1. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 1 McGraw-Hill Chapter 2 The HIPAA Privacy Standards HIPAA for Allied Health Careers

2. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 2 McGraw-Hill LEARNING OUTCOMES After studying this chapter, you should be able to: 1.Briefly discuss the role of medical record documentation as the source of health information about patients. 2.List five responsibilities of covered entities under the HIPAA Privacy Rule. 3.Define protected health information (PHI). 4.Discuss the required content of the HIPAA Notice of Privacy Practices (NPP). 5.Discuss the privacy standards relating to appropriate release of PHI for treatment, payment, and operations (TPO) purposes. 6.Describe the conditions under which authorization for release of PHI must be obtained. 7.List the items that are essential for general authorizations to release information. 8.Discuss the major exceptions to the HIPAA release of information requirements. 9.State the privacy standards that relate to incidental use and disclosure of PHI. 10.State patients’ rights regarding the use and disclosure of their PHI.

3. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 3 McGraw-Hill Key Terms accounting of disclosures Acknowledgment of Receipt of Notice of Privacy Practices amendment authorization de-identified health information designated record set (DRS) disclosure documentation electronic medical record (EMR) encounter HIPAA Privacy Rule hybrid record

4. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 4 McGraw-Hill KEY TERMS (cont’d) incidental use and disclosure medical record medical standards of care minimum necessary standard Notice of Privacy Practices (NPP) protected health information (PHI) release of information (ROI) subpoena subpoena duces tecum treatment, payment, and health care operations (TPO)

5. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 5 McGraw-Hill The Medical Record Documentation is the creating of medical records. Medical records show that medical standards of care have been followed. Medical records are legal documents.

6. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 6 McGraw-Hill The Medical Record (cont’d) Documenting Encounters –Physician encounters or visits should be documented with: Patient’s name Encounter date and reason Appropriate history and physical examination Review of all tests and drugs that were ordered Diagnosis Plan of care, or notes on procedures or treatments that were given Instructions or recommendations that were given to the patient Signature of the physician or other licensed health care professional who saw the patient

7. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 7 McGraw-Hill The Medical Record (cont’d) Documenting Encounters (cont’d) –Hospital encounters require the following additional information: Type of encounter Date of encounter, including admission and discharge dates for inpatient admissions Physicians involved with the patient’s care Patient’s diagnoses and procedures Medications prescribed Disposition of the patient (that is, the arrangements for the next steps in the patient’s care, such as transfer to a skilled nursing facility or to home and follow-up care or treatment)

8. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 8 McGraw-Hill The Medical Record (cont’d) Paper, Electronic, and Hybrid Medical Records –Paper records will eventually be phased out. –Hybrid records include both paper and electronic medical records. –Electronic medical records have advantages. Immediate access Computerized physician order management Clinical decision support Automated alerts and reminder Electronic communication and connectivity Patient support Administration and reporting Error reduction

9. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 9 McGraw-Hill HIPAA Privacy: Protected Health Information What is Protected Health Information? –Name –Address (including street address, city, county, ZIP code) –Relatives’ and employers’ names –Birth date –Telephone numbers –Fax number –E-mail address –Social Security number –Medical record number –Health plan beneficiary number –Account number –Certificate or license number –Serial number of any vehicle or other device –Website address –Fingerprints or voiceprints –Photographic images

10. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 10 McGraw-Hill HIPAA Privacy: Protected Health Information (cont’d) Notice of Privacy Practices and Acknowledgment –All covered entities must have a Notice of Privacy Practices (NPP) available on request. –Each patient must get an NPP at first encounter. –An Acknowledgment of Receipt of Notice of Privacy Practices is a form that patients sign.

11. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 11 McGraw-Hill Disclosure of PHI Use of PHI is sharing information within an entity. Disclosure of PHI is sharing information outside the entity.

12. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 12 McGraw-Hill Disclosure of PHI (cont’d) Release of Information for Treatment, Payment, and Operations –Release of information (ROI) is permitted for TPO. Treatment is discussion with providers. Payment involves exchanges with payers. Operations includes accreditation, staff training, and quality improvement.

13. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 13 McGraw-Hill Disclosure of PHI (cont’d) Release can be by any method. PHI can be released to family or friends in certain circumstances. Release of PHI about minors involves some special circumstances. Facility directories may get informal approval. State laws on consent may vary.

14. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 14 McGraw-Hill Disclosure of PHI (cont’d) Release of Information for Purposes Other Than TPO –Authorization is generally required. –No restrictions on use and disclosure of de-identified health information. –There are limits on use of PHI in marketing. –Disclosures must be logged.

15. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 15 McGraw-Hill Disclosure of PHI (cont’d) Exceptions to Disclosure Standards –Court orders –Workers’ compensation cases –Statutory reports –Research –Correctional institutions –National security, intelligence, or other essential government purpose –Incidental use and disclosure

16. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 16 McGraw-Hill Patients’ Rights Within a covered entity’s records, patients have the right to: –Access, copy, and inspect their PHI –Request amendments –Obtain accounting of most disclosures –Receive communications from providers via other means –Complain about alleged violations –Request restrictions on uses or disclosures

17. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 17 McGraw-Hill Patients’ Rights (cont’d) Access, Copy, and Inspect –Access must be provided within thirty days. –CE may charge reasonable fees. –Records may not be held hostage.

18. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 18 McGraw-Hill Patients’ Rights (cont’d) Amendments –Factual amendments must be made. –Subjective amendments can be negotiated. –CE can deny a request if item is accurate.

19. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 19 McGraw-Hill Patients’ Rights (cont’d) Accounting for Disclosures—Patients have a right to a list of disclosures except: –For TPO –To the individual or to the individual’s representative –For notification for those involved in an individual’s health care or payment for health care, for disaster relief, or for facility directories –If the patient has signed an authorization to release the information –Of a limited data set, such as for research –For national security –To correctional institutions or law enforcement officials –Incident to otherwise correct release

20. © 2009 The McGraw-Hill Companies, Inc. All rights reserved. 20 McGraw-Hill Patients’ Rights (cont’d) Confidential Communications Requirement –Patients have the right to alternative means of communications. Patient Complaints –Patients can submit complaints to the OCR. Requests for Restrictions –Patient can request use and disclosure restrictions.