1. HIPAA & PHI TRAINING & AWARENESS
Introduction to HIPAA
PHI Identifiers and Awareness
Security Measures
Privacy Breaches
Policies & Procedures

2. What is HIPAA? The Health Insurance Portability and
Accountability Act (HIPAA) is a federal law
that specifies administrative simplification
provisions that:
Protect the privacy of patient information
Provide for electronic and physical security of patient health information
Require “minimum necessary” use and disclosure
Specify patient rights to approve the access and use of their medical information

3. Protected Health Information (PHI)
PHI is any information about health status, provision of health care, or payment for health care that can be linked to a specific individual

4. Protected Health Information (PHI) 18 Identifiers
Name
Account numbers
Postal address
License numbers
All elements of dates except year
Health plan beneficiary number
Telephone number
Medical record number
Fax number
Device identifiers and their serial numbers
address
Vehicle identifiers and serial numbers
URL address
Biometric identifiers
IP address
Full face photos and other comparable images
Social security number
Any other unique identifying number, code, or characteristic

5. When should you use PHI?
Only when necessary to perform your job duties
Use only the minimum necessary to perform your job duties

6. How do I secure PHI?
Use electronic data only in a firewall environment (cloud)
Do not download to a non-protected environment:
Laptop
Flashdrive
Do not verbally release PHI outside the office
Do not leave PHI on answering machines
Ensure all paper, cds, and records are locked up or destroyed

7. Privacy Breaches
Talking in public areas too loudly or to the wrong person
Lost/stolen or improperly disposed of paper, mail, films, notebooks
Lost/stolen laptops, PDAs, cell phones, media devices (video/audio recordings)
Lost/stolen zip disks, CDs, flash drives
Hacking or unprotected computer systems
/faxes sent to the wrong address, wrong person, or wrong number
User not logging off of their computer system allowing others to access

8. Notice of Privacy Practices (NOPP)
The Notice of Privacy Practices allows PHI to
be used and disclosed for purposes of TPO:
Treatment
Payment
Operations
TPO includes teaching, medical staff/peer
review, legal, auditing, customer service,
business management, and releases mandated
by law

9. Remember All patient information is private Personal information
Financial information
Medical information
Protected Health Information
Information in any format:
Spoken
Written
Electronic