HIPAA FOR THE WORKPLACE 2012

1. HIPAA FOR THE WORKPLACE 2012

2. COURSE GOAL The goal of this training is to help ensure that all Optima employees are prepared to protect the privacy and security of our members’ health information.

3. LEARNING OBJECTIVES After review of this training and successful passing completion of the quiz, you will be able to: • Discuss the 3 different Acts that comprise the Administrative Simplification regulation; • Demonstrate comprehensive understanding of privacy and security measures for our members; and • Understand how to prevent, identify and report violations or breaches.

4. HIPAA OVERVIEW • The Privacy Rulegoverns who has access to protected health information (PHI). • The Security Rulespecifies a series of administrative, technical and physical security procedures to assure the confidentiality, integrity and availability of ePHI. • The American Recovery and Reinvestment Act(ARRA) goal is to establish secure electronic health records for all Americans by 2014. • The Health Information Technology for Economic and Clinical Health Act (HITECH) • ARRA/HITECH brings changes to the HIPAA regulations in 3 categories: • Breach notification • Business Associate responsibilities • Penalties

5. HITECH and ARRA RULES HITECH is designed to encourage health care providers to adopt health information technology in a standardized manner and to protect private health information. ARRA is the direct result of modifications in the HIPAA Privacy, Security and Enforcement Rules and strengthens health information privacy and security protections. ARRA specifically addresses: • Breaches • Electronic Health Records(EHR) • Personal Health Records (PHR)

6. THE PRIVACY RULE The Privacy Ruleis designed to protect individuals’ health information (PHI) and allows individuals to: • get a copy of their medical records • ask for changes to their medical records • find out and limit how their PHI may be used • know who has received their PHI • have communications sent to an alternate location or by an alternate means • file complaints and participate in investigations

7. GUIDELINES FOR USING & DISCLOSING PHI You may disclose information, without a member’s authorization, to the appropriate authorities: • if required by law, court order, etc. • to public health officials, FDA, etc. • for abuse or domestic violence • to help law enforcement officials • to notify of suspicious death • to provide information for workers’ compensation • to assist government actions • to help in disaster relief efforts • to avert a serious threat to health or safety • for health oversight activities

8. YOUR RESPONSIBILITIES You are required to: • disclose PHI – limit the information you share with a person to what he or she needs to know (“minimum necessary” guidelines) • use PHI according to HIPAA-approved guidelines for access, accounting, amendment, and restriction of PHI • only access the PHI necessary to complete your job duties • maintain confidentiality & security of member information at all times

9. ALTERNATE ADDRESS Members and Personal Representatives have the right to request alternate confidential means of receiving communications that includes PHI. Send the completed request to the Director of Compliance: • Must be in writing • Must indicate the alternate address or specifications for the alternative means of communication • Must be signed • If requestor is a Personal Representative, must provide legal proof of their authority to represent the Member

10. VERIFICATION FOR RELEASE OF PHI • Prior to making any verbal disclosures of PHI, you must verify the requestor’s identity by asking several identifying questions, i.e., address, birth date, member number, etc. • You may discuss billing questions, benefit information, etc. without having an Authorization form signed. • Protected health information may be given to custodial parents, adults acting in Loco Parentis, emancipated minors, Designated Representatives and Designated Agents as long as an authorization and/or legal documents are on file.

11. MENTAL HEALTH andSUBSTANCE ABUSE • Federal law protects all information about a member with a current or past diagnosis of substance abuse and/or mental disorder. • These laws override the HIPAA laws. • Protected health information cannot be disclosed without a signed authorization. • Limited mental health information can be discussed with a minor’s custodial parent.

12. MINORS • Federal and State Laws protect Minor’s (under the age of 18) health care rights. • Staff may discuss a minor’s health information with custodial parents except for: • Pregnancy and family planning • Sexually transmitted diseases • Substance abuse • Mental health, if treatment consent given by minor only • All discussions should be limited to the minimal amount of information necessary to resolve the question. • If unsure about procedures for releasing information, seek advice from your supervisor or the Compliance Department.

