1. HIPAA Overview Why do we need a federal rule on privacy? Privacy is a fundamental right Privacy can be defined as the ability of the individual to determine for themselves when, how and to what extent information about them is communicated. In the past, healthcare has spoken about confidentiality and privacy, but was never really held accountable

2. Health Insurance Portability and Accountability Act of 1996 WHAT IS HIPAA?

3. Basic Principles Underlying the HIPAA Privacy Regulation Give consumers control over the release of their health care information: the Privacy Regulation (“Rule”) requires authorization Establish boundaries for the use of health care information: The rule limits the use of information to health purposes Establish accountability: The rule provides for civil and criminal penalties

4. What Must Be Kept Confidential? PHI: Protected Health Information

5. More About Protected Health Information? Any health information relating to: Past, present or future physical or mental health or condition Provision of health care or Past, present or future payment for health care Created/received by a provider, plan, employer or clearinghouse Information that is individually identifiable or that provides a reasonable basis to believe the information can be used to identify the individual In any medium – Written, verbal or Electronic

6. Understanding PHI Individually identifiable information Any form or medium –Written –Verbal –Electronic Medical Records Billing Records Databases

7. Who Is Subject to the Rule? Any covered entity or business associates of the covered entity who use the protected information.

8. Who or What Is a Covered Entity? Health care providers who electronically transmit health information in a HIPAA-covered transaction Health plans (does not include worker’s compensation, disability, sickness funds, liability coverage) Health care clearinghouses (entities that process nonstandard data elements into standard data elements)

9. Who Is a Business Associate? A person, other than a member of the covered Entity’s workforce, who on behalf of a Covered Entity performs or assists with a function or activity involving PHI.

10. What PHI Can You Use, Disclose or Request? The Minimum Necessary Rule Covered entities must make all reasonable efforts to limit disclosures of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure or request.

11. Use of PHI Sharing, application, utilization, examination, or analysis of PHI within the organization

12. Disclosure of PHI The release, transfer, access, or divulging of PHI to an outside person or entity.

13. How Do I Know… …When information is considered private? –Did you learn it through your job? If yes, then it is considered private

14. What Rights Does the Rule Grant to Individuals? Right to notice of privacy practices Right to access PHI Right to an accounting of disclosures Right to amend PHI Right to request restriction on further disclosures Right to request communications in alternative fashion Right to complain to covered entity and to HHS

15. How Do I Handle… …An individual asking for access to their record? –Individuals have a right of access –Route requests to the Medical Records Manager

16. How Do I Handle… …An individual’s request to change their medical record? –Individuals have the right to amend or correct their record Requests will be investigated –Route requests to the Medical Records Manager

17. How Do I Handle… …A family member or close friend asking about a patient? –Directory information Name, location, condition in general terms –Other type of clinical or billing information Obtain permission Disclose appropriate information Use judgment if permission cannot be obtained

18. How Do I Handle… …Another member of the workforce inquiring into a patient’s condition or treatment? –Determine if it is necessary to their position –Is it related to treatment?

19. “Privacy-Friendly” Practices Abide by the organization’s Notice of Privacy Practices Shred or destroy Fax and copy machine location Talking in public areas Keep patient information out of public areas

20. “Privacy-Friendly” Practices Secure records in all locations Passwords Computer screens Remember individuals’ right to privacy during treatments

21. What Happens If… …a privacy policy is violated? –Organization- specific sanctions –Right to file a complaint –Civil and criminal penalties

22. Take pride and ownership in the fact that your organization is concerned about privacy and recognizes its importance in providing quality healthcare.