Office of the Secretary Office for Civil Rights (OCR) Indian Health

Office of the Secretary Office for Civil Rights (OCR) Indian Health Service HIPAA Training Hosted by the Aberdeen Area Office July 24, 2012

Who must follow the Privacy Rule? Three categories of covered entities: – Health plans – Health care clearinghouses – Health care providers who transmit health information electronically in connection with certain administrative and financial transactions OCR 2

HIPAA Regulation - Coverage “Covered entities” - health care providers who electronically transmit health information in connection with a standard transaction; health plans; health care clearinghouses Hybrid entities (e.g., HHS) Business associates (contract usually required) OCR 3

Business Associates Provides that a business associate may use or disclose PHI only if such use or disclosure is in accordance with the HIPAA Privacy Rule’s required terms for business associate contracts. OCR 4

Scope: What is Covered? Not PHI: – De-identified information – Employment records – FERPA records OCR 5

Uses and Disclosures: Key Points No use or disclosure of PHI unless permitted or required by the Privacy Rule. Required Disclosures: – To the individual who is the subject of the PHI. – To the Secretary of HHS in order to determine compliance. OCR 6

Uses and Disclosures: Key Points All other uses and disclosures in the Privacy Rule are permissive. Covered Entities may provide greater protections. OCR 7

HIPAA Privacy Rule and Mental Health Information Most mental health information protected to same degree and manner as other PHI Exception for psychotherapy notes that are maintained separate from the rest of the patient’s medical record OCR 8

To Individuals Besides making required disclosures, Covered Entities may also disclose PHI to their patients or enrollees. For example: – Health plans may contact their enrollees. – Providers may contact or speak with their patients. Covered Entities must treat a personal representative -- person who has authority to make decision related to health care -- as an individual OCR 9

Sharing Information under the HIPAA Privacy Rule Relevant permissible disclosures of PHI under the Privacy Rule may include: – With authorization of patient or personal representative Without authorization, subject to conditions: For treatment Involved in care or payment for care OCR 10

Sharing Information under the HIPAA Privacy Rule – Without authorization, subject to conditions: To parents, family, or others involved in care (with the opportunity to agree or object) To avert a serious and imminent threat to health or safety To law enforcement As required by other law OCR 11

Permissive Uses and Disclosures To the individual or personal representative For specific public priorities “Incident to” Limited data sets As authorized by the individual OCR 12

Permissive Uses and Disclosures For treatment, payment, and health care operations (TPO) Treatment also includes the coordination or management of health care by a health care provider with a third party, which could include others responsible for following the care of the individual after discharge OCR 13

To Parents, Family, or Others Involved in Care PHI may be disclosed to parents or other persons who are involved in care personal representatives of the patient OCR 14

Incidental Use and Disclosures The Privacy Rule permits uses and disclosures incidental to an otherwise permitted use or disclosure, provided minimum necessary and reasonable safeguard standards are met. – Examples: talking to a patient in a semi-private room; talking to other providers if passers-by are present; waiting-room sign-in sheets; patient charts at bedside. Allows for common practices if reasonably performed OCR 15

Opportunity to Agree or Object To disclose PHI to persons involved in care or payment for care and for notification purposes. For example: – Friends may pick up prescriptions. – Hospitals may notify family members of a patient’s condition. – Covered entities may notify disaster relief agencies. OCR 16

To Parents, Family, or Others Involved in Care If the patient does not object, relevant PHI also may be disclosed to family members or other persons identified by the patient as involved in the patient’s care or payment (may not be personal representatives) OCR 17

Public Priorities Covered entities may use or disclose PHI under these provisions if required conditions are met: – As required by law – For public health activities – About victims of abuse, neglect or domestic violence – For health oversight activities – For judicial and administrative proceedings OCR 18

Public Priorities – For law enforcement purposes – To coroners, medical examiners, funeral directors – For cadaveric organ, eye, or tissue donation purposes – For research purposes – To avert a serious threat to health & safety – For specialized government functions – For workers’ compensation OCR 19

Minimum Necessary Standard Covered entities must make reasonable efforts to use, disclose, or request the minimum necessary PHI based on purpose. Exceptions to the minimum necessary standard: e.g., disclosure of PHI for the purpose of treatment OCR 20

Minimum Necessary Standard Covered entities must develop criteria to limit disclosures of and requests for PHI to the minimum necessary. OCR 21

With Authorization PHI may be disclosed with written, signed authorization of patient or patient’s personal representative Authorization must meet requirements of Privacy Rule OCR 22

With Authorization Personal representatives are: – For adults/emancipated minors, persons with legal authority to make health care decisions on behalf of patient – For unemancipated minors, parent or guardian generally OCR 23

Individual Rights Notice of Privacy Practices Access: inspect and copy Amendment Accounting Alternative communications Request restriction Complaints to Covered Entity and Secretary OCR 24

