HIPAA BOOT CAMP
WELCOME TO MIAMI VALLEY
HOSPITAL’S HIPAA TRAINING
PURPOSE OF THIS TRAINING
 To introduce you to the basics of HIPAA in



order to understand the rules and regulations.
Review its impact on our Healthcare Network.
Explore practical ways to deal with Protected
Health Information (PHI) on the job.
Help you understand patients’ rights under the
law to protect them, our organization and you.
2
TOPICS
 WHAT IS HIPAA?
 WHO DOES IT AFFECT?
 WHAT IS THE IMPACT OF



HIPAA?
WHEN WILL IT HAPPEN?
WHAT IS MVH DOING?
WHAT IS YOUR ROLE ?
3
WHAT IS HIPAA?
Health Insurance Portability and
Accountability Act of 1996
A Federal law imposed on all health care
organizations including hospitals, physician
offices, home health agencies, nursing homes and
other providers, as well as health plans and
clearinghouses, that protects patient health
information.
4
WHAT IS HIPAA?
 Its main purpose is to make sure that Protected Health



Information (PHI) is properly handled.
HIPAA tells us how we must process and protect our
patient information.
It also says that if we transmit PHI electronically, we must
do it in a standard way.
Under HIPAA patients have new rights that we must
inform them about.
HIPAA IS ALL ABOUT DOING WHAT IS RIGHT
FOR OUR PATIENTS.
5
WHO DOES IT AFFECT?
 All organizations that deal with a person’s
health information:
Providers (Hospitals, Clinics and Physicians)
Health Plans
Health Care Clearinghouses
6
WHEN WILL IT HAPPEN?
Privacy: April 14, 2003.
Data Standards (EDI): October 16, 2003.
Security: April 21, 2005.
7
HIPAA FINES & PENALTIES
Non-Compliance with Requirements and Standards
 Penalties for overall non-compliance could reach
millions of dollars per year.
 These penalties can apply to our organization and in
some cases to specific individuals including jail time.
 $100 per violation up to $25,000 limit per year.
8
HIPAA FINES & PENALTIES
Wrongful Disclosure of Protected Health information or
Misuse of Identifiers (directly or indirectly):
 Simple negligence $50,000 fine, one (1) year in prison or both
 Disclosure under false pretenses $100,000 fine, five (5) years in prison or both
 Intent to sell or use information $250,000 fine, ten (10) years in prison or both
Employees will also be held accountable by MVH
if HIPAA policy violations occur
9
WHAT IS MVH DOING?
MVH has been hard at work the past 2 years preparing for
HIPAA and the impact it will have on our organization. Here
are some of the activities:
 The establishment of the HIPAA Steering Committee with
representatives from key departments affected by HIPAA.
 The review and revision of policies and procedures as needed.
 The creation of new policies to support the process changes
needed.
 The education of employees on HIPAA.
 The review of our computer systems to ensure security of
patient information.
 The review of our process for transmitting electronic data
for payment purposes.
10
KEY PATIENT PRIVACY RIGHTS
Patient Privacy rights include:
 Access to health information (and restricted access to
information when the patient does not want it disclosed).
 Amendments to PHI when patients make specific
written requests and those requests are granted.
 Accounting of Disclosures (whenever we send patient
information without prior patient approval).
 Restrictions on Uses and Disclosures of PHI (we are
obligated to safeguard patient information and keep it
confidential to protect their right to privacy).
Patients will be given a paper copy of our Notice of
Privacy Practices concerning the above items and will be
asked to sign an acknowledgement of receipt.
11
Notice of Privacy Practices
Provides individual notice of all of the ways the
organization uses and shares a patient’s health
information
Explains a patient’s rights to confidentiality and
access to his/her information
Is posted prominently in the organization and
on the organization’s Web site
12
Notice of Privacy Practices
If a patient has questions about the
organization’s practices or his/her
privacy rights, direct him/her to
the Notice of Privacy Practices,
the Consumer Relations
Department (208-2666) or the
Privacy Officer, Mike Moddeman
(208-8339).
13
PRIVACY SUMMARY
April 14, 2003 is the deadline for implementation of the new
policies and procedures. MVH will be compliant with these
rules. We are performing the necessary training of staff as
required under the regulations.
Under HIPAA we can still use a patient’s name in the
waiting room. We may put a patient’s name outside
their door for identification and patients may still
share rooms. Our obligation and focus is to
SAFEGUARD their individual health information
and to protect their privacy.
14
Safeguarding Patient Information
The Release of Patient Information:
HIPAA allows us to share patient information with
any of the patient’s health care providers without an
authorization from the patient.
If you are presented with an authorization to release
medical information, contact the Health
Information Management Department
15
Releasing Confidential Information
You cannot share information with the patient’s family, friends or
anyone else without written authorization from the patient except:
The patient’s guardian, durable power of attorney for
healthcare, or next of kin (if the patient is incapacitated).
For operations of the hospital (ex. quality assurance, incident
reports, teaching and education of residents and students).
To enable our organization to get paid for services rendered.
When there is a legal duty to report (ex. child abuse,
domestic violence, gunshot or stab wounds).
To another healthcare provider that has treated the patient to
enable that provider to get paid for their services.
16
What is Confidential Information?
Any information about a patient that is written, saved on a
computer, or electronic media (disks, CDs, etc.), or spoken is
Protected Health Information (PHI). PHI includes:
Name
Age
E-Mail
Social Security #
Address
Phone Number
Diagnosis
Medical history
Medications
Observations of Health
Medical Record Number
Any Unique Identifier
The fact that the patient is in the hospital
17
Confidential Information
HIPAA DON’TS
Don’t tell anyone what you may overhear regarding a patient.
Don’t discuss a patient in public areas such as elevators,
hallways, or cafeterias.
Don’t look at information about a patient unless you need to
as part of your job.
Don’t look up information about friends or relatives unless
you need to to perform your work.
18
Confidential Information
HIPAA DO’S
Do keep all information you hear about a patient to yourself.
Do dispose of patient information by placing in properly designated
shredder bins for destruction.
Do notify security if you see an unescorted visitor in a non-public
area of the hospital.
Do contact the Privacy Officer, Mike Moddeman (208-8339), if you
have any questions.
19
SECURITY
 Print-based medical records need to be kept in a
secure area or in a safe location with access to
authorized people only. (These areas should be
locked when not in use).
 Access to those locations needs to be controlled so
that we can maintain the security of records
containing PHI.
 If you use a workstation as part of your job, a
password (not to be shared) should be used to
control access to PHI.
 If a workstation is available/viewable by nonauthorized people, use a screensaver or reposition
to protect the viewing of PHI.
 Lock cabinets that contain PHI when you leave your
area.
20
The Privacy Officer
• Manages the development of the organizations privacy
standards, policies and procedures.
• Oversees the education and training of the workforce.
• Investigates suspected violations and complaints.
• Facilitates the enforcement of HIPAA within the
organization
The Privacy Officer for Miami Valley Hospital
is Mike Moddeman @ 208-8339
21
What do you need to know?
HIPAA requires health care workers to use the
minimum amount of patient information they need
to do their jobs efficiently and effectively.
Ask yourself:

