MONTGOMERY COLLEGE
HIPAA Privacy Training

HIPAA and Its Impact on

Clinical Partners, Faculty

and

Students

Prepared by:

Thomas C. Evans

Privacy Officer

Health Pathways, Inc.

H ealth

I nsurance

P ortability

(and)

A ccountability

A ct

(of 1996)

HIPAA’s Administrative Simplification Provisions

Mandated controls on the use and disclosure of health information by covered entities

Privacy Rule effective April 14, 2003

Minimum national standards for the use and disclosure of health information by covered entities in all forms – oral, paper and electronic

Privacy Rule Applies to Covered Entities

Health plans (Medicare, Medicaid, private insurance companies)

Health care clearinghouses

and

Healthcare providers engaging in HIPAA electronic transactions

Good News/Bad News

GOOD – Montgomery College is not a covered entity!

BAD -- Montgomery College’s clinical partners are covered entities

They may use and disclose health information only as permitted by the Privacy Rule

They are liable for non-permitted uses and disclosures of health information

Why We are Here

HIPAA impacts Montgomery College’s clinical program partners

Montgomery College supports compliance efforts of its clinical partners

Health information is crucial to clinical programs and to the classroom

Protecting the privacy and confidentiality of health information is a mutual responsibility

Sources and Uses of Health Information

Patients and others on site at clinical partners

Students

Our jobs

Classroom preparation

Classroom instruction

Human subjects in the classroom

Tests and assignments

Health fairs

 

HIPAA Vocabulary

Health information

Individually identifiable health information

Protected information

Treatment

Payment

Use

Disclosure

Covered Entity Health Care Operations

Includes:

Conducting training activities in which students, trainees or practitioners in areas of healthcare learn under supervision to practice or improve their skills as healthcare providers and the training of non-healthcare professionals

In short: Montgomery College’s clinical programs

Minimum Necessary

Applies to non-treatment uses and disclosures, including those for healthcare operations purposes (clinical training)

Clinical partners may use or disclose only the minimum PHI necessary to accomplish the purpose of an otherwise permitted use or disclosure

De-Identification

Disclosure of "de-identified" health information is permitted by the Privacy Rule

However, de-identification means more than blacking out a name

Check with each clinical provider on its de-identification procedures

Privacy Rule Obligations of Clinical Partners

Policies and procedures providing reasonable administrative, technical and physical safeguards against unauthorized PHI uses and disclosures

Provide its Notice of Privacy Practices to individuals

Train its workforce members on its Privacy Policies and Procedures

Montgomery College Faculty and Students

While participating in a clinical program, you are members of the clinical partner’s workforce

Employees, volunteers, trainees and other persons

Whose conduct, in the performance of work for a clinical partner

Is under the clinical partner’s direct control

Whether or not they are paid by the clinical partner

Clinical Partner Liability

Clinical Partner faces civil fines and criminal penalties if a workforce member violates the Privacy Rule

Faculty or student Privacy Rule violation may create HIPAA liability for clinical partner

Civil liabilities a possibility

Clinical Programs

Are an asset of Montgomery College

Are a strength of the Health Sciences program

Are central to student education and post-graduate employment

Protecting PHI, whether on site or in the classroom, protects these benefits

Privacy Rule and Existing Obligations to Clinical Partners

Over 70 clinical partner agreements

Students obligated to observe partner’s policies and procedures

Students obligated to maintain confidentiality of patient information encountered during clinical site work

Failure to observe and maintain grounds for dismissal from clinical program

Privacy Rule now a critical part of

Partner’s policies and procedures

Privacy as a Healthcare Professional’s Mindset

Patient’s have the right to expect that you will use their information only as permitted by the clinical partner’s policies, procedures and the Privacy Rule

Patient expectations carry over to the classroom and clinical presentations and discussions

Classroom Don’ts

Don’t:

Bring PHI in from a clinical partner without permission

Use the patient’s name or other identifying information

Gossip about a clinical partner’s patients

Misuse health information obtained from fellow students

Clinical Partner Site Do’s and Don’ts

Do:

Treat patient information the way you would want your own PHI treated

Learn the clinical partner’s Privacy Policies and Procedures applicable to you

Don’t:

Gossip about patients

Talk about patients with friends, family or significant others

Second guess a patient’s decisions on privacy rights

While On Site at Clinical Partners

Charts – prevent public viewing; return records and charts to secure location after viewing

Computers – log off after viewing patient information

Guard against incidental disclosures

Remember that, in a clinical training environment, minimum necessary applies

Why We are Here

HIPAA impacts Montgomery College’s clinical program partners

Montgomery College supports compliance efforts of its clinical partners

Health information is crucial to clinical programs and to the classroom

Protecting the privacy and confidentiality of health information is a mutual responsibility

Films brought in by students for educational purposes

Information on the film must be removed.

Discussion of the film should be relevant to the pathology, unusual finding or technical factor only. Identifying information such as verbalizing the name, location of where the patient was injured, personal information that might otherwise identify the patient must not be relayed to the class upon presentation of the film.

Conversations of relevant patient information

Kept out of earshot of general public

Elevators

QC areas

Hallways

Cafeteria

Is information that a colleague (student or tech) may need to know in order to better image the patient or maintain patient and/or co-worker care.

Specifics to RT students

A student cannot release information about the whereabouts or specifics of an exam being completed or even done to anyone who asks.

Example: Student completes an exam of patient brought in through ER, outpatient or is an inpatient. This patient does not have anyone with them. A person stops the student in the hall to inquire as to if this same patient has just been seen. The student has to assume that the patient has not authorized the hospital to release any information about that patient. Direct the inquiring person to the front desk

SPECIFICS TO RT STUDENTS

Competency forms must have x-ray number but NO NAME. Students who wish to keep a copy of their completed competencies must de-identify the form after copying. (BLACK OUT THE NUMBER)

Logbooks need the x-ray number recorded. Logbooks are to be turned in at the end of the RT course completion.