Date post: | 25-Dec-2015 |
Category: |
Documents |
Upload: | blaze-tate |
View: | 218 times |
Download: | 0 times |
From HIPAA to HITECH
OMH Briefing
Overview
Part 1: HIPAA Review
Part 2: HITECH Highlights
Part 3: HITECH Breach Notification Requirements
PART ONE:
Review Of HIPAA
Background
OMH is a covered entity required to comply with the requirements of the HIPAA Privacy and Security RulesFebruary 17, 2010: Additional federal requirements now enforceable against covered entities as a result of the HITECH Act (Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009)
HIPAA Review Privacy Rule
Development of policy for use and disclosure of PHI/clinical information and to assure individual rights
Implementation of appropriate safeguards for protecting PHI/clinical information
Workforce training
HIPAA Review Privacy Rule
Each covered entity must:
• Issue Privacy notices
• Have privacy officer and privacy liaisons at each facility
• Use business associate agreements
HIPAA Review Privacy Rule
A covered entity can only use or disclose PHI:
• For treatment, payment, or healthcare operations• As specifically authorized requests by the patient
in writing• If HIPAA provides another exception
HIPAA Review Privacy Rule
No consent required for uses and disclosures of PHI for treatment*, payment and health care operations (* Note that Mental Hygiene Law is more stringent; no consent needed if provider has “nexus/link” with OMH)• Thru licensure, local agreement, services plan
With some exceptions, individual’s written authorization required for all other disclosures
Use of OMH authorization form (OMH-11)
HIPAA ReviewPrivacy Rule
Clinical information protected under Mental Hygiene Law §33.13 is Protected Health Information (PHI) under HIPAA
State or federal rule providing greater confidentiality or greater access to information to the individual will prevail (preemption)
Patient Authorization Needed:
Agencies/Individuals involved in discharge planning/follow-up services
Attorney
Physicians/Providers of health/mental health• Unless there is nexus/link with NYS OMH
Patient Authorization Needed (cont.):
Children Protective Agency
Department of Social Services
Family
Probation Department
VESID
Media
HIPAA Review Privacy Rule
Minimum Necessary Rule
Limit use and disclosures of PHI to amount necessary to fulfill purpose of the disclosure (or perform job functions)
Exceptions: provider use for treatment purposes, disclosures to individuals and disclosures required by law
PHI Identifiers
Names
All elements of dates (except year) for dates directly related to an individual
Phone numbers
Social security numbers
Medical record numbers
PHI Identifiers
Health plan beneficiary numbers
Account numbers
Full face photographic images and any comparable images
Any other unique identifying number, characteristic, or code
HIPAA Review Security Rule
Requires Safeguards to protect Electronic PHI (EPHI):
C Confidentiality of EPHI;
I Integrity of EPHI; and
A Accessibility of EPHI
HIPAA ReviewSecurity Rule
Administrative safeguards• Security Awareness
and Training • Information Access
Management • Contingency Plan • Business Associate
Contracts and Arrangements
Physical safeguards• Device and Media
Controls • Facility Access Controls • Workstation Security • Workstation Use
Technical safeguards• Access Control • Audit Controls • Integrity • Person or Entity
Authentication • Transmission Security
PART TWO:
HITECH Highlights
HITECH-2009
Amends HIPAA- now includes breach reporting and notification requirementsSignificantly increases civil and criminal penalties for violationsEnhances state and federal enforcement and oversight activitiesHIPAA provisions are now directly applicable to Business Associates
Business Associates
Must comply with all safeguards under HIPAA security rule for E-PHIRequired to document policies and procedures for safeguarding PHIMust report security breachesMust fix/report any known pattern of activity or practice by a covered entity that breaches or terminates the BAANow directly liable for civil and criminal penalties
Business Associates
Revised OMH Business Associate Agreement in accordance with HITECH changesBusiness associates:• BOCES staff• IT vendors • Consultants (PT, OT)
Additional HITECH Changes
Mandated Audits-to ensure compliance
Audits performed by:
- HIM
- IT
- CIT
Additional HITECH Changes
OMH continues to follow Mental Hygiene and Confidentiality rules
Allows individuals to have broader rights of access to their records
Additional HITECH changes
Mental Hygiene Law- “need to know” similar to HIPAA- “minimum necessary standard”
Access and disclosure of PHI • Only what is required to provide
care/treatment or in order to perform job duty
Patient Rights
Now have the right to request an accounting of disclosures (EHR): made for treatment, payment, healthcare operations, and those authorized by patient
Can go back as far as 3 years
Patient Rights
Individuals may file privacy complaints
Designated OMH contact persons• Facility Director
• QM
• HIM
• HHS
• OCR
Patient Rights
CE MUST comply with individual’s request to restrict use or disclosure for payment or health care operations purposes when PHI pertains to service paid in full and out of pocket by individual
Additional HITECH Changes
Individuals have right to access their PHI in electronic format, if requested
Limits use of PHI for marketing purposes
Prohibition on sale of PHI, HHS regulations to be promulgated
Safeguards to Protect PHI
Follow the “Minimum necessary rule” except for treatment purposes, use and disclosure of PHI is limited to amount necessary to perform job functionsUse file covers, locked filing cabinets and locked record roomsAvoid conversations identifying individuals in public placesAvoid posting PHI where it can be seen by unauthorized individuals
Safeguards to Protect PHI
Don’t leave the worksite with unsecured PHI
Use, but don’t share, computer passwords
Follow computer security policies for desktops, laptops, disks and other media.
