HIPAA OVERVIEW Version 2 12 16 02 HIPAA Collaborative of

This Training Module is Copyright 2002 by the HIPAA Collaborative of Wisconsin (“HIPAA COW”). It may be freely redistributed in its entirety provided that this copyright notice is not removed. It may not be sold for profit or used in commercial documents without the written permission of the copyright holder. This Training Module is provided “as is” without any express or implied warranty. This Training Module is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney. HIPAA COW has not yet addressed all state pre-emption issues related to this Training Module. Therefore, this form may need to be modified in order to comply with Wisconsin law. 2 Copyright 2002 HIPAA COW

Press for Glossary AGENDA l l l l l 3 History Purpose Compliance Dates

Press for Glossary HISTORY l HIPAA stands for “Health Insurance Portability & Accountability Act of 1996” l HIPAA was passed in 1996 as part of a broad congressional attempt at healthcare reform What we’re now dealing with is Title II – Administrative Simplification 4 Copyright 2002 HIPAA COW

Press for Glossary HIPAA Title I n Health insurance access, portability and renewal Title III n Fraud and Abuse n n Medical Liability Reform Medical Savings Accounts n Tax deduction provisions n Administrative Simplification Electronic Transaction Standards (EDI) n n n Security Standards 5 Privacy Standards Title IV n Title V Group health plan provisions n Revenue offset provisions For 9 key payor transactions Includes clinical code sets Includes key identifiers n For protecting electronic health information n To spell out permissible uses of patient identifiable healthcare information Copyright 2002 HIPAA COW

Press for Glossary PURPOSE – TITLE II ADMINISTRATIVE SIMPLIFICATION l To increase the efficiency and effectiveness of the entire health care system through: ü The electronic exchange of information ü The standardization of that information l 6 To enhance the security and privacy of Protected Health Information (PHI) throughout the entire health system Copyright 2002 HIPAA COW

Press for Glossary THE NEED 1 in 6 patients will omit sensitive information when discussing medical history with their physician out of fear of misuse or mishandling. DHHS-Privacy Rule Preamble 7 Copyright 2002 HIPAA COW

Press for Glossary COMPLIANCE DATES l Electronic Transactions Standards ü ü ü Standardized Code Sets – 10/16/02 or 10/16/03 if extension was filed. Unique Provider & Health Plan Identifiers – Final Rule not yet published Claims Attachments & 1 st Report of Injury – Final rule not yet published Privacy Standards – April 14, 2003 l Security Standards – Final rule not yet published l 8 Copyright 2002 HIPAA COW

Press for Glossary HIPAA APPLIES TO: Covered Entities: l l l 9 Health Plans (licensed insurers, ERISA plans, HMOS, Medicare, etc. ) Providers (physicians, hospitals, home health, DME, pharmacy, chiropractic, dental, etc. ) who conduct 1 or more of the HIPAA-defined transactions electronically Clearinghouses Copyright 2002 HIPAA COW

Press for Glossary Electronic Transactions and Code Sets 10 Copyright 2002 HIPAA COW

Press for Glossary ELECTRONIC TRANSACTIONS Providers Eligibility and Benefits Inquiry Preauthorization or Referral Request Claim Submission Employers Payers 270 271 278 837 Eligibility and Benefits Response 834 Enrollment and Termination of Enrollment Data Preauthorization or Referral Response 820 Premium Payment and Advice Claim Receipt 276 Claim Status Inquiry 277 11 Receive Claim Payment / Advice 835 Claim Status Response Claim Payment/Advice Source: Phoenix Health Systems Copyright 2002 HIPAA COW

Press for Glossary ELECTRONIC TRANSACTIONS & CODE SETS Must use HIPAA standards for designated transactions l Must use appropriate code sets in transactions l ü Medical data code sets ü Non-medical data code sets 12 Copyright 2002 HIPAA COW

