Adult ED Staff MeetingMarch 10, 2010

WELCOME!

Privacy and Information Security

Terri Hartman, DirectorPrivacy Office

Why Respect Privacy and Confidentiality?It’s the right thing to do!

It’s a VUMC Credo Behavior

It’s a key driver to overall patient

satisfaction!

It’s the law!

“It’s Who We Are”

What is HIPAA?

What Does HIPAA Do?Limits how we use and share patient information

Gives patients more control over their information

Protects the integrity, availability and confidentiality of patient information

Defines violation penalties

Health Insurance Portability and Accountability Act of 1996

Protected Health Information and Research Health Information

Authorized users who access, process, and store Protected Health Information (PHI) or Research Health Information

(RHI) on electronic computing end user devices are accountable for the protection and security of the data

including encryption of the device.

VMC policy specifies that when a legitimate business purpose exists requiring an individual to maintain identifiable Protected Health Information (PHI) or Research Health Information (RHI) on a device other than a secure network server that device must be encrypted.

Any desktop or laptop computer that is used to access, create, or store individually identifiable information about VMC patients, research participants, employees, or students must be encrypted.

The centrally supported encryption solution (CheckPoint) must be used if the computer contains PHI or RHI.

Research involving VA Sensitive Information MAY NOT reside on non-VA owned equipment unless specifically designated and approved in advance by the appropriate VA officials and a waiver has been approved and granted by the VA’s Chief Information Officer.

Things You Need to Know:

Protected Health Information and Research Health Information

Key Points:Photography for purposes of patient care does not require additional consent beyond the standard Consent for Treatment.

Patient Identifiable Photography is Protected Health Information (PHI) and use and disclosure of this PHI must comply with all Information Privacy and Security Policies for PHI.

Photography for purposes other than patient care generally does require explicit consent.

Immediately upload patient photos to the EMR or another secure server and delete from the device used to capture the image(s). Do not identify patient photographs with more than the minimum necessary (e.g. avoid SSN and patient phone number).

 Do Not post Photography of patients in public areas, on internet websites, or blogs without written or documented verbal consent from the patient/legal representative prior to the posting. 

If your department or work uses Patient Photography, review the new policy for specific information related to:

Permissible uses of Photography; Requirements for consent, camera and recording equipment, and storage/retention of images;Use and disclosure of Photography images; andBehaviors that are not permissible by staff/faculty related to Photography of patients.

Authorization/Consent forms to use:Permission to Take and Use Photography or Videos(MC 3930) - use for education/training, performance improvement, or other non-media related acceptable purposes. Media Relations-Authorization to Create, Use, or Disclose Photographs or Videos for Media Releases and Public Relations (MC6690) - use for public relations, media, or marketing purposes is coordinated through VU Media and Public Relations staff and uses a specific consent form. Patient Authorization for Security Photographs(MC3642) – use in the newborn nursery areas fornewborn Photography

Patient Photography and Video Imaging

Operations Policy, OP 20-10.10 https://mcapps.mc.vanderbilt.edu/E-Manual/Hpolicy.nsf/AllDocs/32DB38E6CD9FEDF986256B420079E44E

VUMC may utilize Photography to collect protected health information for purposes of identification and patient care and treatment or as otherwise authorized by the patient or the

patient’s legal representative.

Social NetworkingOnline social media allow Vanderbilt University Medical Center (VUMC) faculty and staff to engage in professional and

personal conversations. All faculty and staff who identify themselves with VUMC and/or use their Vanderbilt email address in social media venues such as professional society blogs, Linked In, Facebook, or Twitter for deliberate

professional engagement or casual conversation are to follow the VUMC Credo Behaviors, Health Insurance Portability and Accountability Act (HIPAA), Conflict of Interest Policy, privacy policies and general etiquette. VUMC faculty and

staff can be held accountable for conduct that negatively impacts or represents VUMC

• If you identify yourself in any online forum as a faculty/staff member of VUMC or use your Vanderbilt email address, you must make it clear you are not speaking for VUMC and all submissions represent your own personal views and comments.

•  Do not post digital images and messages containing protected health information (PHI) without written authorization from the patient. Remember recognizable markings or body parts are PHI.

