Hipaa privacy and Security Community Health NetworK, Inc. On-Line Mandatory Training

Objectives of Training HIPAA Fundamentals Privacy Rule Basics Security Rule Basics Security Components Security Policies and Procedures Instructions: On-line mandatory training

What does HIPAA stand for? Health Insurance Portability Accountability Act

Hipaa Policies CHN has 25 policies that relate to HIPAA they can be found on the CHN Intranet. CHN HIPAA policies are updated on an ongoing basis in order to satisfy changing compliance requirements and industry best practice. “Policies & Procedures” – Section 20 – Information Technology “CHN Manuals & General Info – HIPAA” “Policies & Procedures” – Section 37 – Corporate Compliance

HIPAA overview HIPAA originally passed in 1996 and finalized in January of 2013. The Rule is meant to: Standardize Records- Transaction coding and compliance more simple thereby saving money in the long-term. Provide Portability- Allows for easy transfer of medical information. Promote Accountability- The responsibility piece, keeping the information private and secure. Within HIPAA there are two rules that we need to comply with: The Privacy Rule The Security Rule

HIPAA: Privacy rule Privacy Rule: Restricts what information can be disclosed and who should have access to it. Specifically in relation to: Individually Identifiable Information Protected Health Information (PHI)

Hipaa: Privacy Rule Individually Identifiable Information: A subset of health information, created or received by a Covered Entity, like CHN, relating to a condition, treatment, or payment which could be used to identify a client. Any information that can be traced back to a specific person is then considered Individually Identifiable Information.

Hipaa: Privacy Rule Protected Health Information (PHI): Any health or individually identifiable information given to a covered Entity, like CHN, whether verbal, written or electronic needs to remain confidential. This includes information that can connect the patient to the medical record: Name Address Social Security Number & Other ID Numbers Medical Record Number (MRN) Physician’s Notes Billing Information

HIPAA: Privacy Rule Covered Entity: Any health plan, clearinghouse, or provider who transmits health information (CHN). Covered entities MUST: Allow patients to see and receive copies of their PHI and do so electronically. Designate a Privacy Officer and a means to contact him/her. Develop a Notice of Privacy Practice document for patients. Provide training to new employees and affiliates. Develop and utilize a complaints process. Ensure Business Associates also comply with the privacy regulations.

Hipaa: Privacy rule Business Associate: A person or organization that performs a function on behalf of a Covered Entity using individually identifiable information. Business Associates are required to sign a Business Associate Agreement. If the Business Associate should need to share information with another organization or subcontractor they must continue the same process of establishing the Business Associate Agreement. The chain on private information cannot be broken. Patients can file a grievance if they think their rights have been violated.

Hipaa: Privacy Rule Corrective action for HIPAA Privacy violation: CHN has a ZERO TOLERANCE POLICY for non-compliance in relation to Privacy Breaches, the non-compliant individual will be immediately dismissed. Violations of a severe nature may result in notification to law enforcement officials as well as regulating, accrediting, and/or licensing organizations.

HiPAA: PRIVACY OFFICER Privacy Officer-Director of Health Info Services Develops a Notice of Privacy Practice document. Investigates complaints and violations related to Privacy Breaches. Works with Compliance Officer to make sure Business Associates also comply with the privacy ruling. Ensures CHN and it’s employees are compliant in regards to the privacy rule. Ensures privacy standards comply with statutory and regulatory requirements. Maintains HIPAA privacy policies and procedures.

Hipaa: Security Rule Ensures that electronic information is kept private. Four Requirements of Security: Ensures confidentiality, integrity, and availability of electronic PHI. Protects against possible threats and hazards to the information. Hackers, viruses, natural disasters or system failures. Protects against unauthorized uses or disclosures. Ensures compliance by the workforce through security regulations and policies/procedures. Three Components of Security: Administrative Safeguards Physical Safeguards Technical Safeguards

HIPAA: Security Rule Administrative Safeguards: Documentation kept for 6 years. Corrective action for HIPAA security violation: Violations of a severe nature may result in notification to law enforcement officials as well as regulating, accrediting, and/or licensing organizations. Internal system audits minimize security violations. Logins, file accesses, and or security incidents. Information access management: Access to PHI based on what is needed to preform the job. Once computer access is requested, it will take 48-72 hours to implement due to complexity of security system. Security awareness and training: Security updates, incident reporting, log-in, and password management. Security incidents will be reported if suspected or if there is an actual breach. Name and phone number of person reporting the incident Date and time the incident was discovered Observed behaviors that led to the incident being suspected Any unusual circumstances surrounding the event

Hipaa: Security Rule Physical Safeguards: Safeguard the facility and equipment, from unauthorized physical access, tampering, and theft. Workstations positioned so monitor screens/ keyboards are not directly visible to unauthorized persons. Use of privacy screens when applicable. Physical access to the server room limited to key IT personnel. Staff complies with appropriate workstation access/use. Log on as themselves. Log off prior to leaving the workstation. Comply with all applicable password policies and procedures. Close files not in use.

