Presentation on theme: "Copyright 2003 Page, Wolfberg, & Wirth, LLC. All Rights Reserved."— Presentation transcript:
Copyright 2003 Page, Wolfberg, & Wirth, LLC. All Rights Reserved.
HIPAA stands for the “Health Insurance Portability and Accountability Act” HIPAA is a Federal law passed in 1996 Applied to EMS in April, 2004
Specifies what is required to protect the security and privacy of personally identifiable health care information Applies to most health care providers, including ambulance services
Protecting patient privacy Safeguarding patient information
Protected Health Information (PHI) ◦ Individually identifiable information ◦ Dealing with past, present or future physical or mental health care or payment
Protected Health Information (PHI) ◦ Created by or received by a health care provider ◦ Oral, written, photographic, electronic, digital, etc.
Patient Care Reports
Dispatch/Call Intake Records
Incident Reports with Patient Information
Verbal Communications Between Health Care Providers
Patient Records from Nursing Homes/Hospitals
Physician Certification Statements
The Golden Rule of HIPAA: ◦ Respect the privacy of patient information as you would your own
Do not share PHI with others not involved in the patient’s care, except when permitted or required
Generally speaking, keep disclosures to the “minimum amount necessary” to get the job done
1. Treatment 2. Payment 3. Health Care Operations
You may freely share PHI with other health care providers who also treat the patient
Facilities may give PHI to the ambulance service and vice versa (e.g., transfers) EMATALA requires the ambulance crew to have access to patient records
The “minimum necessary” rule does not apply to treatment- related disclosures
Your ambulance service may use PHI to file claims with payers and send bills to patients without patient consent or authorization
Includes Quality Assurance or Continuous Quality Improvement, Training and certain management functions
The “minimum necessary rule” applies ◦ Disclose the minimum amount needed to perform the function
Can the dispatch center transmit PHI over the radio? ◦ YES! How else would you know where to respond?!
Can you share PHI over the radio with other responding agencies?
◦ YES! HIPAA does not prevent oral communications for treatment purposes!
However, remember that the dispatch information you receive is still PHI!
Be sure to document the nature of the dispatch! ◦ Example: “dispatched by 911 for a patient with chest pain...”
Can you discuss the patient’s condition with first responders or other on-scene providers?
Can you discuss PHI with family members?
What about talking to the media or to bystanders?
You may engage in discussions necessary to treat the patient
Take care to minimize “incidental disclosures”
Use common sense approaches!
You are permitted to transmit PHI to the receiving facility
May apprise the hospital of patient condition
Take care to minimize incidental disclosures
Use most secure transmission option
You may give your PCR to the hospital ◦ The “minimum necessary” rule doesn’t apply
You may give a verbal report to the hospital staff ◦ Take care to minimize incidental disclosures ◦ Sound-proof room not required!
You may obtain a face sheet or billing information from the facility
Discussions in the station?
Quality improvement activities?
HIPAA greatly limits the disclosures that EMS personnel can make!
EMS personnel are patient care advocates, not law enforcement tools
Permissible law enforcement disclosures are limited to specific situations
After an accident call, a police officer stops by the station and asks for a copy of your PCR for the patient you transported to the hospital
A police officer asks you if the patient at an accident scene appears to have been drinking
A police officer who is a medically-trained First Responder is assisting you and asks for the patient’s blood pressure and pulse to record on the first responder scene report
PHI can be verbally disclosed for treatment, but… Must take reasonable steps to minimize incidental disclosures
Examples ◦ Give report to ER nurse away from the crowd ◦ Use softer volume when speaking ◦ Use most secure type of transmission available
“Notice of Privacy Practices” (NPP) ◦ Written document
Two obligations ◦ Furnish to patient ◦ Obtain signed acknowledgment in non-emergency ◦ NuCare sends the NPP with billing statement
These still involve PHI
Furnish notice and obtain signed acknowledgment when possible
Document reason why if not possible
Can include acknowledgment directly on the refusal form
You are permitted to disclose PHI to a public or private entity involved in disaster relief efforts ◦ Example: American Red Cross
Purposes ◦ Notify a family member or other personal representative ◦ Of location, condition or death of patient
Patients have the right to inspect and copy their medical records
Requests should be directed through management (Privacy Officer) of your ambulance service
Patients have a right to request amendment of their PHI
Requests must go through the ambulance service ◦ 1 st : Director of Operations ◦ 2 nd : Director, Business Dev.
Not required to amend if information is complete and accurate
Changes should be made by the original author
Policies for protection
PCRs should not be left unattended in the open Do not leave PCRs and notes in your clipboard, lock them up
PCRs should be maintained in a locked cabinet with limited, role-based access ◦ Keyed banker’s bag ◦ Padlocked white box
Must also safeguard written notes, call intake records, physician certifications, etc. that contain PHI
Trip sheets and other PHI should not be posted or used as “examples” unless identifying information is removed ◦ Training Officer is the only employee with role based access for this purpose
Implement password protection to computers or networks where PHI is maintained
Include confidentiality statements on s and fax cover sheets
Keep fax machines which receive PHI in a secure location and ensure others to whom you fax PHI do the same
Use encryption technology for the electronic transmission of PHI
Generally no: ◦ The recently enacted (October, 2010) HITECH ACT makes it a HIPAA violation to enter, review or QA patient records from any device that does not contain encryption software. ◦ If your device contains company approved encryption software, you may perform the above duties from personal items. ◦ FTOs, Supervisors, Managers and Directors are not exempt from this ruling.
Use most secure method available to communicate with dispatch, hospital, etc. ◦ Example: cell phone vs. VHF radio
Conduct conversations about PHI with other treatment providers in most secure location available
Use appropriate voice volume
No inappropriate banter about specific patients