1. Protecting Students’ Personal Health Information What Everyone Needs to Know 1

2. Outline Personally Identifiable Information (PII) HIPAA and the Privacy Rule Sharing and handling private information Documentation and safeguards Scenarios Who is responsible? 2

3. Personally Identifiable Information (PII) Name Date of Birth Social security number Photo/x-ray/video Fingerprint/voiceprint Mother’s maiden name Address Phone numbers Medical record numbers Legal documents Medical notes Email address Educational records PII = information from which a person’s identity is apparent, or can reasonably be ascertained 3

4. Handling PII in Job Corps Among other requirements, Job Corps requires that: – PII must be stored within CDSS – All incidents involving PII must be reported within 1 hour to the Job Corps Technical Assistance Center (TAC) – Health and counseling records be secured in a lock file cabinet Refer to program instructions for more information 4

5. HIPAA and the Privacy Rule 5

6. What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 was enacted by Congress and signed by President Clinton. The Act is made up of: Title I (Portability) of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs Title II (Accountability) of HIPAA, known as the Privacy Rule, deals with health information privacy 6

7. What is the Privacy Rule? The Privacy Rule, a Federal law, gives patients rights over their health information and sets rules and limits on who can view protected health information The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral The Security Rule, a Federal law that protects health information in electronic form, requires entities covered by HIPAA to ensure that health information is secure 7

8. The Privacy Rule and Job Corps Under the Privacy Rule – – Job Corps’ Health and Wellness Centers are considered “covered entities” – Job Corps is subject to imposed penalties if the rule is violated 8

9. Protected Health Information (PHI) Protects all “individually identifiable health information”; referred to as PHI Includes: – Demographic data – Individual’s past, present, or future physical or mental health condition – The provision of health care to the individual – The past, present, or future payment for the provision of health care to the individual Source: U.S. Department of Health and Human Services. (2010). Summary of HIPAA Privacy Rule. http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html 9

10. Sharing and Handling Personal Information: The Need to Know 10

11. The “Need to Know” HIPAA does not block the communication of information on a “need to know” basis on center The minimal necessary amount of information about a student’s health or disability may be shared with staff if this information is vital for staff to successfully assist students and to perform their job duties Information must be shared for the safety and security of students or staff and to protect centers from liability 11

12. Sharing PHI with Center Staff Often, staff outside of the Health and Wellness Center need to know a student’s diagnosis A student’s medical information should be focused on behavior or symptoms and not a medical diagnosis Sometimes it’s okay to share common diagnoses after talking with the student; case-by case basis Information should only be shared if a particular staff member must know the information to successfully assist students and perform his or her job duties 12

13. Scenario Entry lab results indicate one of the new students is HIV positive. Which staff has a need to know about this student’s lab results? 13

14. Who Needs to Know? StaffNeed to know about… CounselorsInformation from the Social Intake Form (SIF); some mental health information TEAP SpecialistInformation from the SIF, drug screen results, mental health records in case where co-occurring disorders are suspected Mental Health StaffMental health history, information from the SIF, some medical/oral health issues, alcohol and drug information Residential Living StaffAllergies (over the counter medication, food, bee sting), healthy evening snack needs, inhalers or nebulizers for shortness of breath, restrictions related to injuries, students who require medications, symptoms or complications related to a procedure, specific behaviors 14

15. Who Needs to Know? StaffNeed to know about… Food Service ManagerDietary needs, including food allergies, students requiring an evening health snack (diabetic or pregnancy related) Center Standards Incentive Officer Positive drug screens Recreational StaffBee sting allergies, students using an inhaler for exercise-induced breathing difficulties, students on restrictions related to injuries 15

16. Who Needs to Know? StaffNeed to know about… Student Records and Data Management Staff Student leave or medical separations All Staff Access to view accommodation plans in CIS, but not have access to the IEP or the disability records, unless the student specifically gives written authorization DOL Personnel or Contractors Information as requested for the purposes of resolving grievances or conducting audits/assessments Center Director Access to everything 16

