Welcome to our HIPAA Privacy Training Session January

Welcome to our HIPAA Privacy Training Session! January 2016 Hunterdon Radiological Associates, P. A. 1

Why Do We Train? ? : Laws "We need to review our training material. ” Cartoon by Dave Harbaugh HCHumor© 2008 CCPro, Inc. 2

What Is HIPAA? 3

What is HIPAA? n n n HIPAA is an acronym for the Health Insurance Portability & Accountability Act of 1996. It is a federal regulation that protects the privacy, security, and confidentiality of a patient’s health information. Gives more control to patients over their health information – How the information may be used – Limits the amount of information released – Give patients the right to examine and obtain a copy of their health records and request corrections. n For healthcare providers HIPAA – Sets boundaries on the use and release of health records – Establishes safeguards to protect the privacy of health information – Holds violators accountable 4

Diagram of the HIPAA Statute Each part has separate regulations to comply with 5

Parts of HIPAA We will Cover n HIPAA Privacy – – Protection for the privacy of Protected Health Information (PHI) effective April 14, 2003 – Sets the standards for how covered entities and business associates are to maintain the privacy of Protected Health Information (PHI) n HIPAA Security – – Protection for the security of electronic Protected Health Information (e-PHI) effective April 20, 2005 – defines the standards which require covered entities to implement basic safeguards to protect electronic Protected Health Information (e-PHI) 6

Privacy Training Focus Protected Health Information Use & Disclosure – Release of Information Session 1 Minimum Necessary Patient Rights Notice of Privacy Practices Session 2 Privacy Policies Reporting Privacy Concerns 7

The Privacy Rule Requires appropriate safeguards to protect the privacy of personal health information. n Sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. à HRA/HIPA workforce must have a job-related reason to use and or disclose PHI. n Requires that all HRA/HIPA workforce use only the minimum amount of PHI necessary to get the job done – the Minimum Necessary Standard. n Gives patients privacy rights and greater control over their own health information. 8

HIPAA Privacy The Privacy Rule Protects information known as Protected Health Information (PHI) that exists in written, oral, and electronic formats. 9

Definition: Protected Health Information n n Sent or stored in any form; Identifies the patient or can be used to identify the patient; Is created or received by a covered entity; Generally is about a patient’s past, present and/or future treatment and payment of services. What are the identifiers? 10

HIPAA Identifiers Include… n n n n n Patient Names Medical Record Numbers Social Security Numbers Account Numbers License/Certification numbers Vehicle Identifiers/Serial numbers/License plate numbers Internet protocol number Health plan numbers Full face photographic images and any comparable images n n n n Web universal resource locaters (URLs) Any dates related to any individual (date of birth) Telephone numbers Fax numbers Email addresses Biometric identifiers including finger and voice prints Health plan beneficiary numbers Any other unique identifying number, characteristic or code 11

PHI Includes. . Items in the record, such as: Ø Encounter/visit documentation Ø Lab Results Ø Appointment dates/times Ø Invoices Ø Radiology films and reports Ø History and Physicals (H&Ps), etc. 12

Definitions: Use and Disclosures Use: generally refers to how PHI is handled by us. Disclosure: generally refers to how PHI is shared (i. e. , released) externally. What do you do if you overhear others talking about patients? 13

Permitted Use & Disclosures of PHI HIPAA regulations permit use or disclosure of PHI for: n providing medical treatment n processing healthcare payments n conducting healthcare operations n public health purposes as required by law Employees may not otherwise access or disclose PHI unless: n n the patient has given written permission it is within the scope of an employee’s job duties proper procedures are followed for using data in research required or permitted by law 14

Disclosing PHI – Release of Information (ROI) n n n What information can be released without an authorization? What needs to be determined before PHI can be released? What PHI may be released? 15

Disclosing PHI – Release of Information (ROI) I received a request to release a patient’s PHI. What now? à Whether releasing verbally or in writing, determine the following: Is the requestor legally authorized to receive the PHI? Is a signed Authorization required? Ø If yes, determine if the Authorization is HIPAA compliant 16

ROI: Authorization Not Required There are times when an authorization is not needed. 17

