Presentation on theme: "Your Role in Corporate Compliance and HIPAA Confidentiality"— Presentation transcript:
1Your Role in Corporate Compliance and HIPAA Confidentiality
2Part I: Understanding Your Role in Corporate Compliance
3What is Compliance?The term compliance has different meanings. In terms of the healthcare industry, compliance means adhering to the requirements stated under the Medicare and Medicaid laws contained within the Social Security Act and the regulations from CMS (Centers for Medicare and Medicaid Services) and other respective federal and state agencies.Our employees’ behavior is a direct reflection on OSF Healthcare. We want to be known as the region’s best health-care system with employees who consistently display high standards of integrity, conduct and ethical behavior.
4What Does Compliance Mean to You as an OSF Employee? The Vision of OSF Healthcare is that recognizing God’s great gift of life, we will be a community of caregivers pursuing perfection in healthcare quality, safety, service and financial integrity.Our Corporate Compliance Plan is located online at the following address,Our employees’ behavior is a direct reflection on OSF Healthcare. We want to be known as the region’s best health-care system with employees who consistently display high standards of integrity, conduct and ethical behavior..
5Who is Big Brother?CMS (Centers for Medicare and Medicaid Services) works with the OIG (Office of the Inspector General) to investigate possible fraud and abuse cases. If CMS believes the hospital has participated in fraudulent activities either knowingly or unknowingly, the OIG investigate.The FBI is the organization that investigates and enforces healthcare compliance.The Department of Justice prosecutes healthcare organizations for healthcare fraud and abuse.
6What is a Breach of Compliance? Understanding how these regulations apply in our daily lives can be difficult.An example of fraud is billing for services not provided. Even mistakenly violating these laws could be abuse and may also result in fines.Examples of possible abuse are repeatedly using the wrong billing codes or making the same error when filing claims.
7What is in OSF’s Compliance Plan? Standard of Conduct: Each new employee signs a form located in the HR handbook that is given to them during orientation.The statement reads:Any OSF Healthcare employee who has knowledge of any activity or behavior which is unethical, immoral or illegal must report this activity or observed behavior to his/her immediate supervisor or to the Director of Human Resources.Identification of High Risk Areas:These are areas that are identified as a higher risk for potential fraud and abuse therefore require more frequent monitoring by the compliance department.
8What is in the Compliance Plan? Disciplinary Guidelines:The Corporate Compliance Plan identifies employee obligations to government investigations, compliance chain of command and compliance plan discipline.
9The OSF Healthcare System Corporate Compliance Program promotes: The requirement of a facility compliance officerThe identification of a facility compliance officerThe identification of chain of commandThe identification of Integrity HotlineThe provision of education to staff regarding complianceThe identification of Standards of Conduct
10In Summary.....Compliance means adhering to the requirements stated under the Medicare and Medicaid laws contained within the Social Security Act and the regulations from CMS (Centers for Medicare and Medicaid Services) and other respective federal and state agencies.Doing the right thing, the right way, the first time, all the time!Non-compliance means fraud and/or abuse, penalties, disciplinary action, and public distrust.
11Part II: HIPAA Awareness Training Privacy and Security Rules OSF Healthcare SystemHIPAA Awareness Training – explaining the Privacy and Security Rules.
12What is HIPAA? HIPAA stands for: Insurance Portability and HealthInsurancePortability andAccountabilityAct of 1996HIPAA stands for Health Insurance Portability and Accountability Act of No, it’s not short for hippopotamus.
13What is HIPAA?HIPAA is a federal regulation that OSF Healthcare System has to comply with that protects the privacy, security and confidentiality of a patient’s health information.So because of these reasons, a federal regulation that OSF Healthcare System has to comply with that protects the privacy, security and confidentiality of a patient’s health information.
14HIPAA Privacy Rule The HIPAA Privacy Rule Standards to protect the privacy of medical records and other patient specific information.Making sure protected health information (PHI) is properly handled by the facility.So – then read slide.
15HIPAA PrivacyWhat is protected health information? - Information that could be used to identify an individual - Examples would be: name, social security number, (demographic information) - Transmitted or maintained in any form such as oral, written, or electronic informationProtected health information, known as PHI, is defined as individually identifiable health information. Individually identifiable health information identifies the individual where there is a reasonable basis to believe that the information can be used to identify the individual. Some examples of individually identifiable health information include: name, address, social security number, drivers license number, etc. The HIPAA Privacy Rule is to protect information in any format – whether it be oral, written or electronic.
16Corporate Compliance/Privacy Officer HIPAAHIPAA requires that all health care organizations have a Privacy Officer.Corporate Compliance/Privacy OfficerJohn EvanchoEach OSF entity has their own Privacy Officer.OSFSFMC – Dan Blunier ( )Read Slide
17Privacy Officers Responsibilities include: Overseeing the privacy functions at the facility.Serve as a resource for questions and concerns.Handle any privacy related complaints.Develop privacy policies and procedures.Provide training to staff.Read slide.
18HIPAA – Why is training necessary? Confidentiality is so important, that OSFrequires that:All employees and workforce members be informed of their responsibility to protect confidentiality.Proven violation of the confidentiality of patient information shall include immediate disciplinary action up to and including termination.Confidentiality is so important that OSF requires that all employees and workforce members, which includes not only employees, but also volunteers, consultants, students, and business partners, be informed of their responsibility to protect patient confidentiality. A proven violation of the confidentiality of patient information shall include immediate disciplinary action up to and including termination as described in our Positive Discipline Policy.
