Hipa afor area2
-
Upload
john-wible -
Category
Education
-
view
1.041 -
download
2
description
Transcript of Hipa afor area2
To HIPAA and BeyondTo HIPAA and BeyondThe Law of The Law of
Confidentiality and Confidentiality and SecuritySecurity
Public Health Area II Public Health Area IIDecember, 2010December, 2010
By John R. Wible, General CounselAlabama Department of Public Health
1ADPH, 2010
DocumentationDocumentationSubstantiates proof of servicesProvides continuity of careDocumentation must be objective
facts, not opinions
2ADPH, 2010
The “Golden Rule of The “Golden Rule of Documentation”Documentation”
The “Golden Rule of Documentation:” If it ain’t wrote down it didn’t happen!
“Wible’s corollary” The way it is wrote down is the way it
happened regardless of the way it happened!
3ADPH, 2010
Confidentiality-Confidentiality- Access to Records Access to Records GenerallyGenerally
All patient information is strictly confidential◦ See Employee Handbook 10-02
Some Bad ScenariosBad scenarios equal bad liability
4ADPH, 2010
Conditions for Conditions for Release of InformationRelease of InformationConditions for release of
information:◦Prior written consent of
Patient, parent/guardian
Subpoena in accordance with Departmental/ institutional policy
Otherwise provided by law
5ADPH, 2010
TB/STD/DC Records TB/STD/DC Records Special Special ConfidentialityConfidentiality
STD/TB/disease control information not public.
Not revealed even by subpoenaNot admissible into evidence
except for commitment hearings ADPH requests for notifiable
disease records to be forwarded to Legal ◦ Call 334.206.5209.
See ADPH Policy 04-02 for specifics
6ADPH, 2010
Disease Control Disease Control GuidelinesGuidelinesInformation considered not
confidential:Final completed report written in
blank, not identifying any personsThe name of businesses,
establishments, restaurants involved in an investigation
Aggregate statistical informationAny other public recordsRegular environmental and
daycare inspection reports 7ADPH, 2010
ConfidentialConfidential Information Information (EPI)(EPI)
Epidemiologic interview sheetsRequired reportsWork papers, notes and analysesActual numbers of cases or IDsCorrespondence on a caseComplaint generated environmental
and other inspection reportsincomplete drafts of reportsOther document received privately
8ADPH, 2010
Released With Released With AuthorizationAuthorization
A notifiable disease record generated by the Department or in the possession of the Department (such as electronic laboratory reports or facsimile lab reports) that concerns the symptoms, condition or other information specific to an individual
One patient’s authorization, however does not release other person’s names or information
9ADPH, 2010
Written Authorization Written Authorization Not Required: Not Required:
10
Transfer information from one county health department to another or to the state office
Transfer information to physicians, nurse practitioners or other health professionals with contract or other provider arrangements to provide care
Some practitioners require consents to transfer out of abundance of caution
ADPH, 2010
What Makes a Valid What Makes a Valid Authorization?Authorization?
Description of the info to be released
Name or description of info receiverName of patientDescription if the use of the infoExpiration date or continuousRight of revocation by pt.Notice of possible re-disclosuresSignature of pt or representative See CHR Form 6A and instructions
11ADPH, 2010
Note Concerning Note Concerning Certain InformationCertain InformationCHR 6A states: pt. is made aware that s/he is releasing STD/HIV/AIDS or drug and alcohol treatment or mental health records
This is NOT required if other providers’ releases meet the earlier criteria
ADPH, 2010 12
Release of Contact Release of Contact Information – Don’t Do Information – Don’t Do It!It!
The medical record or information regarding STD/TB/disease control cannot be released without the written consent of the patient
Even with consent, it should not include contact information.