Press for Glossary Security Proposed Rule 13 Copyright 2002 HIPAA COW

Press for Glossary SECURITY Covered Entities must maintain reasonable & appropriate administrative, physical, & technical safeguards to: l l 14 Ensure the integrity & confidentiality of PHI Protect against unauthorized access, use, or disclosures by employees or external parties Protect the availability of PHI in emergency and disaster situations Demonstrate compliance by officers and employees Copyright 2002 HIPAA COW

Press for Glossary COMPONENTS OF PROPOSED SECURITY STANDARDS l l l 15 Administrative Security Procedures Physical Safeguards Technical Security Services Communications Security Electronic Signature Copyright 2002 HIPAA COW

Press for Glossary ADMINISTRATIVE PROCEDURES l l l Certification of Security Chain of Trust Agreements Contingency and Disaster Recovery Planning Information Access Control Internal Security Audit Procedures Personnel Security ü ü ü 16 Transfers Termination procedures Management of authorization methods Personnel clearance procedures Training in security Copyright 2002 HIPAA COW

Press for Glossary PHYSICAL SAFEGUARDS l l 17 Assigned Security Responsibility Media Controls Physical

Press for Glossary TECHNICAL SECURITY SERVICES l l l 18 Access Controls Audit Controls

Press for Glossary COMMUNICATIONS SECURITY l l l l 19 Integrity Controls Message Authentication Access Controls or Encryption Alarm Audit trail Entity Authentication Event Reporting Copyright 2002 HIPAA COW

Press for Glossary Privacy 20 Copyright 2002 HIPAA COW

Press for Glossary PRIVACY: KEY FEATURES l l l l 21 PHI Uses & Disclosures Consent Authorization Notice of Privacy Practices Minimum Necessary Patient Rights Business Associates l l Marketing, Fundraising, and Research Interaction with State privacy and confidentiality laws Administrative Requirements Penalties Copyright 2002 HIPAA COW

Press for Glossary PRIVACY RULE: WHAT DOES IT DO? HIPAA regulates the use or

Press for Glossary WHAT IS PHI? Health and demographic information about an individual that is transmitted or maintained in any medium where the information: l l 23 Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and Relates to the past, present, or future: ü Physical or mental health condition of an individual, or ü Provision of health care to an individual, or ü Payment for the provision of health care to an individual. Copyright 2002 HIPAA COW

Press for Glossary Copyright 2002 HIPAA COW INDIVIDUAL IDENTIFIERS 1. 2. 3. 24 4. 5. Name Geographic subdivisions smaller than a State – Street Address – City – County – Precinct – Zip Code & their equivalent geocodes, except for the initial three digits Dates, except year – Birth date – Admission date – Discharge date – Date of death Telephone numbers Fax number 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. E-Mail Address Social security numbers Medical record numbers Health plan beneficiary numbers Account numbers Certificate/license numbers Vehicle identifiers and serial numbers, including license plate numbers Device identifiers and serial numbers Web universal resource locations (URLs) Internet Protocol (IP) address numbers Biometric identifiers, including finger and voice prints Full face photographic images and any comparable images Any other unique identifying number, characteristic, or code

LIMITED DATA SET For research, public health or health care operations: 1. 2. 3. 4. 5. 6. 7. 25 8. Names Postal Address, other than town, state, & zip Telephone numbers Fax numbers E-mail addresses Social Security Numbers Medical Record numbers Beneficiary numbers 9. 10. 11. 12. 13. 14. 15. 16. Account numbers Certificate/license numbers Vehicle numbers Device identifiers URLs – web locators Internet IP addresses Biometric identifiers Full face photographs

Press for Glossary PERMITTED USES & DISCLOSURES Covered entities are permitted to use and disclose PHI for: l Treatment l Payment l Health Care Operations (These are referred to as “TPO”) 26 Copyright 2002 HIPAA COW

PERMITTED USES & DISCLOSURES The final modifications permit covered entities to: l Use or disclose PHI for its own TPO l Disclose PHI to another entity for treatment, payment and health care operation activities. – – – 27 Each entity has a current or prior relationship. The disclosure is for “health care operations” The disclosure is for fraud and abuse detection.

