Understanding HIPAA

1. Understanding HIPAA Dr. Jennifer Lu

2. Introduction • HIPAA = Heath Insurance Portability and Accountability Act

3. Historical Framework • Increasing automation in healthcare has created increasing awareness about the security of protected health information • 1997: National Research Council reports widespread weaknesses in healthcare security (user authentication, access controls, audit trails, external communications, physical security and disaster recovery)

4. Historical Framework • 1990’s: Public begins to have serious concerns about the privacy and security of health information. This is due to breaches such as • Press disclosures of individuals’ HIV status • Disclosure of patient information for financial gain • Misdirected patient emails

5. Violation Examples • A Michigan based health system accidentally posted the medical records of ten thousand patients on the internet • An employee of the Tampa health department took the names of 4,000 people who were HIV and tried to blackmail individuals. • A patient in a Boston hospital discovered her medical information had been viewed by more than 200 hospital employees. • A banker who sat on a county heath board gained access to patient’s records with cancer and called in their mortages.

6. Violation Examples • A candidate for congress nearly saw her campaign derailed when newspapers published her medical records showing she had sought psychiatric help. • A physician diagnosed with AIDS in the hospital he worked in. His surgical privileges were suspended. • Johnson and Johnson marketed the names and addresses of elderly incontinent women to drug compaanies

7. So how did we change things?

8. Historical Framework • 2003 HIPAA is passed and includes a mandate for assurance of the security and integrity of health information • 1998: Privacy concerns cause an investigation by government • 2003: Security Rule is finalized and published in the Federal Register on February 20, 2003

9. HIPAA Security Rule • Applicability: • Protected Health Information ( PHI) applies to all individually identifiable health information that is in electronic form (stored or transmitted) • All healthcare entities, health plans and clearinghouses which store health information or transmit it to others must comply

10. HIPAA Security Rule • Security Threats • Internal • More likely to occur than external threats • Careless staff unaware of security issues • Malicious insiders

11. HIPAA Security Rule • General Rule Information Securitymust be followed– no single policy or tool can effectively assure overall security and cultural and organizational issues must also be addressed. • Federal standard is set to a minimum or floor level and organizations may choose to exceed these standards

12. HIPAA Security Rule • In order to address these principles, HIPAA security makes specificrecommendations in 3 areas: • Business Associate (Business Rules) • Physical Safeguards (Ability to use a machine) • Technical Safeguards (Ability to access data)

13. HIPAA: Administrative Safeguards • These are ,mandatory formal practices that are designed to manage the integrity and execution of security measures • Intended to disclose health information only to the appropriate parties and protect this information from all others

14. HIPAA: Administrative Safeguards • Security Awareness and Training • In order for an organization to work securely, the employees must be educated about security practices • Identifying threats • Monitoring LOGIN failures • Review of policies • Virus Protection

15. HIPAA: Administrative Safeguards • Security Incident Procedures • Organizations are required to formalize their procedures for dealing with security breaches • Employees should be instructed on how to report security compromises • Roles and responsibilities during an incident should be published

16. HIPAA: Administrative Safeguards • Evaluation • Evaluate compliance of existing security practices • Identify deficiencies • Correct deficiencies • This is a continuous process

17. HIPAA: Physical Safeguards • Workstation Security • Have policies that govern workstation placement to avoid violations • Orient workstations to prevent potential viewing by unauthorized individuals • Installation of shields to protect screen contents • Use of monitoring and video surveillance as necessary

18. HIPAA: Technical Safeguards • Physical restrictions that enable the need for timely access with risk for breach of confidentiality • Ensure the security of transmitted information over open networks

19. HIPAA: Technical Safeguards • Access Control • A documented procedure for granting authorized access to data • Provision for care • The optional use of and decryption • Provision for an _logoff after idling for a period of time

20. HIPAA: Technical Safeguards • Person or Entity Authentication • Organizations must take steps to protect against unauthorized access by an entity attempting to access data • Many solutions exist for this ( encrypted passwords, PIN numbers, tokens and telephone callback procedures)

21. Here are some common ways that staff members can protect patient privacy • Always ensure privacy when discussing patients protected health information. • Move away from any open doorway when talking about a specific patient‘s care. • Avoid discussions about patients in elevators and cafeteria lines. • Do not leave messages on answering machines regarding patients medical information • Avoid patients using telephones to receive results. • Encourage portal use

22. Questions