HIPAA

Seite 1

HIPAA (Health Insurance Portability and Accountability Act) is meant to let patients and agencies know about how their PHI (protected health information) is used and disclosed

Do Not Display:

- name

- SSN

- Address

- Phone number

- any charting

- Make sure you shred any paper documents that are not part of the medical record after use so privacy is maintained. - make sure faxing is safe and encrypted.

- talk on the phone on a private line and in a way that no one else can hear you

Telehealth situations:

- inform patients about the potential of privacy violations.

- video recordings can be breached

- audio recordings and maintenance of tapes

- storage and transmission of information and images.

- technical operators overhearing or having access to health information

electronic mail situations

- inform patients of privacy issues

- what kinds of information is appropriate for email

- what is the turnaround time for responses

- when does an email warrant an office visit

Safeguards

-third party vendors must have a "chain of trust" when they are entrusted with PHI

- assigned responsibility for security in agencies

- procedures to limit physical access

- procedures for routine and non-routine receipt

- internal auditing

- termination procedures

- training in security and sensitivity of PHI

- audit who is accessing information in the system

- authenticating data to ensure that it has not been altered

- authentication of entities receiving and sending PHI

- barriers to access by unauthorized users

HIPAA-- gives patients the right to examine and obtain a copy of their own health records and to request correction

TPO- treatment, payment and operations are the only grounds in which PHI should be shared without the patient's direct consent

an agency can use or disclose PHI for TPO for:

- its own treatment, payment or healthcare operations

- treatment activities of a HCP

- payment activities of another covered entity or provider who receives the PHI

- healthcare operations activities of the covered entity if that entity has/had a relationship with the individual and the PHI pertains to that relationship and if disclosure is for quality improvement and other specific purposes or review of healthcare professionals for purposes in operations

A covered entity can obtain consent to carry out TPO, however it cannot permit a use or disclosure when an authorization would be required

If the patient is a minor and/or has a personal representative (parent or guardian), the provider may elect not to share the PHI with the representative when:

- there is reasonable belief that the individual may be or has been subjected to domestic violence, abuse, neglect or if treating such person as a personal rep. could endanger the individual

- the provider decides that it is not the best interests of the individual to share PHI

Other stricter laws than HIPAA on:

- substance abuse

- mental/behavioral health

- communicable diseases

- reproductive health

Emergency situations may also allow disclosure

court orders, issued with proper accordance can access medical records

When for research purposes, the auditor or evaluator must agree in writing hat it will protect individually identifiable health information.

When authorization is NOT required.

- preventing or controlling disease, injury, or disability

- reports of child abuse or neglect

- FDA jurisdiction who is responsible for the quality, safety or effectiveness activities of a particular product to collect and report adverse events, product defects or biological product deviations, enable product recalls repairs, replacement or to conduct post-market surveillance

- person who may have been exposed to communicable disease o at risk of spreading disease.

- work related injuries or workplace medical surveillance

- correctional institutes who have lawful custody of the inmate may have PHI to maintain good health and order of the inmate.

- workers compensation may allow an entity to access PHI in order to comply with workers comp. laws

Coding and Billing

- code sets: numeric groupings used to identify specific diagnoses and clinical procedures on claims and encounter forms.

- in order to optimize reimbursement, diagnoses present on admission (POA) should be noted as well as past health information.

Administration and Documentation

- revisions of the notice of privacy practices

- all revisions of policies and procedures

- workforce training

- sanctions against non-compliant members of the workforce

- restrictions to uses and disclosures of PHI

- use and disclosure for research

- the designated record set

- staff roles related to the privacy rule

- all signed, written acknowledgement of receipt of the notice of privacy practices and if not signed, the reasons why

-accounting of disclosures

- authorizations

- complaints received and results

Documentation must be kept for 6 years from the date of its creation or date it was last in effect, whichever is later.

Enforcement of HIPAA is primarily complaint-driven and the procedure is as follows:

- complainants submit the complaint in writing

- retain an original copy of every complaint

- review and investigate each complaint

- report the results of the investigation to the appropriate individuals and inform complainants in writing at the time of the complaint of their right to complain directly to the secretary of health and human services

Seite 2