Hipaa: Security Rule Physical Safeguards (Continued): Exercise caution when saving any files that may contain PHI or proprietary business information: Avoid saving such information whenever possible. If files containing EPHI must be saved, only store on CHN shared drives. NEVER save files containing EPHI or proprietary business information to a flash drive, laptop, or local PC harddrive If you have questions, or would like assistance properly securing files, please call the IT helpdesk (x6600) Report any concerns regarding data security to CHN’s IT Security Officer, Privacy Officer, or The Corporate Compliance Officer.

HIPAA: Security Rule Technical Safeguards: Access controls: User password setup is for one-time use initially. Allowing the individual to choose their own unique password for future access. User passwords reset every 180 days. Citrix sessions automatically close after 60 minutes of inactivity. Electronic “patient charts” will automatically close at different intervals depending on place within the program. Initial log-on screens close within seconds of inactivity. Screens further into specific modules, close and back up to the previous screen, ranging from seconds to minutes of inactivity. No downloading to laptops, tablets, or PC’s.

Hipaa security officer Security Officer- IT Manager Maintains appropriate security measures to guard against unauthorized access to electronically stored and/or transmitted patient data and protect against reasonably anticipated threats and hazards. Oversees and/or performs on-going security monitoring of organization information systems. Ensures compliance through adequate training programs and periodic security audits. Ensures security standards comply with statutory and regulatory requirements. Maintains HIPAA security policies and procedures.

Hipaa: Corporate Compliance HIPAA regulations are also overseen by the Corporate Compliance Officer as part of the CHN Corporate Compliance Plan. The Corporate Compliance Officer works with both the Privacy and Security Officer to ensure processes are in place to maintain compliance with HIPAA regulations. The Corporate Compliance Officer aids both the Privacy and Security Officer in investigating actual or suspected HIPAA violations. Privacy and Security breaches can be reported to the Corporate Compliance Officer

Hipaa violations Significant issues beyond CHN jurisdiction can be reported to : Centers for Medicare & Medicaid Services (CMS) Office for Civil Rights (OCR) Department of Justice (DOJ) Attorney General HIPAA violations can and do result in civil and criminal penalties, which could be faced individually : May range from a $100 civil penalty up to a maximum of $1,000,000 per year for each standard violated. May become a criminal penalty for knowingly disclosing PHI, a penalty that could escalate to a maximum of $25,000 for visibly malice offenses.

Who is responsible for HIPaa? EVERYONE at CHN (including our affiliates) has an obligation to maintain privacy and security, for example: IT Managers/Staff: Implement safeguards for the computer systems. Medical Professionals: Create and access the majority of patient information. Managers and Supervisors: Develop and implement policies and procedures that relate to security and ensure their staff are trained properly. Clerical Staff: Create and access patient information. Volunteers: Have access to patient information in various setting such as lobbies and waiting rooms.

Tips for Hipaa compliance Log on and off the network appropriately. Never let others use your ID or work under your ID. Do NOT write your password down. Do NOT disable anti-virus software or install unapproved software. Never introduce new hardware or media. E-mail may be, but is not always, a secure form of data transmission. Do NOT e-mail PHI outside of CHN unless entering “@encrypt” in the subject line to send encrypted. Only access PHI if you need it to preform your job. Be aware of, and report, security threats to the Security Officer. Put security safeguards on your mobile devices. Be careful and aware of who is around you when PHI is being discussed. Report lost or stolen laptops, tablets, or cell phones ASAP.

Following the presentation Be sure to complete the two required forms as documentation of completion. Successful completion of this on-line mandatory training is required to receive your computer access privileges. CHN HIPAA Security Quiz Policy – Internet/Intranet Acceptable Use **Complete both items and return them to the applicable Department (HR or Education) PRIOR to your first day.**