Paper copies, films, tapes, electronic devices § Anytime, anywhere even while on public transportation, crossing the street, in the building, in your office § Misdirected to others outside of work environment § Verbal messages sent to or left on the wrong voicemail or sent or left for the wrong person § Mislabeled mail, misdirected email § Wrong fax number, wrong phone number § Placed on intranet, internet, websites, facebook, Twitter Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 120

Protecting Privacy (continued) Examples of Privacy Breaches Talking in public areas, talking too loudly, talking to the wrong person Lost/stolen or improperly disposed of paper, mail films, notebooks Lost/stolen laptops, PDAs, cell phones, media devices (video and audio recordings) Hacking of unprotected computer systems Email or faxes sent to the wrong address, wrong person or wrong number User not logging off of computer systems, allowing others to access their computer or system Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 121

Question & Answer Scenario: 5 Question 5: I called a patient’s phone number and left a voice mail for Mrs Molly Smith to contact surgery center regarding his scheduled thyroid surgery. Was this a privacy breach? A. No, the patient provided this phone number B. Yes, I stated his name and medical procedure C. No, I did not state the medical reason fore the surgery Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 122

Question & Answer Scenario: 5 Answer 1: The correct answer is B. Patient name in conjunction with any medical information constitutes PHI. You do not know who will hear the message; the patient may not have told family, friend or roommate. It is best practice to leave the minimum amount of information needed: your name, phone number and that you are from HHI. Never leave PHI on an answering machine. B. Yes, I stated his name and medical procedure Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 123

Protecting Privacy (continued) Computer Security Ensure your computer and data are physically secured by using lockdown cables, locked drawers, placement in a secured area, etc. Create a strong password and do not share your username or password with anyone Log off your computer terminal when you are done, or even if you walk away for a few moments Ensure information on computer screens is not visible to passersby Use a privacy screen Lock your PC by using the keyboard command Ctrl + Alt + Delete Use a password to start up or wake up your computer Ensure your system has antivirus and all necessary security patches and updates Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 124

Protecting Privacy (continued) Portable Device Security Tips Always encrypt portable devices and media with confidential information on the (laptops, flash drives, memory sticks, external drives, CDs, etc. ) Recommend not keeping confidential data on portable devices unless absolutely necessary. And if necessary, the information must be encrypted Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 125

Protecting Privacy Question & Answer Scenario: 6 (continued) Question 6: A physician is very busy and asks you to log into the clinical information system using his user ID and password to retrieve some patient reports. What should you do? A. It is a physician, so it is okay to do this B. Ignore the request and hope he forgets C. Decline the request and refer him to information policies D. None of the above Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 126

Protecting Privacy Question & Answer Scenario: 6 (continued) Answer 6: The correct answer is C. Always login under your own user ID and password. If you do not have system owner permission to access the system, then do not access the system. This would have been a violation of privacy and security policies. C. Decline the request and refer him to information policies Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 127

Protecting Privacy Question & Answer Scenario: 7 Question 7: As part of your job, you need to use a laptop as you work as various sites. You have patient emails, addresses and medical information files on the laptop. What is the best way to protect this device? A. The information on my portable device is encrypted, I use a complex password and I physically secure the device when leaving it unattended B. I only need a complex password to secure the laptop C. It is secured as I use a complex password and when unattended, I always lock it up in the trunk of my care D. None of the above Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 128

Protecting Privacy Question & Answer Scenario: 7 Answer 7: The correct answer is A. Your laptop must be encrypted if it contains patient information or other sensitive confidential information. Password protection by itself is not enough but you do need to use complex passwords for the device and physically secure it when unattended. Unencrypted devices are considered unsecured in the event of a loss or theft by federal and state privacy laws and therefore reportable to federal and state agencies! A. The information on my portable device is encrypted, I use a complex password and I physically secure the device when leaving it unattended Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 129

Protecting Privacy Question & Answer Scenario: 8 Question 8: Which workstation security safeguards are you responsible for using and/or protecting? A. Your User ID B. Your Password C. Logging out of programs that access PHI when not in use D. All of the above Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 130

Protecting Privacy Question & Answer Scenario: 8 Answer 8: The correct answer is D. Always log off programs and always protect your user ID and password. Never share these with anyone D. All of the above Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 131

Protecting Privacy Reporting Privacy Breaches Immediately report any known or suspected privacy breaches (such as paper, conversations, suspected unauthorized or inappropriate access or use of PHI) to the Privacy Officer Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 132

Protecting Privacy How to Report Security Incidents Report lost or stolen laptops, blackberries, PDAs, cell phones and flash drives immediately to security/police Report any unusual or suspected information security incidents to supervisior Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 133

Closing Remember All Patient information is Private This includes: Personal Information Financial Information Medical Information Protected Health Information in any format: Spoken, written, or electronic Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 134

Harmony Healthcare International Have you Considered a Customized Complimentary HARMONY(HHI) MEDICARE PROGRAM EVALUATION or CASE MIX ANALYSIS for your Facility? Perhaps your facility has potential for additional revenue Benchmark your facility against key indicators and national norms Email us at for more information RUGS@harmony healthcare. com Analysis is cost & obligation free Copyright © 2013 All Rights Reserved Harmony Healthcare International, Inc. 136

Related presentations