1. Electronic Health Records Danielle P. Berthelot, RHIA Director, Health Information Management and Cancer Registry Privacy Officer Woman’s Hospital

2. Overview of Woman’s Hospital Not-for-profit 225 bed Women and Infants Specialty Facility 82 bed Level III NICU Statistics FY 2007 8,200 births 7,400 surgeries 12,000 adult admissions

3. Implementing an EHR Where are we going? What do we need? How do we get there? Are we there yet?

4. Where are we going? Set a Goal What are we trying to accomplish?

5. What do we need? Defining the Task Must have Would like to have Would love to have

6. How do we get there? Implementing the Plan Phased in approach Flip the switch approach

7. Benefits Forms Management Documentation Consistency Health Information Access Online Record Completion

8. Forms Management

9. Form location Form revisions Patient demographics Form packets Form identification

10. Documentation Consistency

11. Standard information Required fields and formats Automated reports

12. Health Information Access

13. Information control Remote access Multi-user access

14. Online Record Completion

15. Increased Physician Flexibility Increased Physician Satisfaction Decreased Delinquency Rates

16. Are we there yet?

17. Hurdles Human Resources Inconsistent Processes Hardware Integration

18. Looking Back What’s different about our organization today? What did we do to help staff accept the change? What did we do to help physicians accept the change? What challenged us as leaders? What was the best part of the experience?

19. Privacy and Security What is HIPAA?

20. Law passed by Congress in 1996 –Major rules affecting hospitals Transactions, Code Sets, and Identifiers Privacy Rule – Sets standards for the protection of patient information (oral, written, electronic) Security Rule – Sets standards for protected health information in an electronic format Health Insurance Portability and Accountability Act

21. HIPAA Compliance Enforcement Privacy Rule – Office for Civil Rights (OCR) Security Rule – Centers for Medicare/Medicaid Services (CMS) Criminal Matters – Department of Justice (DOJ)

22. What is Protected Health Information (PHI)? Name Address/Dates Telephone/fax #s Social Security #s Medical Record #s Patient Account #s Insurance Plan #s Vehicle Info. Certificate/License #s Medical Equipment #s Photographs Fingerprints Email/Internet address Web URLs Any other unique code, or identifier

23. Most Frequent Privacy Complaints Impermissible use and disclosure of PHI Lack of adequate safe guards to protect PHI Refusal or failure to provide an individual with access to his/her health records Disclosure of more information than is necessary to satisfy a request for information Failure to provide the Notice of Privacy Practices

24. Most Frequent Security Complaints Information access management Security awareness and training Access control Workstation use Device and media control

25. Hot Topics Permitted Uses and Disclosures Authorization Forms Minimum Necessary Facility Directory E-mail Access EPHI Disposal of PHI Audits

26. Breaches/Violations Inadvertent: accidental, often due to lack of education or awareness Intentional: accessing PHI with not legitimate business purpose for doing so Intentional with malice: accessing PHI with the intent to use for personal gain or to harm someone.

27. Sanctions Consistent throughout organization Fits the crime

28. Compliance Tips Update policies and procedures regularly. Conduct ongoing training for staff. Discuss patient information in private areas. Keep voices down. Place computers, printers, fax machines in secure areas. Direct monitors away from view of visitors. Access only the information you need to perform your job. Retrieve documents from printers and fax machines immediately. Dispose of PHI properly. Assist visitors promptly to ensure they do not access staff areas. Report and address issues immediately. Audit compliance with polices and procedures. Enforce compliance with polices and procedures.

29. Questions and Answers Danielle P. Berthelot, RHIA Director, Health Information Management and Cancer Registry Privacy Officer Woman’s Hospital Email: danielle.berthelot@womans.org