2This HIPAA Training Program will help you understand What.…..is HIPAA?How…....does HIPAA affect you and your job?Where…...can you get help with HIPAA?How ……you can protect CCSC patients’ confidential and sensitive information and your own personal information in any formatHow ……to understand the risks when using and storing electronic informationHow ……to reduce those risksObjectives:Provide simple, catchy framework for HIPAA 101 based on the 5 w’s of journalism.Provide simple language that can be easily translated into other languages.
3What Is Health Insurance Portability and Accountability Act HIPAA? HIPAA is a Federal law enacted to:Protect the privacy of a patient’s personal and health information.Provide for the physical and electronic security of personal health information.Simplify billing and other transactions with Standardized Code Sets and TransactionsSpecify new rights of patients to approve access/use of their medical informationObjective:Highlight three key components of HIPAA in simple, 6th grade level languageEmphasize that it is a federal requirement
4Do the HIPAA laws apply to you? The Health Insurance Portability & Accountability Act (HIPAA) requires that CCSC train all members of its workforce about the Clinic’s HIPAA Policies and specific procedures required by HIPAA that may affect the work you do for the CCSC.
5What are the HIPAA requirements? To protect the privacy and security of an individual’s Protected Health Information (PHI)To require the use of “minimal necessary”To extend the rights of individuals over the use of their protected health information
6What Patient Information Must We Protect? We must protect an individual’s personal and health information that…Is created, received, or maintained by a health care provider or health planIs written, spoken, or electronicAnd, includes at least one of the 18 personal identifiers in association with health informationHealth Information with identifiers = Protected Health Information (PHI)
7Examples of Protected Health Information (PHI, ePHI) Name, address, birth date, phone and fax numbers, address, social security numbers, and other unique numbersBilling records, claim data, referral authorizationsMedical records, diagnosis, treatments, x-rays, photos, prescriptions, laboratory, and any other test resultsResearch recordsPatient can be identified from health informationAll formats including verbal, written, electronic
8Notice of Privacy Practices specifically allows…HIPAAThe clinic to create, use, and share a person’s protected health information for healthcare operations such as:TreatmentPaymentOperations, including teaching, Medical staff activities, disclosures required by law and governmental reportingBut only if CCSC ensures that each patient receives a copy of the CCSCNotice of Privacy Practices
9In order for CCSC Healthcare Provider to use or disclose PHI The Clinic must give each patient a Notice of Privacy Practices that:Describes how the Clinic may use and disclose the patient’s protected health information (PHI) andAdvises the patient of his/her privacy rightsThe Clinic must attempt to obtain a patient’s signature acknowledging receipt of the Notice, EXCEPT in emergency situations. If a signature is not obtained, the Clinic must document the reason it was not.
10But, for purposes other than treatment, payment, operations… The clinic must obtain authorization and use only the minimum necessary:Patient Authorization - allows for CCSC to disclose information for other purposes (§ )Minimum necessary applies to all uses and disclosures (§ (b), § (d))
11With All of the State and Federal Laws, what Patient Information Must Be Protected? Keep it simple: All personal and health information that exists for every individual in any form:WrittenSpokenElectronicThis includes HIPAA protected health information and confidential information under State laws.ObjectiveSimple language to help 6th grade level understand what information must be protected3/6/03
12To the patient, it’s all confidential information Patient Personal InformationPatient Financial InformationPatient Medical InformationWritten, Spoken, Electronic PHI
13Why Me?I do not provide Patient Care… do I Need Training? I do not use or have contact with Patient health or financial information…do I Need Training? And…….. Isn’t this just an IT Problem?
14Who Uses PHI at CCSC?Anyone who works with or may see health, financial, or confidential information with HIPAA PHI identifiersEveryone who uses a computer or electronic device which stores and/or transmits informationSuch as:CCSC employeesCCSC VolunteersCCSC students who work with patientsCCSC board membersAlmost Everyone – at one time or another!
15Why is protecting privacy and security important? We all want our privacy protected!It’s the right thing to do!HIPAA and Ohio laws require us to protect a person’s privacy!CCSC requires everyone to follow the Clinic’s privacy and security policies!
17HIPAA Scenario #1 Should you give your friend this information? I volunteer at the reception desk of CCSC. A friend of mine asks me if I knew any of the patients coming to clinic.Should you give your friend this information?
18HIPAA Scenario #2 Did I do the right thing? I am a file clerk. While opening lab reports, I saw my friend’s daughter’s pregnancy test results. Her pregnancy test was positive! That night at a holiday party, I saw her and her mother, and congratulated her on her pregnancy. Later I heard that my friend did not know about the pregnancy. I was the first person to tell her!Did I do the right thing?