ROI: Permitted Uses and Disclosures of PHI Without an Authorization n Uses and disclosures of PHI for TPO: Ø Treatment – providing care to patients, including appointment reminders Ø Payment – Various activities related to paying for or getting paid for health care services Ø Health Care Operations – normal business activities (reporting, quality improvement, training, auditing, customer service and resolution of grievances data collection and eligibility checks, accreditation, etc. ). n n To share PHI with that patient. For public health purposes. For disclosures to our vendors under a Business Associate Agreement. As required by law. What do you do prior to releasing information? 18

ROI: Verify Identity n Prior to releasing PHI to the patient, ask the individual to provide you with enough information to identify the patient, such Ø Ø n as: Name Date of Birth Address Other identifiers: Social security number, mother’s maiden name Identify someone other than the patient by requesting he/she provide you with all the above information, as well as his/her relationship to the patient. Ø Ø Check a physical signature against a known one on file Make a call-back to a known number Ask for a photo ID Ask for a business card 19

ROI: Minimum Necessary Provide only the minimum necessary to safeguard PHI Limit access to what is needed to accomplish the purpose for which the request was made (or that which was authorized). May not disclose an entire medical record unless it is specifically justified as the amount of PHI that is reasonably needed to accomplish the purpose for the use or disclosure. Minimum necessary may be less than what was requested. Only include sensitive PHI (mental health, HIV/AIDS, STDs, etc. ) if specifically authorized. 20

ROI: Documentation n Document the release in Intergy: First step- Record the authorization in the Privacy Area using the Privacy radial button Second step – record the disclosure using the disclosure button n n n Date of the disclosure Who released the information The name of the person the PHI was released to (and address if known) A brief description of the PHI disclosed The purpose of the release Not necessary to document: – disclosures for purposes relating to treatment (providing and coordinating care); – payment (billing for services rendered); and – health care operation (internal business). 21

Release of Information Scenarios n n n n Family & Friends Legal Guardians Workers Comp Release to Another Facility Leaving Messages Faxing PHI Email 22

ROI: Family and Friends n n n Patient present and alert – patient decides. Patient incapable to make wishes known – inferred permission to discuss current care. Care or payment. – Information needed for patient’s care. – Must clearly be involved in payment for care (involvement is obvious, patient stated so). n Notify family or friend(s): – When involved in their care. – Of patient’s general condition. 23

ROI: Legal Guardians An individual calls to discuss appointment information with you for a patient and states he is the patient’s Legal Guardian. May I discuss this with the individual? üYes, after verifying the individual is the patient’s Legal Guardian and has access rights to the type of records being requested. 24

ROI: Workers’ Compensation PHI to an Employer n When releasing workers’ compensation records to an employer and/or work comp carrier, may I release the rest of the patient’s medical history (not related to the work comp claim with that employer)? – – No The patient’s employer and work comp insurance carrier have the right to only those records reasonably related to the workers’ compensation claim/condition without an authorization. Request the patient to sign an authorization form to release additional types of records. 25

ROI: to Another Facility Can I release a patient’s address and/or insurance information to a nursing home? Yes, but if you are not familiar with the individual, request the nursing home to provide you with the following information: Patient’s name, date of birth, and address. Why the information is needed. If they also treat the patient or pay their claims, obtain: Ø Ø When The requestor’s name, name of the nursing home, and a direct telephone to the nursing home (switchboard). Call the requestor back and request to be transferred to the individual. Then release the PHI. uncertain, contact the patient and obtain authorization. 26

ROI: Leaving Messages A spouse answers the phone, or the voice mail picks up. What information may I provide? Ø State your first name and that you are calling from HRA or HIPA. Ø Ask that the patient return your call, and provide your direct phone number. Ø Other than an appointment reminder, do not provide lab results, or other detailed information. Example: “This is Sally from Hunterdon Radiology calling for Johnny Doe. Please call me back at your earliest convenience at [number]. Thank you. ” 27

ROI: Faxing PHI May we Fax PHI? Ø Yes, we may fax PHI, but only when in the best interest of patient care or payment of claims. Ø Use extra care when faxing sensitive PHI (HIV, mental health, AODA, STDs, etc. ) to avoid sending information to the wrong person. Ø Some safeguards to use when faxing: n n n n Verify the fax number to which patient information is being sent. Always use a fax cover sheet; it must contain a disclaimer that identifies the information in the fax as confidential and a statement regarding communication of misdirected faxes and destruction. Do not include PHI on the cover sheet. Restate the fax number to the individual providing it to you. Obtain a telephone number to contact the recipient with any questions. Verify you are including only the correct patient’s information (i. e. check the top and bottom pages). 29 Call to verify fax was received.

