HIPAA: YOUR GUIDE TO PRIVACY AND SECURITY at SALINA REGIONAL HEALTH CENTER Committed To World Class Service Revised October 2013

HIPAA:YOUR GUIDE TO PRIVACY AND SECURITY

atSALINA REGIONAL HEALTH CENTER

Committed To World Class Service

Revised October 2013

HIPAA - WHAT IS IT?

HIPAA stands for Health Insurance Portability and Accountability Act of 1996. Until HIPAA was passed, rules to protect personal health information did not exist. Congress saw HIPAA as an opportunity to move health care into the electronic age. HIPAA sets national standards for the written, oral, faxed, and electronic management of patient information. It is illegal to violate HIPAA. HIPAA:

• requires healthcare organizations to notify patients of their health information rights. • requires healthcare organizations to obtain patient consent before sharing protected health information with others unless the information will be used for treatment, payment, or healthcare operations. • sets standards to protect the integrity, availability, and confidentiality of information.

WHO MUST ABIDE BY HIPAA?

Healthcare providers - hospitals, clinics, nursing homes, physicians, suppliers, and others who furnish, bill, and/or are paid for providing healthcare services

Health plans - group health plans, health insurance issuers, Medicare, Medicaid, and all governmental healthcare programs for military personnel, their dependents, veterans, etc.

Clearinghouses - billing services, repricing companies, "value-added" networks, etc., that are involved in the processing of health claims


Confidential Information

Confidential information takes on many forms. It can be information printed on paper, or data files stored on a computer, a hand-held device such as a smartphone, computer media, or voice mail. Regardless of the form it takes, you are responsible to protect it from unauthorized disclosure or modification.

Committed To World Class Service HIPAA VIOLATION PENALTIES

In addition to internal disciplinary action, HIPAA violations can lead to civil sanctions and fines. Criminal penalties for "wrongful disclosure" could result in large fines and/or jail time. Serious offenses include:

• knowingly releasing patient information. This can lead to one year in jail and a $50,000 fine. • gaining access to health information under false pretenses. This can lead to five years in jail and a $100,000 fine. • releasing patient information with harmful intent or selling patient information. This can lead to ten years in jail and a $250,000 fine.

Due to the Kansas Risk Management law, if an investigation determines that an employee has committed a privacy violation, the violation will be reported to the employee's licensing agency.

REMEMBER - HIPAA VIOLATIONS CAN HAVE SERIOUS CONSEQUENCES!


HIPAA- THINK ABOUT IT

No matter where you work (health center, lab, radiology, business office, doctor's office, volunteer services, information technology, patients' homes, etc.), or whether you have a direct patient care role or not, it is important to know the meaning of privacy, security, and confidentiality!

• As a student at SRHC, you are expected to keep privacy, security, and confidentiality central to providing quality care. • Remember that PATIENTS have the right to control who sees their health information. • In the past, privacy, security, and confidentiality were considered to be ethical obligations. Despite this, many situations led to health information ending up in the wrong hands. HIPAA seeks to correct breaches of privacy, security, and confidentiality. • REMEMBER - MAINTAINING PATIENT PRIVACY, SECURITY, AND CONFIDENTIALITY IS THE LAW!

In today's world, health information is easily transported and increasingly accessible. Information management technologies increase the risks and threats to the privacy of personal health information. HIPAA provides a structure for compliance with standards to protect the privacy and security of health information.


HIPAA: IMPACT ON CLINICAL PRACTICE

HIPAA has had a significant impact on clinical practice. HIPAA does the following:

• Gives patients more control over their health information. • Sets boundaries on the use and release of health records. • Establishes safeguards that healthcare providers and others must provide to protect the privacy of health information. • Holds violators accountable, with civil and criminal penalties that can be imposed if it is determined that a patient's privacy rights were violated. • Strikes a balance when public responsibility supports disclosure of some data to protect public health (as in the case of child abuse).

HIPAA changes every facet of health care, including the way clinicians work, how data is accessed, how healthcare information is stored and shared, and authorizations and consents. It is important that you:

• share or use only the minimum amount of health information necessary to communicate information about patients. • are aware of what patient information you are legally allowed to share and with whom. • discuss a patient's personal health information in private. • shred patient information instead of just throwing it in the trash. • never leave patient information unattended in an area where unauthorized people can see it.


COMMUNICATION OF HEALTHCARE INFORMATION

HIPAA dramatically changes how healthcare information is communicated. Keep in mind:

• Display of patient information on a white board must be out of the view of the public.

