HIPAA for Students Health Insurance Portability and Accountability Act

PHI and Title II This presentation will cover: A.Protected health information (PHI) B.Title II of HIPAA HIPAA laws define and set penalties for fraud and abuse under the following rules: Privacy rule Patient’s rights Security rule Transactions and code sets rule Unique identifiers rule Enforcement rule C.Student considerations

What is Protected Health Information? Protected health information (PHI) is any information that can be used to identify a person, including but not limited to: Name Date-of-birth Social security number Medical record number Information can be written, spoken, or electronic

Protected Health Information- Disclosures Patients may request in advance that health information be shared with certain individuals, such as a family member Certain disclosures do not need the patient’s permission Public health (certain communicable diseases) Adverse drug reactions (reported to FDA) State reporting laws (gunshots, abuse)

Privacy Rule The Privacy Rule protects patients’ information from violations of confidentiality The Rule covers status, treatment, or payment that can be linked to a specific patient Only access and discuss the minimum required information that is necessary to do your job Agencies must keep a record of who has accessed the information and what information was disclosed Take care to shield information from unnecessary viewing Watch for more information.

Patients’ Rights Under HIPAA The Privacy Rule also establishes patients’ rights: To see and copy their health record To update their health record To request correction of any mistakes To get a list of disclosures a health care institution has made independent of disclosures made for the purposes of treatment, payment, and health care operations To request a restriction on certain uses and disclosures To choose how to receive health information (Taylor, Lillis, & Lynn, 2015)

Patients’ Rights Under HIPAA Providers are required to inform patients of their rights Usually via a signed form This should not delay life-saving treatment

Security Rule Providers must keep electronic information safe when stored or sent from one place to another Individual sign-ins and passwords must limit access to only the data need to perform the job Computer screens should be shielded or turned away from public areas Data must be encrypted if in an open network Internal audits are completed routinely and when a suspected lapse occurs Medcom Trainex: HIPAA for Medical Assistants: The Security Rule

Other Rules of Title II Transaction and Code Set Rule Sets up standardized codes and formats for medical and administrative information sent from one place to another Unique Identifiers Rule All providers have a unique 10-digit code Enforcement Rule Establishes disciplinary actions including fines and/or prison

Student Considerations- Know the Laws Do the HIPAA Privacy Rule's minimum necessary requirements prohibit nursing students and other medical trainees from accessing patient medical information in the course of their training? No. The definition of “health care operations” in the Privacy Rule provides for “conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers.” U.S. Department of Health & Human Services

Student Considerations- Know the Laws Patients have the right to access their health information This does not mean you can just hand over the patient’s chart! Follow the agency’s protocol for the release of health information All copies of the patient’s information made for educational purposes must remain attended and not leave the unit Return to clinical instructor or shred copies of information once finished Even confirming/denying a person is (or has ever been) a patient at the facility is considered as a release of medical information Follow the agency’s protocol when answering phone

Student Considerations- Know the Laws Discussion/display of patient information beyond a private education setting is prohibited. Examples include: Conversations with others outside of the “need-to-know” basis Pictures of patients Pictures taken inside agency sites Blogging, video-blogging, social media posting, etc. about clinical experiences Refer to the social media section of the NEP Student Handbook

Identify the HIPAA Violations “I think I saw my neighbor in the ER; I’m going to call his wife later to see what’s going on.” “The baby I helped deliver was so cute! Let me show you this picture I took of her…” “My post about inserting Mr. Smith’s catheter has been ‘liked’ 158 times!” “Mrs. Johnson’s ABG results are the perfect study materials. I printed copies for everyone.” Study Group

Identify the HIPAA Violations- Answers “I think I saw my neighbor in the ER; I’m going to call his wife later to see what’s going on.” Curiosity is not a valid reason to disclose PHI. It is a violation to tell someone about the admission status of a patient. His wife would be notified by the facility if there is an urgent medical need or if he desires. “The baby I helped deliver was so cute! Let me show you this picture I took of her…” It is a violation to take and/or circulate photographs of patients. “My post about inserting Mr. Smith’s catheter has been ‘liked’ 158 times!” Do not discuss patients or clinical experiences outside of the educational clinical setting, in person or electronically. Do not use identifying characteristics such as name. “Mrs. Johnson’s ABG results are the perfect study materials. I printed copies for everyone.” Do not discuss patients by name or identifying characteristics. Do not take copies of any PHI off of the unit and always shred once finished using.