Do I need this information to do my job?

What is the least amount of information I need to
do my job?
22
What do you need to know?
Environmental Services staff do not need to look at
patient records
Professional health care workforce members such
as doctors, nurses, and therapists need to look at
their patients’ records to care for them
Coders and billers need to look at certain portions
of records to code and bill correctly
23
WHAT SHOULD YOU DO?
Let’s look at some situations that may
occur as you deal with patients.
Apply the idea that we should use
common sense and reasonable
judgment in deciding what to do.
24
WHAT SHOULD YOU DO?
A patient comes to Registration requesting a copy
of the Notice of Privacy Practices. The patient
admits having been given one several times, but
keeps misplacing it. Should Registration give the
patient a copy of the Notice of Privacy Practices?
 Yes

 No
 Uncertain
25
WHAT SHOULD YOU DO?
A patient comes into the hospital for the first time.
Where will the Notice of Privacy Practices
be found?
A.
B.
C.
D.
 E.
Copies in Registration
Posted throughout the hospital
On our web site
A and B
All of the above
26
WHAT SHOULD YOU DO?
The insurance company, forgetting to ask the
discharge planner for the history and physical,
figures that it would be easier to just ask for the
patient’s complete medical record and leaf
through the information to get what they need,
even though they know they will not need
everything in the medical record for payment
purposes. Is the discharge planner allowed to
release the entire medical record in this case?
 Yes
 No

27
 Uncertain
WHAT SHOULD YOU DO?
Your sister’s close friend is having surgery at the
organization where you work. She asks you to find
out what you can about the friend’s condition.
Should you call and ask around to the nurses you
know? Should you look up the friend’s medical
record?
 Yes
 No

28
 Uncertain
WHAT SHOULD YOU DO?
No. Even if you and your sister have the best intentions, you
have no right to look at private information about her friend’s
health. Suggest to your sister that she call or visit the
information desk. If the patient has agreed to have her
information available, the staff at the information desk can
give it to your sister.
Do not seek out confidential patient information unless you
need it to do your job. If you happen to hear confidential
information, do not repeat it to anyone.
Looking at patient records for any non-business reason can
be cause for disciplinary and legal action.
29
WHAT SHOULD YOU DO?
You are working in the emergency department
when you see that a neighbor has arrived for
treatment after a car crash. You hear someone
saying he will be taken to surgery soon. Your
neighbor’s wife works in another part of the
organization. Should you notify her that her
husband is in the emergency department?
 Yes
 No

