Protecting Students’ Personal Health Information

What Everyone Needs to Know

1

Outline

• Personally Identifiable Information (PII)• HIPAA and the Privacy Rule• Sharing and handling private information • Documentation and safeguards • Scenarios• Who is responsible?

2

Personally Identifiable Information (PII)

• Name• Date of Birth• Social security number• Photo/x-ray/video• Fingerprint/voiceprint• Mother’s maiden name• Address

• Phone numbers• Medical record

numbers• Legal documents• Medical notes• Email address• Educational records

PII = information from which a person’s identity is apparent, or can reasonably be ascertained

3

Handling PII in Job Corps

• Among other requirements, Job Corps requires that:– PII must be stored within CDSS– All incidents involving PII must be reported within

1 hour to the Job Corps Technical Assistance Center (TAC)

– Health and counseling records be secured in a lock file cabinet

• Refer to program instructions for more information

4

HIPAA and the Privacy Rule

5

What is HIPAA?

• The Health Insurance Portability and Accountability Act of 1996 was enacted by Congress and signed by President Clinton. The Act is made up of:

• Title I (Portability) of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs

• Title II (Accountability) of HIPAA, known as the Privacy Rule, deals with health information privacy

6

What is the Privacy Rule?

• The Privacy Rule, a Federal law, gives patients rights over their health information and sets rules and limits on who can view protected health information

• The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral

• The Security Rule, a Federal law that protects health information in electronic form, requires entities covered by HIPAA to ensure that health information is secure

7

The Privacy Rule and Job Corps

• Under the Privacy Rule – – Job Corps’ Health and Wellness Centers are

considered “covered entities”– Job Corps is subject to imposed penalties if the

rule is violated

8

Protected Health Information (PHI)

• Protects all “individually identifiable health information”; referred to as PHI

• Includes:– Demographic data– Individual’s past, present, or future physical or

mental health condition– The provision of health care to the individual– The past, present, or future payment for the

provision of health care to the individualSource: U.S. Department of Health and Human Services. (2010). Summary of HIPAA Privacy Rule. http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html 9

Sharing and Handling Personal Information: The Need to Know

10

The “Need to Know”

• HIPAA does not block the communication of information on a “need to know” basis on center

• The minimal necessary amount of information about a student’s health or disability may be shared with staff if this information is vital for staff to successfully assist students and to perform their job duties

• Information must be shared for the safety and security of students or staff and to protect centers from liability

11

Sharing PHI with Center Staff

• Often, staff outside of the Health and Wellness Center need to know a student’s diagnosis

• A student’s medical information should be focused on behavior or symptoms and not a medical diagnosis

• Sometimes it’s okay to share common diagnoses after talking with the student; case-by case basis

• Information should only be shared if a particular staff member must know the information to successfully assist students and perform his or her job duties

12

Scenario

Entry lab results indicate one of the new students is HIV positive. Which staff has a need to know about this student’s lab results?

13

Who Needs to Know?Staff Need to know about…

Counselors Information from the Social Intake Form (SIF); some mental health information

TEAP Specialist Information from the SIF, drug screen results, mental health records in case where co-occurring disorders are suspected

Mental Health Staff Mental health history, information from the SIF, some medical/oral health issues, alcohol and drug information

Residential Living Staff Allergies (over the counter medication, food, bee sting), healthy evening snack needs, inhalers or nebulizers for shortness of breath, restrictions related to injuries, students who require medications, symptoms or complications related to a procedure, specific behaviors

14

Who Needs to Know?Staff Need to know about…

Food Service Manager Dietary needs, including food allergies, students requiring an evening health snack (diabetic or pregnancy related)

Center Standards Incentive Officer

Positive drug screens

Recreational Staff Bee sting allergies, students using an inhaler for exercise-induced breathing difficulties, students on restrictions related to injuries

