HIPAA Training

• Privacy Rules, effective on April 14, 2004, to:
  • Keep protected health information (PHI) confidential, and
  • Discipline individuals who fail to keep patient information confidential
• Security Rules, effective on April 20, 2005 to:
  • Ensure the confidentiality, integrity, and availability of all electronic protected health information, and
  • Ensure compliance by the workforce.

• There are many federal and state laws that protect the privacy of patients' health information, therefore:
  • All members of OM's workforce receive at least Privacy and Security Awareness Training at orientation and annually thereafter, even if they will not have access to patients or health information. They are also required to sign OM's Confidentiality Statement annually.
  • Visitors and vendors who will have access or potential access to patients or health information are also required to complete OM's Privacy and Security Awareness Tutorial and sign the confidentiality statement.

• If you have access to any patient information, you are responsible for keeping it safe and confidential.
• There are severe consequences for OM if patient privacy or security is violated by anyone who has access to health information.

• All Covered Entities: any person or organization that transmits health information electronically.
• All protect Health Information (PHI): any health information created, received, transmitted, or maintained by a covered entity that...
  • Relates to past, present, or future physical or mental health, the provision of health care, or payment for health care and
  • Identifies the patient, or could reasonably be expected to identify the patient

• Names: not just the patient, but also relatives, employers, and care givers
• Dates: birth, death, admission, injury, service, surgery
• Numbers: medical record, account, Social Security, telephone, VIN, passport, etc.
• Addresses: any geographical area smaller than a state, and not just the patient, but also the relatives and employers (street, PO Box, city, county, ZIP)
• Graphics: photographs, radiographs, video recordings, voice prints, finger prints

• Paper records of all kinds
  • Documents and forms
  • Labels on patient care items
  • Photos and graphics
• Electronic Records
  • Computer-based records
  • Video recordings
• Verbal/oral communications

• Persons who are officially associated with OM may only use PHI for:
  • Treatment
  • Payment
  • Health Care Operations (Quality Assurance, Peer Review, Business Management, Training, Risk Management, etc.)
• ...WITHOUT the patient's authorization

• To those persons who:
  • Have a valid medical need for the information
  • Have a valid business need for the information
  • Are otherwise authorized to know the information
• There are multiple safeguards in place to limit access:
  • Attempts to bypass or override these safeguards is a violation of HIPAA laws and OM's privacy and security policies.

• ...for OM to use or disclose protected health information for any purpose that is NOT related to treatment, payment, or health care operations otherwise required by the law.
• Examples include:
  • Attorney requests
  • Marketing
  • Fundraising
  • Research
  • When the patient wants a copy of their own record

• ...limits uses, disclosures, and requests for PHI to the "minimum necessary" to accomplish the task for which the information is needed.
• The Minimum Necessary Rule does not apply to Treatment! Providers may have all PHI available within state and federal guidelines to treat patients.

• HIPAA Privacy Rules are enforced by the Office of Civil Rights (OCR)
• HIPAA Security Rules are enforced by the Centers for Medicare and Medicaid (CMS)
• Violating the federal Privacy and Security Rules can result in personal liability, either civil or criminal sanctions, including fines, jail time, or both.
• OM Penalties also apply if confidentiality or security of patient information is breached.

• How much is enough?
• How much is too much?
  • Three Types of Disclosures:
    • Incidental
    • Accidental
    • Intentional

• If you are taking reasonable precautions to safeguard a patient's information, and a visitor or another patient happens to hear or see PHI that you are using, you will not be liable for that disclosure. Reasonable precautions include:
  • Keeping your voice low
  • Moving to as private an area as possible
  • Asking patients if they are comfortable with the setting and offering alternatives if you can
  • Covering papers and shielding computer screens in public areas to make them as secure as possible
    • Do not allow unauthorized people (friends, visitors, family members) to view your computer screen (watch over your shoulder) as you access PHI or other restricted information

• A visitor or another patient sees or hears while you are...
  • Viewing records and orally coordinating services at a nursing station or appointment desk
  • Viewing and discussing lab results with a patient or or another provider in a joint treatment area.
  • Discussing a patient's condition with students during rounds in an academic institution
  • Discussing a patient's condition or treatment with the patient or family in a semi-private room

• Mistakes happen... If you disclose PHI in error to an unauthorized person or if you break a security rule that involves PHI...
  • Acknowledge the mistake and notify your supervising department or the Privacy Officer immediately.
  • Learn from the error - change the way you do things, as needed.
  • Assist in correcting or recovering from the error ONLY if instructed to do so. Don't try to "make it right" on your own.

