HIPAA: Providing

“Five-Star” Privacy

Springfield Clinic 2012 Review

H-I-P-A-A

HIPAA is a Federal Law named “The Health Insurance Portability

and Accountability Act”.HIPAA was enacted in 1996 to standardize

electronic health insurance transactions. Its primary purpose is to reduce the gap in health insurance coverage occurring

with change of employment.

What Are The Main Focal Points?

HIPAA concentrates on the privacy and security of

patient identifiable

health information

as well as the standardization of

electronic transactions.

What Are The Penalties For Noncompliance?

• The Office of Civil Rights oversees criminal penalties.

• Criminal penalties are for malicious release of PHI, or for use or disclosure for profit. These include 1-5 years in prison, and fines of $50,000 - $250,000.

• Civil penalties include private action and fines of $25,000 per incident.

HITECH Laws Raise the BarOn HIPAA

• In February, 2010, the HITECH law became final, adding to HIPAA requirements for privacy.

• Fines have been added for “willful negligence” of up to $1.5 million! That is one reason why training is mandatory.

Who Is A HIPAA Covered Entity?

• A Covered Entity (CE) is someone with a direct (face-to-face) patient care relationship. No authorization is required for PHI release for purposes of treatment, payment and CE operations.

• Everyone at Springfield Clinic is

considered part of the same covered entity. Internally releasing patient information without patient consent is allowed.

Who Is A Covered Entity Outside the

Clinic?• Any Provider with either a face-to-face patient relationship or who processes transactions using electronic patient information

• Any Health Care Plan paying for patient services• Any Clearinghouse providing healthcare billing

services• Interpreters; Dentists; NP’s, PA’s, Counselors,

Therapists• Medical Benefits Coordinator for ANY residential

facility including:– Prisons– Law enforcement officials holding prisoner in custody– Residential, Group & Nursing homes

• Pharmacists• School Nurses (only when evaluating students or

administering medications)

What Is Protected Health Information (PHI)?

Any patient identifiable information contained within an electronic media and its offspring.

This includes all subsequent release of medical records, demographics, or billing information, whether released orally, through electronic transmission, copies, or fax.

HIPAA Rule: Provide Minimum Necessary Information Per

Business Transaction

• It is the individual’s responsibility to provide no more than the “minimum necessary” patient information to satisfy a request or to complete a transaction.

• The only exception to minimum necessary is releasing health or billing information to another CE.

Patient Rights Under HIPAA

• The Office of Civil Rights enforces patient rights under HIPAA.

• If we accept terms or conditions requested by the patient they must be accepted Clinic-wide.

• Please contact the Privacy Office when patients assert the rights on the following slides.

The Right To Copied Records Inspect &

Receive• Patients may ask to sit with us and

review their medical and billing records, which is a Health Information Review.– (Call the Privacy Staff)

• They may ask for copies and we generally must supply them. – (Call Correspondence)

The Right To Amend Health Or Billing

Information • When the patient disagrees with

statements in the record, it is their right to ask the author to change the item.– (Refer them to the Privacy Operations

Manager)

• If the provider refuses the amendment, the privacy staff assists the patient in adding a rebuttal letter to the record.

The Right To Request Confidential

Communications• When a patient asks us to change

our normal way of communicating with him or her. – HIPAA states that where we can we

SHOULD. Remember that this type of request applies to ALL Clinic computer systems and offices.

– (Call the Privacy Office!)

The Right To Request Privacy Restrictions

• When a patient asks us to change the way we internally process our business transactions – (It is critical to call the Privacy Office)– Examples:

• Don’t give my records to anyone• Don’t let the receptionist ay my doctor’s office

see my information• Don’t send information to my other doctor

The Right To An Accounting Of

Disclosures• When a patient asks “Where have you sent my

information without my authorization”?– (Call the Privacy Staff)

• We must supply a listing of 6 years of past transactions.

• Clinic staff must document PHI released to non-clinic sources except when those releases are for purposes of the Clinic’s treatment, payment, or operations.

The Right To A Paper Copy Of The Notice of Privacy

Practices• HIPAA requires that patients receive the Notice of Privacy Practices (NPP) before their first service with a covered entity.