17. Staff Do Not Need to Know HIV and Hepatitis B results – All blood and body fluids should be treated like they are contaminated – universal precautions Drug screen results Why students are taking medications Which students have mental health problems 17

18. The Privacy Rule and CIS Protected Health Information (PHI) should not be put into the CIS unless there is a specific reason that every single staff person needs to know that information Accommodations should be put into CIS, but a medical diagnosis reference to the IEP should not be included 18

19. Transmission of Medical Information Any and all records that are health or disability related, or that contain any of those types of information, must be kept separate from other records about the individual If hard copies are transmitted, health or disability information should be placed in a separate file. That file should be placed in a sealed envelope that is clearly marked as containing such information Additionally, diagnoses should not be included in significant incident reports (SIRs) 19

20. Scenario Shawn, a Job Corps student, is waiting in line in the cafeteria. He overhears two staff members talking about placing a student named Mike on medical leave for a doctor’s appointment, medical tests, and a refill on medication. What went wrong in this situation? 20

21. Oral Transmission Keep in mind that the confidentiality of medical, health, and disability-related information must be maintained when the information is being transmitted orally – in other words, when it is being discussed aloud This means that you must be sure that all such discussions take place in private locations where unauthorized persons cannot overhear the conversation, either voluntarily or involuntarily 21

22. Scenario You are a counselor. You have been working with Kateri, a 16-year-old female student. Kateri’s mother calls and asks if Kateri has a STI and if she is pregnant. Kateri’s mother reminds you that her daughter is a minor. (Kateri had just visited your office crying because she found out she is pregnant and was diagnosed with a STI.) 22

23. Students and Parents Student may: – Access, inspect, and copy medical records according to the HIPAA Notice – Request that information be changed if it is incorrect or incomplete If student is under 18, parents/legal guardians may: – Submit a written request to revoke the Authorization; however, a revocation may result in a separation – Have access to records unless prohibited by state laws 23

24. Sharing Information Off Site Information may be shared with some organizations outside of Job Corps, including: – The department of health – Government or law enforcement authorities – A coroner or medical examiner – Law enforcement officials may have access in certain situations – Workers’ compensation insurers or agencies – Outside medical providers or hospitals to pay medical bills Link to more information: http://www.hhs.gov/ocr/privacy/hipaa/understandin g/summary/index.html http://www.hhs.gov/ocr/privacy/hipaa/understandin g/summary/index.html 24

25. Scenario You are the CMHC and Maria has not come for her scheduled appointment. You have a busy afternoon and ask another student to go to the classroom to get Maria. 25

26. Scenario The Health and Wellness Manager has students deliver passes signifying that a student has an appointment in the wellness center. The passes do not give a reason for the appointment and do not specify who the student will see. 26

27. Scenario The center driver is late picking a student up from an off-center appointment. When he gets back, the Health and Wellness Center is closed. The driver takes the student’s health record and prescription medication and lays both items on the security manager’s desk. What should have occurred? 27

28. Scenario You are attending an annual Bloodborne Pathogen Training. The nurse who is conducting the training says, “This is especially important because we have an HIV- positive student on center.” What are the potential ramifications of this statement? 28

29. Scenario At an assembly, the Center Director offers congratulations to all students who have successfully completed the TEAP program. He reads off their names and asks each student to stand to be recognized. Is this a HIPAA violation? Why or why not? 29

30. Scenario You are an RA. Recently, you received a memo from the Health and Wellness Center asking you to keep an eye out for any odd behaviors from Darrell, a student in your dormitory. You enlist the help of Darrell's roommate, Ben. You tell Ben to let you know if Darrell does anything out of the ordinary. How could this have been handled better? 30

31. Scenario You are the Outreach and Admissions Counselor and your supervisor has instructed you to review all medical records received for completeness. How should you handle this situation? 31

