1. Privacy & Security Inservice Protected Health Information, Personal Electronic Devices & Social Media

2. Background Federal laws
HIPAA, Privacy
HITECH, Security
If you can identify the patient, HIPAA applies!
Information/areas that you have access to solely due to your position as an employee are considered sensitive.

3. Always remember your role.
HIPAA 101
Access/disclosure of PHI is permitted for the following reasons
Treatment
Payment
Healthcare Operations
Required by Law
Authorized by the Patient
Any access/use/disclosure outside of this is a violation.
Always remember your role.

4. Types of Violations EMOTION FAILURE TO VERIFY Fax to wrong #
RX to wrong patient
Discharge instructions to wrong patient
Letters/envelopes

5. Personal Electronic Device Policy
Personal Electronic Devices may NEVER be used to
capture, store, or transmit protected health information
or sensitive business information.
This includes photos, video and audio.

6. Personal Electronic Devices cont’d
Use the patient’s device
Be aware of background
Employees can decide if they want to be in patient photos
No photos, video, or audio of other employees without their consent.

7. PED Violation Examples
Audio captured of patient
Video taken during huddle
Photos of sensitive work area
Video of visitors

8. Social Networking
The use of dedicated websites and applications to interact with other users, or to find people with similar interests to oneself.
Facebook
Twitter
Instagram
SnapChat
Pinterest
YouTube
News Sites

9. Social Media First violation reported in March 2011
Most recent violation – August 2015
Difference between being “friendly” and being “friends/follower” on social media
Violations
By employee
By employee family member
Trying to help patient
Trying to defend Baptist Health

10. Social Media Violation Examples
Employee posts to SM and tags patient
Patient captured in Valentine photo
Employee’s child posts to news site
Patient locates negative comments on SM
Employee messages patient to defend treatment

11. Violations Based in Emotion
Patient information is a tool used by provider but belongs to the patient.
If you have “feelings” about patient information, STOP and re evaluate actions.
Access to information is granted in your role as an employee. See slide 4.
Can’t use system for personal reasons
Role as a mother/caregiver
Role as a visitor/friend

12. Discipline Policy Breach notification not required
Written Counseling
Breach notification required
Written warning
Malicious, personal gain, financial gain, access of protected classes (HIV, etc)
Suspension or termination

13. What is Breach Notification?
Certain violations require notification to patient
“Harm” standard removed in 2013
Must be conducted within 60 days
Breaches are reported to Office for Civil Rights
Breaches damage our reputation and impede our mission.

14. Closing Thoughts
If you disclose or cause to disclose, the violation is yours.
Patient information is a tool you use to help perform your job.
Privacy violations have lasting effects on your employment future.
Corporate Compliance is here to help. Call us anytime!

15. Dana Williams, Privacy OfficerQ U E S T I O N
Dana Williams, Privacy Officer
(501)