30
 Uncertain
WHAT SHOULD YOU DO?
No. Tell the nursing staff that you know the patient and his
wife. Tell them that if they need to locate her, you can help.
Your neighbor has a right to privacy and may not want to
notify his family of the accident. If he is conscious, the
emergency department staff will allow him to decide whom to
notify.
If he is unconscious, the doctors and nurses will decide
whether to notify his wife. Leave the decision up to the
emergency department staff. They will let you know whether
they need your help to find the patient’s wife.
31
WHAT SHOULD YOU DO?
You pass by a nurses’ station where patients
names are listed on a white board. You spot the
name of a close friend. Should you stop by her
room?
 Yes
 No

32
 Uncertain
WHAT SHOULD YOU DO?
No. If you learned of your friend’s stay only by looking at the
white board, you should not go to her room unless your job
responsibilities take you there.
If you find out from the patient or her family member that she
is staying here, feel free to visit her. But be sure to follow the
visitor policies.
33
WHAT SHOULD YOU DO?
A co-worker is having trouble logging in to the
organization’s system. She asks for your login
name and password so she can try them. Should
you share them with her?
 Yes
 No

34
 Uncertain
WHAT SHOULD YOU DO?
No. HIPAA requires the use of individual passwords for each
person with access to health information stored in the
computer system. The organization keeps track of the
records you access based on the login name and password
you use. If you let others use your name and password, you
are breaking HIPAA’s rules and our policy. You may be held
responsible if the co-worker gains access to patient
information inappropriately.
Each person must keep the system secure by using only their
login name and password to gain access to the system.
Never share your login name or password.
35
WHAT SHOULD YOU DO?
A woman provides the name of a patient and asks
for information about his condition. What can you
tell her?
A.
B.
C.
D.
E.
The patient’s diagnosis
The patient’s general condition
The patient’s location in the hospital
B and C
All of the above
36
WHAT SHOULD YOU DO?
B and C. Check the facility directory. If the patient is listed in
the directory (and are not listed as Do Not Admit or No
Information), you can tell the woman the patient’s location
(room number and telephone number) and his general
condition (good, fair, serious, critical).
If the patient is not included in the directory, you can not give
out any information about him to anyone, regardless of the
person’s relationship to the patient.
37
WHAT SHOULD YOU DO?
A billing representative is missing the authorization
number for an outpatient surgery. The representative
calls the physician’s office to ask for the authorization.
The representative also asks about the patients recovery
from the surgery.
Is the representative acting appropriately?
 Yes
 No

38
 Uncertain
WHAT SHOULD YOU DO?
You happen to see a friend (who is a patient) in the
hospital. Later while talking to a family member
you say: “Guess who I saw today in the hospital?”
Have you violated your friend’s privacy rights?
 Yes

 No
 Uncertain
39
WHAT SHOULD YOU DO?
You happen to be walking by a trash bin and you
notice a stack of medical records laying on the
floor next to the trash. What should you do?
A.
B.
 C.
D.
Throw the records in the trash
Deposit the records in a container to be shredded
Bring the records to your supervisor or the Privacy
Officer
Ignore the situation since you are not authorized to
look at these records
40
WHAT SHOULD YOU DO?
A minor is concerned about the possibility of
having contracted a sexually transmitted disease.
She requests to have a private conversation with
the physician. Can the parent receive
documentation related to this discussion at a later
date without authorization of the minor?
 Yes
 No

 Uncertain
41
WHAT SHOULD YOU DO?
An ICU nurse who just returned from vacation today is
caring for a patient who has been in the ICU for four
days. The nurse wants to review all progress notes
and physician orders in the medical record for the
patient’s ICU stay. Does the nurse have the right to
access the progress notes and physician orders?
 Yes

 No
 Uncertain
42
WHAT SHOULD YOU DO?
A patient asks you how they can get their confidential
information sent to their workplace instead of their home.
What should the clerk do?
A. Politely tell the patient that we don’t provide this type of
service
B. Ask the patient why they want their confidential
information sent somewhere else, then get advice from
your supervisor
 C. Contact the HIM department for assistance
D. Tell the patient that we can’t do this until we receive
permission from their employer
43
WHAT SHOULD YOU DO?
Ms. White asks you for an accounting of disclosures of
her child’s PHI. You direct her to the HIM department
Did the employee act properly?
 Yes

 No
 Uncertain
44
WHAT SHOULD YOU DO?
A person performing discharge planning is
coordinating the transfer of a patient to a skilled
nursing facility. The discharge planner has never
worked with this patient before and needs to review
the medical record to appropriately prepare for the
transfer. Does the discharge planner have access to
the medical record to conduct this task?
 Yes

 No
 Uncertain
45
Questions?
If you have questions about privacy matters
or wish to report a concern,
contact Mike Moddeman at
208-8339
46
MIAMI VALLEY HOSPITAL
Thank You
Copyright 2003 The Gates-Brewer Group, LLC