15

Who Needs to Know?Staff Need to know about…

Student Records and Data Management Staff

Student leave or medical separations

All Staff Access to view accommodation plans in CIS, but not have access to the IEP or the disability records, unless the student specifically gives written authorization

DOL Personnel or Contractors Information as requested for the purposes of resolving grievances or conducting audits/assessments

Center Director Access to everything

16

Staff Do Not Need to Know

• HIV and Hepatitis B results – All blood and body fluids should be treated like they are contaminated – universal precautions

• Drug screen results• Why students are taking medications • Which students have mental health problems

17

The Privacy Rule and CIS

• Protected Health Information (PHI) should not be put into the CIS unless there is a specific reason that every single staff person needs to know that information

• Accommodations should be put into CIS, but a medical diagnosis reference to the IEP should not be included

18

Transmission of Medical Information

• Any and all records that are health or disability related, or that contain any of those types of information, must be kept separate from other records about the individual

• If hard copies are transmitted, health or disability information should be placed in a separate file. That file should be placed in a sealed envelope that is clearly marked as containing such information

• Additionally, diagnoses should not be included in significant incident reports (SIRs)

19

Scenario

Shawn, a Job Corps student, is waiting in line in the cafeteria. He overhears two staff members talking about placing a student named Mike on medical leave for a doctor’s appointment, medical tests, and a refill on medication.

What went wrong in this situation?

20

Oral Transmission

• Keep in mind that the confidentiality of medical, health, and disability-related information must be maintained when the information is being transmitted orally – in other words, when it is being discussed aloud

• This means that you must be sure that all such discussions take place in private locations where unauthorized persons cannot overhear the conversation, either voluntarily or involuntarily

21

Scenario

You are a counselor. You have been working with Kateri, a 16-year-old female student. Kateri’s mother calls and asks if Kateri has a STI and if she is pregnant. Kateri’s mother reminds you that her daughter is a minor. (Kateri had just visited your office crying because she found out she is pregnant and was diagnosed with a STI.)

22

Students and Parents

• Student may:– Access, inspect, and copy medical records according to the

HIPAA Notice– Request that information be changed if it is incorrect or

incomplete

• If student is under 18, parents/legal guardians may:– Submit a written request to revoke the Authorization;

however, a revocation may result in a separation– Have access to records unless prohibited by state laws

23

Sharing Information Off Site

• Information may be shared with some organizations outside of Job Corps, including:– The department of health– Government or law enforcement authorities– A coroner or medical examiner– Law enforcement officials may have access in certain

situations– Workers’ compensation insurers or agencies – Outside medical providers or hospitals to pay medical bills

• Link to more information: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

24

Scenario

You are the CMHC and Maria has not come for her scheduled appointment. You have a busy afternoon and ask another student to go to the classroom to get Maria.

25

Scenario

The Health and Wellness Manager has students deliver passes signifying that a student has an appointment in the wellness center. The passes do not give a reason for the appointment and do not specify who the student will see.

26

Scenario

The center driver is late picking a student up from an off-center appointment. When he gets back, the Health and Wellness Center is closed. The driver takes the student’s health record and prescription medication and lays both items on the security manager’s desk.

What should have occurred?

27

Scenario

You are attending an annual Bloodborne Pathogen Training. The nurse who is conducting the training says, “This is especially important because we have an HIV-positive student on center.”

What are the potential ramifications of this statement?

28

Scenario

At an assembly, the Center Director offers congratulations to all students who have successfully completed the TEAP program. He reads off their names and asks each student to stand to be recognized.

Is this a HIPAA violation? Why or why not?

29

Scenario

You are an RA. Recently, you received a memo from the Health and Wellness Center asking you to keep an eye out for any odd behaviors from Darrell, a student in your dormitory. You enlist the help of Darrell's roommate, Ben. You tell Ben to let you know if Darrell does anything out of the ordinary.

How could this have been handled better?30

Scenario

You are the Outreach and Admissions Counselor and your supervisor has instructed you to review all medical records received for completeness.

