RPI Ambulance Annual HIPAA Training

1. RPI Ambulance Annual HIPAA Training Please sign the class roster.

2. RPI Ambulance Annual HIPAA Training • What is HIPAA Anyways? • HIPAA stands for the “Health Insurance Privacy and Accountability Act” and is a Federal Law passed in 1996 • Specifies what is required to protect the security and privacy of personally identifiable health care information • Applies to most health care providers, including RPI Ambulance (and other ambulance services)

3. RPI Ambulance Annual HIPAA Training • HIPAA Issues for EMS Providers • Protecting Patient Privacy • Safeguarding Patient Information

4. RPI Ambulance Annual HIPAA Training • Protecting Patient Privacy • What is PHI (Protected Health Information)? • Individually identifiable information • Dealing with past, present, or future physical or mental health care or payment • PHI (Protected Health Information) can be : • Created by or received by a health care provider • Oral, Written, Digital, Photographic, Electronic, etc.

5. RPI Ambulance Annual HIPAA Training • Protecting Patient Privacy • Some common sources of PHI (Protected Health Information) include: • Patient Care Reports (PCR) • Dispatch/Call Intake Records • Billing Information • “Face Sheets” • Incident Reports with Patient Information • Verbal Communications between Health Care Providers • Patient Records from Hospitals and other Health Care Facilities • Physician Certification Statements

6. RPI Ambulance Annual HIPAA Training • Protecting Patient Privacy • How can you protect your patient’s privacy? • Follow the “Golden Rule” • Respect the privacy of patient information as you would on your own • Do not share PHI with others who are not involved in the patient’s care, except when required or permitted by HIPAA • In general, keep disclosures to the “minimum amount necessary” to get the job done

7. RPI Ambulance Annual HIPAA Training • Protecting Patient Privacy • Remember the Golden Rule of HIPAA • “What you see here • What you hear here • When you leave here • Let it stay here!”

8. RPI Ambulance Annual HIPAA Training • The Three Permitted Uses of PHI • Treatment • Payment • Health Care Operations

9. RPI Ambulance Annual HIPAA Training • Treatment • You may freely share PHI with any other Health Care Provider who will also treat the patient • Facilities may give PHI to an ambulance service and vice versa • The “minimum necessary” rule does not apply to treatment-related disclosures

10. RPI Ambulance Annual HIPAA Training • Payment • An ambulance service may use PHI to file claims with payers and send bills to patients without patient consent or authorization

11. RPI Ambulance Annual HIPAA Training • Health Care Operations • Includes Quality Improvement (QI) and certain other management functions • The “minimum necessary rule” applies, disclose only the minimum needed amount to perform the function

12. RPI Ambulance Annual HIPAA Training • Treatment, Billing, and Health Care Operations • How does RPI Ambulance fit in? • Treatment: RPIA follows all HIPAA regulations • Billing: RPIA does not bill for services • Health Care Operations: RPIA follows all HIPAA regulations

13. RPI Ambulance Annual HIPAA Training • Understanding HIPAA Privacy: The Typical Ambulance Call

14. RPI Ambulance Annual HIPAA Training • Dispatch and Response • Can the dispatcher transmit PHI over the radio? • Yes! We need to know where we’re responding to. Names will be omitted to protect privacy. Remember the dispatch information (including address) is PHI! • Can you share PHI over the radio with other responding agencies? • Yes! HIPAA does not prevent oral communication for treatment purposes.

15. RPI Ambulance Annual HIPAA Training • On Scene • Can you discuss the patient’s condition with first responders and other on-scene providers? • Yes! HIPAA does not prevent oral communication for treatment purposes. • Can you discuss PHI with family members? • What about talking to the media or bystanders? • Take care to minimize “incidental disclosures” • You may engage in any discussions necessary to treat the patient

16. RPI Ambulance Annual HIPAA Training • Enroute to the Hospital and At the Hospital • Can you give a report to the Hospital while enroute? • Yes! You may give a report to the Hospital while enroute to the facility, this report may include PHI. However, take care to minimize incidental disclosure and use the most secure transmission option possible. • Can you give a verbal report to hospital staff? • Yes! HIPAA does not prevent oral communication for treatment purposes. Take care to minimize incidental disclosures, this does not mean you need to find a “sound-proof” room, but means use an inside voice and do not give a report in a public place (such as an elevator). • Can you obtain a face sheet from the hospital? • Yes, you may obtain a face sheet or billing information from the facility. Keep in mind that that document will contain PHI and must be handled accordingly.

