C O M M U N I T Y H E A LT H N E T W O R K , I N C . O N - L I N E M A N D A T O R Y T R A I N I N G

HIPAA PRIVACY AND SECURITY

OBJECTIVES OF TRAINING

•HIPAA Fundamentals• Privacy Rule Basics• Security Rule Basics• Security Components• Security Policies and Procedures• Instructions: On-line mandatory training

WHAT DOES HIPAA STAND FOR?

•Health• Insurance• Portability• Accountability • Act

HIPAA POLICIES

CHN has 25 policies that relate to HIPAA they can be found on the CHN Intranet. CHN HIPAA policies are updated on an ongoing basis in order to satisfy changing compliance requirements and industry best practice.• “Policies & Procedures” – Section 20 – Information Technology• “CHN Manuals & General Info – HIPAA”• “Policies & Procedures” – Section 37 – Corporate Compliance

HIPAA OVERVIEWHIPAA originally passed in 1996 and finalized in January of 2013. The Rule is meant to:• Standardize Records- Transaction coding and

compliance more simple thereby saving money in the long-term.• Provide Portability- Allows for easy transfer of medical

information.• Promote Accountability- The responsibility piece,

keeping the information private and secure.Within HIPAA there are two rules that we need to comply with:• The Privacy Rule • The Security Rule

HIPAA: PRIVACY RULE

Privacy Rule:• Restricts what information can be disclosed and

who should have access to it. Specifically in relation to: • Individually Identifiable Information • Protected Health Information (PHI)

HIPAA: PRIVACY RULE

Individually Identifiable Information:• A subset of health information, created or received

by a Covered Entity, like CHN, relating to a condition, treatment, or payment which could be used to identify a client.• Any information that can be traced back to a specific

person is then considered Individually Identifiable Information.

HIPAA: PRIVACY RULE

Protected Health Information (PHI):• Any health or individually identifiable information

given to a covered Entity, like CHN, whether verbal, written or electronic needs to remain confidential. This includes information that can connect the patient to the medical record:• Name• Address• Social Security Number & Other ID Numbers• Medical Record Number (MRN)• Physician’s Notes• Billing Information

HIPAA: PRIVACY RULE

Covered Entity:• Any health plan, clearinghouse, or provider who

transmits health information (CHN). • Covered entities MUST:• Allow patients to see and receive copies of their PHI and

do so electronically.• Designate a Privacy Officer and a means to contact

him/her.• Develop a Notice of Privacy Practice document for

patients.• Provide training to new employees and affiliates.• Develop and utilize a complaints process.• Ensure Business Associates also comply with the privacy

regulations.

HIPAA: PRIVACY RULE

Business Associate: • A person or organization that performs a function on

behalf of a Covered Entity using individually identifiable information.• Business Associates are required to sign a Business

Associate Agreement. • If the Business Associate should need to share

information with another organization or subcontractor they must continue the same process of establishing the Business Associate Agreement. • The chain on private information cannot be broken.• Patients can file a grievance if they think their rights

have been violated.

HIPAA: PRIVACY RULE

• Corrective action for HIPAA Privacy violation:• CHN has a ZERO TOLERANCE POLICY for

non-compliance in relation to Privacy Breaches, the non-compliant individual will be immediately dismissed.• Violations of a severe nature may result in

notification to law enforcement officials as well as regulating, accrediting, and/or licensing organizations.

HIPAA: PRIVACY OFFICER

Privacy Officer-Director of Health Info Services• Develops a Notice of Privacy Practice document.• Investigates complaints and violations related to Privacy Breaches.• Works with Compliance Officer to make sure Business

Associates also comply with the privacy ruling. • Ensures CHN and it’s employees are compliant in regards

to the privacy rule. • Ensures privacy standards comply with statutory and

regulatory requirements. • Maintains HIPAA privacy policies and procedures.

HIPAA: SECURITY RULE

• Ensures that electronic information is kept private.• Four Requirements of Security:• Ensures confidentiality, integrity, and availability of

electronic PHI.• Protects against possible threats and hazards to the

information.• Hackers, viruses, natural disasters or system failures.

• Protects against unauthorized uses or disclosures.• Ensures compliance by the workforce through security regulations and policies/procedures.

• Three Components of Security:• Administrative Safeguards• Physical Safeguards• Technical Safeguards

HIPAA: SECURITY RULE

Administrative Safeguards:• Documentation kept for 6 years. • Corrective action for HIPAA security violation:• Violations of a severe nature may result in notification to law

enforcement officials as well as regulating, accrediting, and/or licensing organizations.

• Internal system audits minimize security violations.• Logins, file accesses, and or security incidents.

• Information access management:• Access to PHI based on what is needed to preform the job.• Once computer access is requested, it will take 48-72 hours to

implement due to complexity of security system.