DO NOT email confidential clinical information or PHI over the internet
Keep track of paper files and electronic devices which contain PHI.
Safeguards to Protect PHI
When faxing or phoning PHI, know or verify the receiving party and the contact numbersBe mindful of disposing of PHI: Shred don’t toss and use secure waste systems, not regular trash receptaclesWhen storing PHI: choose the most secure, accessible media: encryptable portable devices, hard drives, OMH system drivesAvoid storing PHI on personally owned devices and home computers
Safeguards to Protect PHI
Remove PHI from electronic files and storage devices when no longer neededWhen changing job functions or leaving OMH, discuss with your supervisor the secured return or destruction of PHIReport suspected violations of HIPAA privacy or security requirements to your supervisorImmediately report any suspected instance of lost or stolen paper or electronic files containing PHI to your supervisor
PART THREE:HITECH Breach
Notification Requirements
What is a Breach?
HITECH defines “breach” as:
Unauthorized acquisition, access, use, or disclosure of PHI which compromises the security or privacy of the PHI
Notification of Breech
OMH and business associates are required to notify individuals when there is a breach of unsecured PHIPreviously this was not a HIPAA requirementIf more than 500 residents in a state are involved - media outlets MUST be notified
What is “Unsecured PHI?”
Protected Health Information (PHI) that is NOT:
Encrypted
Destroyed prior to Disposal
Unreadable, unusable or indecipherable
Includes both hard copy and electronic information
How Can a Breach Occur?
It may include:
Loss of an information device or media that contains PHI Smartphone, flash drive, laptop, CD, etc.)
Unauthorized access, use, or disclosure included in clinical records
How can a Breach Occur?
Sending PHI to an incorrect email address or fax number
Posting PHI on an unsecured website
Unauthorized access from an application, database, or another individual’s private account
Notification of Breach
Internal Procedure- when breach is suspectedReport Breach to HIM DirectorRisk Assessment completed • HIM• IT
Determination Made Information Reported to Central Office
Risk Assessment
Factors Considered:
What type of PHI was disclosed?
What amount of PHI was disclosed as a result of the incident?
Who used or had unauthorized access to the disclosed information? Was it a disclosure to another entity?
Risk Assessment
Method of Disclosure• Verbal
• Paper
• Electronic
Recipient of Information• Internal Workforce
• Agency
• Business Associate
Risk Assessment
Circumstances of Release• Unintentional use/access
• Intentional disclosure w/o authorization
• Theft
• Loss
• Hack
Risk Assessment
Was the unauthorized disclosure PHI returned before it could be accessed and used?
What immediate steps were taken to mitigate the risks associated with the unauthorized use or disclosure?
Who must be notified when Breach is discovered?
Affected individuals• No later than 60 days after discovery
Media• If affects more than 500 residents of a state or
jurisdiction
Secretary of Breaches of PHI (HHS)• By filling out an electronic breach report form
Covered Entity • If breach of PHI occurs at/by a Business Associate
Risks
Impact• Financial
• Reputational
• Other Harm
Categories• Low
• Medium
• High
Breach Notification
OMH will provide written notice:
By first class mail to each individual involved;
By hand delivery
Breach Notification
Notifications to individuals must include:
Brief description of incident
Description of the types of unsecured PHI
Steps that should be taken by individual to protect themselves from harm
Brief description of the actions taken by OMH
Contact information to ask questions or gather additional information
Documentation
OMH must create a log of all notifications of breaches involving less than 500 individuals
Submit log within 60 days of the end of each calendar year
Log and all other documentation will be maintained for 6 years
Enforcing HITECH
HITECH significantly increases civil and criminal penalties for violating HIPAA
Civil penalties are tiered and can range from $100 a violation to $1.5 million per year,
Criminal fines up to $50,000 and/or imprisonment
Next Steps
Workforce Training• Current Employees
• Review 2010 Information Security Mandated Training from the Bureau of Education and Workforce Development
• Future Employees• HIPAA videos and all mandated HIPAA Privacy
and Security materials
Manual Updates
Next Steps
Posting of Information• Brochures
• FAQ’s on intranet
• Posters around buildings
HIM attendance at department/discipline meetings
Continued staff awareness
Q & A
Remember…
Information Privacy and Security is
everyone’s responsibility.