Disability Services Agencies Briefing On HIPAA

1. Disability Services Agencies Briefing On HIPAA

2. Who is this for? • This Training is for the entire DSA workforce to provide an overall awareness of “What is HIPAA?” • Additional training will be provided to more specifically address how HIPAA impacts the functions that are performed by the following areas: • Providers • Case Managers/ Counselors • Administrative/Support Staff • Medical Records • Admissions

3. History • Each time a person sees a doctor, is admitted to a hospital, goes to a pharmacist or sends a claim to a health plan, a record is made of their confidential health information. Congress recognized the need for national patient record privacy standards, when they approved the Health Insurance Portability and Accountability Act of 1996 (HIPAA). • The final rule took effect on April 14, 2001. As required by the HIPAA law, most covered entities have two full years – until April 14, 2003 - to comply with the final rule's provisions. The law gives the Department of Health and Human Services (HHS) the authority to make appropriate changes to the rule prior to the compliance date.

4. Brief Introduction to HIPAA Health Insurance Portability & Accountability Act of 1996 (HIPAA) • Public law 104-191 • Portability: Transfer of healthcare when employees change jobs • COBRA – A program that ensures continuous health plan coverage • Accountability: Fraud/Abuse & Administrative Simplification • PRIVACY, SECURITY, TRANACTIONS AND CODE SETS

5. HIPAA has four parts • Transactions = Billing Rules • Unique Health Identifiers and Standard Medical Code Sets • Security Standards • Privacy

6. TODAY WE WILL COVER PRIVACY • Privacy in Effect on 4/14/03. • HIPAA training will occur annually. • Additional training will also be provided for Security and Transactions.

7. Who does HIPAA Apply to? • Covered Entities – are either Health Care Providers, Health Plans or Clearinghouses. • In the DSA only WWRC is a Covered Entity. • Business Associates – are all others that may receive, transmit or store Protected Health Information from a covered entity. • All other agencies in the DSA may be Business Associates.

8. Who does HIPAA Apply to? (cont) • Covered Entities must enter into a contract with Business Associates, requiring that Protected Health Information be kept confidential by the Business Associate receiving information from or on behalf of the covered entity. • Business Associates are not permitted to use or disclose protected health information in ways that the covered entity can not.

9. What does HIPAA apply to? Information relating to an individual’s health, health care treatment, or payment for health care, is called Protected Health Information (PHI) under HIPAA. • Protected Health Information (PHI) • Relates to a person’s physical or mental health, the provision of health care, or the payment of health care; • It identifies, or could be used to identify the person who is the subject of the information i.e. by name, • Is created or received by a covered entity; and • Is transmitted or maintained in anyform or medium.

10. What does HIPAA do? • Provides Individual’s Rights • Right to receive written notice of information practices from health plans and providers • Right to access their own health care information • Rightto request an amendment or correction of protected health information that is inaccurate or incomplete • Rightto receive accounting of when information had been disclosed for purposes other than treatment, paymentand health care operations

11. Consent vs. Authorization • Consent - is required for all clients, it provides us the authority to share Protected Health Information for the purposes of Treatment, Payment and HealthCare Operations( i.e. business processes necessary to provide services to our clients). • Authorization – is needed anytime PHI is shared and it is for reasons other than Treatment, Payment, or HealthCare Operations (TPO). • Example – Financial Institution has requested PHI. An authorization will be needed to provide this information. The request for this information would be outside of the scope of TPO. • Disclosures without patient authorization • Purposes of effecting treatment, payment operations, and health care operations. • Certain federal, state, and other oversight activities, public health, emergencies, judicial proceedings, banking and payment processes, and health research. • Disclosure of PHI for research must be approved by an Institutional Review Board or Privacy Board.

12. What do we have to do? • Must generally obtain the patient’s consent prior to using or disclosing PHI to carry out Treatment, Payment, or health care Operations (TPO). • Obtain an authorization for any disclosure outside of TPO. • Develop mechanism for accounting for all disclosures outside of TPO. • Accommodate requests for amendments or corrections. • Designate a Privacy Officer responsible for privacy activities. • Provide Training to all staff who have access to PHI. • Establish administrative, technical, and physical safeguards. • Establish Policies and Procedures, and Privacy Notice. • Develop and apply sanctions from re-training to reprimand to termination for HIPAA privacy violations. • Have available documentation with the regulation requirements. • Develop methods to disclose minimum amount of PHI. • Develop and use contracts with business associates.

13. Penalties and Enforcement • The federal penalties are $25,000 - $250,000 fines and/or 1 to 10 years imprisonment, dependant on the type of violation. • Employee Sanctions for inappropriate disclosures

14. WAYS THAT YOU CAN HELP • When disposing of paper copies of patient records, they should be shredded for disposal. • Ensure that workstations can’t be viewed by visitors. • Avoid discussing client information in public places such as elevators, cafeterias, and waiting rooms. • Ensure that all Facsimile copies that are sent contain a cover page with the disclaimer statement. • Change your password regularly • Don’t use generic passwords and log-on names • Secure your workstation when unattended.

15. THINGS YOU MAY NOTICE • Ongoing privacy training for workforce • Privacy notices and new authorization process • New Policy and Procedures • Privacy Office to answer HIPAA related questions. • Consent and Authorization forms revised • Email and Fax Disclosure statements