No No, Yes Yes: Simple Privacy & Information Security Tips Krista Barnes, J.D. Senior Legal Officer and Director, Privacy & Information Security, Institutional Compliance Office Presentation to GSBS - Fall 2018

Protected health information (PHI) = health info + identifying info Simple Privacy & Information Security Tips No No Using your personal email to send or receive confidential information Emailing PHI to unauthorized people/emails Storing MDACC confidential information in DropBox or other cloud locations Posting about patients on social media Looking up friends and coworkers’ medical records Yes Yes Using your work/school email to send confidential information Emailing PHI only to authorized colleagues; Using Box for MD Anderson for cloud storage Getting a patient’s HIPAA Authorization before posting about them (or just not doing it) Accessing medical records for work-related reasons only This is what I read these days. Protected health information (PHI) = health info + identifying info

The 18 HIPAA Identifiers Names (including initials); All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code as long as there are more than 20,000 people in the area for those initial three digits; All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, treatment dates; and all ages over 89 (can be combined into a “90 and over” category); Phone numbers; Fax numbers; E-mail addresses; Social security numbers; Medical record numbers Health plan beneficiary numbers; Account numbers; Certificate/license numbers; Vehicle identifiers and serial numbers, including license plate numbers; Device identifiers and serial numbers; Web Universal Resource Locators (URLs); Internet Protocol (IP) address numbers; Biometric identifiers, including finger and voice prints; Identifiable photos; and Any other unique identifying number, characteristic, or code (unless totally unrelated to any other identifying info and cannot be re-identified except by person who holds the key) The OCR stars in

Simple Privacy & Information Security Tips Yes Yes No No No No Storing information on a random USB thumb drive you found in your bag Writing and submitting case reports that aren’t de-identified Leaving your computer and stacks of paper from work in your car Texting your coworkers about patients on your personal phone Storing information in approved institutional locations Getting written HIPAA authorization before using a patient’s information to write a case report (or call me) Taking your bag or computer with you when you go into restaurants or stores Emailing your coworkers/other students using work/school email Yes Yes

POP QUIZ You’re eating in one of the cafes on campus and you see your mom’s favorite celebrity eating at one of the tables. You very covertly take a picture with your camera phone and post it to Facebook, so your mom can see it. After all, it’s not like you were in the celebrity’s medical record; the celebrity was right there in a public area. Is this OK? No no. May be a breach (if the celebrity is indeed a patient). You must protect PHI, regardless of where you get it. Do not do this.

POP QUIZ #2 You’re helping an MD Anderson PI and a collaborator from UT Health Science Center on a research study. The data relates to live human subjects, and is stored in a spreadsheet that you saved to the MD Anderson server. It contains medical record numbers, study ID numbers, treatment dates, diagnoses, and drugs administered. The collaborator wants you to send him the data on a CD. Should you? No no. CDs aren’t encrypted. This isn’t a good way to share data. The MD Anderson PI is on vacation and wants you to put it on Dropbox (online cloud sharing/storage) so she can view it remotely while on vacation. Should you? No no. Dropbox isn’t approved for storing MD Anderson PHI. If your protocol allows, use Box for MD Anderson.

Who You Gonna Call? What to do if a privacy incident occurs: Report incidents quickly to: Institutional Compliance Office at 713-745-6636 or Privacy Hotline at 1-888-337- 7497 Document everything Report to the PI & the IRB as unanticipated problem (if research) Report lost or stolen computers, phones, iPads, jump drives to: UTPD: 713-792-5890 4-INFO: 713-794-4636 Asset manager, if applicable

No No Yes Yes Questions Krista Barnes, Senior Legal Officer, Privacy & Information Security Compliance 713-792-2511 kmbarnes@mdanderson.org