1. Group 3 Angela, Rachael, Misty, Kayelee, and Krysta

2. What is a Privacy Notice? The privacy notice is really called (NPP), Notice of Privacy Practices. It is a formal document that explains in simple terms – how, when, and why a patient’s medical record may be disclosed. This document answers a lot of questions regarding PHI and the practice’s guide to handling their patient’s PHI.

3. What is the Impact of HIPAA’s Privacy Rule? Notifying patients about their privacy rights and how their personal health information can be used. Adopting and implementing privacy procedures for the practice. Training employees so that they understand the privacy procedures of the practice. Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed. Securing patient records containing personal identifiable health information so that they are not readily available to those who do not need them.

4. What has to be in the Notice of Privacy Practices? It must contain specific language as required by the U.S. Department of Health and Human Services (HHS), typically displayed at the beginning of the notice. “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU (NAME OF PRACTICE) MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO YOUR INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.”

5. The Notice Should Contain: A statement that the office is committed to PHI privacy. Should state that the practice has the right to minor changes or reconsider or alter this notice if the privacy practices change. The office must give detailed examples of how PHI may be used in the practice. The practice must inform the patient of your obligations concerning the use and disclosure of his or her PHI.

6. The Notice Should Contain: The practice must inform the patient of his or her right to:  Receive a copy of the Notice of Privacy Practices  Consent to disclosure of his or her health information  Restrict certain uses and disclosures of his or her PHI  Receive confidential communications  Inspect and copy his or her PHI  Make changes to his or her PHI  An accounting of PHI disclosures for other treatment, payment, and health care operations (TPO)  Complain about alleged privacy violations by the practice to the Health and Human Services

7. The Practice’s Responsibilities To make sure that every patient gets a copy of the Notice of Privacy Practice at their first office visit or if you have made any changes to the notice. Must post the notice in the main office The Notice of Privacy must appear on the practice’s Web site and be downloadable ( If the practice has a Web site ) The practice must get written documentation from the patient that he or she received this notice.

8. Healthcare Requirements Healthcare organizations will be required to address the following four areas as defined by the Department of Health and Human Services (DHHS): Administrative procedures — Procedures for establishing and enforcing security policies Physical safeguards — Safeguards that protect physical computer and network facilities Technical security services — Services that protect, control, and monitor access to health care information Technical security mechanisms — Mechanisms for protecting information and restricting access to data transmitted over networks

9. Administration Procedures Data backup plan Disaster recovery plan Emergency mode operation plan Security reminders Protection from malicious software Log-in monitoring Password management

10. Physical Safeguards Locked doors Signs warning of restricted areas Surveillance Cameras Alarms Property control such as tags and engraving on equipment Personnel controls such as identifications badges Private security service or patrol for the facility

11. Technical Security Services Unique user identification Emergency access procedure Automatic logoff Encryption and decryption Password protection

12. Technical Security Mechanisms Routers, Firewall, and Proxy servers Passwords Cryptography, encryption Antivirus software Security management Process Assigned security responsibility Security awareness training

13. HIPAA Enforcement Follow phone protocols- A medical office must have specific guidelines for what information is given over the phone. Certain individuals, like health insurance reps or family members, might have clearance to be told patient information. But other callers should be given only basic information that does not violate HIPAA.

14. HIPAA Enforcement Protect workstations- A computer should always be locked when the person who uses it is away from the desk. This is to prevent unauthorized use. Protect papers- Documents like medical claims and bills should be turned face down when the person who is responsible for them is away from the desk. The files must be kept in secure containers where they can't be read by someone passing by.

15. HIPAA Enforcement Use HIPAA compliant waste baskets and shredders. Some offices have color-coded trash bins, one set for regular trash like apple cores and gum wrappers, and another covered set of bins for documents. The documents that go in the secure bins get shredded every day. The other trash bins get emptied by cleaning people at night. Educate. A well-informed staff will be more adept at following HIPAA regulations, and they'll know why they're doing it. Conversations about the laws are good, and help to get everybody on the same page.

16. Under What Circumstances Can the Practice Use and Disclose Protected Health Information (PHI)? The practice is permitted to use or disclose PHI:  To the individual.  To carry out treatment, payment, and health care operations (TPO).  Without written authorization but with an opportunity to agree or disagree prior to the use or release  When data is de-identified.  When public good permits the use/disclosure.

17. PHI the Practice is Required to disclose: They are REQUIRED to disclose information:  To avoid a serious threat to your health or safety.  Military and Veterans  Public health risks  Lawsuits and Disputes  Law enforcement  Coroners, Medical Examiners, and Funeral directors  National security and Intelligence activities  Protective services for the President

18. http://www.ouwb.ohiou.edu/hipaa/ohic-oucom/textframe.htm http://indianapainsociety.org/index.php/regs/hipaa-physican- offices http://www.hhs.gov