How should you handle this situation?

31

Documentation and Safeguards

32

HIPAA Authorization

• Job Corps requires applicants or legal guardians to sign the HIPAA Authorization as a condition of enrollment prior to the applicant arriving on center– Authorization informs applicants how, to whom, and why

their health information will be shared– Complete Authorization should be in the student health

record– The student may revoke his/her Authorization at any time;

however, this action may result in the student's separation from the program

• A Supplemental Authorization must be completed for disclosure of protected health information not covered in the Authorization

33

Notice

• Describes how medical information may be used and disclosed without consent, and how to obtain access to this information

• Is given to students on their first visit to the Health and Wellness Center

• Is sent to the parent or legal guardian of those students under the 18

• Is placed in the student health record

34

Notice

• A copy of the Notice must be posted in the Health and Wellness areas and in off-center areas of center health providers, such as doctor, mental health consultant, and dentist offices

• The Notice should have the name of the Privacy Officer

35

Privacy and Complaint Officers

• Center Director should designate a:– Privacy Officer, who is responsible for reviewing

policies and procedures regarding the Privacy Rule– Complaint Officer, who is responsible for receiving

complaints alleging privacy violations• The Privacy Officer and the Complaint Officer

should not be the same person.

36

Scenario

A nurse was going on vacation and wanted to brief the Health and Wellness Manager about a student's visit to the Health and Wellness Center that day. She drafted a quick email and in her haste to leave for vacation, she sent the email to the entire center distribution list.

What should happen next?

37

Who is Responsible?

38

Center Director Responsibilities

• Ensure that the Privacy Rule is enforced • Designate a Privacy Officer and Complaint

Officer• Ensure that ALL students on center have a

Notice and signed Authorization in their medical record

• Review and grant written requests to revoke the HIPAA Authorization

39

Outreach and Admissions Responsibilities

• Have the applicant or parent/legal guardian sign the Authorization

• Provide the applicant a copy of the signed Authorization

• Forward the Authorization to the receiving center prior to the applicant’s arrival. If the center does not have the Authorization, departure must be delayed

40

Health and Wellness Responsibilities

• Post the Notice in the Health and Wellness Center

• Have the Center Physician, Center Mental Health Consultant, and Center Dentist post the Notice, if services are provided off center

• Develop center/standard operating procedures (COPs/SOPs) regarding the Privacy Rule

41

Health and Wellness Responsibilities

• Give and explain the Notice to the student during the student’s first visit to the Health and Wellness Center; make additional copies of the Notice available for student requests

• Send a copy to the parent/legal guardian for students under the age of 18 and request that the Notice be returned signed. However, a signature is not mandatory. If a signed Notice is not received, document in the health record that the Notice was sent to the parent or legal guardian

42

Summary • Federal Law enacted by Congress to protect

the privacy of patients’ medical records• Information is disclosed only to staff that have

a need to know• Transmission, storage, and confidentiality of

protected health information must be safeguarded

43

Information Notices

• Job Corps Program Instruction 05-26—Survey of Computer Systems Containing Personally Identifiable Information (PII)

• Job Corps Program Instruction 06-08—Use of Computer Applications Containing Job Corps Students PII

• Job Corps Program Instruction 06-13—Reporting Incidents Involving Job Corps Students’ PII

• Job Corps Program Instruction 06-23– Guidance on Safekeeping of Forms, Records, and Other Hardcopy Documents Containing PII

44

Resources• Health and Human Services HIPAA website

http://www.hhs.gov/ocr/hipaa/• HIPAA Violations and Enforcement

http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.shtml

• 45 CFR § 164.508• Job Corps Community Website—Health and Wellness—HIPAA • PRH Appendix 601—Student Rights to Privacy and Disclosure

of Information • PRH Appendix 607—Transmission, Storage, and

Confidentiality of Medical, Health, and Disability-Related Information 45