Beruflich Dokumente
Kultur Dokumente
Objectives
● Understand what HIPAA is and its goal
● Identify what information are protected by HIPAA
● Understand how HIPAA affects the company and our jobs
● Identify the steps needed to ensure compliance with HIPAA
● Know what to do when we suspect any security breaches
What is HIPAA
HIPAA is the federal Health Insurance Portability and Accountability Act of 1996. The
primary goal of the law is to make it easier for people to keep health insurance, protect
the confidentiality and security of healthcare information and help the healthcare
industry control administrative costs.
1996 - Enacted by the United States Congress and signed by President Bill Clinton.
2009 - Expanded and strengthened by the HITECH Act (Health Information
Technology for Economic and Clinical Health).
2013 - Department of Health and Human Services issued the “Final Rule”
that implements HITECH’s statutory amendments to HIPAA on January of
2013.
HIPAA TITLE I
Health Care Access, Portability, and Renewability
HIPAA TITLE II
Preventing Health Care Fraud and Abuse; Administrative
Simplification; Medical Liability Reform
5 Rules:
In Summary…
The Privacy Rule addresses the use and disclosure of Protected Health Information
(PHI) by organizations subject to the privacy rule (Covered Entity) and their partners
(Business Associates).
PHI
Protected Health Information
Any information that can be used to identify a patient - whether living or deceased - that
relates to the patient’s past, present or future physical or mental health or condition,
including the health care services provided and payment for those services
- Name
- Postal Address
- All elements of dates except year
- Contact information (e.g. Email address, phone number, fax number)
- URL & IP addresses
- Social Security Number
- Account numbers
- License numbers
- Medical record number
- Health plan beneficiary number
- Device and vehicle identifiers and serial numbers
- Biometric identifiers (finger and voice prints)
- Full face photos and other comparable images
- Any other unique identifying numbers, codes, or characteristics
Covered Entity
Business Associate
A Business Associate is a person who performs a function or activity in behalf of, or
provides services to a covered entity that involves PHI. This may include medical
software companies, health IT companies, medical billing companies and medical
transcription companies.
A. Basic Principle
- PHI may be used or disclosed only if:
(1) as the Privacy Rule permits or requires
(2) if the patient or personal representative of the patient authorizes in writing
- PHI of a deceased individual is protected for a period of 50 years following the
death of that individual.
B. Required Disclosures
- A covered entity must disclose PHI if:
(1) The individual or their personal
representative specifically requests access
to these information or when asks for an
accounting of disclosures of PHI
(2) HHS is undertaking compliance
investigation or review or enforcement
action
Authorization
A covered entity must obtain the individual’s written authorization for
any use or disclosure of protected health information that is not for
treatment, payment or health care operations or otherwise permitted or
required by the Privacy Rule.
An authorization must:
- be in plain language
- be Written in specific terms
- contain specific information regarding the information to be disclosed or used,
the persons involved, expiration, right to revoke in writing, and other data
Minimum Necessary
A covered entity must make reasonable efforts to use,
disclose, and request only the minimum amount of
protected health information needed to accomplish the
intended purpose of the use, disclosure, or request.
(www.hhs.gov)
The Privacy Rule also specified the distribution requirements for direct treatment
providers, other health care providers and health plans.
● Health Plan:
- Must distribute to each enrollee by its Privacy Rule compliance date
- Thereafter, must give its notice to each new enrollee upon enrollment and send
a reminder to every enrollee at least once every three years that the notice is
available upon request
A provider in a covered entity with direct treatment relationship with patients must
make sure to obtain a written acknowledgement of receipt of the privacy
practices notice except in an emergency treatment situation. If the provider fails to
do so, he or she must document the reason for any failure to obtain the patient’s written
acknowledgement.
Aside from those mentioned above, the Privacy Rule also has the following provisions:
● Access. Patients have the right to review and get a copy of their protected health
information in a covered entity’s designated record set except in certain
circumstances.
● Amendment. Patients have the right to request for amendment of their PHI in a
designated record set when that information is inaccurate or incomplete.
● Restriction Request. Patients have the right to request that a covered entity
restrict the use of or disclosure of PHI during treatment or health care
operations, or disclosure to notify family members about the patient’s condition,
location or death. A covered entity is not obligated to agree to these requests but
if they do so, they must comply with the agreed restrictions except during medical
emergency.
● Implement written privacy policies and procedures that are consistent with
the Privacy Rule.
● Train and manage all the workforce members on the privacy policies and
procedures necessary for them to carry out their functions. There must also be
appropriate sanctions for those who violate the privacy policies and procedures.
● Mitigate any harmful effect caused by the violation of the entity’s workforce
members of the Privacy Rule.
● Have complaint procedures and must explain those procedures in its privacy
practices notice.
● Maintain proper documentation and record retention until six years after
the last effective date. Includes privacy policies and procedures, privacy practice
notices, acknowledgements, disposition of complaints, other actions and
activities that the Rule requires to be documented.
The Privacy Rule:
Personal Representatives and Minors
Personal Representatives
A Personal Representative is a person legally authorized to make health care decisions
on an individual’s behalf or to act for a deceased individual or estate. The Rule requires
that covered entities must treat a personal representative the same as the individual.
(www.hhs.gov)
The HIPAA Security Rule applies to all covered entities and business associates who
transfer PHI in electronic form. Its major goal is to protect the privacy of the
individual’s health information while allowing covered entities to adopt new
technologies to improve the quality and efficiency of patient care.
