Why now, Why us? • Federal Trade Commission (FTC) regulations for Identity Theft which may not apply, but it is good business to do this anyway. • The Massachusetts Data Privacy Regulations become effective January 1, 2010 (TJ Maxx and Martha Coakley) • Changes to HIPPA as outlined in the American Recovery Reinvestment Act of 2009 that went effect in February, 2010
Why do we need the regulations? • Data and identity theft is being conducted by organized, motivated, and sophisticated groups that are well compensated for their success.* • The FTC estimates annual losses to business from data and identify theft amount to almost $50 billion.* • Tests done by groups assessing for the security of data are able to access highly sensitive information 90% of the time.* • CCHC data belongs to our neighbors, our families and ourselves! We have seen identity theft at CCHC. *”10 Minutes on Data and identity Theft” Price Waterhouse Coopers 10/08
The New CCHC Policy… • Requires an Annual Report of compliance with the policy from each entity. • Depends on all employees being aware of flags that might signal an Identity Theft and reporting those flags to your supervisor. • Requires all areas who conduct registration / intake to include a copy of a photo ID issued by a government entity. • If no photo ID, ask for two forms of non-photo ID (not a credit card or bank statement)
What are Identity Theft Flags? When you see one of the following examples consider this may be an alert that Identity Theft might be occurring:
Suspicious Documents: • Documents provided for identification that appear to have been altered or forged. • A photograph that does not match the face. • Other information on the identification is not consistent or does not match what we have on file. • Documents that appear to have been altered or forged, or gives the appearance of having been destroyed and reassembled.
Suspicious Personal Identifying Information: • The address does not match an address on any other type of document or the phone is invalid out of service or is a pager/answering service. • The Social Security Number (SSN) has not been issued, or is listed on the Social Security Administration's Death Master File. • There is a lack of correlation between the SSN range and the date of birth. • The address on an application is fictitious, a mail drop, or a prison.
Unusual or Suspicious ActivityRelated to a Covered Account: • Mail sent to the patient is returned repeatedly as undeliverable although transactions continue to be conducted in connection with the patient's covered account. • We are notified that the patient is not receiving paper account statements.
Other Identity Theft Flags: • Alerts, Received fromConsumer Reporting Agencies or providers, such as Fraud Detection Services. • We are notified by a patient, a victim of identity theft, a law enforcement authority, or any other person that we have an account for a person engaged in identity theft.
What do I do if there is no ID? • Providing identification is nota condition for obtaining emergency care. The process of confirming a patient's identity must never delay the provision of an appropriate medical screening examination or necessary stabilizing treatment for emergency medical conditions. • Patients should not be refused care if they do not have acceptable identification. • Ask the patient to bring ID with them the next time they visit.
How do we respond to an Identity Theft Flag? • monitoring an account for evidence of identity theft; • contacting the patient; • changing any passwords, security codes, or other security devices that permit access to an account; • reopening an account with a new account number;
More options: • Not opening an account or closing an existing account; • Not attempting to collect on an account or not assigning an account to a debt collector; • Consulting with the Compliance Officer who may notify law enforcement officials and/or suspected victims; or • determining that no response is warranted under the circumstances presented due to a lack of sufficient facts/proof or otherwise.
What else do I need to know? • If you see anything suspicious please report it to your supervisor right away. • It may not be anything, but you may be the first person to detect a theft and you may be helping a person who has had their identity stolen.