CONFIDENTIALITY GUIDELINES FOR PA STAFF Based on HIPAA Regulations & General Confidentiality Protocols

What is HIPAA? A federal law Geared to improve the health insurance system Defines rules for protection of patient information  More on that later

Does the PA Have to Comply w/ HIPAA? Yes, it’s recommended HIPAA guidelines cover three basic groups:  Health plans, health care providers, and health care clearinghouses.  Expansive regulatory definition of health plan above includes: Employee benefit plans

But We’re Not A Health Plan! True, but we are:  An organization that routinely handles protected health information from a health plan, in any capacity, is in all probability a covered entity.  Routinely handles, includes: “administration” The PA is likely considered the plan administrator However, this hasn’t been officially determined In the meantime, better to err on the side of caution

We Contract w/ A Health Plan Business associate contracts required by HIPAA  Organizations performing functions involving PHI on behalf of “covered entities” would be reached.  The PA is considered a business associate of the AAH, Delta & EyeMed How does that business association effect all PA staff?  All PA staff are supposed to comply  Behavior of individuals in the business associates' workforces would be covered by HIPAA rules.

What Does the PA Have to Do to Comply? Generic requirements for covered entities:  Training workforce members so that they understand the privacy procedures  Designating a privacy office/officer  Adopting adequate security policies and procedures for records containing individually identifiable health information

What Am I Protecting? Patient information PHI  Individually identifiable health information

What is Patient Information? Patient information, a.k.a “patient health information,” is:  “Any information, whether oral or recorded in any form or medium that is…  “Created or received by an employer...” and  “Relates to the provision of health care to an individual…” or  “…the past, present, or future payment for the provision of health care to an individual."

What is PHI? (Protected Health Information) Protected health information includes any individually-identifiable health information. Health information with data items which reasonably could be expected to allow individual-identification. Individually-identifiable health information should not be interpreted narrowly Beyond a patient's name and social security number, other information:  Spouse's name, & emergency contact individual and number, could be used to individually identify a patient.

HIPAA Privacy Rule Mandates the protection and privacy of all protected health information. Specifically defines the disclosures of "individually-identifiable" health info.

What If I Don’t Handle Medical Information? You should still abide by general confidentiality protocols for sensitive information Let’s learn  What confidentiality means  What’s considered confidential  How to handle confidential data

Confidentiality Confidentiality defined by the International Organization for Standardization (ISO)  “Ensuring that information is accessible only to those authorized to have access"  Adaptation of the military's "need-to-know" principle  Forms the cornerstone of information security today

Sensitive Data- What is It? Why Keep It Confidential? Data required to hire, pay, and manage employees is by nature sensitive. Information could be misused to commit fraud, discrimination, and other violations.  Job discrimination based on breech of medical data or DOB  Identity theft If data is misused, employer could face costly lawsuits. Employer may lose employee trust and confidence

How Do Other Employers Handle Sensitive Information? Most employers voluntarily protect employee’s personal information  They follow the laws willingly Abide by current laws  Laws passed to protect employee confidentiality include: ADA (federal) HIPAA (federal)  State laws limit how an employee's SSN number can be used or transmitted Information Practices Act of 1977 On PA M:/ drive

Protocols for Handling Sensitive Information Develop policies that address workplace confidentiality Train managers and supervisors about confidentiality issues and legal requirements Guard against indiscreet behavior  Even seemingly minor incidents Tossing sensitive info. in the trash Speaking too loudly where other’s can overhear Leaving employee data displayed on visible monitor Coordinate with external employee services  Benefit providers, payroll services (HRM), outsourced HR service centers (HRM)

More Protocols (General) for Handling Sensitive Information Store confidential information securely  Traditional “lock & key” for hard copies  Electronic methods for electronic data Firewalls, encryption, password protection Secure disposal Stay current on legal requirements and best practices  Professional HR associations are a good source of updates  You also can attend seminars sponsored by consulting, outsourcing, and law firms

Confidentiality “How To”: Begin with Mindfulness Develop your confidentiality “higher consciousness”  Keep confidentiality in the forefront of your mind Continually ask yourself, “Am I dealing with something considered sensitive or confidential?” Hone your “Spidey” confidentiality sense Make peace with confidentiality protocols  Don’t fight them, adopt them

Confidentiality “How To” Best: exchange sensitive files via secure FTP Good: zip & encrypt files; send via  Win Zip or other software OK: password protect docs w/ out zipping; send via Turn monitor off if displaying sensitive info.  Monitor off & lock computer (cntrl, alt,del) if away from desk for more than a minute or two

More Confidentiality “How To” Keep your voice down  Don’t discuss/share sensitive info. where others can hear you  Just close the door Keep hard copies in a locked file cabinet  Restrict access to locked cabinet Use file folders to keep hard copy docs from public view when working with them

Even More Confidentiality “How To” Tell callers that you are bound by State & Federal laws that limit what you can discuss Steer callers away from disclosing personal medical information/sensitive info. if not necessary  The less you know, the less you may potentially misuse