Health Insurance Portability

1
Health Insurance Portability Accountability Act
(HIPAA)

• Education Training for Foothills Nursing
  Consortium Students

2
HIPAA

• HIPAA is a broad law dealing with privacy
  security of health information. There are two
  Rules contained in the law
• The Privacy Rule tells hospitals when and how
  they can use or disclose patient health
  information.
• The Security Rule tells hospitals how to protect
  health information from being inappropriately
  accessed, edited, or destroyed.

3
What is protected health information (PHI)?

• PHI is ALL personal health, billing,
  demographic info in ANY format (oral, paper,
  photo, electronic) CREATED or HELD by the
  hospital/facility.

4
Minimum Necessary or Need to Know

• All members of the workforce contribute to care
  of the patient. That does NOT mean all those need
  to see information about patients.
• If you do not need to know confidential
  information in order to provide care (clinical or
  financial) you are NOT permitted to access it.
  This includes your own PHI.

5
Privacy Security Rules Comparison

• Privacy Rule Regulates

• Security Rule Regulates

• Use, Disclosure Tracking of PHI
• Patient s Rights to their PHI
• Access
• Amendment
• Authorization
• Requirements

• Computer hardware software containing PHI
• Buildings that house computer soft/hardware
• Who has access to data how access is granted
• Visitor access to facility

6
Discipline for Violation of HIPAA

• What could happen to employees of an agency?
• WRITTEN WARNING
• SUSPENSION WITHOUT PAY
• TERMINATION of employment
• Therefore

7
Nursing Student Discipline

• What could happen to nursing students who violate
  HIPAA?
• WRITTEN WARNING
• FACULTY REVIEW COMMITTEE will meet to determine
  disciplinary action
• DISMISSAL FROM PROGRAM

8
Examples of Violations

• Not signing off a computer (with PHI) when
  leaving a work area
• Leaving confidential info displayed on
  computers, desks, workstations, or nursing
  stations
• Accessing info (dates of birth, phone s, or
  addresses when not needed to do job)
• Sharing password with a co-worker or supervisor

9
Examples of Violations cont.

• Accessing confidential medical info on a patient
  you have no job-related responsibility for,
  including families/friends your own info
• Using a co-workers password without their
  knowledge
• Disclosure of PHI for personal gain or releasing
  PHI with intent to harm the reputation of the
  individual or organization
• Accessing HIV results, records of sexual assault
  or domestic violence victims when not involved in
  the care of those patients

10
1 ISSUE GREATEST RISK

• NOSEY EMPLOYEES! (includes students!)
• Compliance Enforcement of Privacy Rule
• Dept. of Justice (DOJ) enforces criminal
  penalties (disclosure violations)
• Office of Civil Rights (OCR) enforces civil
  penalties (regulations not followed)

11
Civil /Criminal Penalties

• Fines of up to 100 per violation per person
• Limit of 25,000 per mistake
• Ex. Hospital releases info on 100 patients
  inappropriately, 100 per record10,000
• Harmful intent/personal gainlarge fines
  possible jail time
• Selling info gt stiffer penalties
• Criminal penalties can reach 250,000 10 yrs
  prison

12
Destruction of PHI

• TRASH must be checked! Patient name,
  demographics, name bands, telemetry strips, IV
  bag labels are examples of PHI that must be
  properly destroyed.
• Info must be shredded or blackened with a marker.

13
Passwords

• Do not share passwords with ANYONE
• Audit trails used to document systems user IDs
  are linked to every item read or printed

14
PERMISSION

• Permission must be granted for any disclosure
  excluding
• Treatment
• Payment
• Operations (state reporting)
• Privacy practice notices will describe the way
  info is used tell patients about rights

15
Information Access Management

• All authorized to access PHI have unique user
  IDs, including volunteers, temporary workers,
  students, independent contractors
• Passwords are selected for each user ID
• User IDs passwords should NEVER be shared
• Log-ons attempts are monitored

16
Problem areas

• Sensitive health info HIV, mental-health,
  obstetrical/gynecological history
• Minimum necessary need to know
• Inappropriate disclosure to YOUR family/friends
• Access of YOUR OWN record
• Sharing of passwords
• Identity verification

17
Reasonable precautions

• Close room doors/privacy curtains when discussing
  patient care
• Dont leave medical records where anyone can see
  them
• Keep lab, x-ray, other tests private
• Keep fax machine out of view use cover sheet
• Make sure computer screen not visible