• Phone communication requires more verification prior to giving out patient information.

• Communication with or about patients that involves sharing patient health information must be conducted in private and limited only to those who need to know the information in order to provide treatment, payment, and/or healthcare operations.

• It is important for you to know to whom patients have approved the release of personally identifiable health information.

Committed To World Class Service HIPAA- TERMS TO KNOW

Health Information (HI) - refers to information in ANY form (oral, written, electronic) related to an individual's past, present, or future physical or mental health, including the services delivered and the method of payment.

Protected Health Information (PHI) - refers to any individually identifiable health information (IIHI) that is transmitted or maintained in any form.

Electronic Protected Health Information (EPHI) - refers to any individually identifiable health information that exists in or is transmitted in electronic form.

WHAT IS IDENTIFIABLE INFORMATION?

• Names • Addresses • Employers • Relatives' names • Dates of birth • Telephone & fax numbers

• E-mail addresses • Social Security numbers • Medical Record numbers • Member/account numbers • Certificate numbers • Voice Prints

• Finger prints • Photos • Codes • Any other characteristics which may be used to identify an individual (for example, occupation)


DID YOU KNOW?

Patients are concerned about privacy. In a November 2000 Gallup Poll commissioned by Medic Alert:

• 77% of the people surveyed feel their personal health privacy is very important.

• 84% were somewhat to very concerned that their personal health information might be available

without their consent.

• 90% said they trust their doctor to keep their personal health information private and secure, and

66% said they trust a hospital to do the same.

• 42% said they trust their insurance company.

• Only 7% were willing to store or transmit personal information on the Internet, and only 8% felt a

web site could be trusted.

REMEMBER• Healthcare providers are bound by law to protect patients' privacy and security. Increased access to healthcare information leads to increased risks for misuse.


MISUSE OF HEALTH INFORMATION

People assume that discussions they have with healthcare providers will remain private. They expect that their private health information will not be shared inappropriately with others. When people don't trust healthcare providers, they:

• do not obtain treatment. • give incomplete or inaccurate information. • try to pay for services out of pocket to prevent insurance claims. • change healthcare providers frequently. • ask physicians to NOT document actual conditions.

REMEMBER Medical information is some of the most sensitive and personal information that is collected and shared. Privacy is central to the healthcare provider/patient relationship.


Sshhh: PRIVATE MEANS PRIVATE

If your role as a student requires you to discuss healthcare information with patients, be sure to assess the environment before you start talking. Are there other people in the area who might hear the information you are sharing? Are those people authorized to hear the information you are sharing? Patients have the right to expect that they can talk to their healthcare providers in private and that their protected health information will be shared with (or overheard by ) only those people they have authorized.

RESPONSIBILITIES You should also use caution when discussing information with other providers involved in a patient's care. Make sure that people who DON'T NEED TO KNOW about a patient's medical condition don't hear your conversations.


HIPAA AND PATIENT RIGHTS

HIPAA regulations give patients the right to:

• determine who can see and hear their personal health information (PHI).

• inspect their medical records and, for a reasonable fee, obtain copies of those

medical records if they want them.

• restrict the use and release of information.

• file complaints based on violation of privacy rights.

• exclude their names from patient directories.

• request confidential or alternative communication methods.

• request a list of when and where their confidential information was released.


HIPAA AND CONFIDENTIALITY

REMEMBER

Information about patients is considered confidential whether it is written, saved on a computer, or spoken out loud. Information includes name, address, age, social security number, past medical history, reason for visit, etc.

As a student in a healthcare setting, it is important that you take steps to protect the privacy of patients.


PROTECTING PRIVACY: IT'S EVERYONE'S JOB!

• Use care when you discuss patients' health information. Don't hold discussions in hallways, elevators, cafeterias, or other public places in the health center. Always make sure that your discussions with patients, staff, family members, etc., can't be overheard. • Do not leave open charts, lab results, medications, or other sensitive information out in the open where others can see it. Keep test results private. • Do not use the intercom to provide health information to patients or other staff members. • Make sure you know whether or not a patient has opted out of the directory. • DO NOT GIVE HEALTH INFORMATION to family members or friends unless you are authorized by a patient to do so. • Keep records locked and accessible only to those people who need them in order to do their jobs. • Make sure that posted or written information about patients can't be seen by the public


PROTECTING PRIVACY: IT'S EVERYONE'S JOB!

