We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byDenisse Hurt
Modified over 2 years ago
Privacy and Security Basics for CDSME Data Collection Sue Lachenmayr, MPH, CHES
2 A nonprofit service and advocacy organization © 2012 National Council on Aging Training for CDMSE Data Collection Overview Purpose of the Privacy Act Primary Features of the Act Who Needs Privacy Training? Master Trainers and Lay Leaders Program Coordinators and Data Collection/Data Entry Personnel Types of Information Protected by the Act Disclosure Safeguarding, Transporting and Disposing of PII Roles and Responsibilities Test Questions Certificate
3 A nonprofit service and advocacy organization © 2012 National Council on Aging Privacy Act of 1974 Public Law 93-579 (5 U.S.C.A. 552a) Purpose: to protect records that can be retrieved by personal identifiers such as a name, social security number, or other identifying number or symbol. The act was created in response to concerns about how the use of computerized databases might impact individuals' privacy rights. requires government agencies to show individuals any records kept on them requires agencies to follow "fair information practices," when gathering and handling personal data. places restrictions on how agencies can share an individual's data with other people and agencies. lets individuals sue the government for violating of these provisions http://epic.org/privacy/1974act / http://epic.org/privacy/1974act
4 A nonprofit service and advocacy organization © 2012 National Council on Aging Who Needs to be Trained? If your work involves the management of sensitive information, PII (Personally Identifiable Information), or protected health information, you need to ensure you are taking precautions to protect it from unauthorized access/disclosure, theft, loss and improper disposal.
5 A nonprofit service and advocacy organization © 2012 National Council on Aging Who Needs to Be Trained? Employees, Managers, Supervisors, Coordinators, Master trainers (MTs), and Lay leaders (LLs), including volunteers who are involved in the collection, handling, and/or data entry of Personally Identifiable Information (PII) on individuals participating in CDSME.
6 A nonprofit service and advocacy organization © 2012 National Council on Aging What Type of Training is Needed? Training for program coordinators and program implementers The rights of individuals participating in CDSME The appropriate protection of PII shared by CDSME participants at the workshop level The appropriate storage and transfer of participant forms Training for individuals completing data entry and data transfer The appropriate protection of PII shared by CDSME participants at the workshop level The appropriate storage, transfer and destruction of data forms Security requirements for electronic data transfer, storing and degaussing (destruction)
7 A nonprofit service and advocacy organization © 2012 National Council on Aging Types of Information Covered by the Privacy Act Sensitive: if the loss of confidentiality, integrity, or availability could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets or individuals. Sensitive: Protected Health Information: Individually identifiable health information that relates to a persons past/present/future physical/mental health, health care received, or payment. Protected Health Information: http://irtsectraining.nih.gov/publicUser.aspx
8 A nonprofit service and advocacy organization © 2012 National Council on Aging Information Protected by the Privacy Act
9 A nonprofit service and advocacy organization © 2012 National Council on Aging Information Protected by the Privacy Act PERSONALLY IDENTIFIABLE INFORMATION (PII) "the term Personally Identifiable Information means any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individuals identity, such as their name, social security number, date and place of birth, mothers maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual. http://www.gsa.gov/portal/content/104276
10 A nonprofit service and advocacy organization © 2012 National Council on Aging Disclosure No agency or person shall disclose: – any record – by any means of communication – to any person or another agency – without a written request or prior written consent of the individual to whom the record pertains any means of communication includes oral (phone, in- person), written and electronic (emails, faxes, texts, tweets, pins, etc.) http://www.dodea.edu/upload/2011_patrainingslides.pdf
11 A nonprofit service and advocacy organization © 2012 National Council on Aging Safeguarding PII PII must always be treated as FOR OFFICIAL USE ONLY and must be marked accordingly. This applies not only to paper records (including e-mail, faxes, etc., which must contain the cautionary marking FOR OFFICIAL USE ONLY – FOUO). All records containing PII should be stored in locked filing cabinets or other secure containers to prevent unauthorized access. Electronic records must be password protected and be transferred via encrypted e-mail.
