New Employee Orientation HIPAA Privacy Marcia Matthias, MJ, RHIA, - - PowerPoint PPT Presentation

New Employee Orientation – HIPAA Privacy

Marcia Matthias, MJ, RHIA, CHPC Corporate Director, Health Information/Privacy Officer

Definitions

• HIPAA – Health Insurance Portability and Accountability Act
• PHI – Protected Health Information
• HHS – Department of Health and Human Services
• OCR – Office for Civil Rights – Enforces HIPAA Privacy and

Security rules.

What is identifiable protected health information (PHI) under HIPAA

– Certificate # – Voiceprints – Fingerprints – Photos – Codes – Any other characteristics, such as occupation that can be used to identify an individual.

• Includes:

– Name – Address – Employer – Relative’s names – Birth date – Phone/fax numbers – Email address – Social Security # – Medical Record # – Member/Acct #

Forms of Information

Paper Verbal Electronic

It is the responsibility of every employee to protect the privacy and security of PHI in ALL forms

Goals of the Privacy Rule

• Provide strong federal protections for privacy rights

– Ensure patient’s TRUST the privacy and security of his/her health information

• Preserve QUALITY health care

– Encourages frank communication with healthcare providers

• Makes sure that the right information is flowing to the right people

at the right time.

Breaches

• A breach occurs when information that, by law, must be protected

is: – Lost, stolen, or improperly disposed of – “hacked” into by people or computer programs – Communicated or sent to others who do not have an official need to receive the information

The U.S. Attorney for the Southern District of Illinois announced today that Susan L Harris , 28

• f Marissa, Illinois, and Ashley C. Drummond, 25, of East St. Louis, Illinois were

sentenced for aggravated identity theft and conspiracy to commit mail fraud in the U.S. District Court for the Southern District of Illinois, East St.

Louis Division. Harris was convicted following a 2-day jury trial in December 2012 Today, the U.S. District Court sentenced Harris to 4 years in prison, to be

followed by 3 years of supervised release. Harris was ordered to pay

$7,648.97 in restitution and a $200 special assessment. Drummond, who pleaded

guilty in November 2012, was previously sentenced to 2 years in prison, to

be followed by a 3 year term of supervised release. Drummond also was

• rdered to pay $8,675.27 in restitution to various victims and a $200 special

assessment.

Evidence presented at the trial of Susan Harris showed that Harris conspired with Ashley Drummond to steal personal identifying information of patients of a

Southern Illinois hospital. The two women targeted elderly patients, particularly patients who came in to the hospital from the nursing homes and assisted living facilities. Drummond and Harris used the stolen personal information to apply for new credit card accounts in the victims’ names

Drummond was a radiology technician, and it was her job to transport patients to and

from the radiology department as needed. While transporting the patients,

Drummond would steal victims’ personal information from their charts. Harris was later caught on camera at a retail stores using one of the credit

cards obtained with the personal information of a 90-year-old woman who lives in an assisted living center and had been a patient at the hospital where Drummond

worked. The case was investigated by the Southern District of Illinois Identity Theft Task Force, the U.S. Postal Inspection Service, the Internal Revenue Service Criminal Investigation Division, the Social Security Administration Office of the Inspector General, the Maryville Police Department, the Glen Carbon Police Department, and the Collinsville Police Department.

Other recent nationwide reports of breaches

• A Nevada man pleaded guilty to violating HIPAA by using patient records to

generate referrals for personal injury attorneys.

• Medical files were found at a recycling center in Tenn. They contained “graphic

photos” and SS# from potentially 2 medical facilities.

• An unencrypted, password protected desk top computer was stolen from

administrative offices at Sutter Health in Sacramento CA. The computer contained information on about 4 million patients.

• New York Presbyterian Hospital & Columbia University agreed to pay 4.8 million

fine after the health records of more than 6000 people were mistakenly released

• n the Internet.
• 4 employees were fired from University Medical Center in Tucson after 1

employee took a picture of a patient with a cell phone camera.

• Natahsa Orr, 36 of Miami was sentenced to 24 months in prison plus 12 month
• f home confinement followed by 3 years of supervised release for stealing

patient information from the Holy Cross ER during her employment. She used the information to obtain bank account info & obtain debit cards in the patient’s name.

noteworthy facts

• Data breaches are occurring in health care at nearly 3 times the

rate as in banking and finance.

• A thief downloading and stealing data can get $50 on the street

for a medical identification number compared to just $1 for a social security number.

• Victim’s can suffer monetary loss, possible inability to obtain or

retain insurance, and corruption of their medical history.

Breaches involving 500 or more individuals reported to OCR (as of 3/2014)

Breached Patient Information was due to:

Unknown 2% Theft 47% Loss 11% Unauthor Access 18% Hacking 8% Improper Disposal 4% Other 10%

Breaches involving 500 or more individuals that have been reported to OCR

Desktop Computer, 15% Portable Electronic Device, 14% EMR, 2% Network Server, 11% E-mail, 2% Other, 10%

Paper, 23% Laptop, 23% Breached Patient Information was located

• n:

Illinois “Wall of Shame”

Breaching Patient Privacy Requires Notification of the Patient

Breach definition: The unauthorized acquisition, access, use, or disclosure of PHI

which compromise the security or privacy of protected health information, except where an unauthorized person to whom such information is disclosed would not have reasonably have been able to retain such information Applies to paper, electronic or verbal breaches

The healthcare facility MUST:

• notify the individual (patient) within 60 days (of knowledge of breach)

that their PHI has been or may have been accessed, acquired or disclosed as a result of a breach.