ROI: Email n n We may communicate with patients through emails only if we have informed the patient that email is not secure and the patient agrees. Document patient consent in Intergy. 30

Session 1 Recap Protected Health Information Use & Disclosure – Release of Information Session 1 Minimum Necessary Patient Rights Notice of Privacy Practices Session 2 Privacy Policies Reporting Privacy Concerns 32

Thank you! This completes session 1 of our Privacy training We will let you know the date for Privacy session 2 Hand In - hand Protecting All Accounts! 33

Welcome to our HIPAA Privacy Training Session 2! January 2016 Hunterdon Radiological Associates, P. A. 34

RECAP… Session 1 So far we’ve talked about: n n n Protected Health Information Use and Disclosure Minimum Necessary 35

Session 1 Recap Protected Health Information Use & Disclosure – Release of Information Session 1 Minimum Necessary Patient Rights Notice of Privacy Practices Session 2 Privacy Policies Reporting Privacy Concerns 36

The following slides provide examples of Privacy violations to help you better understand how they occur so that you may help prevent them. 37

Privacy Violations: How Do They Happen? What are some common ways breaches of confidentiality occur? Faxing to the wrong individual/location. Ø Wrong “sticky” patient label place on a document, then it is handed to the wrong patient. Ø When typing a medical record number to look up an address, it is transposed. The lab results are then sent to the incorrect patient. Ø When searching for a patient’s address, her name is typed, her date of birth is not validated, and a patient with the same name is selected instead. These can be prevented by double checking you have the right patient’s records prior to releasing PHI. Ø 38

Privacy Violations: Incorrect Records Released A lawyer requested we send 2013 test results to his office. In addition to the 2013 test results, we also released 2011 and 2012 test results. Is this a breach of confidentiality? Yes §This is a breach of confidentiality as more information than was requested by the patient was released. §Always keep in mind we may only release the minimum necessary PHI to accomplish the purpose of the request – even when releasing to another treating provider, insurance company, etc. §Request the lawyer to return the 2011 and 2012 test results. §Notify the Compliance Officer who will complete an incident report. 39

Privacy Violations: Incorrect Patient’s Results Mailed A doctor requested lab results for a patient but lab results for another patient were incorrectly sent. Is this a breach of confidentiality? Yes. It is a breach of confidentiality if the lab results were sent to the wrong doctor. Request the doctor to return the incorrect lab results, document the disclosure. Send the doctor the correct patient’s lab results. notify the Compliance Officer who will complete and incident report. 40

Privacy Violations: Patient’s Records Sent to the Wrong Doctor Patient records were sent to the wrong doctor. Is this a breach of confidentiality? Yes Request the doctor return the incorrect records. Notify the Compliance Officer who will complete an incident report. 41

Privacy Scenarios 42

Scenario 1 n – – A clinical staff employee is assigned to routinely view and update: medications, blood pressure, pulse, and weight for each patient being seen by the provider with whom she works. She was curious and concerned about a particular patient’s health, and therefore viewed several other records, such as: lab results, and specialist transcriptions. Can she do this? 43

Scenario 2 Answer: No. n n We may only access the minimum necessary to complete our assigned job responsibilities. We may not access information out of curiosity and/or concern about a patient’s health. 44

Scenario 2 The newspaper has reported that someone famous has come to our facility, and you are curious to know if this is true. Should you ask around or look for records about this person? 45

Scenario 2 Answer: Absolutely Not. You are not allowed to satisfy your curiosity. If you look at patient records for any nonbusiness/non-treatment purposes, it is cause for dismissal and possible legal consequences. It’s all about the privacy of the patient and how much we are authorized to use and disclose. 46

