1. HIPAA Health Insurance Portability andAccountability Act

2. What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 provides laws that govern the exchange of information and applies to : Health care providers such as physicians, dentists,hospitals, and nursing facilities Health insurance and billing companies

3. Privacy and Security Federal privacy and security standards implemented to protect a patient’s rights regarding the use and disclosure of health and personal information from being viewed by unauthorized people, stolen, lost or destroyed Gives patients control over their health information Controls use and release of health record

4. Transactions and Code Sets Organizations that transmit patient information electronically must comply with HIPAA standards by October 16, 2003

5. What is considered “Protected Information”? Protected Health Information can be any of the following: Information contained in a medical record Information in Meditech Billing records Any verbal conversation regarding a patient’s medical information

6. Incidental Disclosure The Privacy Rule does not restrict communication of patient information. It recognizes that there will be times when your conversation may be overheard. However, the privacy regulations require that every health care organization take precautions to prevent such incidents.

7. Examples of Incidental Disclosure • Disclosure to other patients in a waiting room of the identity of the person being called • Staff discussing patient information in public areas such as waiting rooms, elevators, cafeterias, hallways, bathrooms, nursing stations, or parking lots • Discussing patient information outside of the hospital with friends or family

8. Health System Requirements The Health System MUST: Notify patients about privacy rights and how their information can be used Adopt policies and procedures to protect privacy rights Train employees to understand privacy procedures

9. Health System Requirements (cont.) The Health System MUST: Have a “Privacy Official” to serve as the contact person for privacy procedures and complaints Secure patient records so they are not available to those who do not need them

10. The “Notice” The health provider must give the patient a “Notice” of their privacy rights at the time services are rendered. The Notice describes how the provider will use the patient’s information, and also describes how and when the patient’s information may be released. The Notice will provide information about how to file complaints about privacy concerns, and about how to contact the Privacy Official.

11. Privacy Official The Privacy Official is the contact person for questions regarding the privacy or confidentiality of patient information. The Privacy Official is the reviewer for policies and procedures regarding privacy protection in the Health System. The Privacy Official for the Georgia Health System is the Director of Legal Services and may be reached at (912) 692-5290.

12. Policies • The Privacy Policies are: • Confidentiality-Breach • Confidentiality of Patient, Business, and Employee information • Release of Information Policy The Health System has privacy policies to guide employees in using and releasing patient information.

13. Releasing Information The Health System can not release a patient’s protected information to an outside company or individual without a signed Authorization from the patient, unless it is released for: Treatment purposes to Physician Payment purpose Healthcare operations

14. Authorization A request to release a patient’s Protected Health Information should be referred to the Health Information Department, or to the Medical Records Department. The patient must sign an “Authorization to Release Information”.

15. Minimum Access Employees will only have access to the minimum amount of Protected Health Information to enable them to do their job. Restrictions will be set on computer and other employee access to patient information.

16. Frequently Asked Questions What if an individual asks for access to their records? Individuals have a right to access Route request to the appropriate department or staff Notify physician so they can be aware of the request

17. Frequently Asked Questions (cont.) What if the individual wants to change their medical record? Individuals have the right to amend or to correct their medical record. Requests for changes will be reviewed. Route requests to the appropriate department or staff.

18. Frequently Asked Questions (cont.) What if another member of the workforce asks about a patient’s condition or treatment? Determine if it is necessary to their position Is there a need to know? Limit access as needed

19. Frequently Asked Questions (cont.) What if family or friends ask about a patient’s medical record? Only provide information such as name, location, and condition in general terms

20. Violations If an employee knowingly uses or releases a patient’s medical information without the patient’s permission, or as required by their job, the person who violates the law may be fined between $50,000 and $250,000 and may serve between one to ten years in jail.