Surveillance TRICARE Management Activity HEALTH AFFAIRS 2009 Data Protection Seminar TMA Privacy Office

Surveillance TRICARE Management Activity HEALTH AFFAIRS

TRICARE Management Activity HEALTH AFFAIRS 3 Surveillance Purpose The purpose of this presentation is to introduce the TRICARE Management Activity (TMA) Privacy Office Surveillance Assist Visit Program and illustrate how an assist visit can highlight the significance of privacy and the protection of Personally Identifiable Information (PII) and Protected Health Information (PHI)

TRICARE Management Activity HEALTH AFFAIRS 4 Surveillance Objectives Upon completion of this course, you should be able to: − Describe the TMA Privacy Office Surveillance Assist Visit Program − Determine how a TMA Privacy Office Surveillance Assist Visit can help your organization identify opportunities for improvement in complying with the Privacy Act of 1974 and Health Insurance Portability and Accountability Act of 1996 (HIPAA) requirements − Identify how to request a TMA Privacy Office Surveillance Assist Visit

TRICARE Management Activity HEALTH AFFAIRS 5 Surveillance Overview New program developed under the direction of the TMA Deputy Director and Privacy Officer Provide assistance to the organization in assessing compliance with the Privacy Act and HIPAA requirements Organizations that may request an assist visit − TMA − TRICARE Area Offices − TRICARE Regional Offices

TRICARE Management Activity HEALTH AFFAIRS 6 Surveillance What is Surveillance? An Assist Visit − Offers objective review of Privacy Act/HIPAA procedures and practices − Sheds light on the functions and purposes of the TMA Privacy Office

TRICARE Management Activity HEALTH AFFAIRS 7 Surveillance What is Surveillance? (continued) An Assist Visit − Educates on policies, instructions, guidelines, and departmental and federal regulations governing privacy

TRICARE Management Activity HEALTH AFFAIRS 8 Surveillance What is Surveillance? (continued) An Assist Visit − Assists in formulating ways to improve Privacy Act/HIPAA practices

TRICARE Management Activity HEALTH AFFAIRS 9 Surveillance What is Surveillance? (continued) Components of an Assist Visit − Review By gathering information By assessing current privacy practices for baseline − Identify Weaknesses Opportunities for improvement Best practices − Prevent By education By process improvement By routine maintenance

TRICARE Management Activity HEALTH AFFAIRS 10 REVIEW IDENTIFY ASSIST VISIT Surveillance Dynamics of Surveillance

TRICARE Management Activity HEALTH AFFAIRS 11 Surveillance Outcome Ideal outcome − Educated, Privacy Act/HIPAA-savvy members of the organization − Business functions are not disrupted by unfortunate events − Healthcare runs smoothly without protests/questions Acceptable outcome − Organizational awareness and education − Organization meets obligations as defined by regulations

TRICARE Management Activity HEALTH AFFAIRS 12 Surveillance Group Activity

TRICARE Management Activity HEALTH AFFAIRS 13 Surveillance Group Activity George Clooney Barack Obama Britney Spears

TRICARE Management Activity HEALTH AFFAIRS 14 Surveillance Summary You should now be able to: − Describe the TMA Privacy Office Surveillance Assist Visit Program − Determine how a TMA Privacy Office Assist Visit can help your organization identify opportunities for improvement in complying with Privacy Act/HIPAA requirements − Identify how to request a TMA Privacy Office Assist Visit

TRICARE Management Activity HEALTH AFFAIRS 15 Surveillance Summary - Who Benefits?

TRICARE Management Activity HEALTH AFFAIRS 16 Surveillance Summary - Who Benefits? (continued) Jane Doe

TRICARE Management Activity HEALTH AFFAIRS 17 REVIEW IDENTIFY PREVENT Surveillance The Road to Compliance REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT REVIEW IDENTIFY PREVENT

TRICARE Management Activity HEALTH AFFAIRS 18 Surveillance Resources DoD R, “DoD Health Information Privacy Regulation”, January 2003 DoD R, “Department of Defense Privacy Program”, May 2007 DoD R, “DoD Health Information Security Regulation”, July to subscribe to the TMA Privacy Office E-News for subject matter questions “TMA Facsimile Transmission Policy for Documents Containing Personally Identifiable Information and/or Protected Health Information (PII/PHI)”, April 9, 2008