HIPAA Minimum Necessary: Use/Disclosure & Role-based Access  Charlene Dunbar Madonna Rehabilitation Hospital  Sheila Wrobel Nebraska Health System.

Slides:

Advertisements

Similar presentations

HIPAA Privacy Practices. Notice A copy of the current DMH Notice must be posted at each service site where persons seeking DMH services will be able to.

Advertisements

Minimum Necessary Standard Version 1.0

HIPAA Privacy Rule “Standards for Privacy of Individually Identifiable Health Information” 45 CFR 160 and 164* *

1 The HIPAA Privacy Rule and Research This presentation will probably involve audience discussion, which will create action items. Use PowerPoint to keep.

NATIONAL FORUM ON YOUTH VIOLENCE PREVENTION: HIPAA PRIVACY RULE CONSIDERATIONS November 1, 2011 Iliana L. Peters, JD, LLM HHS Office for Civil Rights.

COBB/DOUGLAS COMMUNITY SERVICES BOARD Confidentiality and Privacy of Consumer Information.

HIPAA – Privacy Rule and Research USCRF Research Educational Series March 19, 2003.

Increasing public concern about loss of privacy Broad availability of information stored and exchanged in electronic format Concerns about genetic information.

What is HIPAA? This presentation was created by The University of Arizona Privacy Office, The Office for the Responsible Conduct of Research on March 5,

1 Louisiana Department of Health and Hospitals Basic HIPAA Privacy Training: Policies and Procedures 01/09/

TM The HIPAA Privacy Rule: Safeguarding Health Information in Research and Public Health Practice Centers for Disease Control and Prevention Beverly A.

Professional Nursing Services.  Privacy and Security Training explains:  The requirements of the federal HIPAA/HITEC regulations, state privacy laws.

Health Insurance Portability Accountability Act of 1996 HIPAA for Researchers: IRB Related Issues HSC USC IRB.

August 10, 2001 NESNIP PRIVACY WORKGROUP HIPAA’s Minimum Necessary Standard Presented by: Mildred L. Johnson, J.D.

University of Miami1 HIPAA Survival Skills An Introduction to HIPAA and Research University of Miami Human Subjects Research Office October 31, 2006 Evelyne.

Medical Records in Court: Life after HIPAA North Carolina Conference of Superior Court Judges, October 2003 Presented by Jill Moore, UNC School of Government.

1 Developed by: U-MIC To start the presentation, click on this button in the lower right corner of your screen. The presentation will begin after the.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA Collaborative of Wisconsin PAYMENT, COLLECTIONS, AND ACCEPTED BENEFITS FURTHER DEFINITION OF THE PRIVACY RULE Copyright HIPAA Collaborative.

HIPAA PRIVACY AND SECURITY AWARENESS.

1 Research & Accounting for Disclosures March 12, 2008 Leslie J. Pfeffer, BS, CHP Office of the Vice President for Research Administration Office of Compliance.

HIPAA The Privacy Rule Health Insurance Portability and Accountability Act of 1996 (HIPAA) The 104 th Congress passed the Act, Public Law ,

1 Disclosures © HIPAA Pros 2002 All rights reserved.

1 HIPAA OVERVIEW ETSU. 2 What is HIPAA? Health Insurance Portability and Accountability Act.

“HIPAA Beyond April 14, 2003” n “BUILDING HIPAA COMPLIANCE” Beyond April 14, 2003”

Computerized Networking of HIV Providers Workshop Data Security, Privacy and HIPAA: Focus on Privacy Joy L. Pritts, J.D. Assistant Research Professor Health.

HIPAA – How Will the Regulations Impact Research?.

NE SNIP PRIVACY WORKGROUP Use and Disclosure of Protected Health Information Regarding a Deceased Individual.

HIPAA Michigan Cancer Registrars Association 2005 Annual Educational Conference Sandy Routhier.

H I P A A T R A I N I N G Self Directed Module 7 Research Disclosures For Data Custodians START Click to begin…

HIPAA SURVIVAL SKILLS: An Update University of Miami1 Marisabel Davalos, M.S.Ed., CIP Associate Director of Educational Initiatives November, 2008.

Health Insurance Portability and Accountability Act (HIPAA) CCAC.

Copyright © 2009 by The McGraw-Hill Companies, Inc. All Rights Reserved. McGraw-Hill Chapter 6 The Privacy and Security of Electronic Health Information.

Health Insurance Portability and Accountability Act of 1996 HIPAA Privacy Training for County Employees.

© 2013 The McGraw-Hill Companies, Inc. All rights reserved. Ch 8 Privacy Law and HIPAA.

HIPAA BASIC TRAINING Presented by Anderson Health Information Systems, Inc.

HIPAA BASIC TRAINING MODULE 1C – Overview (For staff who do not generally create Protected Health Information) Anderson Health Information Systems, Inc.

HIPAA PRACTICAL APPLICATION WORKSHOP Orientation Module 1B Anderson Health Information Systems, Inc.

HIPAA THE PRIVACY RULE. 2 HISTORY In 2000, many patients that were newly diagnosed with depression received free samples of anti- depressant medications.

OHCAs, ACEs and Hybrid Entities Paul Smith Davis Wright Tremaine LLP One Embarcadero Center Suite 600 San Francisco, CA (415)

Rhonda Anderson, RHIA, President  …is a PROCESS, not a PROJECT 2.

A Professional Corporation Stinson, Mag & Fizzell (402) Business Associates 101 Jennifer Wolfe Jerram, B.S.N., J.D.

1 Privacy Plan of Action © HIPAA Pros 2002 All rights reserved.

HIPAA Training Workshop #1 Council of Community Clinics – San Diego February 7, 2003 by Kaye L. Rankin Rankin Healthcare Consultants, Inc.

