WELCOME to The University of Toledo

1. WELCOME to The University of Toledo Lynn Hutt Compliance/Privacy Officer

2. Topics • Compliance • HIPAA • Privacy • Security • Family Educational Rights and Privacy Act - FERPA • Public Records • Obama Administration - 2010

3. Who is the Compliance Officer?Lynn Hutt

4. Health Insurance Portability and Accountability Act (HIPAA) • Privacy – covers certain health information in any form. Written, spoken, electronic or any other form. • Security – covers information that is stored or transmitted electronically. Internet, computer networks.

5. What is HIPAA? • Law created to improve access to health insurance, protect the privacy of health information and promote standardization of electronic health-care related records to improve and safeguard their use. • Not: Hospitals In Pain, Aguish, and Agony

6. Patient privacy is everyone’s concern. It’s a basic part of patient care.

7. What can happen if you don’t follow the Privacy Rule? • There may be a fine for each violation of the rule. Total fines can go up to $1.5 million per year. • A person can be fined or sent to prison. • “Fifteen fired, eight disciplined for looking at medical records of octuplet mother.” FoxNews.com March 2009 • “CVS Pays $2.25 Million to Settle HIPAA Privacy Case” HHS.gov Feb 2009 • “Staff nurse faces jail time for copying medical record with intent to do malicious harm. Possible 10 years in prison, fine of $250,000. The nursing board is seeking to revoke her license.” Renal and Urology News Oct. 2008

8. A Closer look at PHI • Pay attention to information that gives details about who a person is: • Name • Social Security Number, Account Number, MRN • All or part of an address • Phone or fax number • Drivers License number, license plate • Date of Birth • Admission or discharge date • Tattoo's When combined with health information these could be considered PHI. Health Information is protected if it could be used to identify somebody.

9. Medical record Prescription label An x-ray Doctor’s notes about a patient A letter giving patient test results Facesheet Waste material that contains personal information- patient label Information sent from one place to another- computer, fax, phone or mail. Computer monitors that can be seen by the public Information that you say ALOUD. Facebook, pictures of patients. To name a few!!! Examples of PHI:

10. HIPAA Rule: Minimum Necessary • Only access PHI you need to do your job. • Any time you share PHI with others provide only the information the other person or organization needs.

11. General rules for disclosing and using PHI • You may disclose or use PHI for health-care purposes. Treat a patient Get payment for health-care services Continuity of Care Quality Assessment Fraud and Compliance programs Competency activities –accreditation Federal/State Agencies Suspected abuse or neglect Organ donation

12. Permitted disclosures • T-Treatment • P-Payment • O-Health care operations In all instances, strict regulations apply.

13. Incidental disclosures of PHI • When PHI is seen or heard by someone who does not need to know. • Even though UTMC has taken appropriate steps to limit the information shared or keep the information private. Example-nurses stations or two patients in the same room

14. Getting authorization to disclose information • Authorization to disclose PHI must be obtained when • Provided to insurer or other business for marketing • Information is communicated to an employer (pre-employment physical)

15. DO’s Speak quietly when possible Avoid using patient names in hallways and public areas Share information needed to treat the patient Use a private space to discuss patient information DON’Ts Share PHI with people who don’t need to know it to do their job Share PHI you are not authorized to disclose Let privacy issues keep you from treating the patient properly Some Do’s and Don’ts when talking about patients

16. Safeguard guidelines • Shut and lock doors when leaving • PHI should be not visible or audible • Computer monitors should be turned away from the direction of public view • Copy only the minimum necessary • Securely dispose of all PHI • Home offices subject as well • Record storage areas must be secure

17. Safeguard guidelines cont. • Printers and Fax Machines must be secure • Unauthorized personnel may not be left alone without supervision • Policies apply to any Portable Device or LAPTOP • Visitors must be accompanied • EVERYONE is responsible for PHI • DO NOT SHARE YOUR LOG-IN OR PASSWORDS!

18. Protect printed PHI • Where is printed PHI? • Patient chart • Wrist tag • Prescription bottle • Lab report • X-ray • Log sheets/patient lists • Patient mailing list • Faxes • ALWAYS use a shred bin for printed PHI!

19. Patient rights • They have them • They know them • Respect them

20. Your responsibility • Know policies and practice appropriate procedures within your unit • If unsure, ASK

21. The Family Educational Rights and Privacy Act of 1974 Protects students educational/treatment records. FERPA

22. Public records • The University of Toledo’s operational functions are considered public records. • Emails • Reports • Contracts

23. President Obama legislative changes to HIPAA • Health Care Reform • American Recovery & Reinvestment Act of 2009 (ARRA) • New requirements will include: • Notification of HIPAA breaches • Application of HIPAA to BA’s • Restrictions requested by patients • Electronic Health Records • Increased penalties and enforcement • HITECH Act

24. How do I report…. • Report concerns in these steps: • First to your professor • Advisor or Dean of College • Student Academic Affairs • Compliance/Privacy Officer, x 6933

25. What are my rights…. • Non-retaliation policy • Qui tam provisions (“whistleblower” )

26. Quiz questions • Who’s the Compliance/Privacy Officer? • Name 3 safeguards for PHI? • What does HIPAA stand for? • Name 3 examples of PHI. • Can you be held personally responsible for a HIPAA violation? • What is minimum necessary? • If you are unsure, what should you do? • PHI used for TPO are permitted disclosures, what does TPO stand for?

27. COMPLIANCE It’s YOUR Responsibility.

28. Questions?