1. Top Compliance Topics

2. Course Objective
When completed the employee will have an understanding of the top ten compliance topics facing GHS health care workers today.

3. Top Ten Compliance Topics
Code of Excellence
Conflict of Interest Process
Government Inquiry – Guidance Document
Research Compliance and Publications
HIPAA – Privacy and Security
HIPAA – Social Media and Texting
Unencrypted
EPIC –Auditing and Break the Glass
EPIC – Use of My Chart
Medical Identity Theft

4. Code of Excellence* ● Reflects our Mission, Vision and Values
● Crucial part of GHS Compliance Program’s Plan
● Explains important Laws, Rules, and Regulations
● Describes acceptable behaviors
● Discusses Conflicts of Interest; especially in research (Clinical Trials)
● Allows for non-retaliation of good faith reporting of:
Suspected wrong doing
Policy violations
● Hotline Reporting (Anonymously if needed)
* Available for review after presentation

5. Conflict of Interest Process
Applies to all GHS Employees including Physicians
Requires disclosure of personal interests that may be counter to the best interests of GHS
Discloses financial as well as business/vendor relationship interests
Applies to Researchers (Principal Investigators) who have a financial interest in the outcome of a research study
Disclosures remove the appearance of outside influence on decision-making practices
All disclosures are reviewed by the GHS Conflict of Interest Committee and follow-up is required.
For Physicians review includes Open Payment review

6. Government Inquiry – Guidance Document*
What to do if a government agent appears at your place of work…
Be Polite and Courteous
Ask for Identification
Minimize disruption to your work area
Notify your Supervisor so she/he can make reasonable inquiry
Is their a subpoena / search warrant / other documentation?
There should always be accompanying documentation (prior to release of any GHS information)
What is the specific purpose of the visit / Does it make sense?
Contact the GHS Office of Corporate Integrity, Risk Management or Legal Affairs Department
See Guidance Document* for physician practices
* Available for review after presentation

7. Research Compliance and Publication
Sharing data is encouraged to benefit patients, investigators, and the scientific community.
To protect our patients and our institution, the GHS Institutional Review Board (IRB) needs to be informed prior to sharing data.

8. Research Compliance and Publication (cont.)
GHS IRB notification required:
Plan to share data with an outside GHS source (e.g., presentation or publication)
Intent to develop or contribute generalizable knowledge beyond single individual or internal program.
Results do not have to be published or presented to qualify.
Preplanned data collection or analysis (quantitative or qualitative, retrospective or prospective).

9. HIPAA - Privacy and Security
Protected Health Information (PHI) Definition:
Protected Health Information (PHI) is anything that can identify a patient and includes but is not limited to:
Patient Demographics (including DOB, SSN)
Clinical or Health Information
Images or Photographs
Financial Information

10. HIPAA - Privacy and Security (Cont’d)
Tips for Handling Protected Health Information (PHI)
Reasonableness-Don’t Delay Treatment
Patient Care Comes First!
Need-to-Know Principle
Is this information needed to do my job?
Does it meet the Minimum Necessary rule?
Pay Attention to Details
Before you dispose, , fax, mail or deliver PHI (verbal or written) make sure it’s going to the right person and place
Maintain Reasonable Safeguards
Protect your device, your login, and any patient documents

11. HIPAA – Social Media
Social Media
Do Not Discuss patients or any aspect of patient care or our patient population on ANY social media site
Patients or Family/Visitors may NOT be photographed or videoed without a signed written authorization for purposes other than treatment, payment or operations

12. Texting PHI Text Messages are NOT secure
HIPAA –Texting
Texting PHI Text Messages are NOT secure
Orders and Identifiable PHI cannot be sent via Text
Photos become part of the EHR (as protected health information)

13. HIPAA – Encryption Email Storage
Any patient or confidential information must be sent using a ghs.org address (external accounts do not meet encryption requirements)!
If you are sending PHI or other confidential information to someone outside of the GHS system, type [GHS Confidential] in subject line prior to sending to their external address
Storage
Files with PHI or other confidential information should only be stored in secure network locations
Do not store any of these documents to your desktop, any mobile storage device (such as flash drives) or to unapproved cloud based applications (such as Google Documents or Drop Box)

14. EPIC – Auditing Break the Glass
All Access into electronic medical information is auditable and is monitored by the Privacy Office
Before accessing a patient’s record, remember the Need to Know and Minimum Necessary Rules.
EPIC – Break the Glass Security Feature
Break the Glass is applied to individual patient accounts or encounters as deemed necessary by a patient’s Care Team, Registration, or the Privacy Office.
Break the Glass offers a warning message to users, outside of the assigned care team, that the record is being monitored and provides an extra layer of security protection for the patient.
You will be required to document a reason for accessing the chart if you encounter a Break the Glass patient record.

15. EPIC – Auditing Bump the Glass
GHS can monitor anyone who attempts to access secure protected health information.
Bump the Glass
Attempting to Access Secure Protected Health Information Inappropriately Can Result in Disciplinary Action.
Before attempting to access a patient’s record, remember the Need to Know and Minimum Necessary Rules.
“Bump” the Glass is monitored for those patients assigned “Break” the Glass status.

16. EPIC – MyChart
As an employee of GHS you may not use your EPIC login to access:
Your own information (clinical, financial or demographics)
Your Friends’ or Family Members’ information (clinical, financial or demographics)
Even if you have their permission, this is a violation of the Minimum Necessary Policy!
You may access your own information by signing up for MyChart. Contact your Primary Care Provider to begin this process.

17. MyChart

18. Medical Identity Theft
Identity Theft is … “fraud committed or attempted using the identifying information of another person without authority”
Recognize-A red flag is a pattern, practice of specific activity that indicates the possible existence of identity theft.
Report suspected attempts or activity to GHS Law Enforcement or the Office of Corporate Integrity

19. Medical Identity Theft
Alerts:
Presenting altered or forged documents for identification
Person signs their name differently than what appears on the documents
Information, such as SSN, already exists in the medical record system under another patient’s name
Social Security number or card appears fictitious, altered or is missing data elements
Collection Agency contacts patient regarding medical debt they do not owe or credit report contains medical notices patient does not recognize