1. Surveillance TRICARE Management Activity HEALTH AFFAIRS 2009 Data Protection Seminar TMA Privacy Office

2. Surveillance TRICARE Management Activity HEALTH AFFAIRS

3. TRICARE Management Activity HEALTH AFFAIRS 3 Surveillance Purpose The purpose of this presentation is to introduce the TRICARE Management Activity (TMA) Privacy Office Surveillance Assist Visit Program and illustrate how an assist visit can highlight the significance of privacy and the protection of Personally Identifiable Information (PII) and Protected Health Information (PHI)

4. TRICARE Management Activity HEALTH AFFAIRS 4 Surveillance Objectives Upon completion of this course, you should be able to: − Describe the TMA Privacy Office Surveillance Assist Visit Program − Determine how a TMA Privacy Office Surveillance Assist Visit can help your organization identify opportunities for improvement in complying with the Privacy Act of 1974 and Health Insurance Portability and Accountability Act of 1996 (HIPAA) requirements − Identify how to request a TMA Privacy Office Surveillance Assist Visit

5. TRICARE Management Activity HEALTH AFFAIRS 5 Surveillance Overview New program developed under the direction of the TMA Deputy Director and Privacy Officer Provide assistance to the organization in assessing compliance with the Privacy Act and HIPAA requirements Organizations that may request an assist visit − TMA − TRICARE Area Offices − TRICARE Regional Offices

6. TRICARE Management Activity HEALTH AFFAIRS 6 Surveillance What is Surveillance? An Assist Visit − Offers objective review of Privacy Act/HIPAA procedures and practices − Sheds light on the functions and purposes of the TMA Privacy Office

7. TRICARE Management Activity HEALTH AFFAIRS 7 Surveillance What is Surveillance? (continued) An Assist Visit − Educates on policies, instructions, guidelines, and departmental and federal regulations governing privacy

8. TRICARE Management Activity HEALTH AFFAIRS 8 Surveillance What is Surveillance? (continued) An Assist Visit − Assists in formulating ways to improve Privacy Act/HIPAA practices

9. TRICARE Management Activity HEALTH AFFAIRS 9 Surveillance What is Surveillance? (continued) Components of an Assist Visit − Review By gathering information By assessing current privacy practices for baseline − Identify Weaknesses Opportunities for improvement Best practices − Prevent By education By process improvement By routine maintenance

10. TRICARE Management Activity HEALTH AFFAIRS 10 REVIEW IDENTIFY ASSIST VISIT Surveillance Dynamics of Surveillance

11. TRICARE Management Activity HEALTH AFFAIRS 11 Surveillance Outcome Ideal outcome − Educated, Privacy Act/HIPAA-savvy members of the organization − Business functions are not disrupted by unfortunate events − Healthcare runs smoothly without protests/questions Acceptable outcome − Organizational awareness and education − Organization meets obligations as defined by regulations

12. TRICARE Management Activity HEALTH AFFAIRS 12 Surveillance Group Activity

13. TRICARE Management Activity HEALTH AFFAIRS 13 Surveillance Group Activity George Clooney Barack Obama Britney Spears

14. TRICARE Management Activity HEALTH AFFAIRS 14 Surveillance Summary You should now be able to: − Describe the TMA Privacy Office Surveillance Assist Visit Program − Determine how a TMA Privacy Office Assist Visit can help your organization identify opportunities for improvement in complying with Privacy Act/HIPAA requirements − Identify how to request a TMA Privacy Office Assist Visit Privacymail@tma.osd.mil http://www.tricare.mil/tmaprivacy/

15. TRICARE Management Activity HEALTH AFFAIRS 15 Surveillance Summary - Who Benefits?

16. TRICARE Management Activity HEALTH AFFAIRS 16 Surveillance Summary - Who Benefits? (continued) Jane Doe

17. TRICARE Management Activity HEALTH AFFAIRS 17 REVIEW IDENTIFY PREVENT Surveillance The Road to Compliance REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT

18. TRICARE Management Activity HEALTH AFFAIRS 18 Surveillance Resources DoD 6025.18-R, “DoD Health Information Privacy Regulation”, January 2003 DoD 5400.11-R, “Department of Defense Privacy Program”, May 2007 DoD 8580.02-R, “DoD Health Information Security Regulation”, July 2007 http://www.tricare.osd.mil/tmaprivacy/Mailing-List.cfm to subscribe to the TMA Privacy Office E-News Privacymail@tma.osd.mil for subject matter questions “TMA Facsimile Transmission Policy for Documents Containing Personally Identifiable Information and/or Protected Health Information (PII/PHI)”, April 9, 2008