Quality Integrity Stewardship Courtesy Care Accountability Medical Records ARMA Florida Gulf Coast Chapter Michael Spake Lakeland Regional Medical Center February 21, 2012

Quality Integrity Stewardship Courtesy Care Accountability Medical Records  Past  Present (HIPAA)  Future (the Digital Age)

Quality Integrity Stewardship Courtesy Care Accountability HIPAA  Privacy Rule  Security Rule  HITECH Act (Health Information Technology for Economic and Clinical Health Act ) Enforcement Breach Notification

Quality Integrity Stewardship Courtesy Care Accountability HIPAA Privacy Rule  How a hospital may use patient information: Treatment Payment Hospital Operations  Quality Assessments, Protocol Development, Medical Staff Credentialing, Business Management/Development Role Based Access

Quality Integrity Stewardship Courtesy Care Accountability HIPAA Privacy Rule  How a hospital may use patient information: Fundraising Marketing Facility Directory Individuals/Family Involved in your care Business Associates

Quality Integrity Stewardship Courtesy Care Accountability HIPAA Privacy Rule  How a hospital may use patient information: Required by Law To Avert Serious Threat to Health and Safety Coroners, Funeral Directors, and Medical Examiners National Security

Quality Integrity Stewardship Courtesy Care Accountability HIPAA Privacy Rule  Patient Rights Right to Inspect and Copy Right to Amend Right to an Accounting of Disclosures Right to Request Restrictions Right to Request Confidential Communications Complaints

Quality Integrity Stewardship Courtesy Care Accountability HIPAA Security Rule  Administrative Safeguards Risk analysis, role-based access, malware and virus protections  Physical Safeguards Contingency operations, Facility access controls, data backup and storage  Technical Safeguards Access controls, Encryption, Integrity Controls

Quality Integrity Stewardship Courtesy Care Accountability HITECH  Breach Impermissible use or disclosure that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual.  Notification Patients be notified of any unsecured breach Notice to prominent media outlets within the State or jurisdiction if a breach of unsecured PHI affects or is reasonably believed to affect more than 500 residents of that State or jurisdiction Notice to the Secretary by covered entities immediately for breaches involving more than 500 individuals and annually for all other breaches. Posting by the Secretary on an HHS Web site of a list that identifies each covered entity involved in a breach in which the unsecured PHI of more than 500 individuals is acquired or disclosed

Quality Integrity Stewardship Courtesy Care Accountability HITECH  Enforcement The HITECH Act (enacted as part of the American Recovery and Reinvestment Act of 2009) increased the maximum penalties for HIPAA violations from $100 per day (with a $25,000 annual cap) to $50,000 per day of violation and a $1.5 million annual cap for the same violation

Quality Integrity Stewardship Courtesy Care Accountability HITECH  A total of 385 breaches of protected health information (PHI) affecting over 19 million records have been reported since the August 2009  Fifty-nine percent (59%) of all breaches in 2011 involved a Business Association.

Quality Integrity Stewardship Courtesy Care Accountability HIPAA  Saint Francis Health System (Oklahoma) 1 computer (84,000 patient records) x $282 = $23,688,00  Henry Ford Health System (Michigan) 1 flash drive (2,777 patient records) x $282 = $783,114

Quality Integrity Stewardship Courtesy Care Accountability The Future  June 15, 2012 Lakeland Regional Medical Center will “Go-Live” with its Electronic Medical Record Regional Health Information Exchange Personal Health Records  Social Media: LRMC will be launching its Facebook Page in the near future  Employer Sponsored Wellness