• Provide a private area for patients to discuss their health concerns, financial information, etc. with physicians and other staff. • Knock on doors before entering patient rooms. Draw privacy curtains and close doors when appropriate. • If you are unsure about whether or not you should provide information about a patient, ask your supervisor for assistance. • If you overhear employees, students or observers discussing patients inappropriately, remind them of confidentiality policies. Report problems if you know of them! • When you leave a computer terminal, make sure you LOG OFF or LOCK the workstation to prevent others from accessing patient information under your log-in. To lock the workstation, hit the Ctrl Alt Delete keys, then click the "lock workstation" tab. SPECIAL NOTE: Keep in mind that if you share a computer workstation with others (i.e. at a nurse’s station), it is best for you to log off the workstation when you step away instead of locking it. If you lock the workstation, other staff will be unable to log in to the workstation until you return and log off. • WHEN YOU LOOK FOR INFORMATION ON PATIENTS, REMEMBER - ONLY SEEK INFORMATION YOU NEED TO KNOW IN ORDER TO DO YOUR JOB PROPERLY.


THE "NEED TO KNOW" RULE

Patient privacy boils down to one main point - the "need to know."

Believe it or not, as a student at SRHC, you do not have the right to look at all the information available on every patient. For example, a student on 3 Center does not have the right to look at the medical record of a friend on 2 Center. Not all students need to see patient health information about patients, and some only need to see partial patient information.

Before looking at patient information, ask yourself, "Do I need to know this to do my job?" If the answer is "yes," you are allowed to access the information. If the answer is "no," access to the information is NOT ALLOWED. You will be in violation of HIPAA regulations if you access patient information you don't NEED TO KNOW in order to do your job.

Many students at SRHC do not have access to computer-based or written patient information. Why? Because they don't need to know patient information in order to complete their clinical/observation. If a fellow student asks you about a patient, only provide information if he/she is directly involved in the patient's care and needs to know the information in order to appropriately care for the patient.

Remember the SRHC rule of thumb - ask yourself, "Do I need to know this to do my job?" YOU SHOULD NOT ACCESS ANY INFORMATION THAT YOU DO NOT NEED TO KNOW IN ORDER TO DO YOUR COMPLETE YOUR CLINICAL/OBSERVATION.


HIPAA AND THE HOSPITAL DIRECTORY

The following protected health information can be maintained in a patient directory: name, location in the hospital, condition described in general terms (good, fair, poor), and religious affiliation. SRHC must inform patients of the protected health information that may be included in the directory and to whom it might release the information (including clergy). SRHC provides patients with the opportunity to restrict or prohibit some or all of the uses or disclosures.

• If a patient chooses to have his/her name published in the directory, then patient name, room number, general condition (serious, poor, fair, good, etc.) will be given to people who ask for the patient by name.

• If a patient chooses NOT to have his/her name in the directory, then mail will be returned, flowers will not be delivered, and people asking for the patient by name will be told, "There is no one by that name listed in our patient directory."

• Patients who do NOT want to have their names in the directory will be listed on the white board using first and last initials. Additionally, a star should be placed by those patients' initials.


TIME OUT FOR PRACTICE

Hilda is observing on a unit in the hospital where Celia, a member of her church, is currently hospitalized. Hilda knows that Celia's family could use some help with meals, transportation, and babysitting. Hilda also knows that members of the church would be happy to help Celia's family, but the problem is that nobody from church knows that Celia is in the hospital. Hilda can get Celia's family the help it needs by making a quick phone call to the church.

In accordance with HIPAA regulations, Hilda should:

call her pastor, explain the situation, and arrange to have healthy meals taken to Celia's home for the next five days.

do nothing unless Celia gives her the authorization to call the church and get help for her family.

Click to the next screen to find out the correct answer.

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Hilda_Wrong_Answer.htm

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Hilda_Correct_Answer.htm

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Hilda_Wrong_Answer.htm

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Hilda_Correct_Answer.htm



Hilda is observing on a unit in the hospital where Celia, a member of her church, is currently hospitalized. Hilda knows that Celia's family could use some help with meals, transportation, and babysitting. Hilda also knows that members of the church would be happy to help Celia's family, but the problem is that nobody from church knows that Celia is in the hospital. Hilda can get Celia's family the help it needs by making a quick phone call to the church.

Before Hilda can call the church, Celia must give her authorization. If Hilda calls the church without getting Celia's authorization, she is in violation of HIPAA regulations.

