1. HIPAA (health insurance portability and accountability act)

2. Excluded from HIPAA Privacy Rules Benefits excluded from the HIPAA Privacy Rules are:  Accident-only coverage  Disability Insurance  Worker’s compensation  Liability Insurance  Life Insurance  Leave and Sick Programs  Information gathered for OSHA regulations (Occupational Health and Safety Administration)

3. What is considered Protected Health Information (PHI)? For information to be PHI, it must:  Relate to the past, present, and future physical or mental health condition, the provision of health care, or the payment for health care  Identify, or could reasonably be used to identify, the individual The Privacy Regulations cover PHI that is transmitted or maintained in any form or medium (e.g., electronic, paper, fax, voice mail and oral communications)

4. Examples of PHI Names Social Security Numbers E-mail Addresses Date of Birth License Plate Number Geographic Subdivisions (street address) Telephone Numbers Any unique characteristic or code which will link an individual to their health information

5. Examples of how you will use PHI To enroll employees into the NAF HBP (Aetna and HMO plans) To review an Explanation of Benefits form to help an employee receive payment To examine data in a spreadsheet for overseeing the NAF HBP To review a claims appeal To examine a provider billing

6. Minimum Necessary Standard When you use or disclose PHI, always use the minimal number of unique identifiers or the minimal amount of health information necessary to complete the job or tasking. Example:  When discussing an EOB with Aetna, do not use the employee name or any unique identifier which could link the medical information to the employee (especially over the phone in a public area).

7. When to obtain an individual’s authorization to use PHI Anytime PHI is used outside of TPO, authorized employees must obtain a signed Authorization Form from the individual before releasing only the requested information Example:  The spouse of your employee requests a copy of the employee's PHI from his/her personnel file. The authorized employee in your office can not provide the health-related information to the spouse unless the employee signs an Authorization Form releasing the information.

8. When is an Authorization Form not required? Public health activities related to disease prevention To report victims of abuse, neglect or domestic violence For audits, legal investigations or law enforcement purposes To avert a serious threat to health and safety As authorized by state workers’ compensation laws. When the information has been de-identified and does not link or identify an individual to their health information

9. Ways to Secure PHI Lock, Shred, Destroy, Secure, & Monitor  Lock computer stations, cabinets, disks/files that contain PHI when not in use  Shred documents containing PHI before disposing  Secure your emails using password encryption Use the Minimal Necessary Standard when transmitting PHI through e-mail for TPO purposes  Monitor the fax machine if receiving PHI, Do not leave voicemail messages with PHI, or share PHI if non-authorized employees are present

10. Training Who should take the training?  Anyone that has access to PHI ( including access to PeopleSoft, OPFs, leave donations, FMLA, and workman’s compensation records ) Members of Human Resources, Benefits, HRMS, and Workman’s Compensation Training: http://crossroads/MRG/Pages/HIPAA.aspxhttp://crossroads/MRG/Pages/HIPAA.aspx  Read training, take quiz, & submit to HR  HR should grade, record training in PeopleSoft, and provide a Certificate for the Employee & OPF HR should submit scores & completion date to Carolyn Woodson via Email  Recertified and reported annually (in April)

11. Additional Information Health and Human Services  http://www.hhs.gov/ocr/hipaa http://www.hhs.gov/ocr/hipaa Department of Labor  http://www.dol.gov/ http://www.dol.gov/ HIPAA Procedures Guideline For more information contact Carolyn Woodson  WoodsonCC@usmc-mccs.org WoodsonCC@usmc-mccs.org  703-432-0420  Fax: 703-432-0436