• Remember that all content contributed on all platforms becomes immediately searchable and can be immediately shared…It immediately leaves your control forever.

• Known or suspected incidents involving use or disclosure of PHI or Personal Information through social networking are reported to the VUMC Privacy Office and investigated.

• New federal law and regulations require breach notification and reporting when a patient’s health information is accessed, used or disclosed in a way that violates the Privacy Rule of HIPAA and poses a significant risk of reputational, financial, or other harm to the individual.

HR-025: “Electronic Communications and Information Technology Resources”      “Computing Privileges and Responsibilities: Acceptable Use Policy” http://www.vanderbilt.edu/aup.html

• When faxing a document always use a cover sheet that includes the sender’s full name, department or clinic name, and complete phone number and fax number. Double check to make sure you are sending the right patient’s information to the right recipient at the confirmed fax number.

• When you select a recipient for faxed documents from the StarPanel Fax Directory always confirm that you have the correct provider by name, specialty, office location, and fax number.

• When mailing patient information always double check to be sure you are sending the correct patient’s information to the correct person at the correct address.

• Always ask visitors to step out of the room before discussing clinical history or information with the patient, giving the patient the opportunity to consent to the visitor’s presence.

• Photos taken of patients for treatment purposes must be stored in the patient’s medical record or in a secure database and should not be stored on the camera device. Always capture the minimum necessary identifiable data on the picture. The camera must remain secured and not left unattended.

• Avoid conversations about patients in an area that is open to the public where you might be overheard.

• Always place confidential information in a shredder bin for disposal.

Careless Handlingof Personal or

Confidential InformationThings You Need to Know:

Things You Need to Know: Whenever possible, allow the patient to determine which family members or others

involved in their care are communicated with regarding the patient’s care and services. Do not assume that the patient agrees for a visitor or family member in the patient’s room to see or hear any personal health information.

Prior to accessing a patient’s medical record for any reason other than completion of your assigned job duties, there should be documentation in the medical record showing the patient has granted you permission prior to accessing the record. Written authorization may be in the from of a note entered into the medical record documenting verbal permission or, preferably, a signed copy of an authorization form granting the access.

Unauthorized Access or Disclosure of

Patient Information

Things You Need to Know: The Privacy Office regularly audits the medical records of all VUMC staff

and faculty that are admitted to VUMC for access by co-workers.

Patients may request an audit of the medical record if they believe a staff or faculty member has accessed their record without appropriate authorization.

Gossiping about a faculty/staff member’s health information resulting in the individual filing a complaint, gossiping about a VUMC patient’s health information, or gossiping or sharing PHI secured through your role at VUMC are all considered privacy violations and will result in disciplinary action.

Unauthorized Access or Disclosure of

Patient Information

Only share patient information with other faculty and staff who need the information to do their job.

Avoid accessing a patient’s record unless you need to do so for your job or you have written permission from the patient.

You are not allowed to access the record of your co-worker, spouse, or family member unless there is written

authorization in the patient’s record.

Protecting the Privacy of Patient Information

You will be prompted when accessing the medical record of a VUMC employee.

The Privacy Office will be prompted to audit the medical record you are accessing.

Protecting the Privacy of Patient Information

All incidents/complaints are investigated and all violations result in disciplinary action, up to and

including termination.

Unauthorized Access or Disclosure of Patient Information

Questions & Answers

Chris Ruckman

Nurse Manager

Leadership Expectation

1. Time & Attendance2. Meeting Deadlines

3. Teamwork4. Honesty

Kudos

Letters from patients and co-workers

Jackie Ashburn

Quality

Blood Cultures

12/19/2010

12/24/2010

12/29/2010

1/3/2

011

1/8/2

011

1/13/2

011

1/18/2

011

1/23/2

011

1/28/2

011

2/2/2

011

2/7/2011

2/12/2

011

2/17/2

0110.00%

1.00%

2.00%

3.00%

4.00%

5.00%

6.00%

7.00%

Weekly Blood Culture ContaminationGoal of 3%

Blood Culture Contam-inationMoving average (Blood Culture Contamination)Moving average (Blood Culture Contamination)

Goal

Nov.09Dec.