• Notification must include:

– Description of what happened – Type of information disclosed – Steps the patient should take to protect themselves from potential harm – Steps SIH is taking to investigate the breach, alleviate any potential harm, and protect against further breaches.

• report breaches annually to Department of Health & Human Services.

Dear Patient: On (date) (SIH/SIMS), became aware of a breach of your personal health information. The breach of your information

• ccurred on or around (date) when you were at the ________ Department. We are notifying you so you can take

personal action along with our organization’s efforts to reduce or eliminate potential harm. The incident involved your protected health information, specifically, your name and ______________ being disclosed to ___________. I recommend that you increase your awareness of any type of communication regarding your personal health information. If you suspect anything unusual please contact the Contact the Consumer Protection Agency in Illinois: (800) 243-0607; http://www.illinoisattorneygeneral.gov/consumers; 1001 East Main Street Carbondale, IL 62901 Southern Illinois Healthcare sincerely apologizes for the inconvenience and concern this incident causes you. The privacy of your personal information is very important to us and we will continue to do everything we can to fortify our

• perational protections for you and others. As a result of this breach SIH took the following actions: ________________

Under the Health Insurance Portability and Accountability Act (HIPAA) you also have the right to file a written complaint with the Director, Office of Civil Rights of the U.S. Department of Health and Human Services at the following address: Office of Civil Rights, U.S. Department of Health and Human Services 233 N Michigan Ave. Suite 240 Chicago IL 60601 Your complaint must describe Southern Illinois Healthcare’s acts that you believe to be in violation of applicable law. A complaint to the Director of Health and Human Services may be submitted either by mail or electronic transmission within 180 days of this date. We will not retaliate against you if you file a complaint with the Director of Health and Human Services.

Example of Breach Notification Letter SIH/SIMS sends to a patient

• If breach involves PHI of 500 patients or more, then SIH will

be required to notify local media and the Department of Health and Human Service

Information is accessible for authorized use and to Authorized users only

• When requested by

the individual (patient), with proper identification

• For treatment of

the individual (example: practitioner caring for the patient)

• For payment purposes (example: sending billing information to

patient’s insurance company), and

• Certain healthcare operations (example: TJC survey, quality

improvement, Peer Review)

Patient’s Privacy Rights Under HIPAA

1. To view and keep a copy of our Notice of Privacy Practices (document patient receives that explains how SIH uses their PHI and their rights regarding their PHI) 2. To view and copy their own protected health information (PHI) found in their medical/billing records 3. To request an amendment to documentation in their medical/billing record they think is inaccurate or

• incomplete. (Example: medical record documents patient

has no allergies. The patient requests their medical record be amended to reflect an allergy to penicillin) 4. To request confidential communication

5. To ask for restrictions on how SIH uses and discloses their PHI for treatment, payment and healthcare

• perations (TPO).

6. To receive an Accounting of Disclosures. A document that identifies disclosures of their PHI made:

– To agencies, work comp, law enforcement, registries, when patient authorization is not required, and/or – accidentally (example, faxed medical records to the wrong place).

7. To complain to SIH or with the U.S. Department of Health & Human Services about privacy violations 8. To opt out of the patient directory – (do not want name

• n hospital publish list (do not want public to know of

hospitalization)

Definitions

• Sensitive Information = Information in any form, including but not

limited to paper, electronic, or oral, which if improperly disclosed could cause damage to the reputation, privacy, image and/or financial viability of the patient, medical staff, employees, board of trustees and/or Southern Illinois HealthCare. – Sensitive information includes, but is not limited to – All individually identifiable health information; – Anything marked or stated as confidential – Employee information; – Financial information; – Guarded Operational Information; – Marketing and general business strategies – Patient billing information; – Physician information; and – Proprietary products and product development

Are you an authorized user of Sensitive Information and PHI?

• Ask yourself . . .

– “Do I need this information to do my job?”

• Two rules of thumb.

Rule 1: Is using or disclosing this information in the best interest

• f the patient?

Yes = Do it and document No = Don’t do it Rule 2: Do I need to access/know this information, (whether paper or electronic) to perform my job function? Yes = Go ahead and access the information No = Don’t even think about accessing the information.

What does protecting health information & sensitive information mean?

