Holland Hospital

1. Holland Hospital Orientation for students, contractors and temporary employees

2. Welcome! • Mission • To continually improve the health of the communities we serve in the spirit of hope, compassion, respect and dignity. • Vision • In partnership with our medical staff, to be the pre-eminent stand-alone hospital in West Michigan as measured by benchmark customer service, business growth, financial performance and medical quality. • Our Core Values • Customer Service – “Be There” • Commitment – “Choose Your Attitude” • Communication – “Make Their Day” • Creativity – “Play”

3. Introduction • This presentation is intended to familiarize you with procedures and expectations while you are at Holland Hospital. • The presentation will offer reading material on HIPAA, Infection Control and Needle Stick Safety.

4. Instructions • Immediately following the slides for HIPAA and Infection Control, a quiz will be given. Please complete the quiz and then print completed quiz (please print only the quiz pages). • Complete the Non-Employee Workforce Form and Non-Employee Service Provider Acknowledgement Form on slides at the end of this presentation and then print each. • Call Human Resources at (616) 394-3780 to schedule a time to meet prior to starting your assignment at Holland Hospital. • Please remember all required documentation for your appointment in Human Resources. Without it you may NOT begin your assignment. A checklist is provided at the end of this presentation to ensure you have all required paperwork.

5. HIPAA Training Self-Study Module

6. HIPPA Directions: • Review the slide presentation. • Complete the HIPAA quiz. • Sign the HIPAA quiz. Be sure to print and sign your name; include the date and your department. Thank you!

7. The HIPAA Privacy Rule What You Need to Know

8. HIPAA What are the possible repercussions to the patient, to you, and to the hospital if confidentiality is broken?

9. What is HIPAA? HIPAA stands for Health Insurance Portability and Accountability Act, passed in 1996. It’s a federal law imposed on all health care organizations such as: • Hospitals, physician offices, home health agencies, nursing homes and other providers. • HMOs, private health plans and public payers such as Medicare and Medicaid.

10. HIPAA Components Portability and Accountability • Its original goal was to make it easier for people to move from one health insurance plan to another as they changed jobs or became unemployed. • This means they would be able to move their medical records and information more easily and to get the care they needed. The next component of HIPAA is Administrative Simplification. What does this mean?

11. HIPAA Components Another component is Administrative Simplification, intended to do the following: • Standardize formats, codes and IDs for the electronic transmission of health information. • Protect the security of electronic health data. • Protect the privacy of all health information.

12. HIPAA Components Administrative Simplification • Before computerized records, it would have been difficult to remove many records and make use of this information. • Today, with e-mail and electronic storage of information, thousands of records can be sent virtually anywhere in just a few minutes via a computer.

13. HIPAA Components Imagine you wanted to identify patients who had an expensive medical condition in order to discriminate against them. It would take countless hours to use paper records, but with a computer and standardized records, it’s simple to sort out patients who have expensive illnesses and potentially use that information to hurt their chances at getting jobs or insurance.

14. HIPAA Privacy Rule • HIPAA is the first federal law protecting patients’ privacy and it gives patients certain rights to view their own medical records and restrict who sees their health records. • Key concepts to remember: • HIPAA punishes individuals and organizations that fail to keep patient information confidential. • HIPAA gives patients federal rights to gain access. So what could happen if a patient’s privacy is violated?

15. Penalties for Breaking HIPAA Privacy Rules • Criminal penalties: Maximum of 10 years in jail and a $250,000 fine for serious offenses. • Civil penalties: Maximum fine of $25,000 per violation. • Facility sanctions: See HR Policy 15.5.1.2. – “Confidential Information” located on Holland Hospital’s internal website. (Could result in suspension or termination.)

16. Penalties for Breaking HIPAA Privacy Rules • For instance: • Knowingly releasing patient information in violation of HIPAA can result in a one-year jail sentence and $50,000 fine. • Gaining access to health information under false pretenses can result in a five-year jail sentence and $100,000 fine. • Releasing patient information with harmful intent or selling the information can lead to a ten-year jail sentence and $250,000 fine.

17. Penalties for Breaking HIPAA Privacy Rules Civil: Civil penalties are fines up to $100 for each violation of the law per person, up to a limit of $25,000 for each identical requirement.

18. Section VII: Employment Realities Holland Hospital Standards of Conduct: I understand that Holland Hospital employees are expected to conduct their duties in a manner that meets the highest legal and ethical standards. I agree that I will comply with all applicable laws, regulations, programs requirements and standards of ethical conduct as described in the HH Standards of Conduct. I also certify that I will report any known or suspected violations of these Standards of Conduct to the Corporate Compliance Officer immediately and without concern for retaliation or retribution for doing so. Confidentiality: I am aware that authorization to access computer systems at Holland Hospital also allows me access to confidential information. I certify that I understand that it is my responsibility to keep in strict confidence all information I encounter and will not discuss, disclose or disseminate such information to unauthorized persons. I specifically understand that information regarding patients, employees and individuals affiliated with Holland Hospital is not to be accessed by individuals who do not have a need to know this information. I recognize that unauthorized release of confidential information may make me subject to civil action under the provision of state and federal codes and regulations governing the confidentiality of patient specific health care information. In addition, any such breach of confidentiality will be reported to licensing and professional organizations as appropriate.

