Embed Size (px)
Citation preview
HIPAA Workforce Training: Advanced Strategies in Complying with the HIPAA
Privacy and Security Workforce Mandates
Steven S. Lazarus, PhD, FHIMSSBoundary Information Group
Paul T. Smith, Esq.Davis Wright Tremaine LLP
HIPAA Summit Seven
1
AcknowledgementAcknowledgement
The presenters acknowledge the contributions and suggestions of Margret Amatayakul, RHIA, CHPS, FHIMSS, President, Margret\A Consulting, LLC, who was not able to join us today
The presenters acknowledge the contributions and suggestions of Margret Amatayakul, RHIA, CHPS, FHIMSS, President, Margret\A Consulting, LLC, who was not able to join us today
2
Privacy TrainingPrivacy Training
The Regulation
“A covered entity must train all members of its workforce on the policies and procedures with respect to PHI required by this subpart, as necessary and appropriate for the members of the workforce to carry out their function.”
(45 CFR 164.530(b))
The Regulation
“A covered entity must train all members of its workforce on the policies and procedures with respect to PHI required by this subpart, as necessary and appropriate for the members of the workforce to carry out their function.”
(45 CFR 164.530(b))
3
DeadlinesDeadlines
Training must be provided:No later than April 14, 2003 (2004 for small health plans)To new hires within a reasonable period
Retraining must be providedAfter change in job functionsAfter change in policies and procedures
Training must be provided:No later than April 14, 2003 (2004 for small health plans)To new hires within a reasonable period
Retraining must be providedAfter change in job functionsAfter change in policies and procedures
4
DocumentationDocumentation
Training must be documented--Maintained in written or electronic form for 6 years.
What is not requiredEmployee acknowledgment or certificationRefresher training
Training must be documented--Maintained in written or electronic form for 6 years.
What is not requiredEmployee acknowledgment or certificationRefresher training
5
Security TrainingSecurity Training
The Security Rule requires security awareness and training for all personnel, including management, with the following “addressable” implementation specifications:
Periodic security remindersEducation on virus (“malicious software”) protectionLog-in monitoringPassword managementInitial training is due by April 21, 2005, but remember the “Mini Security Rule” in Privacy
(45 CFR 164.308(a)(5))
The Security Rule requires security awareness and training for all personnel, including management, with the following “addressable” implementation specifications:
Periodic security remindersEducation on virus (“malicious software”) protectionLog-in monitoringPassword managementInitial training is due by April 21, 2005, but remember the “Mini Security Rule” in Privacy
(45 CFR 164.308(a)(5))
6
Who Must be Trained?Who Must be Trained?
PrivacyWorkforce must be trained
EmployeesVolunteersStudentsIndependent contractors with assigned workstations (if CE chooses)Occasional workers
What about non-workforce?Medical staffOther independent contractors
PrivacyWorkforce must be trained
EmployeesVolunteersStudentsIndependent contractors with assigned workstations (if CE chooses)Occasional workers
What about non-workforce?Medical staffOther independent contractors
7
Who Must be Trained?Who Must be Trained?
SecurityWas employees, agents and contractors, now just workforce (including management).Role-based training optional.Contractors must be aware of security policies, but do not need training.
SecurityWas employees, agents and contractors, now just workforce (including management).Role-based training optional.Contractors must be aware of security policies, but do not need training.
8
Policy and Procedure TrainingPolicy and Procedure Training
Responsibility of Privacy Official is “development and implementation of the policies and procedures of the entity.”Policies should cover—
Privacy administrationPhysical protectionTechnical safeguardsUse and disclosureSanctions and mitigationIndividual rights
Responsibility of Privacy Official is “development and implementation of the policies and procedures of the entity.”Policies should cover—
Privacy administrationPhysical protectionTechnical safeguardsUse and disclosureSanctions and mitigationIndividual rights
9
Policy and ProcedureDevelopment
Policy and ProcedureDevelopment
Business Rules
More stringentstate law
OrganizationalEthics Policies
andProcedures
WorkforceTraining
HIPAA
10
Policy and ProcedureDevelopment
Policy and ProcedureDevelopment
A HIPAA-Based Policy:“We restrict the use and disclosure of all individually identifiable health information. Individually identifiable health information is information that identifies or could be used to identify an individual, and that contains information about the individual’shealth condition or health care, including payment for health care.”An Alternative:“We treat all health care related information as confidential, whether or not it identifies an individual, or could be used to identify an individual.”
