1. Next ETCH Confidentiality and HIPAA Annual Review What you need to know. The Privacy Rule 1

2. NextBack What is HIPAA? Health Insurance Portability and Accountability Act of 1996 (HIPAA). Originally designed to set healthcare industry standards for electronic transmission of data about paying and collecting claims. HIPAA applies to ETCH because we electronically transmit health information. Page 2 of 14

3. NextBack Why HIPAA ? Protects patient privacy Limits how personal health information can be used Lets patients know what their rights are Improves healthcare Standardizes information processing Improves security when transmitting health information Allows patients to… Access health records easily Make corrections to health records Know how their private information is being or may be used Page 3 of 14

4. NextBack The HIPAA Privacy Rule Protection for “individually identifiable health information”. Uses the term Protected Health Information, referred to as PHI PHI is all types of health information that is: electronically transmitted or stored (patient database, patient records or billing information), or in paper form or verbal communications. Failure to follow these rules can result in: Fines for each offense up to $25,000 per year Individual fines or prison time for offending person Page 4 of 14

5. NextBack What is PHI…? PHI is any information that would let somebody identify a patient - written, spoken or electronic. Name, ID #, information about his/her health: – X-rays, lab reports, test results, prescriptions, health insurance claims, billing records, doctors notes, letters Page 5 of 14

6. NextBack More on PHI Information that gives any details about who a person is. Name, all or part of an address, phone or fax #, date of birth, admission or discharge date. Any of those items by themselves might NOT lead to identification of a patient, but when combined together can used for that purpose. Know where PHI can be seen or heard. Nursing stations, room signs, computer monitors, trash, fax, phone or mail. Page 6 of 14

7. NextBack What we do… Tell patients and families about their privacy rights Must be done upon admission Train employees on privacy policy Done at orientation Annual NetL review Make certain patient information stays private Ask if needed in an effort to be certain Safeguarding our computers and access to PHI Directories and computer access to PHI is assigned via job description NEVER share your passwords, keep monitors turned away from public view Log off when leaving a computer Page 7 of 14

8. NextBack Don’t let this happen Page 8 of 14

9. NextBack What we do… Speak quietly or use a private space when verbally passing information. Use only a part of a patient’s name when in public places. Shred documents that may contain PHI. Lock rooms, files when necessary. Knock on patient doors prior to entering, respect a family’s request to leave a door open or closed. Page 9 of 14

10. NextBack Page 10 of 14 Yeah…it’s a real shame. His name is Bobby. His family does not have insurance and they are on government assistance. I hear they filed bankruptcy, and may lose their house. Did you know the Johnson boy in room 213 has abnormal test results and is having surgery tomorrow? Bystander Don’t let this happen

11. NextBack When to use or disclose PHI? When to share PHI with staff… ONLY the minimum information needed to do your job ONLY on a need to know basis When to share PHI with patients/families When they request the information themselves When they give permission to share with family or friends IF the Department of Human Services needs it to determine if the Privacy Rule is being followed If you are unsure, do not share and seek assistance Do not let the Privacy Rule keep you from treating the patient properly. Privacy rule DOES allows us to share PHI to effectively treat patients and conduct proper billing Patients and families have the right to restrict the use or disclosure of PHI Page 11 of 14

12. NextBack Incidental disclosure of PHI Occurs when PHI is seen or heard by someone who does not need to know. ETCH has taken appropriate steps to limit sharing of private information. These do not have to be eliminated entirely, but actions MUST be taken eliminate and limit them. Page 12 of 14

13. NextBack ETCH Privacy Policy-ADMIN O118 Click picture on left to view policy. Please review this policy now. Questions will follow on the test. Page 13 of 14

14. NextBack A good rule to work by… When making a decision about sharing PHI… IF IN DOUBT DON’T GIVE IT OUT Seek assistance if you are unsure! Page 14 of 14