|
1
|
|
|
2
|
|
|
3
|
- Intended to improve “the efficiency and effectiveness of health
information systems through establishment of standards and requireme=
nts
for the electronic transmission of health information”
- Establishes Federal regulation of:
- Transactions and Code Sets
- Health care identifiers
- Confidentiality health information (Privacy)
- Security of electronically maintained/communicated health informati=
on
(Security)
|
|
4
|
- To minimize the risk of intentional or accidental disclosure or misu=
se,
or the loss or corruption of individually identifiable health
information (IIHI)*
- *IIHI - Any information, including demographic information collected
from an individual that a) is created or received by a health=
care
provider, health plan, employer, or health care clearing house; and=
b)
relates to the past, present or future physical or mental health or
condition of an individual, the provision of health care to an
individual, or the past, present, or future payment for the provisi=
on
of health care to an individual, and (i) identifies the individual,=
or
(ii) with respect to which there is a reasonable basis to believe t=
hat
the information can be used to identify the individual.
|
|
5
|
- Some members of the Division of Health Care Financing workforce come=
-
in contact with protected health information (PHI) and
provider/payer
-
identifiers and other security related information in the
completion of their
-
duties on behalf of Division of Health Care Financing
- This document enhances the HR Manual and documents HIPAA policies th=
at
-
are guidelines to help safeguard PHI and other information fr=
om
being used
-
by those who are not authorized
- Division of Health Care Financing’s guidelines and policies are
the rules we
-
must apply while at the same time attempting to safeguard even
the potential
-
that PHI may be inadvertently divulged
|
|
6
|
- Division of Health Care Financing personnel will reasonably safeguard
PHI to limit incidental uses or disclosures
- An incidental use or disclosure is a secondary use disclosure that
cannot reasonably be prevented
- Is generally limited in nature and that occurs as a by-product of an
otherwise permitted use or disclosure
- All members of the Health Care Financing workforce will follow these
guidelines in handling PHI or other security related identifiers to
limit incidental uses and disclosures
|
|
7
|
- Cleaning Personnel
- Whenever reasonably possible, PHI should be placed in locked
containers, cabinets, or out of sight (covered or face down on coun=
ters
or desks)
- Computer Screens
- Computer screens at each workstation should be positioned so that o=
nly
authorized user at that workstation can read the display
- Computer displays will be configured to go blank, or to display a
screen saver, when left unattended for more than a brief period of =
time
- Computer screens left unattended for longer periods of time should =
be
logged off by the user
|
|
8
|
- Conversations
- Conversations concerning individual care, PHI, or security informat=
ion
such as ID’s or passwords or other methods of authentication =
must
be conducted in a way that reduces the likelihood of being overhear=
d by
others
- Copying PHI Information or Reports
- When PHI or identifier are copied, only the information that is
necessary to accomplish the purpose for which the copy is being mad=
e,
may be copied
- This may require that part of a page be masked (blacked out)
|
|
9
|
- Desks and Countertops
- Provider reports and other documents which may display identifiers =
and
other “keys” to information should be placed face down =
on
counters, desks, and other places where individuals or visitors can=
not
see them
- Wherever it is reasonably possible to do so, documents containing P=
HI
will not be left on desks and countertops after business hours
- In areas where locked storage after hours cannot reasonably be
accomplished, PHI and security related identifiers must be kept out=
of
sight
|
|
10
|
- Disposal of paper with PHI or Identifiers
- Paper documents containing PHI must be shredded when no longer need=
ed
- If retained for a commercial shredder, they must be kept in a locked
bin
- Home Office
- Any member of the workforce who is authorized to work from a home
office must assure that the home office complies with all applicable
policies and procedures regarding the security and privacy of PHI,
including these guidelines
|
|
11
|
- Facility Access and Key Policy
- The Security and Privacy Officers will develop a list of which
personnel, by job title, may have access to which keys. This includes access to st=
orage
cabinets, storage rooms and buildings
- All keys must be signed out and surrendered upon termination of
employment
- The Security Officer will act to change locks whenever there is
evidence that a key is no longer under the control of an authorized
member of the workforce, and its loss presents a security threat th=
at
justifies the expense
|
|
12
|
- Transporting of PHI Information
- When a member of the workforce is transporting PHI from one buildin=
g to
another, it may not be left unattended unless it is in a locked
vehicle, in an opaque, locked container
- Locking the vehicle alone is not sufficient
- Record Storage
- Areas where records and other documents that contain PHI are stored
must be secure.
