MONTGOMERY COLLEGE
HIPAA Privacy Training
HIPAA and Its Impact on
Clinical Partners, Faculty
and
Students
Prepared by:
Thomas C. Evans
Privacy Officer
Health Pathways, Inc.
H ealth
I
nsuranceP ortability
(and)
A ccountability
A ct
(of 1996)
HIPAA’s Administrative Simplification Provisions
Mandated controls on the use and disclosure of health information by covered entities
Privacy Rule effective April 14, 2003
Minimum national standards for the use and disclosure of health information by covered entities in all forms – oral, paper and electronic
Privacy Rule Applies to Covered Entities
Health plans (Medicare, Medicaid, private insurance companies)
Health care clearinghouses
and
Healthcare providers engaging in HIPAA electronic transactions
Good News/Bad News
GOOD – Montgomery College is not a covered entity!
BAD -- Montgomery College’s clinical partners are covered entities
They may use and disclose health information only as permitted by the Privacy Rule
They are liable for non-permitted uses and disclosures of health information
Why We are Here
HIPAA impacts Montgomery College’s clinical program partners
Montgomery College supports compliance efforts of its clinical partners
Health information is crucial to clinical programs and to the classroom
Protecting the privacy and confidentiality of health information is a mutual responsibility
Sources and Uses of Health Information
Patients and others on site at clinical partners
Students
Our jobs
Classroom preparation
Classroom instruction
Human subjects in the classroom
Tests and assignments
Health fairs
HIPAA Vocabulary
Health information
Individually identifiable health information
Protected information
Treatment
Payment
Use
Disclosure
Covered Entity Health Care Operations
Includes:
Conducting training activities in which students, trainees or practitioners in areas of healthcare learn under supervision to practice or improve their skills as healthcare providers and the training of non-healthcare professionals
In short: Montgomery College’s clinical programs
Minimum Necessary
Applies to non-treatment uses and disclosures, including those for healthcare operations purposes (clinical training)
Clinical partners may use or disclose only the minimum PHI necessary to accomplish the purpose of an otherwise permitted use or disclosure
De-Identification
Disclosure of "de-identified" health information is permitted by the Privacy Rule
However, de-identification means more than blacking out a name
Check with each clinical provider on its de-identification procedures
Privacy Rule Obligations of Clinical Partners
Policies and procedures providing reasonable administrative, technical and physical safeguards against unauthorized PHI uses and disclosures
Provide its Notice of Privacy Practices to individuals
Train its workforce members on its Privacy Policies and Procedures
Montgomery College Faculty and Students
While participating in a clinical program, you are members of the clinical partner’s workforce
Employees, volunteers, trainees and other persons
Whose conduct, in the performance of work for a clinical partner
Is under the clinical partner’s direct control
Whether or not they are paid by the clinical partner
Clinical Partner Liability
Clinical Partner faces civil fines and criminal penalties if a workforce member violates the Privacy Rule
Faculty or student Privacy Rule violation may create HIPAA liability for clinical partner
Civil liabilities a possibility
Clinical Programs
Are an asset of Montgomery College
Are a strength of the Health Sciences program
Are central to student education and post-graduate employment
Protecting PHI, whether on site or in the classroom, protects these benefits
Privacy Rule and Existing Obligations to Clinical Partners
Over 70 clinical partner agreements
Students obligated to observe partner’s policies and procedures
Students obligated to maintain confidentiality of patient information encountered during clinical site work
Failure to observe and maintain grounds for dismissal from clinical program
Privacy Rule now a critical part of
Partner’s policies and procedures
Privacy as a Healthcare Professional’s Mindset
Patient’s have the right to expect that you will use their information only as permitted by the clinical partner’s policies, procedures and the Privacy Rule
Patient expectations carry over to the classroom and clinical presentations and discussions
Classroom Don’ts
Don’t:
Bring PHI in from a clinical partner without permission
Use the patient’s name or other identifying information
Gossip about a clinical partner’s patients
Misuse health information obtained from fellow students
Clinical Partner Site Do’s and Don’ts
Do:
Treat patient information the way you would want your own PHI treated
Learn the clinical partner’s Privacy Policies and Procedures applicable to you
Don’t:
Gossip about patients
Talk about patients with friends, family or significant others
Second guess a patient’s decisions on privacy rights
While On Site at Clinical Partners
Charts – prevent public viewing; return records and charts to secure location after viewing
Computers – log off after viewing patient information
Guard against incidental disclosures
Remember that, in a clinical training environment, minimum necessary applies
Why We are Here
HIPAA impacts Montgomery College’s clinical program partners
Montgomery College supports compliance efforts of its clinical partners
Health information is crucial to clinical programs and to the classroom
Protecting the privacy and confidentiality of health information is a mutual responsibility
Films brought in by students for educational purposes
Information on the film must be removed.
Discussion of the film should be relevant to the pathology, unusual finding or technical factor only. Identifying information such as verbalizing the name, location of where the patient was injured, personal information that might otherwise identify the patient must not be relayed to the class upon presentation of the film.
Conversations of relevant patient information
Kept out of earshot of general public
Elevators
QC areas
Hallways
Cafeteria
Is information that a colleague (student or tech) may need to know in order to better image the patient or maintain patient and/or co-worker care.
Specifics to RT students
A student cannot release information about the whereabouts or specifics of an exam being completed or even done to anyone who asks.
Example: Student completes an exam of patient brought in through ER, outpatient or is an inpatient. This patient does not have anyone with them. A person stops the student in the hall to inquire as to if this same patient has just been seen. The student has to assume that the patient has not authorized the hospital to release any information about that patient. Direct the inquiring person to the front desk
SPECIFICS TO RT STUDENTS
Competency forms must have x-ray number but NO NAME. Students who wish to keep a copy of their completed competencies must de-identify the form after copying. (BLACK OUT THE NUMBER)
Logbooks need the x-ray number recorded. Logbooks are to be turned in at the end of the RT course completion.