12 A nonprofit service and advocacy organization © 2012 National Council on Aging Transporting PII Hand Carrying Use a Cover sheet to shield contents Using Mail Use manila or white envelopes Mark the envelope to the attention of the authorized recipient Never indicate on the outer envelope that it contains PII Using E-mail: Password protect personal data placed on shared drives, the Internet or the Intranet Use encrypted e-mail Do not send PII to a personal, home or unencrypted e-mail address Announce in the opening line of the text (NOT the subject line) that FOUO information is contained http://www.dodea.edu/upload/2011_patrainingslides.pdf
13 A nonprofit service and advocacy organization © 2012 National Council on Aging Disposing of PII A disposal method is considered adequate if it renders the information unrecognizable or beyond reconstruction. Disposal methods may include: Burning Melting Chemically decomposing Pulping Pulverizing Shredding Mutilating Degaussing (erasing from magnetic field or disc) Deleting/Emptying Recycle Bin www.dla.mil/.../Privacy%20Act%20103%20Safegarding%20Privacy%20
14 A nonprofit service and advocacy organization © 2012 National Council on Aging Your Role and Responsibility Take privacy protection seriously Respect the privacy of others Ensure messages, faxes and e-mails that contain personal information are properly marked and e-mail is encrypted Make sure you have consent forms in place for PII Dont share PII with individuals who are not authorized Have appropriate transfer, storage and disposal protocols in place for PII Do not e-mail PII to personal, home or unencrypted accounts
15 A nonprofit service and advocacy organization © 2012 National Council on Aging Your Role and Responsibility Advise all participants of their right to consent or refuse use of data about them Provide participants with a blank copy of the consent form If a participant initially consents, but changes their mind during the workshop: 1) Either destroy the original form and replace it with a new form indicating refusal to consent, or 2) Cross out consent on the original form, initial and re-date it Collect Participant Consent Forms and maintain in a secure, locked container until transfer to data entry location Maintain hard copies of Participant Consent Forms in a secure, locked storage area for 3 years after grant end Electronically scanned copies must be stored in a secure, password-protected database for 3 years after grant end
16 A nonprofit service and advocacy organization © 2012 National Council on Aging Your Role and Responsibility All individuals involved in providing CDSME programs must sign Non-Disclosure Agreements All individuals involved in data collection, data transfer and/or data entry must sign Non-Disclosure Agreements Non-Disclosure Agreements should be maintained for 3- years after the end of the grant and stored by the state leader or the states designee for data collection/data entry
17 A nonprofit service and advocacy organization © 2012 National Council on Aging Master Trainers and Lay Leader Role Use the CDSME Program Group Leader Script at a Class Zero pre-session or at the start of Session 1 and with any new participants who start at Session 2 The script explains why participant data is being collected and how it will be kept secure Emphasize that completing the survey is voluntary Individuals may skip any questions they do not want to answer Individuals may choose to not complete the Survey, but they can still participate in the program Collect consent forms and surveys from individuals who sign consent forms Store forms in sealed envelope and mail to appropriate program coordinator
18 A nonprofit service and advocacy organization © 2012 National Council on Aging Program Coordinator/Data Entry Roles Store completed CDSME forms in a secure, locked cabinet when not in use Enter data into secure, password protected database, such as the CDSME database Destroy participant data forms after data entry Hard copies of participant consent forms MUST be stored in a secure, locked cabinet for a minimum of 3 years after grant end Electronically scanned copies MUST be stored on a secure, password protected site for a minimum of 3 years after grant end
19 A nonprofit service and advocacy organization © 2012 National Council on Aging Test Questions – Circle all correct answers 1.Information about an individual that is unique, or identifies or describes him or her (such as Social Security Number, medical history, date of birth, home address) is called: a.Interesting b.Record c.Data d.Personally Identifiable Information
20 A nonprofit service and advocacy organization © 2012 National Council on Aging Test Questions – Circle all correct answers 2. Disposal methods may include all except: a.Burning b.Shredding c.Tearing in half and putting in the garbage can d.Melting
21 A nonprofit service and advocacy organization © 2012 National Council on Aging Test Questions – Circle all correct answers 3. The CDSME Group Leader Script: a.Describes what participants will learn in the workshop b.Requests participants to share their birth date, address and sex c.Explains how participant privacy is protected and why data is being collected d.Emphasizes that participants are required to complete all survey forms
22 A nonprofit service and advocacy organization © 2012 National Council on Aging Test Questions – Circle all correct answers 4. Signed Participant Consent Forms must be maintained for a.36 months b.60 months c.3 years after the grant period ends d.The same length of time as tax return records are kept
23 A nonprofit service and advocacy organization © 2012 National Council on Aging Privacy and Security Basics Training Certificate ________________________________________ (Name) Has Successfully Completed the Privacy and Security Basics Training for CDSME Program Implementation and Data Collection _____________ Date ________________________________________ (Name) Has Successfully Completed the Privacy and Security Basics Training for CDSME Program Implementation and Data Collection _____________ Date
24 A nonprofit service and advocacy organization © 2012 National Council on Aging Test Answer Code 1.d - Personally Identifiable Information 2.c - Tearing in half and putting in the garbage can 3.c - Explains how participant privacy is protected and why data is being collected 1.c - 3 years after the grant period ends
Privacy and Security Basics for CDSME Data Collection Sue Lachenmayr, MPH, CHES Updated April 10, 2014.
1 PUBLIC HEALTH DIVISION Health Promotion and Chronic Disease Prevention Privacy and Security Basics for Self-Management Participant Data Collection Laura.
CDSME Data Collection Requirements and Procedures January 9, 2014 update You Can! Live Well, Virginia!
Overview of the Privacy Act United States Army. Overview After completing this training course, you should be knowledgeable on: The purpose of the Privacy.
Privacy Act Training Mandatory training for all Users who have access to Privacy Act Data.