A HIPAA-Based Policy:“We restrict the use and disclosure of all individually identifiable health information. Individually identifiable health information is information that identifies or could be used to identify an individual, and that contains information about the individual’shealth condition or health care, including payment for health care.”An Alternative:“We treat all health care related information as confidential, whether or not it identifies an individual, or could be used to identify an individual.”
11
Policy and Procedure TrainingPolicy and Procedure Training
HIPAA Education
Privacy Awareness Training
Role-Based
Policy and Procedure Training
12
RequirementsRequirements
Flexible and scalableYou decide content and delivery
Classroom instructionVideosOn-line trainingHandbooks
HHS says one hour per employee, on average
Flexible and scalableYou decide content and delivery
Classroom instructionVideosOn-line trainingHandbooks
HHS says one hour per employee, on average
Training Case Studies:What Works and What To Watch Out For
Margret Amatayakul, RHIA, CHPS, FHIMSSPresident, Margret\A Consulting, LLC
14
OrganizationOrganization
Senior Management OversightDelivery Network OversightFocused Committees:
PrivacySecurityEDIEducation
Coordination through central project managerMonthly meetings to address issues
Senior Management OversightDelivery Network OversightFocused Committees:
PrivacySecurityEDIEducation
Coordination through central project managerMonthly meetings to address issues
15
Monthly ReportingMonthly Reporting
Project Status SummaryTaskDue DatePercentage Complete*On Target (Y/N)
AccomplishmentsNext StepsIssues/Concerns/Barriers
Project Status SummaryTaskDue DatePercentage Complete*On Target (Y/N)
AccomplishmentsNext StepsIssues/Concerns/Barriers
16
* Percentage Complete* Percentage Complete
100% = Final Draft Approved95% = Summary to Education Committee90% = Operational Issues Resolved and
Second Draft Completed75% = Work Flow and Forms Developed50% = First Draft Completed35% = First Draft Submitted for Review25% = Document Template Reviewed and
Questions Generated10% = Document Template Received0 = Not Started
17
Policy & Procedure TemplatesPolicy & Procedure Templates
Make Operational Decisions
Educational Summary
18
FormsForms
“For Office Use Only”
Structure Options
19
Mis-directed Fax
Work FlowWork FlowAccounting
for Disclosures
Disclosures
PublicHealth
OversightPreparatory to Research
Subpoena
20
ExamplesExamples
Covered entity describes health-related product or service, or makes a face-to-face communication/ provides promotional gift of nominal value.
A communication about product or service that encourages recipients to purchase or use product, unless . . .
Provider sends information about smoking cessation program it is providing to patients who are determined to be smokers.
Provider sells list of patients to a local community college for them to sell smoking cessation and weight loss programs.
Providers gives sample drug, tells patient about certain drug, or sends brochure about certain drug to patients who would benefit from taking drug
Provider gives list of patients on certain medications to pharmaceutical company for them to market drugs
Provider distributes diaper samples and/or coupons to new mothers.
Provider allows diaper company sales rep to visit new mothers.
Not Marketing CommunicationMarketing
21
Anticipate and ScriptAnticipate and Script
If:Patient refuses to signPatient refuses to acceptPatient asks what this isPatient asks for restrictions
If:Patient refuses to signPatient refuses to acceptPatient asks what this isPatient asks for restrictions
Then:Check “no sign” in computerCheck “refused” in computerExplain that this is …Provide Request for Restrictions Form and refer to Supervisor
Then:Check “no sign” in computerCheck “refused” in computerExplain that this is …Provide Request for Restrictions Form and refer to Supervisor
22
Gaining ApprovalGaining Approval
Reason: Describes why the policy and procedure is created/revised.
Risk Assessment:Briefly describes the risk of not implementing the policy and procedure, and the residual risk after implementation.
Impact: Affected Components: Identifies classes of workers/units most impacted.Operations: Critical elements that positively and/or negatively change the way the organization functions.Financial: Operational and capital cash outlays required as well as any return on investment and/or loss avoidance that can be quantified.
Summary: Essence of policy and procedure in two to three sentences.
Policy Name: Type: Number:Executive Sponsor: Status: New Revision Date:
23
Target TrainingTarget Training
Categorize by:Keywords or
Policies & Procedures
24
Organize TrainingOrganize Training
StandardsIntegrate policies and proceduresRefer to/link to policies and procedures
Notice of Privacy PracticesTopicsCategories
General TopicsAvoid focusing too much on HIPAAAnd not enough on your operations
StandardsIntegrate policies and proceduresRefer to/link to policies and procedures
Notice of Privacy PracticesTopicsCategories
General TopicsAvoid focusing too much on HIPAAAnd not enough on your operations
25
TrainingExamples
TrainingExamples
Based on NOPP
Explains Specific Policy
Incorporates Provider’s Own Values(Privacy is not new!)
