1 Identity Theft Program Procedures Viewing RED FLAGS in the MEDITECH System

2 Policy Statement and Purpose To establish procedures to comply with the Identify Theft Program Policy (the “Program”) for Mount Auburn Hospital (“MAH”) and Mount Auburn Professional Services (“MAPS”) designed to detect, prevent and mitigate identity theft in connection with the opening of a covered account or an existing covered account and to provide for continued administration of the Program

3 Red Flag Rules Section 114 of Fair & Accurate Credit Transaction of 2003 (FACT Act) Requires financial institutions and creditors to develop, implement and administer an Identity Theft Program Hospital falls into “creditor” as we establish accounts and allow “customers” to defer payment.

4 Definitions Identity Theft: Fraud committed or attempted using the identifying information of another person without authority. A Red Flag: A pattern, practice of specific activity that indicates the possible existence of identity theft.

5 Identification of Red Flags Suspicious Documents Suspicious Identifying Information Notices from other sources  Address discrepancy  Law enforcement  Victim of identity theft Please see Identity Theft Program Procedures in the Mt Auburn Administrative Manual for comprehensive list of Red Flags

6 Interviewing the Patient  Whether interviewed by phone or in person, all patients will be asked to verify their personal information as opposed to confirming existing information. For example, a patient will be asked to give their home address instead of being asked if they still reside at the address already in the system.  When interviewing a patient in person, all patients with a Red Flag Alert will be asked to provide a license or some form of picture identification. c) If no picture identification is available, each patent will be asked at least two identifying questions, such as date of birth, social security number, telephone number, etc. The verification questions will be determined by the Director.

7 A Patient with a Red Flag Alert in the MEDITECH Admissions Application A patient with a Red Flag will appear in the Admitting Look Up with an asterisk prefixed to the last name.

8 Patient Registration with Red Flag Pop Up Box appears to identify that the patient has a Red Flag

9 Detection of Red Flags Staff who detect a Red Flag must report their findings to the Department Manager. If the Red Flag identified requires immediate attention, staff are to report the information immediately to their Manager. The Director will monitor the reported Red Flags and respond as appropriate. All Red Flags will be reported to the Director of Health Information Management to be input the Meditech system to alert all staff of a potential flagged account. Each Red Flag Alert should be faxed to x1677 or send via a MOX message to the Director of Health Information Management.  a) If a patients requests information on an account that has a Red Flag Alert attached to it, the staff member will forward the patient to their Manager.

10 HIM Director Inputs Red Flag into Patient’s Record in MEDITCH via Medical Records Application The HIM Director adds VIP “Y” and VIP Comment to the patient’s record. The VIP flag triggers the asterisk to prefix the patient’s last name in the Admitting and B\AR Applications.

11 View Red Flag Status in PCI The Red Flag Demo Recall Information can be viewed in PCI under >Admissions Demographic Data >Patient Demographics NOTE: The asterisk does not appear on the patient’s last name in PCI.

12 Patient Financial Services Can View a Red Flag When Calling up an Account Patient last name prefixed with asterisk

13 V.I.P. Patient List The V.I.P Patient List is run from the Admitting Application. This list will identify all patients that are “Red Flagged” in the MEDITECH System on or after a specified Admission or Service Date.