Presentation on theme: "HIPAA Security Training 2005"— Presentation transcript:
1HIPAA Security Training 2005 Security Training 2005
2IntroductionTo improve the effectiveness of the health care system in protecting patient health information the federal government signed into law the Health Insurance Portability and Accountability Act in HIPAA, as it is commonly known provides health care entities with guidelines on how it must secure and safeguard electronic Protected Health Information (ePHI).This course:Explains the differences between HIPAA Security and Privacy Rules.Outlines new security regulations.Identifies new security-related policies and procedures.Reviews your role in protecting patient information.Use this template to create Intranet web pages for your workgroup or project. You can modify the sample content to add your own information, and you can even change the structure of the web site by adding and removing slides. The navigation controls are on the slide master. To change them, on the View menu, point to Master, then choose Slide Master. To add or remove hyperlinks on text or objects, or to change existing hyperlinks, select the text or object, then choose Hyperlink from the Insert menu.When you’re finished customizing, delete these notes to save space in your final HTML files.For more information, ask the Answer Wizard about:The Slide MasterHyperlinks
3HIPAA Security HIPAA Security becomes effective on April 21, 2005. HIPAA Security and Privacy go hand-in-hand.While the Privacy Rule, effective on April 14, 2003 covers all forms of protected health information (PHI), the Security Rule only applies to PHI in electronic forms.
4What is HIPAA Security?With a focus on the protection and monitoring of Electronic Protected Health Information (ePHI), HIPAA security regulations require an entity to:Ensure the confidentiality, integrity, and availability of all electronic PHI (ePHI).Protect against any reasonably anticipated threats and uses or disclosures not allowed by the Privacy Rule.Mitigate threats by using safeguards reasonably and appropriately implemented that conform to the Security Rule standards.
5What is PHI?Protected Health Information (PHI) consists of patient identifiable information delivered via paper, verbal communications or electronic means. Examples include:Patient nameAddressDate of birthSS#Medical record #addressIdentifiable health information may be shared among caregivers for the purposes of: Treatment, Payment or Healthcare Operations (TPO). Healthcare Operations include: QA/QI, Utilization Review, Disease, Management, Credentialing, Auditing, etc.Any other use of PHI or disclosure information, i.e., research, marketing, etc. requires the written authorization and consent of the patient.
6Privacy/Security Comparison Similarities and Differences between HIPAA Privacy and SecurityPRIVACYPatient focusedPHI – electronic, paper, or verbalPrivacy officerPrivacy awareness trainingBusiness associate contractsPolicies and procedures that meet privacy standardsSECURITYCovered entity focusedPHI – only electronicSecurity officerSecurity awareness trainingBusiness associate contractsPolicies and procedures that meet security standards
7HIPAA Security Safeguards HIPAA Security safeguards fall into the following 3 main categories:TechnicalAccess ControlAudit ControlIntegrityPerson or Entity AuthenticationProcedures in place that protect and monitor information access and prevent unauthorized use of data transmitted over the network.PhysicalFacility AccessWorkstation UseWorkstation SecurityDevice & Media ControlsProtection of computer systems, building sites, and equipment from hazards and/or intrusions.AdministrativeSecurity Mgmt., Security OfficerWorkforce Security, Access Mgmt.Training, Incident ProceduresPolicies and procedures utilized to manage the selection and execution of security measures.
8Technical Safeguards Using PHI Information Access is given on a “need-to-know” basis. Access to a system does not imply it is appropriate to search any patient information at will simply to satisfy a curiosity.Use/access the absolute minimum patient information.For information not currently available to you, ask your manager or supervisor for approval.
9Computer SecurityComputer and information technology are a significant component to our business structure at BWH.Never leave any PHI data displayed on your monitor when you’re away from your desk.Lock your computer. Click on the yellow lock symbol at the bottom right of the task bar to enable the PHS Password Protected Screensaver.Do not download files to local directories or copy files to external devices, such as floppy disks, CDs, and flash drives without authorization.CDs, floppy disks, etc. must be physically destroyed when no longer needed. For example, break a CD or floppy disk in half.
10Computer Viruses/Malicious Software Viruses can range from seemingly harmless “jokes,” all the way to widespread destructive infections that can shut down an entire network.Do not open attachments from unknown senders. If an looks suspicious – don’t open it! Delete it! If you think you downloaded a virus, contact the Help Desk.Avoid free downloads and software such as WeatherBug and Search bars. These are examples of spyware that interfere with PHS applications as well as bog down the system.
11Protecting Portable ePHI Portable electronic media covers devices, such as laptops, diskettes, CD’s, zip drives, flash drives, PDA’s, etcAll movement of electronic media containing ePHI into and out of BWH must be tracked and logged.BWH employees who move electronic media or information systems containing ePHI are responsible for the subsequent use of such items and must take all appropriate and reasonable actions to protect them against damage, theft, and unauthorized access.Prior to downloading/moving ePHI, refer to HIPAA Security Policy, Accountability of Electronic Media.
12Controlling PHI Access Collecting PHI requires a controlled, secure environment to store information.As EmployeesDo not attempt to view information you have not been authorized to access.Memorize your password, never write it down.If you suspect your password has been compromised, change it immediately or call the Help Desk and request a new one.Audits are run regularly to ensure appropriateness.As ManagersAuthorize employees to receive minimum access to perform their jobs. If you’re a ‘key giver,’ identify the user’s role before giving them access.Conduct periodic application monitoring to identify and track who accessed PHI and determine its appropriateness.Remove an employee’s ability to access PHI within 24 hours after their termination date.
13Uses containing PHI should be limited to instances of absolute necessity. Determine the following:Has the patient authorized you to communicate with them or a member of their family via ?Has all extraneous information been removed from the content of the message?Has the PHS disclaimer been linked to your outgoing messages?Have you password protected your files?For more information, refer to Clinical Guidelines in the BWH Administrative Policy Manual.
14Physical SafeguardsBWH Security staff regularly monitors those entering the building.Staff and employees must wear ID badges at all times.Report suspicious behavior.Restricted areas must remain restricted.Read and understand the BWH Privacy and Security policies, your departmental policies, and regulations regarding visitors.
15Contingency Planning – BWH IS Contingency planning is important for maintaining the integrity of PHI. Partners Information Systems has policies and procedures in place in the event of a network or system failure. These procedures include:Methods to back up data in case of a system failure.Plans to protect data in case of an emergency or disaster.Methods to access data if due to an emergency, you cannot access it in the usual way.
16Contingency Planning - BWH To learn more about contingency planning, refer to the online BWH Crisis Resource Manual (CRM). To access the BWH CRM, go to:Start Menu> Partners Applications > Clinical References > BWH Crisis Resource Manual (CRM). - OR -BWH Pike Notes > Hospital-wide Policies And Manuals > Emergency Management Manual > BWH Crisis Resource Manual (CRM).
17Administrative Safeguards As part of HIPAA security, BWH has implemented a broad program that includes policies, procedures, standards and guidelines to guide, protect and support you.BWH strongly encourages you to report any issues or concerns you have about HIPAA security. If you observe any inappropriate activity, it is your responsibility to report it.Speak with your manager or supervisor.the BWH HIPAA Security Office mailbox.Call the BWH Compliance Hotline (617) to make an anonymous report.
18You have completed the BWH HIPAA Security Training Course CongratulationsYou have completed the BWH HIPAA Security Training Course