26
What to Watch Out For!What to Watch Out For!
It is easy to create policies and procedures that reflect the rules,
It is more difficult to create policies and procedures that reflect how things will actually work in your environment
It is easy to buy, or even develop, training materials that are generic,
It is more difficult to efficiently and effectively incorporate your specific policies and procedures into the training
It is easy to plan a massive training roll out,It is more difficult to achieve full compliance on training, Let alone get everyone to understand what to do,It is even more difficult to ensure that compliance lasts
Although the Privacy Rule does not require awareness building or reminders, this is critical for ongoing compliance
It is easy to create policies and procedures that reflect the rules,
It is more difficult to create policies and procedures that reflect how things will actually work in your environment
It is easy to buy, or even develop, training materials that are generic,
It is more difficult to efficiently and effectively incorporate your specific policies and procedures into the training
It is easy to plan a massive training roll out,It is more difficult to achieve full compliance on training, Let alone get everyone to understand what to do,It is even more difficult to ensure that compliance lasts
Although the Privacy Rule does not require awareness building or reminders, this is critical for ongoing compliance
Does every one
need to be
trained in
every thing?
But don’t leave out
critical staff!
Advanced Strategies in Complying with the HIPAA Workforce
Training Requirement
Steven S. Lazarus, PhD, FHIMSSBoundary Information Group, PresidentTrain for Compliance, Inc., Vice Chair
Workgroup for Electronic Data Interchange(WEDI), Past Chair
28
Achieving Effective Privacy and Security
Achieving Effective Privacy and Security
Need good Security to achieve PrivacyPrivacy Regulation requires SecurityReminders, periodic training, and “breach monitoring” reporting and management will be needed to achieve effective PrivacyNeed to train the workforce on the organization’s policies and procedures for Privacy and Security
Need good Security to achieve PrivacyPrivacy Regulation requires SecurityReminders, periodic training, and “breach monitoring” reporting and management will be needed to achieve effective PrivacyNeed to train the workforce on the organization’s policies and procedures for Privacy and Security
29
Policies and ProceduresPolicies and Procedures
Privacy Administration§164.530(i) and 164.520(b)Process for developing, adopting and amending of privacy policies and procedures, making any necessary changes to the Notice of Privacy Practices, and retaining copies
Privacy Administration§164.530(i) and 164.520(b)Process for developing, adopting and amending of privacy policies and procedures, making any necessary changes to the Notice of Privacy Practices, and retaining copies
30
Organizing Policy and Procedure Development and Revision
Organizing Policy and Procedure Development and Revision
Chief Information Privacy OfficialChief Information Security OfficialWorkgroups
PrivacySecurityTransactions, Code Sets and IdentifiersEducation/training
Chief Information Privacy OfficialChief Information Security OfficialWorkgroups
PrivacySecurityTransactions, Code Sets and IdentifiersEducation/training
31
Policy and Procedure Development ProcessPolicy and Procedure Development Process
Gap analysis of existing policies and proceduresIdentify needed changesDevelop new/revised policies and proceduresApprove policies and proceduresReplace former policies and proceduresTrain the workforce on the policies and procedures
Gap analysis of existing policies and proceduresIdentify needed changesDevelop new/revised policies and proceduresApprove policies and proceduresReplace former policies and proceduresTrain the workforce on the policies and procedures
32
Training Issues and OptionsTraining Issues and Options
Define workforce categoriesFew workforce categories
Easy to administerAssign workforce to courses
Less customization to create and maintainMany workforce categories
May be difficult to administerComplex management of workforce to training content choices
Potential to highly customize content to workforce categories
Define workforce categoriesFew workforce categories
Easy to administerAssign workforce to courses
Less customization to create and maintainMany workforce categories
May be difficult to administerComplex management of workforce to training content choices
Potential to highly customize content to workforce categories
33
Training Issues and OptionsTraining Issues and Options
Practical IssuesIdentify source of workforce lists, identifications and passwordsInclude employees, physicians, volunteers, long-term contract renewal (e.g., Medical Director in a health plan)Use Human Resource application if capable