In accordance with HIPAA regulations, Hilda should:

call the church pastor, explain the situation, and arrange to have healthy meals taken to Celia's home for the next five days.

INCORRECT

do nothing unless Celia gives her the authorization to call the church and get help for her family. CORRECT



You hear a "Code Blue" called on the Mother/Baby unit, and you are curious to know who coded and why. You know the unit secretary on Mother/Baby, so you call her to find out what happened.

According to HIPAA regulations, should the unit secretary give you the information you are requesting?

Yes, because you tell her you won't share the information with anyone else. You tell her you are just curious to know what happened because it is unusual for someone to code on the Mother/Baby unit.

No, she shouldn't give you any information unless you can demonstrate a legitimate NEED TO KNOW. Any time patient information is requested for purposes other than treatment, payment, or operations, its release must be authorized.


http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Code_Blue_Wrong_Answer.htm

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Code_Blue_Correct_Answer.htm

http://authoring.healthstream.com/Salina_Regional_Health_Center/HIPAA%20Privacy%20and%20Security/Quizzes/Code_Blue_Wrong_Answer.htm



You hear a "Code Blue" called on the Mother/Baby unit, and you are curious to know who coded and why. You know the unit secretary on Mother/Baby, so you call her to find out what happened. Based on the information provided in the scenario, you are seeking information out of curiosity. It doesn't matter that you promise to keep the information to yourself. You do not NEED TO KNOW any information about the patient who coded and why she coded; therefore, the unit secretary should not give you the information you are requesting.

According to HIPAA regulations, should the unit secretary give you the information you are requesting?

Yes, because you tell her you won't share the information with anyone else. You tell her you are just curious to know what happened, because it is unusual for someone to code on the Mother/Baby unit.

INCORRECT

No, she shouldn't give you any information unless you can demonstrate a legitimate NEED TO KNOW. Any time patient information is requested for purposes other than treatment, payment, or operations, its release must be authorized.

CORRECT


KEY POINTS REGARDING TECHNOLOGY:

• Use the "NEED TO KNOW " rule before you access electronic personal health information. ONLY ACCESS PATIENT INFORMATION YOU NEED TO KNOW IN ORDER TO PERFORM YOUR JOB RESPONSIBILITIES. • Once you log on to a computer workstation, ALL ACTIVITY UNDER YOUR LOG-IN IS TRACKED AND ATTACHED TO YOUR NAME. Even if you are only stepping away from the computer terminal for a brief time, it is very important that you protect yourself by either logging out of or locking the workstation. • To lock the workstation, hit the Ctrl Alt Delete keys, then click the "lock workstation" tab. If you forget to log off or lock the computer workstation and someone uses that workstation to inappropriately access patient information, you could be held responsible in the event a complaint is filed. Why? Because the inappropriate activity will be attached to your log-in Remember, if you share a computer workstation with others (i.e. at a nurse’s station), it is best for you to log off the workstation when you step away instead of locking it. If you lock the workstation, other staff will be unable to log in to the workstation until you return and log off. • Make sure you enter information into the computer in a timely, accurate manner. Timeliness and accuracy ensures that appropriate information is available for medical decision-making. For example, failure to document a medication at the time it is administered could cause the medication to be duplicated or could give the appearance of omission or chart tampering.

User IDs

Your user ID uniquely identifies you. You are responsible for all actions associated with your user ID; therefore, it is important to ensure that your user ID is used only by you and no one else. You will be held responsible for the actions of another individual if you allow them to obtain and use your user ID and password or allow them access to patient information in a clinical application while you are logged on.


COMPUTER WORKSTATIONS

Take these steps if you work with computers:

• Angle your computer away from public access/view.

• Keep all PDA's, laptops, and media locked up when not in use.

• Log off the system at the end of the work day. Log-off or lock the workstation when you leave

your work area.

• Even if you don't share a computer with someone else, it is possible that someone could try to

illegally access information on your computer. Never leave secure information unattended while

you are logged onto a secure system.

• Never allow anyone to use a secure system for which he/she does not have

access after you have logged onto the system.



A classmate needs to look up information on a patient; however, you are currently logged into the computer he needs to use. You tell him to "go ahead and look up the information" and then log off the computer. Four months later, while checking up on a reported HIPAA violation, investigators discover that patient information was inappropriately accessed under your log-in. The problem is, you know you weren't the one who did it!