• Keeping this information private
• Making sure this information is only accessible to

the appropriate workforce and/or providers

• Safeguarding this information from

unauthorized users

How to keep PHI & Sensitive Information private- paper world

Private

• Medical records/documents are placed in a secure location
• Documents containing identifiable information that can be discarded are

shredded

• Use fax cover sheet
• Timely removal of documents from fax machine tray, printer tray or

copier

• Documents do not leave SIH premises, unless authorized to do so

How to keep PHI & Sensitive Information private – electronic world

Private

• Monitors are turned away from public view
• Patient information is not left up on computer screen
• User ID, passwords are not shared
• PHI is not downloaded/copied on personal storage media such as home

computer, PDA, jump drive, etc

How to keep PHI and Sensitive Information private – verbal world

NO PHI Discussion:

Elevators Smoke Areas

Public or Private Dining Areas

Employee Break Areas Public places – restaurants, bars, etc. Social Networking Sites – myspace, facebook, etc. Hallway Home

Civil and Criminal Penalties for Breaches

• Enforced by Office for Civil Rights & Department of Justice

Unknown Violations $100-$50,000 (not to exceed $1.5 million in calendar year) Violations with reasonable cause $1,000-$10,000 (not to exceed $1.5 million in calendar year) Violations resulting from willful neglect $10,000-$250,000 (not to exceed $1.5 million in calendar year) Violations from willful neglect and not corrected $50,000-$1.5 million( not to exceed $1.5 million in calendar year)

SIH Top 5 HIPAA/Sensitive Information Hot Spots

• Wrongful disclosure due to misdirected fax (example: a fax

number entered incorrectly & sent to an unintended individual/business).

• Patient complaints of breach of confidentiality involving an SIH

employee wrongfully accessing or disclosing the health information of a family member, ex-family member or friend.

• Patient request for an amendment to their medical record

because they are disagreeing with documentation about them entered by a physician or clinician.

• Employee access to their or their family members PHI stored on

Electronic Medical Record (Meditech, Chartmaxx, etc)

• Employee posting SIH job related information on their social

network site*

Know what you’ve signed

Does this document look familiar? This agreement, signed by you, is in your employee file.

More about “Social” Media –

SIH Policy – Applies to use of social media at work and away from work when SIH affiliation is identified, known, or presumed. – Used for approved business related purposes

• Workforce Members

– bound by SIH policies: Confidentiality of Sensitive Information, Internet Access & Usage, Harassment, HIPAA – Abide by SIH: Mission & Values, Compliance Program, Code

• f Ethics & Conduct Standards, Performance Standards,

Guidelines for using Social Media, Marketing guidelines – Have a duty to report a violation of policy to immediate supervisor.

RESPECT, PROTECT, SAFEGUARD

• RESPECT – Patients, Customers, and One Another
• PROTECT – Confidentiality, Privacy & Security
• SAFEGUARD – Properly use SIH Assets

Some Social Media Guidlines

• Do not announce company news. Do not cite or reference patients,

partners or supplies w/o approval or written authorization from Marketing & Communications dept. Only those officially designated by SIH have the authorization to speak publicly on behalf of the company.

• Take responsibility. You are personally responsible for your post. SIH

has the right to review & take action if a violation of policy or law occurs, even in personal blogs, etc.

• Be professional. Statements made in private social media sites, chat

rooms, blogs, must treat the company & its workforce members, customers, and competitors with respect. SIH’s harassment policy applies to the use of social media during both working & non-working hours.

• Be mindful of the world’s longer memory. Everything you say is likely to

be indexed & stored forever.

Confidentiality Policy – Disciplinary Criteria

• Level 1. Failing to demonstrate appropriate care in handling sensitive

information that results in accidental access, incidental access or inappropriate access due to lack of awareness or education. – HIPAA Examples: Employee self access to own PHI, leaving PHI unattended, being away from work area while logged into application containing PHI, inadvertently routing PHI to a wrong recipient, fax sent to the wrong person, business, etc.

• Level 2. Disregard of organization or departmental policy related to the

appropriate use and disclosure of sensitive information – HIPAA Examples: Employee access to family member’s PHI not needed for job related duties, knowingly sharing a password with co- worker, discussing PHI in public areas, such as cafeteria’s, hallways,

• r elevators

• Level 3. Unauthorized access and/or disclosure of sensitive information

– HIPAA Examples: Intentionally exhibiting or divulging (verbal or written) PHI with co-workers or other individuals who are not privy to the information. Posting PHI on Internet sites, such as MySpace, FaceBook, Blogs (NOTE: POSTING OF ANY SENSITIVE INFORMATION ON MySpace, FaceBook Blogs is PROHIBITED).

• Level 4. Purposeful disregard of organizational or departmental

policies. – HIPAA Examples: Seeking personal benefit or permitting

• thers to benefit personally from PHI. Access and/or

disclosing PHI with malicious intent. Repeated disregard of any of the above levels 1-3.

 Encrypt all email containing PHI

addressed to non-sih email addresses.

 Do not send email containing PHI to

your personal email account

 Do not text any type of PHI  Securely store lap tops when

unattended

 Log off of computer when walking

away

 Keep your password confidential

 Turn computer monitors away from public eye-

sight

 Faxing:

 Double check fax numbers  Complete fax cover sheet

 Securely seal mailing envelopes and containers

that contain patient health information

 Before handing a patient medical record

documents make sure the patient name matches the patient name on the documents.

 Refrain from taking pictures in patient care

areas with your personal cell phone.

 Do not post information via social networking

(face book, twitter, etc) that involves patient information you know about from being a workforce member at SIH.