1. Building a Privacy Foundation

2. Setting the Standard for Privacy Health Insurance Portability and Accountability Act (HIPAA) Patient Bill of Rights Federal and State Regulations Accreditation Standards Case Law Professional Standards of Practice

3. What Must Be Kept Confidential? PHI: Protected Health Information

4. Understanding PHI Individually identifiable information Demographics Any form or medium –Oral –Written –Electronic Medical Records Billing Records Databases

5. Use of PHI Sharing, application, utilization, examination, or analysis of PHI within the organization

6. Disclosure of PHI The release, transfer, access, or divulging of PHI to an outside person or entity.

7. Minimum Necessary What can I access? –Information you “need to know” to do your job Does it apply in every situation? –Treatment –Patient

8. Minimum Necessary

9. HIPAA Requirement – Identify members of the workforce who need access to confidential information Identify what information can be accessed Limit access

10. How Do I Know… …When information is considered private? –Did you learn it through your job? If yes, then it is considered private

11. How Do I Handle… …An individual asking for access to their record? –Individuals have a right of access –Route requests to appropriate department or staff

12. How Do I Handle… …An individual’s request to change their medical record? –Individuals have the right to amend or correct their record Requests will be investigated –Route requests to appropriate department or staff

13. How Do I Handle… –Directory information Name, location, condition in general terms –Other type of clinical or billing information Obtain permission Disclose appropriate information Use judgment if permission cannot be obtained …A family member or close friend asking about a patient?

14. How Do I Handle… …Another member of the workforce inquiring into a patient’s condition or treatment? –Determine if it is necessary to their position –Is it related to treatment?

15. “Privacy-Friendly” Practices Abide by the organization’s Notice of Privacy Practices Shred or destroy Fax and copy machine location Talking in public areas Keep patient information out of public areas

16. “Privacy-Friendly” Practices Secure records in all locations Passwords Computer screens Remember individuals’ right to privacy during treatments

17. What Happens If… …a privacy policy is violated? –Organization-specific sanctions –Right to file a complaint –Civil and criminal penalties

18. Take pride and ownership in the fact that your organization is concerned about privacy and recognizes its importance in providing quality healthcare.