Ways to Protect Privacy Not leaving detailed information on answering machines or emails. Knowing who your are speaking to on the phone. Being sure no on can see your computer screen while you are working. Never sharing your access code. Logging off when you are not working on your computer or locking your computer. Never leave documents unattended. à Store, file, shred, or destroy. Making sure fax numbers are correct and use a cover sheet with a confidentiality statement. Before mailing patient information verify the recipient name & address are correct. Other ways? ? 47

RECAP… So far we’ve talked about: n n Protected Health Information Use and Disclosure Minimum Necessary Protecting Patient Privacy Now let’s look at patient rights 48

HIPAA Privacy – Patient Privacy Rights The Privacy Rule Ø Provides patients with certain rights - these rights are commonly referred to as the Patient Privacy Rights. Ø These rights are communicated to the patient in the Notice of Privacy Practices. Ø If a patient wishes to exercise any of these Patient Privacy Rights they must do so in writing. 49

Patient Privacy Rights ü To receive Notice of Privacy Practices ü To request restrictions* of their PHI ü To inspect and/or obtain copy of their medical records ü To request corrections/amendments to PHI ü To obtain an accounting of disclosures ü To file a complaint ü To receive confidential communications ü To receive notice of a breach of their unsecured PHI * The Final Rule requires that we must agree to a request to restrict the disclosure of PHI to his/her health plan for a health care item or service for which the patient has paid in full out of pocket, unless otherwise required by law. 50

Notice of Privacy Practices n The NPP: – Explains how we may use and disclose PHI – Explains how to file a complaint – Details patients individual rights n n n Provide at initial visit Available upon request Post in general areas 51

Patient Rights: Privacy Complaints n Right to file a privacy complaint. – Direct all requests or complaints regarding patient rights to the Compliance Officer (Karen Mc. Mahon) by phone or mail. n Phone: 806 -2635 X 215 n Mail: P. O. Box 5388 Clinton, NJ 08809 52

HIPAA Privacy Policies The Privacy Rule: n n Requires that HRA/HIPA create policies regarding how our workforce is allowed to use and disclose (release) PHI. Also requires that we make available to and educate its workforce on those policies. n All of HRA/HIPA’s PRIVACY and SECURITY POLICIES will be located on the Compliance Page of HRA. net. (TBD) n Hardcopies of the policies may be printed directly from HRA. net or obtained from the Compliance Officer. Each department will have a 53 hard copy of the policies.

Privacy Compliance Tips “Common Sense” At all times… Protect a patient’s information as if it were your own! Look at a patient’s PHI only if you need it to perform your job. Use a patient’s PHI only if you need it to perform your job. Give a patient’s PHI to others only when it’s necessary for them to perform their jobs. Talk to others about a patient’s PHI only if it is necessary to perform your job, and do it discreetly. Refrain from discussing PHI in public areas. 54

How May I Report a HIPAA Privacy Violation? n n Directly to your Supervisor, who in turn reports it to the Compliance Officer. Call or email the Compliance Officer. Information sources will be kept confidential! 55

HIPAA Penalties: Civil Monetary Violation Category Each Violation All such violations of an Identical Provision in a Calendar Year 1. Did not know $100 - $50, 000 $1, 500, 000 2. Reasonable Cause $1, 000 - $50, 000 $1, 500, 000 3. Willful Neglect. Corrected $10, 000 - $50, 000 $1, 500, 000 4. Willful Neglect. Not Corrected $50, 000 $1, 500, 000 Penalty based on level of negligence. 56

HIPAA Penalties: Criminal HIPAA violations may be a crime!! Violations may result in criminal penalties. Prohibited Conduct Penalty Knowingly obtaining or disclosing protected health information without authorization. Up to $50, 00 fine and one year in prison If done under false pretense. Up to $100, 00 fine and five years in prison If done with intent to sell, transfer, or use the information for commercial advantage, personal gain or malicious harm. Up to $250, 00 fine and ten years in prison 57

Questions, Comments, Concerns… Not sure which way to go? n Please contact our Compliance Officer, Karen Security Officer at: IT@hunterdonradiology. Mc. Mahon at: 908 -806 -2635 X 215 908 -938 -5006 (cell) com kmcmahon@hunterdonradiolog y. com 58

Thank you! This completes the Privacy portion of our training Hand In - hand Protecting All Accounts! 59