Press for Glossary MANDATED USES & DISCLOSURES l HIPAA mandates the disclosure of PHI for certain purposes such as: ü Health oversight activities ü Judicial and administrative proceedings ü Law enforcement purposes ü Organ donation l 28 All other uses or disclosures outside of TPO require an authorization. Copyright 2002 HIPAA COW

Press for Glossary HEALTH CARE OPERATIONS Any of the following activities of a Covered Entity: l l l 29 Quality assessment and improvement and populationbased activities Peer review and credentialing activities Underwriting, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance Medical review, legal services, and auditing Business planning and development Business management and general administrative activities Copyright 2002 HIPAA COW

Press for Glossary CONSENT l l Covered entities must provide individuals with notice of their privacy practices. l 30 Consent is optional, prior to disclosing PHI for treatment, payment or health care operations. Providers required to keep the patients receipt acknowledgement on file. Copyright 2002 HIPAA COW

Press for Glossary This slide is optional CONSENT l Consent forms must: ü Be in plain language ü Inform individual of how information may be used for TPO ü Refer to notice of privacy practices ü Inform of the right to request restrictions ü Inform of the right to revoke consent ü Be signed and dated by the individual l 31 Consent forms are valid until revoked Copyright 2002 HIPAA COW

Press for Glossary AUTHORIZATION l l Authorization must be obtained for ALL uses and disclosures other than TPO or those mandated under law. Authorizations must include: ü A description of the information to be disclosed ü The name of the person or entities to whom the information will be disclosed ü An expiration date ü Information regarding right to revoke ü Date and signature 32 Copyright 2002 HIPAA COW

Press for Glossary PRIVACY NOTICE Privacy Notices Must: l Be in plain language l Contain a description and example of TPO l Contain a description and example of other uses and disclosures not requiring Authorization l Include statements about an individual’s rights l Include statements about the Covered Entity’s duties l Describe the complaint process l Provide other specific requirements 33 Copyright 2002 HIPAA COW

Press for Glossary MINIMUM NECESSARY The privacy rule requires covered entities to use or disclose only the “minimum necessary” PHI to accomplish the intended purpose of the use, disclosure, or request. 34 Copyright 2002 HIPAA COW

Press for Glossary MINIMUM NECESSARY l Internal Requirements: ü ü l External Requirements: ü ü 35 Identify workforce who need to access PHI For each class, category or person identified, limit access based on need-to-know Limit access to what is needed to accomplish the purpose for which the request was made May “reasonably rely” that the requesting entity is asking for the “minimum necessary”. * Copyright 2002 HIPAA COW

Press for Glossary BUSINESS ASSOCIATE l l NOT a member of your workforce l 36 A person or entity who either provides services on behalf of a Covered Entity, or to a Covered Entity which involves the use or disclosure of PHI Transition Period - an additional year to enter into Business Associate Agreements. Copyright 2002 HIPAA COW

Press for Glossary MARKETING HIPAA defines “marketing” as a communication about a product or service to encourage a recipient to purchase or use that product or service. l What is NOT marketing? l Concerns health-related products and services of the covered entity, and the communication meets certain requirements. ü Is made for treatment of the individual ü Is made for case management or care coordination, or to direct alternative treatments, therapies, providers or care. ü 37 Copyright 2002 HIPAA COW

MARKETING l Authorization is not required to use or disclose PHI for marketing if the communication is: ü ü Face-to-face, made by the covered entity with the individual. A promotional gift of nominal value. • Any other marketing requires an individual’s authorization. 38

Press for Glossary FUNDRAISING l PHI use and disclosure for a covered entity’s own fundraising purposes is permitted. ü ü ü l PHI may also be disclosed to a business associate or institutionally-related foundation ü ü l 39 Meets definition of Health Care Operations Consent required (to be removed under NPRM) Authorization not required Must be for purpose of raising funds for covered entity Limited to demographic information and dates of health care provided Fundraising material must offer opt-out mechanism Copyright 2002 HIPAA COW

