HIPAA BASIC HIPAA BASIC TRAININGTRAINING

MODULE 1C – OverviewMODULE 1C – Overview(For staff who do not generally create Protected Health (For staff who do not generally create Protected Health

Information)Information)

Anderson Health Anderson Health Information Systems, Inc.Information Systems, Inc.

WHAT IS HIPAA?WHAT IS HIPAA?

Protect privacy and security of health Protect privacy and security of health informationinformation

Improve continuity of health insurance Improve continuity of health insurance coverage and transfer of information about coverage and transfer of information about the personthe person

WHAT IS HIPAA? WHAT IS HIPAA? -2-2

Federal law signed in 1996 authorizing Federal law signed in 1996 authorizing development of regulations that:development of regulations that: Relates to how we bill for a resident.Relates to how we bill for a resident.

How we protect the resident’s How we protect the resident’s

private health information; private health information;

more than the medical record, more than the medical record,

i.e. Social Security #, i.e. Social Security #,

insurance #, birth-date, etc.insurance #, birth-date, etc.

THIS HIPAA TRAINING THIS HIPAA TRAINING FOCUSES ON…FOCUSES ON…

The Privacy RegulationThe Privacy Regulation

Steps that must be taken to protect individually Steps that must be taken to protect individually identifiable health informationidentifiable health information

Sets standards to restrict, limit and account for Sets standards to restrict, limit and account for access to individual health recordsaccess to individual health records

Compliance deadline of 4/03Compliance deadline of 4/03 Steps that must be taken to protect individually Steps that must be taken to protect individually

identifiable health informationidentifiable health information

THIS HIPAA TRAINING THIS HIPAA TRAINING FOCUSES ON FOCUSES ON -2-2

The Privacy RegulationThe Privacy Regulation

Sets standards to restrict, limit and account Sets standards to restrict, limit and account for access to individual health recordsfor access to individual health records

Compliance deadline of 4/03 and still Compliance deadline of 4/03 and still required in 2009 --required in 2009 --

TRAINING OBJECTIVESTRAINING OBJECTIVES

Will identify elements of the following:Will identify elements of the following:

Privacy Rule Privacy Rule / / Notice of Privacy PracticesNotice of Privacy Practices

HIPAA RIGHTSHIPAA RIGHTS

Privacy OfficialPrivacy Official

Complaint ProcessComplaint Process

PRIVACY RULE APPLIES TOPRIVACY RULE APPLIES TO

Health Care ProvidersHealth Care Providers Your facility is a health care providerYour facility is a health care provider

Health PlansHealth Plans Blue Shield, Kaiser, HMOs and Medi-CalBlue Shield, Kaiser, HMOs and Medi-Cal

CONTINUING CULTURAL CONTINUING CULTURAL CHANGECHANGE

Impact of Privacy Rule Implementation Impact of Privacy Rule Implementation including facility’s changes to:including facility’s changes to: POLICIESPOLICIES PROCEDURESPROCEDURES PRACTICES – i.e., PRACTICES – i.e.,

conversations; conversations; care where medical care where medical records or other records or other resident documents are keptresident documents are kept

FUNDAMENTAL PURPOSE FUNDAMENTAL PURPOSE OF PRIVACY RULE OF PRIVACY RULE

Establish standards for Establish standards for Protection of Health InformationProtection of Health Information Relates to past / present / future Relates to past / present / future

physical or mental health physical or mental health conditionsconditions

Identifies the individual OR Identifies the individual OR information that can be used to information that can be used to identify the individualidentify the individual

FACILITIES ARE REQUIREDFACILITIES ARE REQUIRED

By federal and state law to :By federal and state law to :• Maintain the privacy of health Maintain the privacy of health

informationinformation• Provide notice of facility’s Provide notice of facility’s

privacy practices privacy practices TO THE TO THE RESIDENT, CONSERVATOR, RESIDENT, CONSERVATOR, REPRESENTATIVEREPRESENTATIVE

PHI - PROTECTED HEALTH PHI - PROTECTED HEALTH INFORMATIONINFORMATION

Includes PHI transmitted/maintainedIncludes PHI transmitted/maintained• Electronically – computer, e-mailElectronically – computer, e-mail• In any other form or medium – disk, fax, In any other form or medium – disk, fax,

paper, and orallypaper, and orally• Can you identify other records that might Can you identify other records that might

be seen by staff who do not need the be seen by staff who do not need the information to do their job duties?information to do their job duties?

PRIVACY PRACTICEPRIVACY PRACTICE

PRIVACY – A WELL PRIVACY – A WELL ESTABLISHED ‘ RIGHT’…ESTABLISHED ‘ RIGHT’…

The HIPAA Privacy Regulation grants six The HIPAA Privacy Regulation grants six rights to individuals regarding their health rights to individuals regarding their health information:information: Confidential CommunicationConfidential Communication Access to and copies of health informationAccess to and copies of health information May request amendments to May request amendments to

their health informationtheir health information

PRIVACY – A WELL…PRIVACY – A WELL…-2-2

The HIPAA Privacy Regulation grants six rights The HIPAA Privacy Regulation grants six rights to individuals regarding their health information to individuals regarding their health information (cont):(cont): Upon request, must be given an accounting of Upon request, must be given an accounting of

disclosures of disclosures of their health information to others.their health information to others.

Upon request, must be given a paper copy of Upon request, must be given a paper copy of the Notice of Privacy Practices.the Notice of Privacy Practices.

May request restrictions on the uses and May request restrictions on the uses and disclosures of health informationdisclosures of health information

RIGHTS PRACTICE SESSIONRIGHTS PRACTICE SESSION

You are working near the You are working near the nursing station and find nursing station and find resident documents on the resident documents on the floor what should you do? floor what should you do?

Confidential resident Confidential resident information is destroyed information is destroyed how? how?

RIGHTS PRACTICE RIGHTS PRACTICE SESSION SESSION -2-2

You are working and can overhear a You are working and can overhear a conversation about a resident. What conversation about a resident. What should you do?should you do? Close the door if possible.Close the door if possible. Leave the area.Leave the area. Let the staff know you can hear.Let the staff know you can hear.

RIGHTS PRACTICE RIGHTS PRACTICE SESSION SESSION -3-3

The nursing staff are discussing a The nursing staff are discussing a resident’s behavior and medications at an resident’s behavior and medications at an open nursing station where you can over open nursing station where you can over hear the conversation and visitors are in a hear the conversation and visitors are in a nearby room.nearby room. 1.1. Is this protection of health Is this protection of health

information? information?

2. What should be done? 2. What should be done?

PRIVACY OFFICIALPRIVACY OFFICIAL

Addressed in Administrative Addressed in Administrative RequirementsRequirements

A Privacy Official has been designated for A Privacy Official has been designated for each Facility who is: MRDeach Facility who is: MRD

A Contact Person/Department The Privacy A Contact Person/Department The Privacy Official is responsible for the oversight of Official is responsible for the oversight of resident privacy under HIPAA regulations resident privacy under HIPAA regulations and other state/federal regulationsand other state/federal regulations

PRIVACY NOTICE REVIEW PRIVACY NOTICE REVIEW COMPLAINT PROCESSCOMPLAINT PROCESS

May file a complaint with either:May file a complaint with either: FacilityFacility

• Privacy OfficialPrivacy Official

Health and Human ServicesHealth and Human Services• Office of Civil RightsOffice of Civil Rights

Complaint must be in writing and filed Complaint must be in writing and filed within 180 days of identifying the within 180 days of identifying the complaintcomplaint