Individual Rights Individual has the right to written notice of the uses and disclosures of PHI that may be made by CE, CE’s legal duties with regard to PHI, and individual rights. Required elements in Privacy Rule OCR 25

Individual Rights In most cases, Covered Entity must post and provide a copy to the individual on first contact with providers and upon enrollment with health plan and upon request. Covered provider must document “good faith effort” to obtain acknowledgement. OCR 26

Alternative Communication Alternative Communication A covered health care provider must permit the individual to request and must accommodate reasonable requests to receive communications of PHI by alternative means and at alternative locations. The requirement applies to health plans if the individual clearly states that the disclosure could endanger the individual. OCR 27

Access Individual has a right to inspect and obtain a copy of PHI about the individual in a designated record set (“DRS”) for as long as the DRS is maintained. Reasonable fees are allowed for copying and postage only (no retrieval fees allowed). OCR 28

Administrative Requirements Covered Entities must: – Designate a Privacy Officer; – Designate a contact person or office to receive complaints and provide further information; – Provide privacy training to all workforce members; – Develop and apply sanction policy for workforce members who fail to comply; OCR 29

Administrative Requirements Implement policies and procedures designed to comply with standards. – Implement administrative, technical and physical safeguards to protect privacy of PHI; – Mitigate any harmful effect of a violation known to the covered entity to the extent practicable; OCR 30

Administrative Requirements – Provide an internal complaint process for individuals; – Refrain from intimidating and retaliatory acts; – Not require individuals to waive their rights. OCR 31

Safeguards Common IHS Safeguards concern: Sending PHI by Email - Heather McClane OCR 32

Security Rule Part 164 – Security Rule and Privacy Rule OCR 33

HITECH and HIPAA 1996 HIPAA Administrative Simplification – Standards for administrative/financial transactions for efficiency/cost savings – Standards for security and privacy to protect patient identifiable information OCR 34

HITECH and HIPAA 2009 HITECH Act – Standards for electronic records and data sharing in clinical setting, for quality reporting, and other population health purposes – Subpart D for privacy protections and security for patient identifiable information OCR 35

Breach Notification Covered entities must notify each affected individual of breach of “unsecured protected health information.” Business associate must notify covered entity of breach OCR 36

Breach Notification Notice to media if more than 500 people affected. Notifications to be provided without unreasonable delay (but no later than within 60 days) of discovery of breach. Notice to Secretary of breach and posting on HHS Website. OCR 37

Compliance and Enforcement Any person or organization can file complaints with OCR (generally within 180 days) OCR may investigate complaints and may conduct compliance reviews Covered entity must provide OCR with access to records; subpoena authority OCR shall attempt to resolve noncompliance by informal means OCR 38

Complaint Investigations Every complaint received by OCR is reviewed and allegations analyzed. An investigation is launched when warranted by the facts and circumstances presented by the complaint. OCR 39

Complaint Investigations OCR investigations have resulted in changes in privacy practices and other corrective actions in over 7,861 cases since April 2003. Corrective action obtained by HHS from covered entities has resulted in systemic change that benefits all individuals they serve. OCR 40

Most Common Complaints The compliance issues investigated most frequently, in order, are: Impermissible use or disclosure of an individual’s identifiable health information OCR 41

Most Common Complaints example of impermissible use: viewing your own PHI, that of a coworker or of a family member example of impermissible disclosure: telling PHI from work to someone outside of work OCR 42

Most Common Complaints The compliance issues investigated most frequently, in order, are: The lack of adequate safeguards to protect identifiable health information Refusal or failure to provide the individual with access to or a copy of his/her records OCR 43

Most Common Complaints The compliance issues investigated most frequently, in order, are: The disclosure of more information than is minimally necessary to satisfy a particular request for information Failure to have the individual’s valid authorization for a disclosure that requires one OCR 44

Our Mutual Goal Ensuring the privacy and security of each individual’s health information in accordance with the standards and requirements of the HIPAA Privacy Rule OCR 45

Indications of Noncompliance 45 CFR 160.312: If investigation or compliance review indicates noncompliance, HHS will attempt to reach resolution satisfactory to the Secretary by “informal means.” OCR 46

Indications of Noncompliance “Informal means” includes: – Demonstrated compliance; – Completed corrective action plan; or – Other agreement. OCR 47

OCR Web Site www.hhs.gov/ocr Privacy: www.hhs.gov/ocr/hipaa/ OCR 48

Additional Information On HIPAA Privacy Rule protections and requirements: http://www.hhs.gov/ocr/privacy/hipaa/unde rstanding/index.html OCR 49

Additional Information On HIPAA Privacy Rule resolution agreements and other enforcement actions: http://www.hhs.gov/ocr/privacy/hipaa/enfor cement/examples/index.html OCR 50

OCR Web Site Karel Hadacek, J.D. Equal Opportunity Specialist [email protected] 303-844-7836 OCR 51