Do you have anything to be concerned about?

Yes, this is a problem for you because all activity conducted under your log-in is tracked and attached to your name. If a complaint is filed, you could be held responsible for inappropriately accessing patient information.

No, there is no problem for you because even though the information was accessed under your log-in, you weren't the one who did it. All you have to do is tell investigators that someone used your log-in to access patient records inappropriately, and all will be OK for you.




A classmate needs to look up information on a patient; however, you are currently logged into the computer he needs to use. You tell him to "go ahead and look up the information" and then log off the computer. Four months later, while checking up on a reported HIPAA violation, investigators discover that patient information was inappropriately accessed under your log-in. The problem is, you know you weren't the one who did it!

Remember, once you log into a computer, ALL ACTIVITY UNDER YOUR LOG-IN IS TRACKED AND ATTACHED TO YOUR NAME.

Do you have anything to be concerned about?

Yes, this is a problem for you because all activity conducted under your log-in is tracked and attached to your name. If a complaint is filed, you could be held responsible for inappropriately accessing patient information.

CORRECT

No, there is no problem for you because even though the information was accessed under your log-in, you weren't the one who did it. All you have to do is tell investigators that someone used your log-in to access patient records inappropriately, and all will be OK for you.

INCORRECT

Personally Owned Devices

The IT department must approve any personally owned devices (including, but not limited to, laptops, tablets, iPads, and digital cameras) prior to being connected to workstations or the internal network. SRHC offers a “guest” wireless network for our patients, visitors or contractors. You may use personally owned devices with the guest wireless network on your personal time.

Texting and Cell Phones

Text messaging is not a secure form of communication. Text messaging of confidential information is not allowed.

Taking pictures of computer screens containing confidential information is also not allowed.

Reporting Security Incidents

Notify the IT Help Desk (extension 7792) and your supervisor if you become aware of or suspect the following: – Theft of or damage to equipment – Unauthorized use of user passwords – Policy violations – Any other problems or questions with information security or patient privacy

The Omnibus Rule and Business Associates

• The HIPAA Rules define “business associate” to mean a person who performs functions or activities on behalf of, or certain services for, a CE that involve the use or disclosure of PHI.

• Disclosure means the release, transfer, provision of, access to, or divulging in any manner outside the entity holding the information.

• Access means the ability or means necessary to read, write, modify or communicate data/information or otherwise use any system resource.

The Omnibus Rule

• Applies to:– Covered Entities (CE) refers to providers, hospitals, health plans– Business Associates (BA)– Subcontractors to Business Associates that handle Personal Health Information

(PHI) on behalf of Business Associates

Business Associates

• BAs must comply with the technical, administrative, and physical safeguard requirements, as well as the policies and procedures and documentation requirements, for ePHI under the HIPAA Security Rule.

• Direct liability for BAs under HIPAA would attach regardless of whether a BA, contractor and/or subcontractors have entered into the required business associate agreements.


HIPAA: SUMMARY

As you go about your daily job tasks, keep HIPAA in mind. Think of every item of information or data about any person who obtains service from SRHC as health information. As you deal with patients and/or their information, keep in mind:

• What is the information? • Who can hear or see the information?• Where is the information going?• How will the information be used? • How will I keep track of the information? • How and where is the information maintained?

Failure to protect patient information and patient records by not following SRHC's privacy policy can have a serious impact on your status as a student at SRHC.


HIPAA: IF YOU HAVE QUESTIONS

• For questions about privacy issues at SRHC, contact Kallie Burgardt, Privacy Officer, Ext. 6897. • For questions about computer security issues at SRHC, contact Larry Barnes, Chief Information Officer, Ext. 7703.

TO REPORT A BREACH OF PRIVACY OR SECURITY, CONTACT BECKY GROSLAND,

COMPLIANCE OFFICER, EXT. 7094.

If a patient believes his/her right to privacy has been violated, he/she can write a letter of complaint and send it to SRHC or the U.S. Department of Health and Human Services. Contact Kallie Burgardt for details. THERE IS NO PENALTY FOR FILING A COMPLAINT.


HIPAA

Our patients trust you to keep their information private and secure.

Remember, “Entrusted with people's lives, we are privileged to provide quality healthcare service in a healing and spiritual environment."

Documents

HIPAA: YOUR GUIDE TO PRIVACY AND SECURITY at SALINA REGIONAL HEALTH CENTER Committed To World Class Service Revised October 2013