- Wherever reasonably possible, use locking cabinet
- Where locking cabinets are not available, the storage area must be
locked when no member of the workforce is present to observe who
enters and leaves and no unauthorized personnel may be left alone =
in
such areas without supervision
|
|
13
|
- Personal Digital Assistants (PDA) and Laptops
- Division of Health Care Financing privacy and security policies app=
ly
to any PHI that is stored on a PDA or LAPTOP
- Users of PDA and/or Laptops are responsible for assuring that their
devices are kept secure and private
- Any loss or theft of a PDA or Laptop thought to contain PHI must be
reported to the Security Officer immediately
- Visitors
- Visitors to areas where PHI is being used must be accompanied at all
times by a member of the Division of Health Care Financing workforc=
e
|
|
14
|
- Printers and Fax Machines
- Printers and fax machines should be located in secure areas when
available, where only authorized members of the workforce can have
access to documents being printed
- Protected or sensitive information, when printed to a shared printe=
r,
should be retrieved immediately
- Workforce Vigilance
- All members are responsible to watch for unauthorized use or disclo=
sure
of PHI, to act to prevent the action, and to report suspected breac=
hes
of privacy and security policies to their supervisor or Security
Officer
|
|
15
|
|
|
16
|
|
|
17
|
|
|
18
|
|
|
19
|
|
|
20
|
- Sanctions for Violating Privacy and Security
- Policies and Procedures
- Members of the Division of Health Care Financing workforce are subj=
ect
to disciplinary action for violation of policies and procedures
- Violations that jeopardize the privacy or security of PHI or Securi=
ty
identifiers are particularly serious
- This seriousness will be reflected in the nature of the disciplinary
action, up to and including termination of employment
|
|
21
|
- Sanctions for Violating Privacy and Security
- Policies and Procedures
- All members of the workforce will be treated fairly and equitably in
the imposition of sanctions for privacy and security violations
- Sanctions will be integrated into Division of Health Care
Financing’s overall employee discipline policy. This policy will be in wri=
ting
- Disciplinary actions due to breaches of privacy or security of PHI =
will
be documented, and the documentation must be retained for seven
years. Disclosure of =
PHI in
violation of policy is reportable under the accounting of disclosur=
es
of protected health information policy
- No member of the workforce will be subject to sanctions for a
disclosure of PHI made in good faith in accordance with the whistle
blowers or victims of crime policy
|
|
22
|
- Termination or Modification of Access to Protected
- Health Information:
Electronic Systems
- Division of Health Care Financing will terminate access to informat=
ion
systems and other sources of protected health information (PHI),
including access to rooms or buildings where PHI is located, when an
Division of Health Care Financing employee, agent or contractor ends
his/her employment or engagement
- Division of Health Care Financing will terminate access to specific
types of PHI when the status of any member of the workforce no long=
er
requires access to those types of information
|
|
23
|
- Physical Access Controls
- Division of Health Care Financing will maintain strict physical acc=
ess
controls to its information systems at all times and under all
conditions
- This includes the physical security of electronic and paper data
- Work Station Use and Location
- Division of Health Care Financing will provide secure workstations
containing computer terminals with physical safeguards
- Secure areas where sensitive information is regularly entered or
utilized
|
|
24
|
- Facsimile Machines and Protected
- Health Information
- PHI may be transmitted by facsimile machine (“fax”),
provided all other Division of Health Care Financing policies and
procedures regarding the disclosure of PHI are observed
- In order to reduce the potential for misdirected faxes, frequently =
used
destination numbers will be pre-programmed into fax machines and te=
sted
before being used to transmit PHI
- To further reduce the possibility of misdirected faxes, each fax
machine should display a key that identifies the destination for ea=
ch
pre-programmed fax number
- When PHI is faxed to a destination number that is not pre-programme=
d,
the fax machine operator will double check the accuracy of the numb=
er
in the machine’s display before sending
|
|
25
|
- Facsimile Machines and Protected
- Health Information
- All fax messages will include a Confidentiality Statement within the
cover sheet
- Fax machines that are used to transmit or receive PHI should be pla=
ced
in secure locations
- Whenever possible, fax machines used to receive PHI will not be used
regularly for other purposes.
- Transmittal sheets will be checked immediately after each transmiss=
ion
of PHI to assure that the information was sent to the correct numbe=
r
- If an error is detected, the sender must immediately act to correct=
the
error, and report the error, to the Division of Health Care
Financing Privacy Off=
icer
- Transmittal sheets will be filed with the PHI that was transmitted,=
to
document the recipient.
|
|
26
|
- eMail and Protected Health Information
- PHI may not be transmitted by e-mail unless the sender is using a
secure e-mail system. A
secure e-mail system has the following features:
- The message cannot be intercepted. If the message is sent ov=
er an
open network (e.g. the Internet) it must be encrypted, using an
encryption standard approved by the Security Officer.
- The recipient of the message will know that the content has not be=
en
altered during transmission.
- The recipient of the message will know the true identity of the se=
nder
- There are safeguards to lessen the possibility of sending the mess=
age
to someone who is not authorized to receive it.
- There are safeguards to reduce the likelihood that the message wil=
l be
forwarded to someone who is not an intended recipient.
|
|
27
|
- eMail and Protected Health Information
- E-mail which contains PHI will not be used to transmit a message to
more than one individual at one time
- This is to avoid the potential for inadvertent disclosure of e-mail
addresses, linking e-mail addresses with clinical information in the
message or violating prohibitions against using individual-specific
information for certain types of marketing
|