POLICIES & PROCEDURES FOR HANDLING CONFIDENTIAL INFORMATION NOVEMBER 5 TH 2015.
Properly Safeguarding Personally Identifiable Information (PII) Ticket Program Manager (TPM) Social Security’s Ticket to Work Program.
The Legal Foundation TRICARE Management Activity HEALTH AFFAIRS 2009 Data Protection Seminar TMA Privacy Office.
DATA PROTECTION and Research University Research Ethics Committee – David Cauchi David Cauchi Office of the Commissioner for Data Protection.
Critical Data Management Indiana University HR Summit April 24, 2014.
Safeguarding Privacy Act Data Awareness Training for ALL DeCA Employees and Contractors.
The Health Insurance Portability and Accountability Act of Federal Law designed to protect sensitive information. HIPAA violations are enforced.
September 22, 2010 Updates New Hire/Rehire Documents.
PRIVACY AND INFORMATION SECURITY ESSENTIALS Information Security Policy Essentials Melissa Short, IT Specialist Office of Cyber Security- Policy.
1 DEFENSE LOGISTICS AGENCY AMERICA’S COMBAT LOGISTICS SUPPORT AGENCY DEFENSE LOGISTICS AGENCY AMERICA’S COMBAT LOGISTICS SUPPORT AGENCY WARFIGHTER SUPPORT.
FERPA - Sharing Student Information Seattle Public Schools by Joy Stevens, Sr. Legal Assistant General Counsels Office.
HIPAA Training. What information is considered PHI (Protected Health Information) Dates- Birthdays, Dates of Admission and Discharge, Date of Death.
The Health Insurance Portability and Accountability Act of 1996– charged the Department of Health and Human Services (DHHS) with creating health information.
Increasing public concern about loss of privacy Broad availability of information stored and exchanged in electronic format Concerns about genetic information.
A Road Map to Research at Jefferson: HIPAA Privacy and Security Rules for Researchers Presented By: Privacy Officer/Office of Legal Counsel October 2015.
HIPAA (health insurance portability and accountability act)
ROLES & RESPONSIBILITIES PRIVACY ACT (PA) SYSTEMS OF RECORDS MANAGERS.
Introduction PHI Rights Protecting PHI Investigating & Reporting HIPAA Training Shelly Vrsek Director of Quality Privacy Officer.
Slide 1 FastFacts Feature Presentation February 21, 2013 To dial in, use this phone number and participant code… Phone number: Participant.
Family Educational Rights and Privacy Act. From the moment a child enters the school system, sensitive information is collected about the child (and even.
HIPAA Health Insurance Portability and Accountability Act of 1996 Sales Agent Training.
ISO/IEC 27001:2013 Annex A.8 Asset management Nguyen Tien Thanh Tran Dinh Minh Thien.
2/16/2010 The Family Educational Records and Privacy Act.
WASHINGTON STATE DEPARTMENT OF REVENUE PROTECTING CONFIDENTIAL TAX INFORMATION.
HIPAA Privacy Training. 2 HIPAA Background Health Insurance Portability and Accountability Act of 1996 Copyright 2010 MHM Resources LLC.
WORKFORCE CONFIDENTIALITY HIPAA Reminders. HIPAA 101 The Health Insurance Portability and Accountability Act (HIPAA) protects patient privacy. HIPAA is.
FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT Electronic Signatures This work is the intellectual property of the author. Permission is granted for this material.
Privacy and Security of Protected Health Information NorthPoint Health & Wellness Center 2011.
Health Insurance Portability & Accountability Act “HIPAA” To every patient, every time, we will provide the care that we would want for our own loved ones.
Department of Commerce Privacy Awareness
The Data Protection Act. Why does it exist? Organisations have always kept information about people. The Data Protection Act was in part enacted because.
Records Management TRICARE Management Activity HEALTH AFFAIRS 2009 Data Protection Seminar TMA Privacy Office.
1 Data Security Protocol. Why is data security important? Compliance with Institutional Review Board (IRB) guidelines –An IRB is a group designated by.
1 ICOTS (Interstate Compact Offender Tracking System) Attachments Training.
606 CMR 14.00: Background Record Checks What you need to know!
Privacy and Information Security Training ( ) VUMC Privacy Website
MINNESOTA GOVERNMENT DATA PRACTICES ACT How the law affects University employees and recordkeeping Susan McKinney Records & Information Management.
SMARTworks ® EffectiveResponse Training: Patient Registration National Park Medical Center November 20, 2014.
Columbia University Medical Center Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy & Information Security Training 2009.
Privacy and Information Management ICT Guidelines.
HIPAA Privacy Rule Training. ©SHRM Introduction The Employee Benefits Security Administration (EBSA) administers several health care laws under.
Red Flags Rule BAS Forum August 18, What is the Red Flags Rule? Requires implementation of a written Identity Theft Prevention Program designed.
What is HIPAA? This presentation was created by The University of Arizona Privacy Office, The Office for the Responsible Conduct of Research on March 5,
© 2017 SlidePlayer.com Inc. All rights reserved.