• At the Clinic, we must provide the NPP booklet to any “new to the Clinic” walk-in patient, so watch for this at Lab, X-ray, PT, and Prompt Care.

• We mail pamphlets to new patients with pre-scheduled services.

• If anyone asks for a privacy statement, please take them to the nearest reception desk for an NPP (Notice of Privacy Practices) booklet.

Purpose of the NPP

• Intent of a public notice• To help patients choose between

covered entities• To explain rights given to individuals• To inform a patient where to complain

if rights are violated

NPP Booklet Variations• If requested, we should try to make

accommodations for our special needs patients.

• Braille copies are available from Operations Managers.

• Large print for visually impaired on the intranet

• Spanish version is on the intranet• The NPP is also posted on www.springfield

clinic.com• Free translation is available - call the Privacy

Office

What If I Don’t Have An Office, Cabinet, Or Other Secure

Storage?

• Reduce the risk of accidental PHI exposure in treatment areas by turning papers face down.

• Consider putting loose records into an unlabeled folder or binder, while you have a patient.

VIP Patients

Well-known patients require sensitivity.

• Even discussing the fact that a VIP was treated here is a HIPAA violation!

• Be aware of a high likelihood of privacy audit for information access on such patients.

HIPAA Fact:After discharging

former President Bill Clinton for bypass surgery in 2004,NY Presbyterian Hospital

fired 40 employeesfor inappropriate

information access.

• Clinic Policy states that all health and health-related services and programs provided by the Clinic are available and accessible equally to patients who are hearing impaired, and to those with limited English proficiency (“LEP”).

• Interpreters shall receive payment for services performed only upon submitting a Clinic form invoice, which is verified or endorsed by a Clinic Manager.

Interpreter Services

Interpreters• Telecommunications manages our

interpreter contracts, and interpreters are available for multiple languages.

• As Business Associates, interpreters are entitled to access minimum necessary PHI relating to the visit, for their services or payment.

• Interpreters should contact the Privacy Office at extension 14216 to request chart copies.

May I discuss treatment information with anyone

present at the appointment?

The patient has implied consent to discuss treatment-related information by allowing them in the treatment room.

Ask if unsure about the patient’s comfort level, and include name/relationship of guests in office notes.

Good to Know!• A visitor brought to the exam room is

only allowed to be privy to the discussion during the exam. For an adult patient, even a parent’s presence does not provide access to any additional information regarding that visit (or any other encounter) without a signed patient authorization.

Authorized Patient Representatives

May I release information to a patient’s healthcare power of attorney?– Watch this! Typically a POA for healthcare

may only access a patient’s information after the patient is deemed incapacitated.

– This is different from a generalized POA.– Prior to incapacitation, this release requires

authorization. The only way to be sure is to read the form.

Business Associate• A Business Associate is defined as a

business or person who is hired to assist with daily operations, and whose job requires them to have access to PHI.

• HIPAA requires written contracts with legally specific language which requires that BA to handle all PHI according to HIPAA rules even when subcontracting.

Is It Okay to E-mail Patient Information to Another Provider?

• Not via Clinic email! It is not encrypted. Unless you encrypt email, it is a HIPAA violation.

HIPAA & Your Role• As a Business Associate of the

Clinic, we would appreciate knowing anytime our Clinic is not delivering “best practice” services to our patients. Please notify the Privacy Operations Manager at ext. 14216. We will appreciate hearing your feedback .

How Can I Reach Privacy Staff? The Privacy Office:• Linda Meadows ext. 14540 Information Privacy Officer• Nancy Cardinale ext. 14216 Privacy Operations Manager • Dawn Kane ext. 14245 Farrah Reagon ext. 14217

Danielle Dellaquila ext.14278 Privacy Operations Analysts

Safron Squires ext. 14198

How Can I Reach theInformation Security Officer?

Steve Cheatham ext. 14694

Information Security Officer

Thank Youfor completing

this HIPAA primer!Helping to educate our Business

Associates about privacy and security rules is part of our ongoing mission to provide the highest quality healthcare to the people of Central Illinois!