HIPAA (Please press F5 to view)

1
HIPAA(Please press F5 to view)

• Health Information Privacy and Accountability Act
• Enacted in 1996
• Governs the Privacy of Protected Health
  Information (PHI)
• Defines basic terms and lists principles that all
  personnel must follow.
• State law that is stricter than HIPAA and is more
  protective of health information privacy than
  HIPAA still applies

2
Basics of the HIPAA Privacy Rule 

• Personnel can only see or use the minimum amount
  of PHI that is necessary for a task .
• Personnel who see or use PHI in violation of
  HIPAA have violated federal law.  Penalties
  include fines, jail, and disciplinary action
  which may include termination.
• All requests for patient health information must
  be directed through the company's Privacy
  Officer.

3
HIPAA Penalties

• 100 fine per day for each standard violation. 
  (Up to 25,000 per person, per year, per
  standard.) 
• 50,000 fine up to one year in prison for
  improperly obtaining or disclosing health
  information. 
• 100,000 fine up to five years in prison for
  obtaining or disclosing health information under
  false pretenses. 
• 250,000 fine up to ten years in prison for
  obtaining health information with the intent to
  sell, transfer or use for commercial advantage,
  personal gain or harm. 
• Penalties under company policy, which can include
  termination.

4
Who Must Comply?

• Everyone employed by the company, whether
  ambulance, wheelchair, dispatch, management, etc.

5
 What is PHI?

• Comes from a health care provider or a health
  plan.
• Identifies an individual or could be used to
  identify an individual.
• Describes the health care, condition, or payments
  of  an individual or describes the demographics
  of an individual.

6
Examples of Demographics 

• Name
• Zip code
• Address
• Name of employer
• Birth date
• Telephone number
• Fax number
• E-mail address
• Social security number
• Medical record number  Health plan beneficiary
  number
• Account number
• Drivers license number
• Vehicle serial number
• URL
• IP address
• Biometric identifiers
• Full-face photo
• Any other unique identifying characteristic

7
PHI Describes Health Condition 

• Information from a health care provider or health
  plan about an Individuals Physical or Mental
  condition, including
• Past history of a condition
• Present condition
• Plans or predictions about the future of a
  condition
• Some specific documents covered
• - Patient Care Report
• - Billing forms
• - Physician certifications
• - Verbal reports
•  

8
PHI Describes Health Care 

• Information from a health care provider or health
  plan about an Individuals Health Care,
  including
• Who provided care
• What type of care was given
• Where care was given
• When care was given
• Why care was given 

9
PHI Describes  Health Care Payments 

• Information from a health care provider or health
  plan
• about an Individuals Health Care Payments,
  including
• Who was paid
• What services were covered by the payment
• Where payment was made
• When payment was made
• How payment was made

10
PHI must be secured in all forms

• Written information (reports, charts, x-rays,
  letters, messages, etc.) Must be locked in a
  container with limited access.
• Oral communication (phone calls, meetings,
  informal conversations, etc.) 
• E-mail, computerized and electronic information
  (computer records, faxes, voicemail, PDA entries,
  etc.) 
• Don't leave written information out for 3rd
  parties to see.
• Law enforcement may not be given patient
  information in the performance of their duties as
  law officers, except for non-medical information
  such as driver's license, Social Security Card,
  etc. (Cant be given PCR without a court order or
  written consent of patient.)

11
HIPAA Golden Rule

• " What you see here,
•    what you hear here,
•     when you leave here,
•     let it stay here."

12
When Can Personnel Use PHI?

• Disclose any and all information required to
  affect treatment and continued care of the
  patient.
• Only Relevant information may be transmitted by
  radio to ensure response to a patient and for
  continued care (dispatch and encode
  communications).
• Information may be discussed with present family
  members.
• Healthcare providers must share protected
  information as required to provide continuous
  care and to facilitate billing.
• When the individual has signed a valid
  authorization form.
• Patient information may be discussed with
  disaster relief agencies for the purpose of
  disaster relief efforts.
• All caregivers are entitled to patient health
  information and demographics required to provide
  any needed patient care.
• As specifically permitted or required by law.  
• In all cases, use reasonable security measures to
  safeguard Protected Health Information 
•  

13
Security Measures for PHI

• Do NOT share user names and passwords.
• Lock doors, lock file cabinets, and limit access
  to workspace where health information is used or
  stored.
• Limit access to printers and faxes where health
  information is printed.
• Limit access to health information to only those
  who need it for a specific task.
• Redact (black out) or use de-identified health
  information whenever possible.
• Shred or otherwise properly dispose of health
  information trash.
• Use and keep only the minimum health information
  necessary for a specific task.
• Follow privacy policies and procedures .

14
Privacy Policy

• Given the nature of our work, it is imperative
  that we maintain the confidence of patient
  information that we receive in the course of our
  work. Carolina MedCare prohibits the release of
  any patient information to anyone outside the
  organization unless required for treatment,
  payment, or healthcare operations, and
  discussions of Protected Health Information (PHI)
  within the organization should be limited.
  Acceptable uses of PHI within the organization
  include, but are not limited to, exchange of
  patient information needed for treatment of the
  patient, billing, and other essential healthcare
  operations, peer review, internal audits, and
  quality assurance activities.

15
Privacy Policy

• I understand that Carolina MedCare provides
  services to patients that are private and
  confidential and that I am a crucial step in
  respecting the privacy rights of Carolina
  MedCares patients. I understand that it is
  necessary, in the rendering of Carolina MedCares
  services, that patients provide personal
  information and that such information may exist
  in a variety of forms such as electronic, oral,
  written, or photographic and that all such
  information is strictly confidential and
  protected by federal and state laws.

16
Privacy Policy

• I agree that I will comply with all
  confidentiality policies and procedures set in
  place by Carolina MedCare during my entire
  employment or association with Carolina MedCare.
  If I, at any time, knowingly or inadvertently
  breach the patient confidentiality policies and
  procedures, I agree to notify the Privacy Officer
  of Carolina MedCare immediately. In addition, I
  understand that a breach of patient
  confidentiality may result in suspension or
  termination of my employment or association with
  Carolina MedCare. Upon termination of my
  employment or association for any reason, or at
  any time upon request, I agree to return any and
  all patient confidential information in my
  possession. This is not a contract for continued
  employment.

17
Privacy Policy

• I have read and understand all privacy policies
  and procedures that have been provided to me by
  Carolina MedCare. I agree to abide by all
  policies or be subject to disciplinary action, up
  to and including termination of employment. This
  is not a contract of employment and does not
  alter the nature of the existing relationship
  between Carolina MedCare and me.

18
Privacy Policy

• I understand that every patient transported by
  Carolina Medcare is entitled to a written copy of
  the privacy policy and will be provided, at no
  cost to the patient, at the time of transport.

19
Privacy Officer

• The Designated Privacy Officer for Carolina
  Medcare is
• Mark Self
• 1935 Second Loop Road
• Florence, SC 29501
• [phone] Ext. 304

20
Summary 

• Keep Protected Health Information private and
  secure at all times.
• Make sure only Personnel who need to use
  Protected Health Information see it or use it.
• Use only the minimum amount of Protected Health
  Information necessary to accomplish the task.
• Read and understand Privacy policies and
  procedures
• Know your Privacy Officer
• Consult your Privacy Officer with any questions
  you have about privacy or Protected Health
  Information.
• Click Here to Take HIPAA Quiz
• Return to New Employee Orientation Page