A. Administrative Safeguards
● Security Management Process/ Security Personnel: designating a
security official
● Information Access Management: role-based access of information
● Workforce Training and Management: train all workforce and must
have appropriate sanctions
● Evaluation: perform periodic assessment
B. Physical Safeguards
● Facility Access and Control: must limit physical access to its facilities
while ensuring that authorized access is allowed
● Workstation and Device Security: implement policies and procedures
to specify proper use of and access to workstations and electronic media
C. Technical Safeguards
● Access Control: only authorized persons should access e-PHI
● Audit Control: implement hardware, software, and/or procedural
mechanisms to record and examine access and other activities related to
PHI
● Integrity Control: place electronic measures to confirm that e-PHI has not
been altered or destroyed
● Transmission Security: implement technical security measures that guard
against unauthorized access to e-PHI that is being transmitted
What is Encryption?
- It is the process of turning readable text to an unreadable encrypted text that can
only be converted back to the original message if a decryption key (from the
sender) is obtained. Refer to the diagram below:
According to HIPAA’s Security Rule, Encryption is NOT required, but only
addressable. This means that the entity is responsible for doing the necessary analysis
to determine if encryption is really needed or not.
- For Data at Rest, meaning information is NOT crossing over to the
internet, encryption is ADDRESSABLE.
- For Data in Transit, meaning information is crossing over to the internet,
encryption is REQUIRED when sensitive information such as PHI is
involved.
- When encryption is not necessary according to the analysis done, the presence of
alternate protection such as Two-factor Authentication and Malware
Programs are enough.
2. End-to-end encryption - If Google only encrypts the emails while in transit
only, end-to-end encryption means that the file is encrypted when it is in transit
and would still be encrypted after it has arrived in the inbox of the recipient. This
means that the decryption process is no longer automatic and that the recipient
would need a decryption key from the sender to decrypt the file.
HIPAA and Faxes Sent to Wrong Numbers
- According to HIPAA, in order for to address situations wherein faxes with PHI
are sent to the wrong number, a fax cover sheet that highlights the confidentiality
of the incoming file. The fax cover sheet must state that the file contains
confidential information and should only be viewed by the intended recipient
only.
Penalties
A. Civil Penalties
● $100 per failure; may not exceed $25,000 per year for multiple violations of the
same requirement in a calendar year
● HHS may not impose civil money penalty under certain circumstances (if
violation is due to a reasonable cause, no willful neglect, corrected the violation
within 30 days)
B. Criminal Penalties
● $50,000 and up to one-year imprisonment: knowingly obtains or discloses PHI
● $100,000 and up to five years imprisonment: involves false pretenses
● $250,000 and up to ten years imprisonment: involves intent to sell, transfer, or
use PHI to commercial advantage, personal gain or malicious harm
2. Core Services where PHI is not permitted:Google Apps administrators can choose to
turn off Hangouts, Contacts and Groups.
3. Other Non-Core services offered by Google where PHI is not permitted, such as
Google+, YouTube, Blogger and Picasa Web Albums.
The admin has the ability to set up restrictions in Google Apps Core Services in the
sharing of PHI. For example, in Gmail and Google Drive, end users can choose to share
only with the intended recipients files that may potentially contain PHI. The same can be
done in Calendar and Google Site
The Google Apps administrator can also set up specific user access within the
organization based on whether the users handle PHI or not. This can be done by
placing users into groups.
To keep data safe and secure, several security practices are recommended including
the following:
● Set up 2-step verification to reduce the risk of unauthorized access in case a
user’s password is compromised
● Avoid writing patient information on a piece of paper or sticky note. Any written
computer systems (including social networking sites) and work areas. Do not
access these sites (Facebook, Twitter, etc.) when accessing a client’s computer
remotely.
outside of the office or to any colleague or individual not directly related to the
client’s case.
site.
● Do not browse non work related sites. If the computer or mobile device you are
using stores work-related sensitive information, personal use of the web is not
recommended.
● Do not download programs, software, and other media using work PC. If it is
● Be doubtful of emails asking you to disclose passwords, name, and other sensitive
information. Should you receive this kind of email, do not open it and discard it
right away.
relying on signs of a secured website may be problematic. The best way would be
to verify any links, especially suspicious ones or those that came from emails you
● Avoid video streaming. Streaming media websites might seem harmless, but
and are used to share files that contain malware. Some may also expose sensitive
P2P (Peer to peer) or file sharing programs are Limeware, BitTorrent, Ares,
● Encryption is required when you are accessing your company email or a client’s
● Do not open email attachments if the message looks suspicious, even if you
“unsubscribe” feature.
- automatic log-off
- encryption
● Never leave mobile devices unattended in unsecured areas. Remember, for any
● When sending an email, do not include PHI or other sensitive information such
as Social Security numbers, unless you have proper written approval to store the
● Avoid storing sensitive information on mobile devices and portable media, but if
● Always keep portable devices physically secure to prevent theft and unauthorized
access. Immediately report the loss or theft of any mobile computing device to
sending emails containing PHI, limit it only to people who are directly related to
Resources:
http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf
http://www.hhs.gov/ocr/privacy/hipaa/enforcement/cmscompliancerev08.pdf
http://www.unc.edu/hipaa/Annual%20HIPAA%20Training%20current.pdf