19Ask yourself these questions — Did you need to read the lab results to do your job?Is it your job to provide a patient’s mother with her health information—even if the individual is a friend or fellow employee?Is it your job to let other people know an individual’s test results?How would you feel if this had happened to you?Do not look at, read, use or tell others about an individual’sinformation (PHI) unless it is a part of your job.
20Remember — Use only if necessary to perform job duties Use the minimum necessary to perform you jobFollow CCSC policies and procedures for information confidentiality and security. (see notice of privacy practices)
21HIPAA Violations Can Carry Penalties-- Criminal Penalties$50,000 - $250,000 finesJail Terms up to10 yearsCivil Monetary Penalties$100 - $25,000/yr finesmore $ if multiple year violationsFines & Penalties – Violation of State Law
22How Can You Protect Patient Information: PHI / ePHI /Confidential Verbal AwarenessWritten Paper / Hard Copy ProtectionsSafe Computing SkillsReporting Suspected Security Incidents
23Patients can be concerned about… Being asked to state out loud certain types of confidential or personal informationOverhearing conversations about PHI by staff performing their job dutiesBeing asked about their private information in a “loud voice” in public areas, e.g.In clinics, waiting rooms, service areasIn hallways, in elevators, on shuttles, on streets
24Protecting Privacy: Verbal Exchanges Patients may see normal clinical operations as violating their privacy (incidental disclosure)Ask yourself-”What if it weremy information beingdiscussed in this place orin this manner?”
25Incidental disclosures and HIPAA “Incidental”: a use or disclosure that cannot reasonably be prevented, is limited in nature and occurs as a by-product of an otherwise permitted use or disclosure. (§ (c)(1)(iii)Example: calling out a patient’s name in the waiting room; sign in sheets in clinic.
26Incidental disclosures and HIPAA Incidental uses and disclosures are permitted, so long as reasonable safeguards are used to protect PHI and minimum necessary standards are applied.Commonly misunderstood by patients!
27Information can be lost… Physically lost…Paper copies, films, tapes, devicesLost anywhere at anytime-streets, restrooms,shuttles, coffee houses, left on top of carwhen driving away from UCSF…Misdirected to outside world…Mislabeled mail, wrong fax number, wrong phone numberWrong address, misplaced on UCSF intranetNot using securedVerbal release of information without patient approval
28We need to protect the entire lifecycle of information Intake/creation of PHIStorage of PHIDestruction of PHIFor any format of PHI
30Shredding bins work best when papers are put inside the bins Shredding bins work best when papers are put inside the bins. If it’s outside the bin, it’s …Daily gossipDaily trashPublic
31Information can also be lost or stolen electronically Lost/stolen laptops, PDAs, cell phonesLost/stolen zip disks, CDs, floppiesUnprotected systems were hackedsent to the wrong address or wrong person (faxes have same issues)User not logged off of system
33“10” Good Computer Security Practices for protecting restricted data
34“Good Computing Practices” 10 Safeguards for Users PasswordsLock Your ScreenWorkstation SecurityPortable DeviceData ManagementAnti VirusComputer SecuritySafe Internet UseReporting Security Incidents / Breach
35Good Computing Practices #1 Passwords Use cryptic passwords that can’t be easily guessed and protect your passwords - don’t write them down and don’t share them!
36Good Computing Practices #2 Workstation Security Physically secure your area and data when unattendedSecure your files and portable equipment - including memory sticks.Secure laptop computers with a lockdown cable.Never share your access code, card, or key (e.g. Axiom card)
37Good Computing Practices #3 Computer Security Don’t install unknown or unsolicited programs on your computer.
38Good Computing Practices #4 Safe Internet Use Practice safe internet useAccessing any site on the internet could be tracked back to your name and location.Accessing sites with questionable content often results in spam or release of viruses.And it bears repeating…Don’t download unknown or unsolicited programs!
39Good Computing Practices #5 Reporting Security Incidents/ Breach How to Reporting Security Incidents/ Breach?Report lost or stolen laptops, blackberries, PDAs, cell phones, flash drives, etc…Loss or theft of any computing device MUST be reported immediately to the CCSC executive director
40Good Computing Practices #6 Reporting Security Incidents/ Breach cont’d… Immediately report anything unusual, suspected security incidents, or breaches to the executive director.This also goes for loss/theft of PHI in hardcopy format (paper, films etc).