19HIPAA – PolicyOur policy states that patient protected health information (PHI) will be kept private and confidentialOur policy also guides us on who should have access to patient informationDirect access to patient information shall only be permitted to those employees who have a “need to know” to perform their job functions.Minimum necessary information to perform their jobs.So what is OSF Healthcare system’s policy regarding confidentiality and our patient’s protected health information? Our policy states that patient protected health information (PHI) will be kept private and confidential.Our policy also guides us on who should have access to patient information: Direct access to patient information shall only be permitted to those employees who have a “Need to know” to perform their job functions. This means that if you don’t need a patients PHI to perform your job –you will not have access to it – nor should you ask for it.
20HIPAA - PolicyWhat patient information does OSF require me to keep confidential?Demographic informationExamples: Name, social security number, date of birth, address, etc.Information about injury, illness or condition – including symptoms, diagnosis or treatmentConversations between the patient and health care workersWhat patient information does OSF require me to keep confidential? We ask you to keep a patients demographic information confidential – that includes their name, address, date of birth, etc. We also request that you keep confidential any information about an injury, illness or any condition – and that includes symptoms, diagnosis or treatment. Also, conversations between the patient and health care workers must also be kept confidential.
21What information can I provide to persons seeking information about a patient? Facility Directory information:1. The patient’s location with the facility;2. The patient’s condition stated in generalterms (i.e. good, fair, poor);3. The patient’s religious affiliation(available only to clergy).If someone asks for information about a patient – what information can I provide? According to the Privacy Rule, you can provide information that is included in the facility directory. That includes the patient’s location in the facility, and the patient’s conditions stated in general terms – such as good, fair, poor, critical. A patients religious affiliation is also available to the clergy .
22HIPAA - PolicyOur Confidentiality Policy also guides us on when and where we can discuss patient information.Discuss patient information privately; never in elevators, lobbies, cafeterias, or corridorsMake sure requisitions, forms, and computer screens with patient names and information are not easily viewed by othersDispose of unnecessary patient information in proper receptacles for shredding, not ordinary trash binsRead slide.
23HOW do I protect the privacy of my co-workers? Take special care to respect the privacy of co-workers and colleagues who are patients.Do NOT discuss the health care services of your co-workers with anyone who is not directly involved in their care.- Do NOT access their private health information unless it is for patient care purposesSo, how do you protect the privacy of a co-worker? Remember to take special care to respect the privacy of co-workers and colleagues who are patients. Do not discuss the health care services of your co-workers with anyone who is not directly involved in their care. Do not ask co-workers why they are a patient, or their reasons for being in the hospital or clinic. Do not access their private health information ( look at their chart) unless it is for patient care purposes.
24HIPAA – How do our patient’s know their Privacy Rights? We are required to provide a Notice of Privacy Practices to all patients that describes their rights over their PHIPatients will sign an acknowledgement form stating that they received a copy of the Privacy NoticeThe HIPAA privacy rules tells us how we must protect a patients health information. How do our patients know how we protect their health information? We are required to provide a Notice of Privacy Practices to all patients that describes their rights over their protected health information. Patients will sign an acknowledgement form stating that they have received a copy of the Privacy Notice.
25Reporting Possible Violations Can employees report possible violations of the privacy rule?Employees are encouraged to report possible violations of the privacy rule to us. Employees should feel comfortable to know that we will not take any retaliatory action when employees file complaintsSubmit complaints to your immediate supervisor, Privacy Officer or the Integrity Line at – 547 – 2822.Read slide.
26Why Comply With the HIPAA Rule? Ethics – it’s the right thing to doCivil Penalties – fines of $100 for every accidental violationCriminal Penalties – up to $250,000 for violations committed knowingly/purposefully and up to 10 years in federal prisonBesides the government telling us we have to comply with the HIPAA rules, OSF wants to comply because it is the right thing to do. HIPAA is serious about patient privacy. Failure to comply can results in civil penalties with fines of $100 for every accidental violation not to exceed $25,000 during a calendar year.For criminal penalties, the fines go up to $250,000 for violations committed knowingly and purposefully and up to 10 years in a federal prison.
27HIPAA Security Rule The Privacy Rules identifies what information is protected, whether it be in electronic, oral or paperform, and who may have access to that information(PHI).The Security Rules identifies steps for ensuring thatonly those who should have access to electronic PHI(ePHI) will actually have access.Read Slide
28Administrative Safeguards The Administrative Safeguards require that facilities develop processes, policies and procedures to prevent, detect, contain, and correct security violations.Read slide.
29Physical SafeguardsThe purpose of physical safeguards is to help protect the physical computer systems and related buildings and equipment from:- Fire- Other natural and environmental hazards- Unauthorized access.Read Slide.Among the physical safeguards that we need to address to comply with the security rules are:Facility access controls – policies and procedures relating to the physical security of the facilityWorkstation use and security – practices that protect work areas and computer systems from unauthorized useDevice and media controls – procedures to handle computers and other items that contain electronic PHI, such as CD-ROMs and floppy diskettes.
30Technical SafeguardsSome of the processes used to promote compliance with theTechnical Safeguard rule include:Computer system access, such as passwordsAssigning security levels based on user identify or job responsibilityProper identification of individuals requesting access to ePHIAudit trails that record system activity as it occursRead slide
31Security Safeguards Passwords - don’t share and don’t post . Workstations - secure your workstation, use screen savers, lock your computer if unattended, log off when not in use, log off at night.- avoid sending sensitive/confidential patient information.Removable media (disks, CDs,) - lock up and store, dispose/destroy properly.Internet - firewalls, monitor and audit usage, utilize virus protection.Here are some examples of security safeguards.Read slide.
32Remember Patient confidentiality is: Everybody’s jobRead slide.