1. HIPAA Certified LLC www.HIPAAcertified.com 1 6th National HIPAA Summit JCAHO and NCQA and HIPAA Business Associates Friday, March 28, 2003

2. HIPAA Certified LLC www.HIPAAcertified.com 2 The Players Sue Miller, Moderator –HIPAA Certified LLC –Co-chair WEDI SNIP SPWG –Chair Advisory Committee, NCQA, Business Associate Privacy Certification Program Patricia Pergal, JD, Director Program Compliance, NCQA Anthony J. Tirone, JD, Director, Federal Relations, JCAHO

3. HIPAA Certified LLC www.HIPAAcertified.com 3 What is HIPAA ? Health Insurance Portability and Accountability ActHealth Insurance Portability and Accountability Act –aka “Kennedy-Kassebaum Act” –Adopted August 21, 1996

4. HIPAA Certified LLC www.HIPAAcertified.com 4 Why HIPAA ? Improve efficiency and effectiveness of healthcare through standardization of all shared electronic informationImprove efficiency and effectiveness of healthcare through standardization of all shared electronic information Protect the privacy and security of patient information stored and exchanged electronicallyProtect the privacy and security of patient information stored and exchanged electronically Reduce the cost of exchanging information among healthcare partnersReduce the cost of exchanging information among healthcare partners

5. HIPAA Certified LLC www.HIPAAcertified.com 5 What does HIPAA apply to? Health Insurance PortabilityHealth Insurance Portability Standards for Electronic Claims SubmissionStandards for Electronic Claims Submission Privacy and Security ProtectionPrivacy and Security Protection

6. HIPAA Certified LLC www.HIPAAcertified.com 6 Who does HIPAA apply to? Applies to Covered EntitiesApplies to Covered Entities –Health care providers who transmit any health information in electronic form –Health plans –Health care clearinghouses

7. HIPAA Certified LLC www.HIPAAcertified.com 7 HIPAAeze (speak the language) PHI – Protected Health Information = demographic, clinical & financial information –medical record –x-rays –insurance information –demographic intake sheets –transmitted by, maintained in electronic media –transmitted by, maintained in any other form or medium

8. HIPAA Certified LLC www.HIPAAcertified.com 8 HIPAAeze (speak the language) CE – Covered Entity = Doctor, Dentist, Hospital BA – Business Associate = Accountant P&P – Policies & Procedures = staff rules and practices NPP – Notice of Privacy Practices = how use PHI TPO – Treatment, payment & health care operations

9. HIPAA Certified LLC www.HIPAAcertified.com 9 When did HIPAA Happen? Transaction and code sets published August 17, 2000 –Effective Date Transaction and Code Sets October, 2002 –With Extension Implementation date: October 2003 Privacy Rule published December 28, 2000 –August 14, 2002 PMFR –Implementation date: Privacy Rules April 14, 2003

10. HIPAA Certified LLC www.HIPAAcertified.com 10 When did HIPAA Happen? Data Security published February 20, 2003 –Implementation date: April 21, 2005 National Employer Identifier published May 31, 2002 –Implementation date: July 30, 2002

11. HIPAA Certified LLC www.HIPAAcertified.com 11 Yet to Come Claims AttachmentsClaims Attachments Unique IdentifiersUnique Identifiers –National Provider Identifier (NPI) –Health Plan Identifier EnforcementEnforcement

12. HIPAA Certified LLC www.HIPAAcertified.com 12 HIPAA Covers PaperPaper OralOral Electronic TransmissionsElectronic Transmissions

13. HIPAA Certified LLC www.HIPAAcertified.com 13 HIPAA Privacy Penalties Civil –Not more than $100 for each violation –No more than $25,000 for all violations of identical type during calendar year –“Loss of reputation”

14. HIPAA Certified LLC www.HIPAAcertified.com 14 HIPAA Privacy Penalties Criminal Improper use of unique health identifiers,Improper use of unique health identifiers, or or Improperly obtaining or disclosing individual health information areImproperly obtaining or disclosing individual health information are –subject to maximum of both: Knowingly $ 50,000 1 yearKnowingly $ 50,000 1 year False pretenses $100,000 5 yearsFalse pretenses $100,000 5 years For profit, gain or harm $250,000 10 yearsFor profit, gain or harm $250,000 10 years

15. HIPAA Certified LLC www.HIPAAcertified.com 15 Business Associate Definition Does a CE functionDoes a CE function Does a function per privacy regulationDoes a function per privacy regulation Other than workforceOther than workforce –lawyer –data aggregator

16. HIPAA Certified LLC www.HIPAAcertified.com 16 Disclosures to Business Associate A covered entity may disclose PHI to a business associate with documentation of satisfactory assurances by written contract

17. HIPAA Certified LLC www.HIPAAcertified.com 17 Business Associate Contract PMFR: sample business associate contract provisionsPMFR: sample business associate contract provisions Make available PHI per 164.524, 164.526, 164.528Make available PHI per 164.524, 164.526, 164.528 Internal books and records open for reviewInternal books and records open for review Termination of contractTermination of contract

18. HIPAA Certified LLC www.HIPAAcertified.com 18 WARNING: Dangerous HIPAA! Please Keep Her Quiet By Keeping All Health Information Confidential