Federal Preemption, and State Healthcare Privacy and Data Security Law and Regulation Fifth National HIPAA Summit October 30 – November 1, 2002 Mark Barnes.

HIPAA Overview Why do we need a federal rule on privacy? Privacy is a fundamental right Privacy can be defined as the ability of the individual to determine.

PwC Issues in HIPAA Research Compliance William R. Braithwaite, MD, PhD “Dr. HIPAA” HIPAA Summit 6 Washington, DC 27 March 2003.

CAN THE CANNED FORMS: Practical Advice in Implementing HIPAA Privacy Policies and Forms Margaret Marchak, Esq. Rachel Nosowsky, Esq. HIPAA Summit West.

HIPAA Training. What information is considered PHI (Protected Health Information)  Dates- Birthdays, Dates of Admission and Discharge, Date of Death.

Final HIPAA Privacy Rule: The Research Provisions Julie Kaneshiro DHHS Office for Human Research Protections Phone: Fax:

Juvenile Legislative Update 2013 Confidential Records and Protected Disclosures.

UNDERSTANDING WHAT HIPAA IS AND IS NOT

Enforcement, Business Associates and Breach Notification. Oh my!

To start the presentation, click on this button in the lower right corner of your screen. The presentation will begin after the screen changes and you.

The HIPAA Privacy Rule: Implications for Medical Research

HIPAA CONFIDENTIALITY

HIPAA Administrative Simplification

HOGAN & HARTSON, L.L.P. “Publications” “Health”

Paul T. Smith Davis Wright Tremaine LLP

HIPAA Pros - Disclosures

Disability Services Agencies Briefing On HIPAA

HIPAA Pros - Minimum Necessary

A Patient has the Right to…..

The HIPAA Privacy Rule and Research

National Congress on Health Care Compliance

Issues in HIPAA Research Compliance

Analysis of Final HIPAA Privacy Modification Rule

Research Compliance: The Research/Privacy Nexus

Strategies to Comply with the HPAA Privacy Rule Before the HIPAA Security and Enforcement Rules are Final Presented by: Steven S. Lazarus, PhD, FHIMSS.

HIPAA, The Next Level: HIPAA Preemption of State Laws

Presentation transcript:

HIPAA Minimum Necessary: Use/Disclosure & Role-based Access  Charlene Dunbar Madonna Rehabilitation Hospital  Sheila Wrobel Nebraska Health System

Privacy Regulation Citations  45 CFR (b): Minimum Necessary General Standard When using or disclosing PHI or when requesting PHI from another CE, a CE must make reasonable efforts to limit PHI must make reasonable efforts to limit PHI to the minimum necessary to accomplish to the minimum necessary to accomplish the intended purpose of the use, disclosure, the intended purpose of the use, disclosure, or request or request

Privacy Regulation Citations  (b) requirements do not apply to: –Disclosures to or requests by a health care provider for treatment –Uses/disclosures to the individual –Uses/disclosures pursuant to an authorization –Disclosures made to DHHS Secretary –Uses/disclosures required by law ( (a)) –Uses/disclosures required to comply with the Privacy Rule Privacy Rule

Privacy Regulation Citations  45 CFR § (d): Minimum Necessary Implementation Specifications (1-5) (d)(1): To comply with 502(b), must follow d(2-5) (d)(2): Role-based Access: A) Identify workforce persons or classes of persons who need PHI to carry out their duties; and B) For each, identify categories of PHI needed, and any conditions appropriate to such access any conditions appropriate to such access ** CE must make reasonable efforts to limit access of PHI consistent with defined categories consistent with defined categories

Implementing Role-based Access 1) Create matrix: Category of PHI Class of Persons History & Physical Labs Progress Notes Etc. Physicians Floor Nurses Billing Clerks Lab Techs

Implementing Role-based Access 2) Incorporate PHI access into job descriptions &/or computer security access matrices & reference them in access matrices & reference them in Use & Disclosure of PHI/Minimum Necessary policy. Use & Disclosure of PHI/Minimum Necessary policy. 3) Other examples?

Minimum Necessary Implementation Specifications  § (d)(3): MN Disclosures of PHI (i): Routine and recurring disclosures - “MN” policies & procedures; protocols (ii): Non-Routine disclosures a. Develop “MN” criteria and b. Review on individual basis  See attached Disclosure flowchart & policy

Minimum Necessary Disclosures of PHI (cont.) (iii) May reasonably rely on requested disclosure as being “MN” if disclosure to: * a. Public official under * a. Public official under b. Another CE *c. Workforce professional or BA *c. Workforce professional or BA d. Researcher pursuant to (i) i. IRB/Privacy board waiver ii. Review preparatory to research iii. Research on decedent’s PHI (*must represent information requested is MN for stated purpose)

Minimum Necessary Implementation Specifications  § (d)(4): MN Requests for PHI –When a CE requests PHI from another CE, must limit requests to “MN” (i) Routine/recurring requests: - “MN” policies & procedures; protocols - “MN” policies & procedures; protocols (ii) Non-routine requests: (ii) Non-routine requests: a. Develop “MN” criteria a. Develop “MN” criteria b. Review on individual basis b. Review on individual basis

Minimum Necessary Implementation Specifications  § (d)(5): Other Content Requirement –CE may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as “MN”.  “Re-disclosures”: a CE may disclose a complete medical record, including portions that were created by another provider, assuming that the disclosure is for a purpose permitted by the Privacy Rule.(10/2/02 OCR FAQ)

Attachments  MRH Disclosure of PHI Flowchart (draft)  MRH Disclosure of PHI - MN Policy (draft)  NHS Request for PHI Worksheet (draft)  NHS Research Preparation Request (draft) Questions?