Don’t write identifying information about how the patient contracted the disease
13ADPH, 2010
Confidentiality – Access to Confidentiality – Access to Medical Records of MinorsMedical Records of Minors
If a minor is qualified to consent and signs the “consent for treatment”, only the minor can sign to release the information regarding those services
If the parent/guardian signs the consent for treatment, the parent/guardian or the minor may consent for the release
14ADPH, 2010
Access to Medical Records of Access to Medical Records of Minors – Rights of the Minors – Rights of the ParentsParents
All information pertaining to a child must be equally available to both parents
However, if the child gave consent for services, neither parent may have access to the records without that child’s consent. ◦Code of Ala, § 30-3-154
15ADPH, 2010
HIPAA – In HIPAA – In BriefBrief
HIPAA stands for The Health Insurance Portability and Accountability Act (1996)
Addresses privacy and security of health data
Includes verbal, written, or electronic dataPrivacy Rule, (2003), includes both paper
& e-PHISecurity Rule, (2003), includes only e-PHIHHS makes the rulesAmended (2009) by “the Stimulus Package
– ARRA (HITEC)
PHI – What is PHI – What is it?it?
Patient namePatient addressPatient phone numberPatient date of birthPatient social security number,
Medicaid number, etcDiagnosisTreatment informationFinancial information
The Privacy Rule: The Privacy Rule: What and Who Is What and Who Is Covered?Covered?“Protected Health Information”
(PHI):Individually-identifiable health
information used or disclosed by a covered entity in any form, whether electronically, on paper, or orally
45 C.F.R. §160.103ADPH is a “covered entity”
18ADPH, 2010
Releases without Releases without Written ConsentWritten Consent
TreatmentPaymentOperationsWhere required by law
19ADPH, 2010
Business AssociatesBusiness AssociatesBusiness associates follow the same
level of protection in the privacy rule and include:◦Claims or data processors; ◦Billing companies and financial service providers
◦Quality assurance providers and utilization reviewers
◦Lawyers, accountants & other professionals
45 C.F.R. §160.10320ADPH, 2010
Business Associates and Business Associates and AARAAARA
Must also adhere to the Security Rule like CEs and are subject to same penalties
Establish administrative, physical, and technical safeguards for Protected Health Information (PHI)
Establish policies and procedures for safeguards
Only use or disclose PHI in accordance with HIPAA
“Rat Fink Provision”
21ADPH, 2010
HIPPA Privacy HIPPA Privacy Rule:Rule:
Who is Not Who is Not Covered?Covered?Life insurance companies
Auto insurance companiesWorkers’ compensation carriersEmployersOthers who acquire, use, and disclose vast quantities of health data
AARA may place some requirements -◦E.g., PHI cannot be bought and sold
22ADPH, 2010
HIPPA Privacy Rule: HIPPA Privacy Rule: What Is Not Covered?What Is Not Covered?
PHI does not include
◦Education records covered by FERPA
◦Employment records held by a covered entity in its role as employer
◦Non-identifiable health information
◦45 C.F.R. 160.103
23ADPH, 2010
HIPAA - What it HIPAA - What it Doesn’t DoDoesn’t Do
Does not override state laws that provide more patient privacy than HIPAA
Does not require that all risk of incidental disclosures of patient information be eliminated
Examples: Cubicles Shield-type dividers Sign-in sheets
24ADPH, 2010
HIPAA and ADPH HIPAA and ADPH PrivacyPrivacy
25
See ADPH HIPAA Privacy Policy 06-008◦“Minimum Necessary” Concept
◦Patient Verification◦Fax Confidentiality◦The “HIPAA Log”◦Breach Sanctions◦Needs updating
ADPH, 2010
•See also CHR Manual and Employee Handbook
How How Uses/DisclosuresUses/Disclosures
Are RegulatedAre RegulatedMinimum necessary rule When using or disclosing PHI, a covered entity must make reasonable efforts to limit such information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request
26ADPH, 2010
Permitted DisclosuresPermitted Disclosures“Minimum” info may be disclosed
To “public officials” To public healthTo law enforcement To national security and intelligence agencies
To judicial authoritiesTo researchersTo DHR for abuse reporting
27ADPH, 2010
Disclosure to PoliceDisclosure to PolicePursuant to subpoenas or by verbal
request As “otherwise required by lawFor ID and location purposesDo not give disease information Individual is a victim of a crimeTo alert about a suspicious death When criminal conduct occurs on
premises In emergency setting, to alert
regarding information pertaining to crime
28ADPH, 2010
Disclosure to National Disclosure to National Security AgenciesSecurity Agencies
CEs may disclose PHI to authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities
29ADPH, 2010
Disclosure Disclosure To To Public Public HealthHealth
Disclosure permitted to: “public health authority that is
authorized by law to collect and receive such information for the purpose of preventing and controlling disease, injury, or disability, including… reporting of disease… and the conduct of public health surveillance….”