32. Documentation and Safeguards 32

33. HIPAA Authorization Job Corps requires applicants or legal guardians to sign the HIPAA Authorization as a condition of enrollment prior to the applicant arriving on center – Authorization informs applicants how, to whom, and why their health information will be shared – Complete Authorization should be in the student health record – The student may revoke his/her Authorization at any time; however, this action may result in the student's separation from the program A Supplemental Authorization must be completed for disclosure of protected health information not covered in the Authorization 33

34. Notice Describes how medical information may be used and disclosed without consent, and how to obtain access to this information Is given to students on their first visit to the Health and Wellness Center Is sent to the parent or legal guardian of those students under the 18 Is placed in the student health record 34

35. Notice A copy of the Notice must be posted in the Health and Wellness areas and in off-center areas of center health providers, such as doctor, mental health consultant, and dentist offices The Notice should have the name of the Privacy Officer 35

36. Privacy and Complaint Officers Center Director should designate a: – Privacy Officer, who is responsible for reviewing policies and procedures regarding the Privacy Rule – Complaint Officer, who is responsible for receiving complaints alleging privacy violations The Privacy Officer and the Complaint Officer should not be the same person. 36

37. Scenario A nurse was going on vacation and wanted to brief the Health and Wellness Manager about a student's visit to the Health and Wellness Center that day. She drafted a quick email and in her haste to leave for vacation, she sent the email to the entire center distribution list. What should happen next? 37

38. Who is Responsible? 38

39. Center Director Responsibilities Ensure that the Privacy Rule is enforced Designate a Privacy Officer and Complaint Officer Ensure that ALL students on center have a Notice and signed Authorization in their medical record Review and grant written requests to revoke the HIPAA Authorization 39

40. Outreach and Admissions Responsibilities Have the applicant or parent/legal guardian sign the Authorization Provide the applicant a copy of the signed Authorization Forward the Authorization to the receiving center prior to the applicant’s arrival. If the center does not have the Authorization, departure must be delayed 40

41. Health and Wellness Responsibilities Post the Notice in the Health and Wellness Center Have the Center Physician, Center Mental Health Consultant, and Center Dentist post the Notice, if services are provided off center Develop center/standard operating procedures (COPs/SOPs) regarding the Privacy Rule 41

42. Health and Wellness Responsibilities Give and explain the Notice to the student during the student’s first visit to the Health and Wellness Center; make additional copies of the Notice available for student requests Send a copy to the parent/legal guardian for students under the age of 18 and request that the Notice be returned signed. However, a signature is not mandatory. If a signed Notice is not received, document in the health record that the Notice was sent to the parent or legal guardian 42

43. Summary Federal Law enacted by Congress to protect the privacy of patients’ medical records Information is disclosed only to staff that have a need to know Transmission, storage, and confidentiality of protected health information must be safeguarded 43

44. Information Notices Job Corps Program Instruction 05-26—Survey of Computer Systems Containing Personally Identifiable Information (PII) Job Corps Program Instruction 06-08—Use of Computer Applications Containing Job Corps Students PII Job Corps Program Instruction 06-13—Reporting Incidents Involving Job Corps Students’ PII Job Corps Program Instruction 06-23– Guidance on Safekeeping of Forms, Records, and Other Hardcopy Documents Containing PII 44

45. Resources Health and Human Services HIPAA website http://www.hhs.gov/ocr/hipaa/ http://www.hhs.gov/ocr/hipaa/ HIPAA Violations and Enforcement http://www.ama-assn.org/ama/pub/physician- resources/solutions-managing-your-practice/coding-billing- insurance/hipaahealth-insurance-portability-accountability- act/hipaa-violations-enforcement.shtml 45 CFR § 164.508 Job Corps Community Website—Health and Wellness—HIPAA PRH Appendix 601—Student Rights to Privacy and Disclosure of Information PRH Appendix 607—Transmission, Storage, and Confidentiality of Medical, Health, and Disability-Related Information 45