HIPAA Test

EHR stands for?

Electronic health record

HIPAA stands for?

Health Insurance Portability And Accountability Act

HITECH stands for?

Health Information Technology For Economic And Clinical Health Act

PII stands for?

Personal Identifiable Information

PHI stands for?

Patient Health Information

ePHI stands for?

Electronic Protected Health Information

What is the 1973 Patients Bill of Rights?

• Defines clear rights of patients

• List of expectations & rights for hospitals to tailor for community needs

• Typically put up in waiting rooms

• No single standard version

What is the 2010 Affordable Healthcare Act?

Protects patients from insurance companies

• Allows dependents up to 26 years old on parent’s insurance

• Insurance can’t deny coverage of patients with pre-existing conditions

• Preventative screenings are covered without copays/fees (ex: mammogram)

Examples of Patient Bill of Rights?

Patients have a right to:

• Protection of privacy

• Considerate, safe, respectful care

• Know the physicians involved in their care

• Refuse testing, treatment, involvement in research

What to do if a patient refuses an exam?

• Clarify why exam is necessary

• Assess competency and urgency (ex: is this an emergency/life threatening?)

• Document refusal, pt must sign refusal form

• Reassure pt they can reschedule if they want to

• Notify physician / provider of refusal

What is the 21st Century Cares Act (2021)?

• Expansion of patient bill of rights that allowed increased access to clinical notes

• Full clinical notes to be released to patient in their medical chart (test results, physician notes) AKA Open Notes

Advantages & disadvantages of Open Note?

Advantages:

• Quick easy access

• PT can point out errors in their notes

• PT can feel more empowered w/ their care

• Transparency between pt & MD

• Pt feels better prepared for their visits

Disadvantages:

• Language may be confusing for a layperson

• Pt may not agree with what’s in their notes

• Potential breakdown of relationship

• MD may have to spend more time explaining or editing their notes

• MD may be overwhelmed with inquiries from Pts

What is a Patient’s Medical Chart? Examples?

Complete record of a patient’s key clinical data & medical history

Ex: demographics, vital signs, diagnoses, medications, treatment plans, billing, address, contact info, patient location, their overseeing RN & MD

What is HIPAA?

Health Insurance Portability & Accountability Act of 1996

• Sets national standards for protection of privacy & security of a patient’s health information in any form

Major additions since it was first signed: Intro to privacy rule, Security rule, Breach enforcement rule, Omnibus final rule

What’s the HIPAA privacy rule?

• Gives patients ability & right to access their medical info and records

• Set boundaries on the release of patient health records & information

• Establishes safeguards for healthcare providers to protect privacy of PHI (patient health info)

Examples of PHI (protected health info)?

Name , Age/DOB , Address

Phone number, email address

Medical history, diagnosis, medications, treatments, symptoms

Patient admit status

Social security #, Medical record #, Fingerprints

What’s the HIPAA Privacy Rule?

Contains standards for patients to know their rights regarding privacy and how their information is used

Who must abide by HIPAA?

Anyone who has access to the patients medical records or private information AKA “Covered Entities”

** What are Covered Entities? Examples? ****

Anyone who has access to patients medical records/private info.

Examples:

• Healthcare providers

• Health plans: entities that provide/pay cost of medical care

• Clearing Houses: processes info they receive from another entity (middleman between health provider & insurance to check claims)

• Business Associates: provides services for a covered entity (IT, billing, coding, data disposal)

Who are exceptions to the HIPAA rule?

Covered entities can disclose pt info under these exceptions:

• Abuse or neglect

• Law enforcement

• Disaster relief

• Judiciary proceedings

• Coroners & medical examiners

• Emergencies affecting life/safety/imminent danger

• Treatment, payment, & healthcare operations (TPO)

Can employees access family/friends/celebrity’s medical record?

Unless you’re part of their care and require info for your job, NO!!!

What’s the HIPAA Security Rule? **

Standards for protecting confidentiality & availability of ELECTRONIC Protected Health Information. Doesn’t apply to oral/written PHI

How to be in compliance of HIPAA security rule?

• Detect & safeguard against threats

• Protect against misuse of PHI

• Certify workforce compliance via employee training

• Ensure confidentiality of electronic PHI

What’s the HIPAA Breach Enforcement rule? **

Allows the Dept of Health and Human Services to investigate HIPAA complaints against covered entities

Covered entities can be fined/penalized for avoidable breaches

What are the consequences for HIPAA violation? **

• Employee termination

• Civil/criminal penalties

• Fines - up to $25,000

• Imprisonment up to 10 years

• Sanctions from professional boards

Malpractice insurance covers some HIPAA violations

Exceptions to the Breach Enforcement rule?

• If breach was unintentional/done in good faith and in scope of authority (ex: accidentally clicking wrong patient name)

Who oversees HIPAA compliance?

They process HIPAA violation complaints

• Health & Human Services Office for Civil Rights (HHS - OCR)

• Works w Dept of Justice

How to file a HIPAA violation complaint? ***

• Submit complaint in writing via online portal, email, mail, or fax

• MUST BE WITHIN 180 DAYS OF WHEN YOU BECAME AWARE OF INCIDENT (not the incident itself)

• Name the entity involved & describe the actions perceived to be HIPAA violations

Who can file a HIPAA violation complaint?

ANY PERSON who believes a covered entity has not complied w/ HIPAA

What to do when a breach occurs?

The covered entity needs to send a breach notification alert WITHIN 60 DAYS to:

• Affected individuals

• Dept of Health & Human Services (HHS)

(If breach affects less than 500 ppl, HHS must be contacted immediately)

• Media, if necessary

What is Notice of Privacy Practices?

• Provides notice of all ways an organization uses/shares info

• Explains a pt’s right to confidentiality & access to their info

• Posted in the organization & on their website

Patient Privacy: What can pt agree or object to?

• Giving family/friends health info or status

• Letting family pick up prescriptions

• Who may be present during exams

• Respect patient privacy in presence of others

What can you share if a patient agrees to listing their name in the hospital directory? **

If they do list their name, you can share location and general location.

If they don’t, DO NOT GIVE ANY INFO.

When do you share medical records of minors to parent/guardians?***

Parent/guardian have access if

• Patient is under 18

• If they request info, except pertaining to an abortion

Parent/guardian does NOT have access if a provider believes they are abusing or neglecting the child

What services can minors receive without parental consent? ***

Pregnancy testing

Birth control

Testing and treatment of STIs

What if a minor decides to have an abortion?

MD law: requires one parent/guardian be NOTIFIED before the abortion (but doesn’t need approval)

When would a parent not be notified of a minor’s abortion?

if the doctor performing the abortion decided that

• Effort to give notice was unsuccessful

• Minor doesn’t live w/ parent or guardian

• Minor is mature & capable of giving informed consent

• Notice may lead to abuse of the minor; notification wouldn’t be in minors best interest

What to do if abuse is suspected?

Mandated reporters must make oral and written reports of suspected abuse or neglect

Oral reports made immediately; Written reports made within 48 hours of contact

Who are mandated reporters?

Health care practitioners

educators

human service workers

law enforcement officers

What are interpeters?

3rd patients that help interpret & explain procedures

Must have patient permission to speak with third party

New virtual remote interpreter = MARTTI system

HIPAA precautions when Faxing/Printing?

Use a “cover sheet” - confidentiality disclosure

Confirm FAX was received & sent to correct number

Don’t leave papers on printer, collect ASAP

What to do with Incidental Findings at UMBC lab?

• A form identifying the incidental finding will be provided to the student (urgent vs non urgent matter)

• Student will agree/disagree to finding being discussed in scan lab

• Learning process