30ADPH, 2010
Child or Elder Abuse Child or Elder Abuse NoticeNotice
Examples of specific public health-based exceptions include disclosures
◦About victims of abuse, neglect, or domestic violence
◦To prevent serious threats to persons or the public
31ADPH, 2010
Information on Information on DecedentsDecedents
May be released to:Law enforcementTransporting emergency medical personnel
Coroners and their personnelMortuary personnelBureau of Health Statistics
32ADPH, 2010
Maintenance of Maintenance of DocumentationDocumentation
Maintain documentation of policies and procedures for 6 years
Make documentation available to workforce who administer the policy
Review and documentation periodically
Ensure the confidentiality, integrity, and availability of ePHI
33ADPH, 2010
HIPAA - The Security HIPAA - The Security RuleRule
Primary objective: protect the confidentiality, integrity, and availability of ePHI when it is stored, maintained, or transmitted.
Applies to identifiable electronic protected health information (ePHI) related to:◦Past, present or future medical or
mental condition◦The individual’s health care◦Payment records
34ADPH, 2010
What about e-PHI?What about e-PHI?Same as PHI, but created, received, or maintained electronically
Does not include telephone calls, copy machines, fax machines, most voice mail
Does not include de-identified information
Security of the Security of the PremisesPremisesHIPAA requires security of the
premises, i.e., door locks. See ADPH Security Policy No. 05-16.
HIPAA also requires security of the electronic records (computer security)
HIPAA requires security of the paper
HIPAA requires security of your mouth
36ADPH, 2010
Building SecurityBuilding SecurityPost the Department’s Notice of Privacy
Practices where clients can see itMaintain visitor sign-in logs and have
visitors sign in and out (this includes repair persons)
Use ADPH and Visitor ID badgesKeep back doors locked or
monitored during business hoursKeep server rooms lockedKeep PHI storage areas locked when
unattended
Paper SecurityPaper SecurityClean Desk
◦ Keep patient records covered or in folders◦ Lock records up at end of day or when away
from deskFax/Copy Machines
◦ Put fax & copiers in secure area away from traffic
◦ Remove faxes/copies promptlyFile Cabinets
◦ Keep locked when unattended◦ Locate in secure area◦ Limit access
Shred it!