NamesJob categoriesIdentifications and passwords from another source
Keep passwords and identifications secure
Practical IssuesIdentify source of workforce lists, identifications and passwordsInclude employees, physicians, volunteers, long-term contract renewal (e.g., Medical Director in a health plan)Use Human Resource application if capable
NamesJob categoriesIdentifications and passwords from another source
Keep passwords and identifications secure
34
Training Issues and OptionsTraining Issues and Options
TestsUse to document learning for complianceSet passing score
Consider Continuing Education credits (can not change content significantly and maintain credits)
TestsUse to document learning for complianceSet passing score
Consider Continuing Education credits (can not change content significantly and maintain credits)
35
Training Issues and OptionsTraining Issues and Options
Training OptionsIn person – classroom
Can customizeQuestions and answers addressed by trainerDifficult to schedule for new workforce membersCan use paper or automated testing
Training OptionsIn person – classroom
Can customizeQuestions and answers addressed by trainerDifficult to schedule for new workforce membersCan use paper or automated testing
36
Training Issues and OptionsTraining Issues and Options
Video or WorkbooksCan not customizeNo questions and answersNeed VCRs and/or supply of Workbooks
Video or WorkbooksCan not customizeNo questions and answersNeed VCRs and/or supply of Workbooks
37
Training Issues and OptionsTraining Issues and Options
E LearningMay be able to customizeLimited questions and answersFlexible schedule for training for current and new workforceCan integrate training with organization’s policies and proceduresThere may be technological barriers depending on delivery modeAutomated testing and learning reinforcement
E LearningMay be able to customizeLimited questions and answersFlexible schedule for training for current and new workforceCan integrate training with organization’s policies and proceduresThere may be technological barriers depending on delivery modeAutomated testing and learning reinforcement
38
Sanction TrainingSanction Training
Workforce sanctions may include:Specific training about the sanctionHIPAA TrainingSupervisor training
There may be a need to validate learningTest scoreOther
Workforce sanctions may include:Specific training about the sanctionHIPAA TrainingSupervisor training
There may be a need to validate learningTest scoreOther
39
Training CostTraining Cost
Cost/BudgetProduct
Fixed pricePer course per personMaintenance
Customized setupPolicies and ProceduresState Law pre-emption for PrivacyCEsAssign courses to individuals
Cost/BudgetProduct
Fixed pricePer course per personMaintenance
Customized setupPolicies and ProceduresState Law pre-emption for PrivacyCEsAssign courses to individuals
40
Training CostTraining Cost
Workforce training timeSalaries and benefitsCE offset
CE value/budgetTechnology
Several VCRs, monitors, and rooms, websiteSupport – internal and external
AdministrativeRecord keepingManagement
Workforce training timeSalaries and benefitsCE offset
CE value/budgetTechnology
Several VCRs, monitors, and rooms, websiteSupport – internal and external
AdministrativeRecord keepingManagement
41
Setup IssuesSetup Issues
Setup Time and ResourcesAssignment of internal staff/outsourceInitially may require dedicated staff, rooms, and equipment
Pilot TrainingEvaluate learning
Setup Time and ResourcesAssignment of internal staff/outsourceInitially may require dedicated staff, rooms, and equipment
Pilot TrainingEvaluate learning
42
Achieving Effective PrivacyAchieving Effective Privacy
Need good Security to achieve PrivacyPrivacy Regulation requires SecurityReminders, periodic training, and incident monitoring” reporting and management will be needed to achieve effective Privacy
Need good Security to achieve PrivacyPrivacy Regulation requires SecurityReminders, periodic training, and incident monitoring” reporting and management will be needed to achieve effective Privacy
Contact InformationContact Information
Paul Smith, Esq.Davis Wright Tremaine, LLPTel. 415-276-6532 [email protected] www.dwt.com
Margret Amatayakul, RHIA, CHPS, FHIMSSMargret\A Consulting, LLCTel. 847-895-3386 [email protected] www. Margret-A.com
Steve Lazarus, PhD, FHIMSSBoundary Information GroupTel. 303-488-9911 [email protected] www.boundary.net www.hipaainfo.net
Paul Smith, Esq.Davis Wright Tremaine, LLPTel. 415-276-6532 [email protected] www.dwt.com
Margret Amatayakul, RHIA, CHPS, FHIMSSMargret\A Consulting, LLCTel. 847-895-3386 [email protected] www. Margret-A.com
Steve Lazarus, PhD, FHIMSSBoundary Information GroupTel. 303-488-9911 [email protected] www.boundary.net www.hipaainfo.net