19. Myths about HIPAA When the privacy rule was released, many people worried that hospitals would have to take extreme measures to make sure no one overheard any Protected Health Information (PHI). The Department of Health and Human Services has released statements assuring the health care industry that such actions are not necessary. Let’s take a closer look at some of these myths.

20. Myths about HIPAA Myth: Hospitals cannot put patient names outside their doors or use white boards. White boards and patient nameplates are acceptable as long as a patient’s health information isn’t in plain view for someone passing by. Problems arise when patients’ names are linked to their conditions. If patients’ names are listed next to their condition on a white board, the board must be kept away from view.

21. Myths about HIPAA Myth: Doctors and nurses can go to jail for honest mistakes. There are certainly serious penalties – including jail times and huge fines – for health care workers who intentionally violate patient privacy by selling information to a marketing company or purposely looking up information about patients they're not treating. However, mistakes such as accidentally grabbing the wrong file will not result in serious sanctions. Now let’s look at what information is considered confidential information.

22. What is Confidential? It’s not just one piece of Protected Health Information (PHI) by itself; it’s two or more pieces of information that might identify a person and their health information – a key concept to remember. What are acceptable uses of confidential information?

23. Acceptable Uses of Confidential Information Health care providers are permitted to share and disclose Protected Health Information (PHI): - For treatment, payment and health care operations – a key concept to remember - For other reasons if they obtain permission from the patient

24. Treatment, Payment and Health Care Operations Health Care Operations: Physicians and quality control directors review confidential information to make sure patients are getting good care. All members of the workforce at a hospital contribute to the quality of care, but that doesn’t mean everyone needs to see health information about patients. This is termed as the “Minimum Necessary Requirement.” Let’s review what this KEY phrase means to you.

25. The Minimum Necessary Requirement HIPAA calls on health care workers to use the minimum amount of patient information they need to do their jobs efficiently and effectively – a key concept to remember. Ask yourself: - Do I need this information to do my job and provide good patient care? - What is the least amount of information I need to do my job?

26. Do You Need to Know? • Coders and billers need to look at certain portions of records to code and bill correctly. • Housekeeping staff do not need to look at patient records at all. If it’s not for treatment, payment, or health care operations, patient authorization is necessary to use or disclose Protected Health Information.

27. Authorization Facilities must obtain authorization from patients before using or sharing their Protected Health Information (PHI) for reasons other than treatment, payment or health care operations Reasons include: - Research - Some types of fundraising - Marketing - Attorney

28. Authorization It’s important that patients understand how they can protect their own health information and how providers protect their information. That’s why the HIPAA rule requires health care providers to post notices telling patients how their information will usually be used. Let’s take a look at some common sense ways that you can protect patients’ privacy.

29. Protect Patient Privacy Don’t leave patient records lying around. It would be easy for a patient or other staff member to look at the papers openly lying on a desk or counter.

30. Protect Patient Privacy Do close curtains and speak softly when discussing treatments in semi-private rooms. Be aware of who is around when you’re discussing patient care, and use common sense to protect confidentiality by taking simple steps such as lowering your voice or moving to a more secluded area of a room.

31. Protect Patient Privacy Do log off the computer when you’re finished. When using any computer system that contains Protected Health Information, log off when you are finished. Do not leave the information visible on an unattended computer monitor.

32. Rules for Faxing Patient Information When sending a fax: • Always use a fax cover sheet. • Call intended recipient before sending the fax. That way, they will be ready for the fax. • Double check the fax number before sending it. It’s critical when faxing PHI that we do everything we can to ensure that the fax is going to the right person. • If ever in question, ask the manager for assistance.

33. Rules for Using Computers Keep your passwords a secret. Although computers have greatly improved the efficiency of health care delivery, they have also increased the risk that large amounts of private information could be sent to the wrong person, computer or website with one keystroke. • For instance, a Midwestern university mistakenly posted children’s psychiatric records on a public website. • Another example, a hospital accidentally revealed the names of organ donors to the recipients in a computer-generated letter.

34. Rules for Using Computers • Do not log into the system using someone else’s password or computer key. Passwords should never be given out, and they should not be written down. • Passwords and other security features are put in place to protect patient information. If you share passwords, you may be held responsible for another worker’s inappropriate use of records.

35. Rules for Using E-Mail • Do not open attached files from unknown sources; this may open the door for viruses and hackers. • Do not use work e-mail for personal matters.

36. Rules for Using E-Mail • Double check the address line of the message before you send it to make sure it’s going to the right person. • Do not use e-mail to send patient’s Protected Health Information (PHI). Only use the internal mail system provided by the Protected Health Information program.

