HIPAA Do’s and Don'ts: What is Really Behind Protected Health Information (PHI) and Health Care Privacy Rules Paul Sisler, Director, Information Services; Corporate Compliance Officer; Privacy Officer; Information Security Officer, The Center for Health Care Services psisler@chcsbc.org 210-731-1300 ext. 203

HIPAA Background Insurance Portability Administrative Simplification 1. Standard Codes and Transactions 2. Information Security 3. Privacy of Protected Health Information 4. Identifiers

HIPAA Privacy The Privacy Rules grant patients a series of Rights to control use and disclosure of their own Protected Health Information (PHI): To review their own records To amend and/or append their own records To direct future non-disclosures To complaint against improper disclosures

HIPAA Privacy PHI can be exchanged between covered entities with the patient’s authorization. PHI can be exchanged between covered entities without the patient’s authorization under the following circumstances: For health care treatment For health care payment For health care operations

HIPAA Privacy Other exceptions to disclosing PHI without the patient’s authorization: For public health activities To address a serious threat to health or safety For law enforcement purposes For judicial and administrative proceedings For national security and intelligence activities To Advocacy, Inc. to investigate complaints To TFPS, if its an alleged case of abuse/neglect/exploitation For governmental programs providing public benefit

HIPAA Privacy Obtaining written authorizations prior to any PHI exchange is always good practice Obtaining written authorizations is required for any reason beyond treatment, payment, or health care operations

HIPAA Privacy The Minimum Necessary Rule Notice of Privacy Practices Designation of staff processing PHI exchanges Reporting possible breaches/violations

HIPAA Privacy Key rulemaking comment and interpretation: “The privacy rules, along with the other administrative rules relating to HIPAA, are intended to improve health care efficiency and effectiveness. They are not intended to be an impediment to proper health care treatment and operations”.

Privacy Compliance Issues CHCS reviews and monitors all programs and program locations for consumer privacy compliance on an ongoing basis. Recent areas of concern (reported by Privacy Officer): Leaving sensitive consumer documents with PHI on desks and/or work space Offices often unattended/unlocked with non-secured PHI Computers left unattended while logged in to system Not disposing of documents in secure shredder containers Leaving sensitive documents in copier rooms, on copiers, on or adjacent to fax machines in un-secure locations. Faxed consumer items should be sent only to secure fax machines located in medical records areas. NEED UPDATED INFO FROM PAUL

Reasonable Safeguards Speak quietly when discussing a consumer’s condition with family members in waiting rooms or other public areas Avoid using consumer names in elevators and hallways Secure documents in locked offices and cabinets Use Fax Coversheets with CHCS confidentiality statement at all times Some examples of Reasonable Safeguards include: (a) speaking quietly when discussing a consumer’s condition with family members in a waiting room or other public area (b) avoid using consumer names in hallways, elevators unless really necessary (c) posting signs to remind employees to protect consumer privacy (d) securing documents in locked offices or file cabinets using passwords and other securing measures on computers Each office will be developing reasonable safeguards – specific to their tasks and set-up. Please talk with your supervisor about the reasonable safeguards that will be followed in your work area. Use passwords and other security measures on computers.

Safeguard Standard For internal communications when dealing with management issues or complaints, any time PHI of a current or former consumer is present in the subject documentation, such as a complaint letter or email, that PHI will be removed/redacted (edited) by the first recipient prior to re-distributing or forwarding the communication. Ex: a multi-subject email or memo full of management and staff complaints, and a consumer happens to be identified in that email because it is a mixed-subject communication. Any recipient of that email would need to redact (or erase) the PHI information before sending it on or responding to any other person. In such instances, the Privacy Officer should be consulted for appropriate and accurate actions. Is this covered in IS orientation???

Paul Sisler, CHCS Privacy Officer and Director of Information Services Privacy Violations All possible violations of protected health information (disclosing private information about a consumer to someone who does not have the authorization or need to know) should be reported to the CHCS Privacy Officer: Paul Sisler, CHCS Privacy Officer and Director of Information Services 210-731-1300 ext. 203 psisler@chcsbc.org Check job title

HIPAA Privacy Questions and Answers