What is HIPAA? Health Insurance Portability and Accountability Act of HIPAA is a major law primarily concentrating on the prolongation of health insurance coverage for individuals who leave their jobs. Regulates provisions for pharmacies with respect to information privacy, security, transaction and code sets, and identifiers.

What is Required by the General Rules? All covered entities (pharmacies) must give notice to all patients before using the minimum necessary amount of protected health information for treatment, payment, or health care operations.

Protected Health Information (PHI) Individually-Identifiable Patient Health Information Basically all traditional patient chart/profile information that can be linked to a specific patient – Includes patient electronic and paper records – Work in progress documents – Trash and casual conversations

Examples of PHI Name Address Birth date Gender Fax/Phone number Medical records number Photographs Employer address Names of relatives Finger or voice prints Drivers license number/SSAN Any other unique identifier (prescription number?)

Who Needs to Comply? Providers Health Care Practitioners Health Care Provider organizations Managed Care and other “Plans” Information clearing houses, universities “Others” dealing with Protected Health Information

Who Needs to Comply? Who Needs to Comply? (continued) All Health Care Professionals All technical support personnel All people with access to confidential health information Others with access to patient data (clerks, secretaries, custodians, volunteers, students/faculty)

What does it mean to the patient? Patient acknowledgement of Notice of the HIPAA regulation Patient’s rights associated with the regulation Patients determine, in certain circumstances, the use of their Protected Health Information

What does it mean to the pharmacy? Obligation to notify and receive acknowledgement of the HIPAA regulation Train entire staff regarding HIPAA regulations Obtain patient authorization for the marketing use of Protected Health Information Store and maintain signature logs (manual and/or electronic) acknowledgement of receipt of Notice of Privacy Practices notices-forms and patient authorizations for six years Maintain and protect the confidentiality of Protected Health Information in accordance with the HIPAA regulations

Patient Consent Consent no longer required (optional) Signed Acknowledgement of receipt of Notice of Privacy Practices (NOPP) now required (mandatory) Signed acknowledgement of NOPP required even when consent is obtained.

What Does Basic Consent Give Permission to do? Basic treatment (filling the prescription and oral counseling) Insurance billings Health Care Operations – Database management – Software/hardware maintenance – “Other” limited acts

When is Consent (NOPP) Not Required? Disclosure to the patient themselves Law enforcement investigations (use with care) National security ( ) Required government reporting Other situations (probably rare, but could include local disasters, riots, etc.)

Examples of Exempted Communications Counseling and DUR Alternative treatment or therapies Therapeutic substitutions Drug recommendations Disease State Management Plan coverage and formularies Other product and service recommendations

SampleAuthorizationForm

SampleAcknowledgementLog

Sample Notice of PrivacyPractices

Enforcement Office of Civil Rights (just like ADA) All documents must be retained for six years Complaint response Lawsuits $250,000 fine and ten years in prison

What must a pharmacy do? Appoint a Privacy Officer Create a privacy policy about the handling of Protected Health Information Jot down all requests for protected patient information to identify types of disclosures that need to be included in the privacy policy Check the physical store environment to ensure prevention of “others” overhearing protected health information Train all personnel on the pharmacy’s privacy policy, make documentations Document Organization Check with software vendors to ensure your pharmacy dispensing system is HIPAA compliant Review contracts with business associates and make any necessary changes Evaluate any other circumstances or activities where HIPAA may have an impact

Other Sources of Information Health and Human Services National Council for Prescription Drug Programs National Association of Chain Drug Stores

Questions?