37. Patient Rights Patients have the right to: • View and keep a copy of the facility’s Notice of Privacy Practices (this notice will be made available at the time of registration). • Request restrictions on disclosures of PHI for treatment, payment and health care operations. • Receive an accounting of disclosuresnot for treatment, payment or health care operations.

38. Patient Rights Patients have the right to: • Inspect and copy their own health information. • Request amendments to information in their medical record. • Request preferred method of contact.

39. Patient Rights:Notice of Privacy Practices • This notice will be posted in main patient areas, off-site locations and on Holland Hospital’s internal website. • It will be offered to all patients at the time of registration and will be available to any individual who requests one from Patient Relations.

40. Patient Rights: Request for Restrictions on Disclosures Patients must agree to let facilities use PHI for treatment, payment and health care operations, but patients can request that they limit the use. For example, a patient knows a lot of Holland Hospital’s staff personally. He/she may request that his/her record not be chosen for quality review, or could ask that we do not use or disclose information about a previous surgery.

41. Patient Rights: Viewing and Copying Information Patients have the right to view and copy their Protected Health Information (PHI). This may include information stored on computer (e.g., their medical and business records). Patients may contact Medical Records for a copy.

42. Patient Rights: Requests for Amendments Patients may think the information contained in their medical record is incomplete or inaccurate and may request an amendment for as long as the information is kept by or for the hospital.

43. Patient Rights: Patient Directory When patients are at the hospital, they are put in the directory so that visitors can inquire about them. Patients may opt out of appearing in the directory. If they have opted out, no information can be given to the visitor or caller. For patients who do not opt out, staff can tell visitors or callers who ask for the patient by name the following: • The patient’s location in the facility. • The patient’s general condition (e.g., stable, good, fair). At the time of registration, the patient will be given the option to opt out of the directory.

44. Patient Rights: Patient Directory Don’t: • Give out a patient’s location or condition without making sure the patient is listed in the directory. • Disclose patient information other than location and general condition. • Say anything about a patient who has opted out of the directory, including confirming if the patient is here or not. If the patient’s privacy is violated, you may direct the patient to Patient Relations (394-3742). You may also call Patient Relations if you know or suspect breaches of confidentiality.

45. Corporate Compliance The main purpose of the program is to create a work culture that is compliant with legal and ethical standards and a way for you to anonymously report inappropriate activities (e.g., The Corporate Compliance Hotline). Standards are set by authorities such as the OSHA, CMS, Medicare, Medicaid, Federal (e.g., HIPAA), state, local governments and Holland Hospital’s own standards and policies (Standards of Conduct). An important part of keeping the trust of our patients and our community is to follow the laws and guidelines established by outside agencies and our own organization. Example: Maintaining patient confidentiality and reporting breaches in confidentiality. Compliance is the responsibility of ALL staff members, regardless of their positions or job responsibilities.

46. Key Concepts to Remember • Minimum necessary – HIPAA calls on health care workers to use the minimum amount of patient information they need to do their jobs efficiently and effectively (e.g., for treatment, payment and/or health care operations). • We have a legal and ethical obligation to protect patient privacy and rights.

47. Next Step • Complete HIPAA quiz on next two slides. • Print off your completed quiz and take to Human Resources (make sure to only print the pages containing the quiz).

48. HIPAA Quiz • The criminal penalties for improperly disclosing patient health information can be as high as fines of $250,000 and prison sentences of up to 10 years. True or False • Confidentiality and privacy are important concepts in health care because: • They help protect hospitals from lawsuits • They allow patients to feel comfortable sharing information with their doctors and care providers • They help establish trust with the organization • All the above • Which of the following are some common ways that employees protect patient privacy? • Looking up your neighbors medical information because you are curious • Lowering voice when needed • Logging off the computer when not using • b & c • Confidentiality protections cover not just patient’s health related information, such as the reason they are being treated, but also information such as address, age, social security number and phone number. True or False • Any employee or physician who violates the hospital privacy policy is subject to punishments up to and including firing or termination of work privileges. True or False

49. HIPAA Quiz • If you suspect someone is violating Holland Hospital’s Confidentiality policy(s), you should: • Say nothing – it’s none of your business • Watch the individual involved until you have gathered solid evidence against him or her • Report your suspicions to your supervisor or call Holland Hospital’s anonymous Compliance Hotline (616) 494-4050 and complete an Occurrence Report (orange form) • Only employees who care for patients need to be concerned with protecting patient privacy and confidentiality. True or False • HIPAA gives patients certain rights to view their own medical records and restrict who sees their health records. True or False • What kind of personally identifiable health information is protected by HIPAA’s Privacy Rule? • Written • Electronic • Spoken • All the above • In addition to regulating your own behavior with regard to confidentiality, you are responsible for monitoring the behavior of others, including physicians, co-workers, volunteers, visitors and patients. True or False Print Name:________________________________________Date:__________________________ Signature:__________________________________________Department:____________________

50. Infection Control Holland Hospital Infection Control