13. EMAILS In your daily job responsibilities, email is used to communicate with staff, members, providers and vendors. Remember: • Emails about members should only be shared with those who have a need to know this information in connection with their specific job function(s). • Emails sent externally should be encrypted. • The Email system cannot be used by employees to express discriminatory views, threaten or harass employees or to advertise information that brings personal or financial gain.

14. ENCRYPTED EMAIL ENCRYPTED EMAIL PROCESS for messages to an external email user (non-Sentara): • The sender needs to insert [secure] in the subject line. • The recipient(s) needs to register for an IRONPORT (POSTX) mailbox to receive/view the message. • The message never leaves Sentara’s Network in an email format, therefore it is only viewed as a web page over https.

15. FAXES • Avoid faxing confidential information. If you send a fax to an incorrect number, report the incident immediately to your Supervisor or Manager. • Verify fax numbers prior to transmission to ensure the fax will be going to the correct person. • Use the Optima Health Fax Cover Sheet located on Wavenet. • The Fax Cover Sheet should contain a confidentiality notice requesting notification if the fax went to the wrong person.

16. PRIVACY/SECURITY BUSINESS ASSOCIATES (BAs) • Performs services to/for Optima Health that involves the use or disclosure of member PHI. • Optima Health Business Associate Agreement (BAA) requires specified written safeguards for PHI. • ARRA requires BAs to comply with all the same regulations as Optima Health. • Optima’s Business Associates have the same penalties for violations as Optima. • Business Associate Agreement (BAA) must be included with contract.

17. THE SECURITY RULE The Security Rule is designed to keep secure the transfer and storage of electronic health information (ePHI) by enforcing: • Administrative Procedures: These measures manage the selection, development, implementation and maintenance of security measures and include workforce security, security training, policies & procedures. • Technical Safeguards: The technology that protects ePHI and controls access and transmission security. • Physical Safeguards: Physical measures to protect the electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

18. PROTECTING ePHI Every organization has its own rules for internal and external storing and transferring of information, also known as EDI (electronic data interchange). You are required to: - use passwords - log off computer systems when you leave your desk - turn monitors so that they are not visible to others - dispose of disks and CDs properly (Contact the IT Dept for disposal assistance) - always save PHI to shared directory – not personal drives

19. WHAT IS A BREACH? A breach is defined as the acquisition, access, use or disclosure of unsecured PHI which is not permitted by the HIPAA Privacy Rules and which compromises the security or privacy of the PHI. • UnsecuredPHI is any member health information that is not secured through encryption or an approved destruction process that renders the PHI unusable, unreadable or indecipherable to unauthorized individuals. • PHI can be in any form or medium including electronic, paper or oral.

20. HITECH BREACH CHANGES When a breach is identified, Optima Health is to notify each individual whose unsecured PHI has been, or believed to have been accessed, acquired or disclosed. Business Associates must notify Optima as well as the individual whose PHI was disclosed. The first day the breach is discovered, or there is reason to suspect that a breach has occurred, is counted as the first day. Required notifications must occur without unreasonable delay (no more than 60 calendar days after discovery).

21. REPORTING HIPAA VIOLATIONS OR BREACHES • If a HIPAA violation, breach or possible breach occurs, complete the Member Disclosure Tracking Form and the HIPAA Breach Form. • Give it to your supervisor who will send it to the Director of Compliance. • Reports may be made without fear of intimidation, coercion, threats, retaliation, or discrimination. • If you have questions about the Privacy Rule and how it affects your job, talk to your supervisor, compliance personnel or call the Sentara Integrity Hotline at 1-800-981-6667. • Be sure to notify your supervisor and/or the Director of Compliance even if you are not sure the error is a breach.

22. OPTIMA BREACH HISTORY

23. This is the end of the 1st Module of the 2012 Optima Health Compliance Course. Please begin Quiz #1. Thank you!