Use of Department Use of Department ComputersComputersUse ADPH furnished equipment/softwareCSC/Tech Support will purchase and
install all network-connected devicesUse strong password protection &
disclaimer◦ Don’t give out your password
CSC/Tech Support will install updatesConnect laptops to the network once a
month for auditBack up critical data
◦See Policy 2005-016 and Security Manual
39ADPH, 2010
Use of ComputersUse of ComputersChange password every 60 daysUse only for lawful activityReport suspected viruses and attacksSupervisors notify CSC on new
employee starting work or leaving employ service
Appropriately salvage computersLimit access to Department
workspaceBe careful with portable storage
devices
40ADPH, 2010
Email and Internet Email and Internet SecuritySecurity
Email◦Do not open email from an unknown source; especially unknown attachments
◦Verify email recipients; make sure email is going to intended recipient
◦Always encrypt email and attachments containing protected information
◦Read security remindersAvoid risky internet sites
Laptop SecurityLaptop SecurityKeep laptop out of view when travelingDo not leave in hot vehicle for long timeDo not check with luggage when flyingPassword protectSet screen saver to require passwordLog on to network once a month to update virus protection software
Encrypt protected information
Patient AccountingPatient AccountingPatients may ask for listing of
disclosures of their PHI up to six (6) years prior in paper or electronic form
The following disclosures are NOT required to be accounted for: ◦Treatment, Payment, Healthcare Operations (TPO)
◦Disclosures to the patient or persons involved with their care
◦Disclosures authorized by the patient or authorized representative
43ADPH, 2010
Patient AccountingPatient AccountingOther disclosures which are not required to be accounted for:National security or intelligence purposesCorrectional institutions or law enforcementIncidental disclosures Limited Data Sets used for research purposes
44ADPH, 2010
HIPAA LogHIPAA Log
45
A single file which relates to pt. files
Kept with medical recordsDocuments “non-routine”
disclosures:◦date of the disclosure;◦the name/address of receiver◦brief description of the PHI disclosed
◦brief statement of the purpose of the disclosure
ADPH, 2010
Required Logged Required Logged ItemsItemsUnauthorized releases on the AIR
FormReleases required by lawReleases based upon subpoenaReleases to law enforcement for ID Requests to limit releasesRequests to amend or correct PHIRequests by the patient for
accountingReports about victims of abuse,
neglect, or domestic violence
46ADPH, 2010
Disclosures Disclosures Not Not LoggedLogged
TPO disclosuresDisclosures made to the patient
or rep.Pursuant to a valid authorizationNational security or intelligence
purposes;To a correctional institution or law
enforcement official that has custody of a patient;
To a health oversight official
47ADPH, 2010
HIPAA BreachesHIPAA Breaches
When there is a breach of phi or e-PHI You have a duty to report on an ARIA
Call if it is serious!ADPH as a duty to:To report to or notify clientsTo report to HHS and the media if
>500To mitigate the damageTo examine employees, policies,
equipment and facilities to prevent it happening again
48
“Teton Dam Breach”
ADPH, 2010
BREACHES - BREACHES - PENALTIESPENALTIESBreach may subject employees and
the Covered Entity:To criminal penalties (up to
$250,000)You are NOT covered by the FundTo HHS civil penalties or lawsuitsTo adverse employment action,
IE.,
49ADPH, 2010
Program ManagementProgram ManagementThe HIPAA program and certain
other similar programs are under the management of the Risk Management Committee
Committee proposes HIPAA policy changes
Committee receives and processes all ARIA reports including possible HIPAA breaches
The Committee oversees Red Flags instances
50ADPH, 2010
Red Flag Regulations Red Flag Regulations Federal Trade Commission
Regulations designed to protect against identity theft
As a “creditor”, ADPH has “covered transactions” with clients/patients
ADHP has a duty to be on the lookout for certain red flags
51ADPH, 2010
Categories of “Red Categories of “Red Flags”Flags”Alerts, notifications, or warnings from
a consumer reporting agency; Suspicious documents; Suspicious personally identifying
information, such as a suspicious address;
Unusual use of – or suspicious activity relating to – a covered account; and
Notices from customers, victims, law enforcement authorities, or businesses about possible identity theft
52ADPH, 2010
See Also Policy See Also Policy DocumentsDocuments
98-07 Fax Policy03-10 Notice of Privacy Practices
(NOPP)◦ Under Revision
03-30 Vital Records Policies04-02 Receipt of Legal Documents05-16 HIPAA Security Policy/Manual06-08 HIPAA Privacy Policy10-04 Contract Employee HandbookOnline ARIA Form
53ADPH, 2010
For A Copy of the For A Copy of the PresentationPresentationSee “HIPAA For Area 2” a download on Slideshare 7
http://www.slideshare.net/jwible
54
7Slideshare
ADPH, 2011