Post on 24-Dec-2015
transcript
HIPAA Privacy & Security
EVMS Health Services 2004 Training
Privacy & Security
• Privacy– what should be protected
• Security– how to protect it
Privacy
What should be protected?
Any health informationthat can be used to identify the patient
Patient Identifiers
Name
Date of Birth
Date of Visit
Social Security #
Postal Address (even zip)
Telephone/Fax #
Medical record/Chart #
Email Address/URL
Account #
Photographs
Privacy
Ways to protect patient information:
– Turn computer screens inward
– Keep patient schedules covered– Talk quietly – don’t use
patient’s name
– Shred documents
– Verify identity before disclosure
– Use security controls
Security
• Is a process not a product
Examples of Security Controls
– Set automatic log offs after 20 minutes
– Use screensavers w/ password features
– Virus protection software
– Log-on trails
Security
• Weakest link in security is people
why?
Don’t see it as importantLazinessAverse to technology Don’t know controls are there
People Controls- management/leadership
• Don’t assign system passwords until employees have Privacy Training
• Tell staff how to safeguard work areas
• Store confidential information on network drive – not hard drive
• Don’t ever share passwords
People Controls
Monitor Behavior
Are staff logging off computers?
Are they accessing information not needed for their job?
Is sensitive information removed whenever possible (minimum necessary rule?)
Are fax cover sheets used?
Are recycling bins used?
People Controls
Monitor Actions
Is the Privacy Notice prominently displayed?
Are new patients being asked to initial/sign the privacy notice acknowledgement?
Are accidental disclosures logged in the patient’s disclosure log?
Are privacy complaints being forwarded to the privacy office?
Fax Transmittals- controls
Always use a fax cover sheet that lets the recipient know who to contact “just in case” there is a transmission error
– If you make a mistake, the “unauthorized” disclosure must be logged in the patient’s medical record.
Disclosure Log- in the medical record
We are required by law to “log” the following types of disclosures:
• Public health
• Social Services
• Law enforcement
• Unauthorized (or accidental) disclosures
Data bases
#1 Risk area
Do it right
Get patient authorization (even for prospective research)
Protect data w/ security controls
Limit access
Don’t store on portable devices
Update data fields
EVMS Privacy & Security Manuals
• It is your responsibility to follow the EVMS HIPAA Privacy & Security Policy & Procedures
• Each manager is required to review the Privacy & Security procedures with staff
• Privacy Policy & Procedures: http://hsmail.evms.edu/compliance/complianceweb/
• Security Policy & Procedures:
http://info.evms.edu/bfis/postdocs/itac_1/hipaa_/policies_/bov20030710secu/default.htm
Mini Quiz
Someone is caught accessing the PHI of a co-worker. How do you handle this situation? Report person to
supervisor/Privacy Office Tell person that she can get fired,
but don’t report to Privacy Office Find out what person was looking
at so you can report it (click mouse for answer)
Report person to supervisor/Privacy Office immediately
Mini Quiz
What are some ways to protect patient information?
Turn computer screens inward
Keep schedules covered up
Talk quietly, without using the patient’s name
All of the above
(click mouse for answer)
All of the above
Mini Quiz
You use an electronic device to store/use health information. How do you protect the information? Log off system when not in use Store information on password
protected network drive Keep portable devices on you or
locked up at all time All of the above
(click mouse for answer)
All of the above
Mini Quiz
The following are patient identifiers:A) Date of birth
B) Date of office visit
C) Strep throat diagnosis
D) A & C
E) A & B(click mouse for answer)
E) A & B
Mini Quiz
A patient does not want to be contacted by EVMS for fundraising purposes. What should be done?A) remove patient’s address &
telephone # from IDX
B) ask patient to complete an opt-out fundraising form & forward to Privacy Office
C) call the EVMS Institutional Advancement office for advice
(click mouse for answer)
Answer is B!
Mini Quiz
Are you allowed to share passwords? It is ok to give passwords to nurses,
but no one else
IDX passwords can be shared but not electronic medical record passwords
No one is allowed to share passwords – ever
(click mouse for answer)
No one is allowed to share passwords!
Privacy- questions/concerns
Contact the Privacy Office: