1. 1 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Privacy in the Physician’s Office Chapter 17

2. 2 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Introduction The creation of privacy and security laws was a huge step toward more efficient healthcare services and faster reimbursements. By understanding HIPAA compliance laws, employees of physicians’ offices can feel secure about their dealings with patients and others who frequent the facility.

3. 3 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. This chapter will examine:  Benefits of the HIPAA Privacy Rule  Requirements of the Notice of Privacy Practices  Differences between Title I and Title II  Patient rights under the Privacy Rule  Expectations for healthcare providers  Incidental disclosures  Role of the Notice of Privacy Policies in emergencies

4. 4 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Health Insurance Portability and Accountability Act (HIPAA) Affects both employees and patients in a healthcare facility, insurance company, or other covered entity

5. 5 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Effect of the HIPAA Privacy Rule The HIPAA Privacy Rule creates national standards to protect individuals’ medical records and other personal health information.

6. 6 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Benefits to Patients and Providers  Patients have more control over their medical records.  Patients are able to make informed choices regarding how personal health information is used.  Boundaries are set on the use and release of health records.

7. 7 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Benefits to Patients and Providers  Safeguards are established that healthcare providers must achieve to protect the privacy of health information.  Violators are held accountable and face civil and criminal penalties if patient privacy rights are compromised.  Protects public health by striking a balance when public responsibility supports disclosure of personal health information.

8. 8 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Before HIPAA  Before the HIPAA Privacy Rule was enacted, personal health information could be distributed to others without notice or authorization from the patient.  Exchange of the information may have had nothing to do with patient treatment.

9. 9 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Before HIPAA  Information could be given to a financial lender, and the information could influence lending decisions.  Employers could obtain health information for use in personnel decisions.

10. 10 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. HIPAA Provisions  Title I  regulates insurance reform  Title II  deals with administrative simplification

11. 11 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Title I  Limits use of preexisting conditions that prevented or limited employees from obtaining health coverage in the past  Prevents discrimination against individuals who are in poor health now or were in the past after leaving or losing a job

12. 12 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Title II Two Parts:  Development and implementation of standardized electronic transactions using Standard Code Sets  Implementation of privacy and security procedures to prevent the misuse of health information by ensuring confidentiality

13. 13 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. HIPAA Patient Rights According to HIPAA, patients have the right:  To notice of a facility’s privacy practices  To have access to, view, and obtain a copy of their personal health information  To restrict certain parts or uses of their personal health information

14. 14 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. HIPAA Patient Rights  To request that communications from the facility be kept confidential  To request the facility to amend the personal health information  To receive notice of all disclosures of the personal health information

15. 15 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Notice of Privacy Practices  Patients should receive a copy of the facility’s Notice of Privacy Practices.  Notice must also be displayed prominently in the office.  Notice of Privacy Practices is developed by the individual facilities.

16. 16 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Notice of Privacy Practices Must include:  How PHI is used by the facility  Duties of the provider to protect PHI  Patient rights regarding PHI  How complaints can be filed  Who to contact at the facility with questions  Effective date of the NPP

17. 17 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Receipt of Notice of Privacy Practices  Patients should be given a copy of the NPP.  They should be asked to sign a document stating that they received the NPP.  If they refuse to sign, document the refusal to prove due diligence.

18. 18 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Signing the NPP  Most patients will sign the document.  Always explain the document to the patient; do not expect the patient to sign it blindly.

19. 19 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Signing the NPP

20. 20 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Access PHI  Patients are allowed access to their PHI.  Maker owns the record.  Patient owns the information contained in the record.  Patients have the right to a copy of their PHI.  Providers may charge a reasonable fee for copies of records.

21. 21 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Request Restrictions on PHI  Patients can request restrictions on the release of their PHI.  Providers do not have to honor the request but must review it and give a good reason for not honoring the request.  Have an appeal process in place for instances in which the provider does not wish to honor the request.

22. 22 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Request Confidential Communications  Patients can express where they wish to receive communications from the provider.  Providers must accommodate reasonable requests.  Make certain the preferred method of communication is used when contacting patients, whether it be cell or home phone, email, or work phone.