09Jan

.10Feb

.10

Mar.10Apr.1

0

May.10

Jun.10Jul-1

0

Aug-10Sep

-10Oct-

10

Nov-10Dec-

10Jan

-11Feb

-110.0%

1.0%

2.0%

3.0%

4.0%

5.0%

6.0%

7.0%

8.0%

9.0%

10.0% 9.23%

5.20%

7.00%

3.30%3.80%

2.50%2.64%2.07%2.18%

2.75%3.00%

1.88%

3.70%3.88%3.27%

2.67%

Blood Cultures Reported as Possible Contamination

% o

f Blo

od C

ultu

re C

onta

min

ation

per

Tot

al

Urine Contamination

Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Oct-10 Nov-10 Dec-10 Jan-11 Feb-110.00%

5.00%

10.00%

15.00%

20.00%

25.00%

30.00%

Contaminated Urines

Perc

enta

gego

al 1

5%

Sepsis Alerts• Jan-11 Alerts 8• Avg time from Call to Disp 1:55 • Arrival to call 1:54 • Arrival to antibiotic order 0:32 • Order to administration 0:19• Disp 6-MICU 1-8N • Feb-11 Alerts 13• Avg time from Call to Disp 2:02• Arrival to call 1:36• Arrival to antibiotic order 0:54 • Order to administration 0:24 • Disp 12-MICU 1-OR/NICU

Strokes• 10 Code Strokes• 1 TPA • 9 sheets• Disposition:

– NICU 6– 8S 1– TOBS 1– ED 2

• 4 ems• 2 pov• 4 air

Antibiotics

Jan-10

Feb-10

Mar-10

Apr-10

May-10

Jun-10Jul-1

0

Aug-10Sep

-10Oct-

10

Nov-10Dec-

10Jan

-110:00

0:28

0:57

1:26

1:55

2:24

2:52

3:21

3:50

4:19

4:48

January Antibiotic Times

Min

utes

Jan-10

Feb-10

Mar-10

Apr-10

May-10

Jun-10Jul-1

0

Aug-10Sep

-10Oct-

10

Nov-10Dec-

10Jan

-110%

10%

20%

30%

40%

50%

60%

Antibiotic% Documented

%

Chart Audits

PAML0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

68%

78%82%

70%

72%

84%86%

66%

82%

78%

May-10Jun-10Jul-10Aug-10Sep-10Oct-10Nov-10Dec-10Jan-11Feb-11

10%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

70%

74%

76%

76%78%

78%72%

75%

78%

92%

Social Screening

May-10Jun-10Jul-10Aug-10Sep-10Oct-10Nov-10Dec-10Jan-11Feb-11

Chart Audits

0%

10%

20%

30%

40%

50%

60%

58%

48%

42%46%

32%

42% 50%

57%

44%

38%

VITAL SIGNS

May-10

Jun-10

Jul-10

Aug-10

Sep-10

Oct-10

Nov-10

Dec-10

Jan-11

Feb-11

MONTHS

Cardiac

Febuary Stemi0

10

20

30

40

50

60

53 532/4/20112/23/2011

Door

to E

KG

0 5 10 15 20 25

4

4

6

4

5

5

4

24

8

FEB-11

2/23/20112/22/20112/20/20112/19/20112/17/20112/11/20112/10/20112/8/20112/4/2011

Pneumonia

Hand Hygiene-Jason Reed

February 10, 2010

HAND WASHINGMed Student/ MD

HAND WASHINGNurses

EDUCATION

Competency Check-offs

Beginning the first Tuesday in April…..and the first Tuesday of every month thereafter in 2010!!

2:00 to 6:00pm

Education Bulletin Board

Will you help us

remember the PSA?!

Lab Labeling

VUnetID

Blood Bank Specimens

“Collector” and “Labeler”

289 Shopping Days Til

Christmas!!

Meeting Evaluation • 5 – Excellent• 4 – Very Good• 3 – Average• 2 – Below Average• 1 - Poor

Use the poll on our Team Member Only Website to Evaluate the Meeting. We will send you a link today.

Share any comments now.