Privacy Assessment: Beginning the Process

Transcription

1 Privacy Assessment: Beginning the Process Debbie Troklus, Manager (502) Chuck Self ΠωΧ

2 HIPAA Privacy Provisions IIHI vs. PHI Uses and Disclosures Minimum Necessary Rights of Individuals Consents and Authorizations Business Associates Related Entities Internal process changes Privacy Official Training Complaint Handling Disclosure Accounting 2

3 Individually Identifiable Health Information (IIHI) A subset of health information, including demographic information collected from an individual, and: Is created or received by a health care provider, health plan, employer, or health care clearinghouse Relates to past, present, or future Identifies the individual

4 Seven Steps to Beginning the Process 1. Determine covered entity status 2. Determine areas of the organization affected by HIPAA 3. Select Privacy lead 4. Appoint Privacy committee 5. Analyze internal resources 6. Develop a work plan and timeline 7. Design and provide HIPAA awareness training

5 Step One: Determine Covered Entity Status Health Plans: A plan provides or pays the cost of medical care. Includes Medicare, Medicaid and self funded plans. Does NOT include small health plans with receipts less than 5M/yr. Providers: A provider of medical or health services such as snfs, home health, hospitals, physician s offices, etc. that transmits in electronic form. Clearinghouse: Processes health information from a non-standard content into standard data elements or to a standard transaction. Such as billing services, health information systems, etc. NOT TPAs.

6 Step Two: Determine Areas of the Organization Affected by HIPAA 1. What areas of the organization have access to Protected Health Information? 2. Where does PHI enter the organization, what happens to it while it is there, and how does it leave the organization? 3. Is research being done in the organization? 4. Is marketing or fundraising being conducted? 5. Do you have a self-funded health plan?

7 Step Three: Select Privacy Lead A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity 1. Will the Compliance Officer be the Privacy Officer? 2. Internal vs. external 3. Define role and responsibility

8 Step Four: Appoint Privacy Committee Provider HIM Legal Research Nursing Financial Billing Registration Others

9 Step Five: Analyze Internal Resources 1. Is there expertise within the organization related to HIPAA? 2. Does qualified individuals have the time to devote to HIPAA? 3. Is financial resources available?

10 Step Six: Develop a Work Plan and Timeline Read and understand the regulation Conduct an inventory of existing policies and procedures Review state laws regarding privacy Outline projects according to the regulation Determine timeline for each project Assign a responsible person for each project

11 Step Seven: Design and Provide HIPAA Awareness Training Design training that will help individuals understand HIPAA Awareness training will not suffice as HIPAA training on organization s policies and procedures relating to HIPAA Review various delivery techniques Select trainers Assure message is consistent

12 Gap Analysis vs. Project Approach A gap analysis is useful in outlining the regulations and the organization s status of compliance A project approach focuses on the projects that must be completed along with a timeline Considerations: Time Staffing resources Financial resources

13 Gap Analysis HIPAA Area Compliance Requirement Findings Recommendations Reference HI 7.6 Verification Prior to any disclosure, a covered entity must verify the identity of a person requesting PHI and the authority of any such person to have access

14 Common Privacy Projects 1. Notice of Information Practices! Draft privacy notice! Testing of notice! Establish process for notification of patients! Draft P&P relating to the privacy notice

15 Common Privacy Projects Cont. 2. Business Associate Relationships/Contracting Define business associate Develop business associate inventory Draft business associate agreement/addendum Develop P&P relating to business associates Develop monitoring protocol for assuring that business associates meet HIPAA regulations Mail new contracts/addendums

16 Common Privacy Projects Cont. 3. Accounting for Disclosure of PHI Determine who will be responsible for accountings Determine who will handle disclosures Develop database for accountings Develop P&P for receiving and evaluating requests Develop request forms Develop P&P for fulfilling requests Develop P&P for accounting for disclosures

17 Common Privacy Projects Cont. 4. Requests for Amendment & Correction of PHI Develop P&P for: Receiving requests for amendment Evaluating requests for amendment Denying requests for amendment Fulfilling requests for amendment To permit individuals to disagree with denial of request Distributing amended info to recipients of original information when amendments are approved Design necessary forms and letters

18 Structuring Project Teams Will each project need it s own committee/team? Who will lead each team? Can the same person lead more than one team effectively? Can projects be combined?