• Security awareness and training:• Security updates, incident reporting, log-in, and password

management.

• Security incidents will be reported if suspected or if there is an actual breach.

HIPAA: SECURITY RULE

Physical Safeguards:• Safeguard the facility and equipment, from

unauthorized physical access, tampering, and theft. • Workstations positioned so monitor screens/ keyboards are

not directly visible to unauthorized persons. Use of privacy screens when applicable. Physical access to the server room limited to key IT personnel.

• Staff complies with appropriate workstation access/use.• Log on as themselves. Log off prior to leaving the

workstation.• Comply with all applicable password policies and

procedures.• Close files not in use.

HIPAA: SECURITY RULE

Physical Safeguards (Continued):• Exercise caution when saving any files that may

contain PHI or proprietary business information:• Avoid saving such information whenever possible.• If files containing EPHI must be saved, only store on CHN

shared drives. • NEVER save files containing EPHI or proprietary business

information to a flash drive, laptop, or local PC harddrive• If you have questions, or would like assistance properly

securing files, please call the IT helpdesk (x6600)• Report any concerns regarding data security to CHN’s IT

Security Officer, Privacy Officer, or The Corporate Compliance Officer.

HIPAA: SECURITY RULE

Technical Safeguards:• Access controls:• User password setup is for one-time use initially. Allowing the

individual to choose their own unique password for future access.

• User passwords reset every 180 days.• Citrix sessions automatically close after 60 minutes of

inactivity.• Electronic “patient charts” will automatically close at

different intervals depending on place within the program.• Initial log-on screens close within seconds of inactivity.• Screens further into specific modules, close and back up to

the previous screen, ranging from seconds to minutes of inactivity.

• No downloading to laptops, tablets, or PC’s.

HIPAA SECURITY OFFICER

Security Officer- IT Manager• Maintains appropriate security measures to guard against

unauthorized access to electronically stored and/or transmitted patient data and protect against reasonably anticipated threats and hazards.

• Oversees and/or performs on-going security monitoring of organization information systems.

• Ensures compliance through adequate training programs and periodic security audits.

• Ensures security standards comply with statutory and regulatory requirements.

• Maintains HIPAA security policies and procedures.

HIPAA: CORPORATE COMPLIANCE

• HIPAA regulations are also overseen by the Corporate Compliance Officer as part of the CHN Corporate Compliance Plan.• The Corporate Compliance Officer works with both

the Privacy and Security Officer to ensure processes are in place to maintain compliance with HIPAA regulations. • The Corporate Compliance Officer aids both the

Privacy and Security Officer in investigating actual or suspected HIPAA violations.

• Privacy and Security breaches can be reported to the Corporate Compliance Officer

HIPAA VIOLATIONS

• Significant issues beyond CHN jurisdiction can be reported to :• Centers for Medicare & Medicaid Services (CMS)• Office for Civil Rights (OCR)• Department of Justice (DOJ) • Attorney General

• HIPAA violations can and do result in civil and criminal penalties, which could be faced individually :• May range from a $100 civil penalty up to a maximum

of $1,000,000 per year for each standard violated.• May become a criminal penalty for knowingly disclosing

PHI, a penalty that could escalate to a maximum of $25,000 for visibly malice offenses.

WHO IS RESPONSIBLE FOR HIPAA?

EVERYONE at CHN (including our affiliates) has an obligation to maintain privacy and security, for example:• IT Managers/Staff: • Implement safeguards for the computer systems.

• Medical Professionals: • Create and access the majority of patient information.

• Managers and Supervisors: • Develop and implement policies and procedures that relate to

security and ensure their staff are trained properly.

• Clerical Staff: • Create and access patient information.

• Volunteers:• Have access to patient information in various setting such as lobbies

and waiting rooms.

TIPS FOR HIPAA COMPLIANCE

• Log on and off the network appropriately.• Never let others use your ID or work under your ID.• Do NOT write your password down.• Do NOT disable anti-virus software or install unapproved

software. Never introduce new hardware or media.• E-mail may be, but is not always, a secure form of data

transmission. Do NOT e-mail PHI outside of CHN unless entering “@encrypt” in the subject line to send encrypted.

• Only access PHI if you need it to preform your job. • Be aware of, and report, security threats to the Security Officer.• Put security safeguards on your mobile devices.• Be careful and aware of who is around you when PHI is being

discussed.• Report lost or stolen laptops, tablets, or cell phones ASAP.

FOLLOWING THE PRESENTATION

• Be sure to complete the two required forms as documentation of completion. Successful completion of this on-line mandatory training is required to receive your computer access privileges.

CHN HIPAA Security QuizPolicy – Internet/Intranet Acceptable Use

**Complete both items and return them to the applicable Department (HR or Education) PRIOR to your first day.**