HIPAA BASIC TRAINING MODULE 1C – Overview (For staff who do not generally create Protected Health Information) Anderson Health Information Systems, Inc.

WHAT IS HIPAA?  Protect privacy and security of health information  Improve continuity of health insurance coverage and transfer of information about the person

WHAT IS HIPAA? -2  Federal law signed in 1996 authorizing development of regulations that: Relates to how we bill for a resident. Relates to how we bill for a resident. How we protect the resident’s private health information; more than the medical record, i.e. Social Security #, insurance #, birth-date, etc. How we protect the resident’s private health information; more than the medical record, i.e. Social Security #, insurance #, birth-date, etc.

THIS HIPAA TRAINING FOCUSES ON…  The Privacy Regulation Steps that must be taken to protect individually identifiable health information Steps that must be taken to protect individually identifiable health information Sets standards to restrict, limit and account for access to individual health records Sets standards to restrict, limit and account for access to individual health records Compliance deadline of 4/03 and continues Compliance deadline of 4/03 and continues Steps that must be taken to protect individually identifiable health information Steps that must be taken to protect individually identifiable health information

THIS HIPAA TRAINING FOCUSES ON -2  The Privacy Regulation Sets standards to restrict, limit and account for access to individual health records Sets standards to restrict, limit and account for access to individual health records Compliance deadline of 4/03 and still required in Compliance deadline of 4/03 and still required in

TRAINING OBJECTIVES  Will identify elements of the following: Privacy Rule / Notice of Privacy Practices Privacy Rule / Notice of Privacy Practices HIPAA RIGHTS HIPAA RIGHTS Privacy Official Privacy Official Complaint Process Complaint Process

PRIVACY RULE APPLIES TO  Health Care Providers Your facility is a health care provider Your facility is a health care provider  Health Plans Blue Shield, Kaiser, HMOs and Medi-Cal Blue Shield, Kaiser, HMOs and Medi-Cal

CONTINUING CULTURAL CHANGE  Impact of Privacy Rule Implementation including facility’s changes to: POLICIES POLICIES PROCEDURES PROCEDURES PRACTICES – i.e., conversations; care where medical records or other resident documents are kept PRACTICES – i.e., conversations; care where medical records or other resident documents are kept

FUNDAMENTAL PURPOSE OF PRIVACY RULE  Establish standards for Protection of Health Information Relates to past / present / future physical or mental health conditions Relates to past / present / future physical or mental health conditions Identifies the individual OR information that can be used to identify the individual Identifies the individual OR information that can be used to identify the individual

FACILITIES ARE REQUIRED  By federal and state law to : Maintain the privacy of health information Maintain the privacy of health information Provide notice of facility’s privacy practices TO THE RESIDENT, CONSERVATOR, REPRESENTATIVE Provide notice of facility’s privacy practices TO THE RESIDENT, CONSERVATOR, REPRESENTATIVE

PHI - PROTECTED HEALTH INFORMATION  Includes PHI transmitted/maintained Electronically – computer, Electronically – computer, In any other form or medium – disk, fax, paper, and orally In any other form or medium – disk, fax, paper, and orally Can you identify other records that might be seen by staff who do not need the information to do their job duties? Can you identify other records that might be seen by staff who do not need the information to do their job duties?

PRIVACY PRACTICE

PRIVACY – A WELL ESTABLISHED ‘ RIGHT’…  The HIPAA Privacy Regulation grants six rights to individuals regarding their health information: Confidential Communication Confidential Communication Access to and copies of health information Access to and copies of health information May request amendments to their health information May request amendments to their health information

PRIVACY – A WELL… -2  The HIPAA Privacy Regulation grants six rights to individuals regarding their health information (cont): Upon request, must be given an accounting of disclosures of their health information to others. Upon request, must be given an accounting of disclosures of their health information to others. Upon request, must be given a paper copy of the Notice of Privacy Practices. Upon request, must be given a paper copy of the Notice of Privacy Practices. May request restrictions on the uses and disclosures of health information May request restrictions on the uses and disclosures of health information

RIGHTS PRACTICE SESSION  You are working near the nursing station and find resident documents on the floor what should you do?  Confidential resident information is destroyed how?

RIGHTS PRACTICE SESSION -2  You are working and can overhear a conversation about a resident. What should you do? Close the door if possible. Close the door if possible. Leave the area. Leave the area. Let the staff know you can hear. Let the staff know you can hear.

RIGHTS PRACTICE SESSION -3  The nursing staff are discussing a resident’s behavior and medications at an open nursing station where you can over hear the conversation and visitors are in a nearby room. 1.Is this protection of health information? 2. What should be done?

PRACTICE SESSION  You see paper in the trash can with names on it and some other writing.  What would you do?

PRACTICE SESSION  You over hear the kitchen staff person talking about a resident’s illness and special food requirements. What would you do?  Was this o.k.?  Why?

PRIVACY OFFICIAL  Addressed in Administrative Requirements  A Privacy Official has been designated for each Facility who is: MRD  A Contact Person/Department The Privacy Official is responsible for the oversight of resident privacy under HIPAA regulations and other state/federal regulations

PRIVACY NOTICE REVIEW COMPLAINT PROCESS  May file a complaint with either: Facility Facility Privacy OfficialPrivacy Official Health and Human Services Health and Human Services Office of Civil RightsOffice of Civil Rights  Complaint must be in writing and filed within 180 days of identifying the complaint