Press for Glossary RESEARCH To use or disclose PHI for research purposes, without authorization, the covered entity must obtain one of the following: ü ü Data Use Agreement to use limited data sets. ü Preparatory to Research. PHI used to prepare research protocol. ü 40 Approval from the Institutional Review Board (IRB) or Privacy Board Research on PHI of Decedents. Copyright 2002 HIPAA COW

Press for Glossary RESEARCH AUTHORIZATION Authorization requirements for the use and disclosure of PHI, for research purposes: ü ü 41 Unlike other authorizations, the research authorization does not have to include an expiration date. Authorization may be combined with other research consent forms. Copyright 2002 HIPAA COW

Press for Glossary INDIVIDUAL RIGHTS Individuals have the right to: l Receive written notice of privacy practices l Request restrictions on uses & disclosures l Access, inspect & copy their PHI l Request amendment or correction of their PHI l Receive an accounting of disclosures of their PHI (except those related to treatment, payment, & operations) 42 Copyright 2002 HIPAA COW

Press for Glossary ADMINISTRATIVE REQUIREMENTS l l l 43 Designate a privacy officer with primary responsibility for ensuring compliance with the regulations Establish training programs for all members of the workforce Implement appropriate policies & procedures to prevent intentional and accidental disclosures of PHI Copyright 2002 HIPAA COW

Press for Glossary ADMINISTRATIVE REQUIREMENTS l l l 44 Establish a system for receiving and responding to complaints regarding the Covered Entity’s privacy practices Implement appropriate sanctions for violations of the privacy guidelines Make reasonable efforts to limit information to minimum necessary to accomplish a person’s purpose/job Copyright 2002 HIPAA COW

Press for Glossary ENFORCEMENT l l Office For Civil Rights (OCR). Designated the enforcement agency concerning privacy regulations. They will provide guidance and monitor compliance. l 45 The Public. The public will be educated about their privacy rights and will not tolerate violations to their privacy! Expect Class Action lawsuits. Department of Justice (DOJ). Involved in criminal privacy violations. Fines, penalties & imprisonment. Copyright 2002 HIPAA COW

Press for Glossary PENALTIES - FAILURE TO COMPLY l l 46 Civil ü $100 per violation person up to a maximum of $25, 000 person per year per standard violated Criminal ü Up to $50, 000, 1 year in prison, or both, for inappropriate use of PHI ü Up to $100, 000, 5 years in prison, or both for using PHI under false pretenses ü Up to $250, 000, 10 years in prison or both, for the intent to sell or use PHI for commercial advantage, personal gain, or malicious harm Copyright 2002 HIPAA COW

Press for Glossary HIPAA AT (INSERT YOUR ORGANIZATION’S NAME) (INSERT YOUR ORGANIZATION’S HIPAA STRUCTURE)

Press for Glossary HIPAA IMPLEMENTATION STEPS l l l l 48 l Provide Education & Awareness Training Establish an Implementation Team Develop Implementation Strategy Allocate Appropriate Resources Conduct Risk Assessment and Gap Analysis Establish Policies & Procedures Audit and Monitor Join HIPAA COW! Copyright 2002 HIPAA COW

RESOURCE WWW. HIPAACOW. ORG 49 Copyright 2002 HIPAA COW

REFERENCES This presentation has been adapted from Cathy Boelke’s presentation for Avanti. 50 Karen Bauer Joan Benson, MBA, MT(ASCP)SH Catherine Boelke, MBA, CMPE Tony Cooper, FHFMA, CFE Terri Edgar, RN, BSN Renee Hinkel, RN, MSN William Jensen , MBA Jennifer Laughlin, RHIA Richard Reynolds, FHIMSS Beth Zallar, MS, RHIA