• Disclosing PHI to a person without verifying their identity
• Storing PHI on the hard drive of your computer; the computer is stolen
• Leaving PHI documents in the cafeteria or a waiting room; not able to find them when you go back
• Throwing PHI in a waste receptacle without shredding them
• Leaving OM with PHI documents picked up accidentally; your spouse or roommate happens to read them.

• If you ignore the rules and negligently or deliberately use or disclose protected health information inappropriately, you can expect:
  • OM Disciplinary Action
  • Civil Liability
  • Criminal Charges
    • both for your self and your sponsor

• Accessing patient information outside of your "professional need to know" either from personal curiosity or as a favor for someone else
• Removing original paper or graphic PHI from OM.
• Selling patient information or inappropriately giving it to the media.
• Leaving work areas with access to PHI unlocked with nobody in the area.
• Photocopying PHI and taking it home without authorization and/or without de-identifying the information.
• Discussing patient information in a public hallway or elevator without taking reasonable precautions

• The HIPAA Security Rules require Safeguards:
  • To control access to PHI
  • To prevent loss, theft, and altercation of PHI
  • To minimize the risk of inappropriate disclosures
  • And still maintain the availability of PHI
• OM has implemented multiple safeguards to protect patient privacy
  • Physical safeguards
  • Administrative safeguards
  • Technical safeguards
• ANY ATTEMPT TO BYPASS, DISABLE, or OVERRIDE THESE SAFEGUARDS IS A VIOLATION OF HIPAA LAWS AND OM POLICIES AND PROCEDURES.

• Identification
  • Physicians, staff, students, and visitors visibly display approved ID badges at all times
• Locks, Doors, and other Barriers
  • Lock offices, workspaces, patient care areas, storage rooms, and other areas when vacant
• Document Binders, Folders, and Covers
  • Protect all paper PHI documents in labeled covers
  • Transport paper records so that the names cannot be read
• Position of computer screens, or the user of shields or hoods
  • Unauthorized persons should not be able to read what is on your screen

• Computer accounts: giving you the right level of access so that you can get your job done
  • Controlled and approved by supervisors
  • Accessible only by a unique login and password
• Password Management
  • Passwords must not be shared
  • Passwords must be "strong" and changed often
• Login Restrictions
  • Limited number of login attempts
  • No multiple logins at the same time

• Computer Screen Savers
  • Set to turn on automatically after a period of inactivity
  • Requires a password to re-enter
• Other Computer Applications
  • Encryption software to prevent unauthorized reading or changing of ePHI
  • Software to detect, contain, or remove viruses, trojans, and other malicious software
• Computer Surveillance
  • Your computer activity may be internally logged and audited
  • Workstation use may be monitored

• Policies and procedures that define:
  • Who can document health information
  • How PHI documentation errors are officially corrected
  • How both active and inactive records containing PHI are stored
• Auditing Tools and Procedures
  • To examine the documentation activities in systems containing PHI in paper or organic formats
  • To record and examine activity in systems containing or using electronic PHI
• Integrity Tools
  • • Monitoring systems to confirm that electronic PHI has not been altered or destroyed in an unauthorized manner
    • Assigned responsibilities for securing ePHI during a disaster

• Sharing, posting, or distributing passwords or account access information
• Knowledge of unauthorized use of an account or password by a co-worker, with failure to report the misuse
• Using a OM account or password for unauthorized activities

• Installing or downloading unauthorized computer programs that include or allow the entrance of viruses, worms, or other malicious software
• Failing to secure a workstation with access to or display of confidential information
• Emailing PHI outside of OM
• Posting PHI on the internet in an insecure manner
• Placing unprotected PHI on removable media or devices such as floppy disks, tapes, and CDs

• Disposing of documents, films, cassette, and video tapes, CDs or disks containing PHI
  • Preferred method: shred, deface, or destroy immediately
  • Next best: Place in a secure location for recycling
    • An area that can be locked
    • An area that will be constantly monitored or attended

• They have completed OM Privacy & Security Awareness Training
• They have signed OM's Confidentiality Statement
• They are accompanied by an OM representative

• Privacy Complaint
  • Paper form from the patient or representative
• Privacy and Security Incident
  • Paper form from a member of the workforce
  • Report all known and suspected violations
• Call the OM Privacy Officer
  • 406.237.5050

• Use or disclose health information ONLY for authorized work-related purposes.
• Limit uses, disclosures, and requests to the "minimum necessary" to get your work done.
• Exercise reasonable caution and use your professional judgment to protect all PHI in your control.

• Watch what you say...
  • Watch were you say it...
    • Watch who you say it to...
• What what you store...
  • Watch where you store it...
    • Watch how you store it...

You have successfully completed OM's Training for Privacy and Security Awareness!

Click "Next" to take your test.

If you have any questions, contact the Privacy Officer at 406.237.5050.