23. 23 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Amendment of PHI  Patients can request changes to their PHI if they inspect it and find an error.  Requests must be in writing.  Providers must review requests and act on them within 60 days.

24. 24 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Amendment of PHI

25. 25 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Denying Amendment Requests  Providers may deny the request for amendment if they were not the creator of the record.  Providers may also deny the request if they believe the record to be accurate and complete.  A review process must be in place to consider such requests.

26. 26 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Right to Receive Accounting of PHI Disclosures  Patients may request an accounting of all disclosures of their PHI.  They are entitled to receive one accounting annually without charge.  A reasonable fee may be charged for additional accountings.

27. 27 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Responsibilities of Providers HIPAA requires providers or health plans to:  Notify patients of their privacy rights  Explain how patients’ health information might be used  Develop privacy procedures in the facility  Implement those procedures

28. 28 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Responsibilities of Providers  Train employees so that they understand the procedures in place.  Designate an individual to be responsible for implementation.  Secure medical records so that they are not available to those who do not need them.

29. 29 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Permission to Disclose PHI Once the patient has signed the NPP, the physician can disclose information, but only as described on the NPP.

30. 30 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Conflicting Permissions  When permissions conflict, first attempt to contact the patient for directions.  If the patient cannot be reached, adhere to the most restrictive request.  Always document patient instructions in writing in such situations.

31. 31 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Identifying the Patient Follow the office policy regarding the types of identification acceptable for patient identification. Usual forms of ID  state-issued driver’s license or ID card  military ID  student ID

32. 32 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Incidental Disclosures A secondary use or disclosure of PHI that cannot reasonably be prevented, is limited in nature, and occurs as a result of another use or disclosure that is permitted.

33. 33 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Incidental Disclosures Incidental disclosures could include:  Confidential conversations between providers or with patients  Seeing patient names when signing in  Unauthorized persons walking by medical equipment and seeing a name on a screen or other device

34. 34 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Incidental Disclosures  Physicians speaking with patients in semiprivate hospital rooms  Healthcare staff orally coordinating patient care services at a nurse’s station or central location within an office  Pharmacist discussing a patient on the phone when another person is standing nearby

35. 35 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Points to Remember  Place medical records in chart holders such that the patient’s name cannot be seen when individuals walk through hallways.  The medical assistant is allowed to call a patient’s name in the reception area when it is time to see the physician.

36. 36 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Children's Health Records In most cases parents are considered the personal representative of children and can view medical records.

37. 37 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Parents are not considered the child’s representative when:  the minor is the one who consents to care and the consent of the parent is not required under state law  the minor obtains care at the direction of a court or a person appointed by the court  the parent agrees that the minor and healthcare provider can have a confidential relationship Children's Health Records

38. 38 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Friends and Family If the provider can reasonably infer, based on professional judgment, that the patient does not object, information can be shared with friends and family. The patient can always specifically exclude a person from obtaining PHI. This should be expressed in writing.

39. 39 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Telephone Messages and Faxes  Make certain that the patient’s preferred method of communication is being used.  Use reasonable care when using these communication methods.  Fax machines should be located in secure areas.

40. 40 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Emergencies  A Notice of Privacy Practices does not have to be signed by a patient when he or she is receiving emergency care.  The facility or provider should attempt to give the patient the NPP as soon as it is practical once the emergency is under control.

41. 41 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Complaints about Privacy Violations  Complaints should be directed to the Privacy Officer at the facility.  If not resolved, the patient has the option to file a written complaint with the Office of Civil Rights (OCR).  Complaints must be filed within 180 days from the point that the complainant knew about the violation.

42. 42 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Summary of Scenario  Only discuss patients with those who are involved in the patient’s care directly.  Breach of patient confidentiality can lead to probation and/or termination of employment and litigation.  Help the patient understand privacy policies and how they benefit the patient.

43. 43 Copyright © 2011, 2007, 2003, 1999 by Saunders, an imprint of Elsevier Inc. All rights reserved. Closing Comments  Be aware of the policies that affect patient privacy.  Understand the HIPAA rules.  If uncertain, ask a supervisor.  Always check the medical record to determine patient preferences.