17. RPI Ambulance Annual HIPAA Training • After the Call • Can the call be the subject of discussion? • Short answer NO! The call may only be the subject of discussion if and only if the disclosure of PHI is minimized and is for a specific Health Care Operation such as Quality Improvement or Critical Incident Stress Debriefing.

18. RPI Ambulance Annual HIPAA Training • Disclosures to Law Enforcement • HIPAA limits the disclosures that EMS Providers can make! • EMS personnel are patient care advocates and not law enforcement tools • Disclosures may be made to Law Enforcement Officials under specific circumstances: • When Required by Law • When Permitted by Law • Optional Disclosures

19. RPI Ambulance Annual HIPAA Training • Disclosures to Law Enforcement: Required by Law • You are required to disclose a patient’s PHI to law enforcement regardless of the patient’s consent when presented with: • A Subpoena, summons, or warrant • An administrative request/investigative demand • A request for information pertaining to a limited number of injuries that you must disclose by law • For example Burns, Domestic Violence, Firearm Injuries • If presented with a legal document requesting PHI confirm its validity first then disclose only the information requested. If a situation ever arises in which this must be done, it will be completed by the Captain or appropriate designee.

20. RPI Ambulance Annual HIPAA Training • Disclosures to Law Enforcement: Permitted by Law • You are permitted to disclose a patient’s PHI to law enforcement under the following circumstances: • Identifying or locating a suspect, material witness, or missing person • Victim of a crime • Abuse, neglect, or domestic violence • If presented with a request for PHI, inquire of the purpose of their request and disclose only the minimal PHI needed. If a situation ever arises in which this must be done, it will be completed by the Captain or appropriate designee. When in doubt of whether or not to disclose, err on the side of caution!

21. RPI Ambulance Annual HIPAA Training • Disclosures to Law Enforcement: Optional Disclosures • You may disclose a patient’s PHI to law enforcement under the following circumstances: • Decedents: when you think your patient died as a result of a crime • Crime on Premises: when you have a “good faith” belief a crime was committed on Ambulance Premises (including Office, Ambulance, Garage, etc) • Reporting a crime in an emergency: when you believe it necessary to alert law enforcement to a crime and details regarding it • If a situation ever arises in which this must be done, it will be completed by the Captain or appropriate designee. When in doubt of whether or not to disclose, err on the side of caution!

22. RPI Ambulance Annual HIPAA Training • Incidental Disclosures • Whenever disclosing PHI be sure to limit an “incidental disclosure” • Means to limit “Incidental Disclosures” • Giving reports to another personnel who will treating the patient away from crowds • Using a softer volume when speaking • Using the most secure means of transmission available and within reason

23. RPI Ambulance Annual HIPAA Training • Mass Casualty Incidents • You are permitted disclose a patient’s PHI to a public or private disaster relief organization involved in the disaster relief efforts. (ie: American Red Cross) • This is done so that families may be notified of location, condition, or the death of a relative. • It is NOT your job to contact families!

24. RPI Ambulance Annual HIPAA Training • Patient Access • Patients have the right to access, inspect, and copy their medical records • Requests must be made in writing to the Captain or appropriate designee

25. RPI Ambulance Annual HIPAA Training • Safeguarding Patient Privacy • Safeguarding Written PHI • PCRs should never be left in the open • The copy of the PCR left at the hospital should be left face down in the appropriate place • After a call, the PCR should immediately be transferred to the “PCR Lockbox” in the Office • PCRs should not be left inside the clipboard in the Ambulance for any extended periods!!! • If a PCR is used for any purpose after the call, all identifying information must be blacked out

26. RPI Ambulance Annual HIPAA Training • Safeguarding Patient Privacy • Safeguarding Verbal PHI • Use appropriate voice volume • Don’t shout! • Conduct conversations about PHI in the most secure location possible, for example not in the busy hallway • Use the most secure method to communicate with the hospital possible • Cell Phone vs. VHF Radio

27. RPI Ambulance Annual HIPAA Training IN SUMMARY: PROTECTING A PATIENT’S PRIVACY IS ONE OF RPIA’S UTMOST CONCERNS. REMEMBER, TREAT ALL INFORMATION CONFIDENTIALLY, AS YOU WOULD WANT YOUR OWN TREATED. IN GENERAL ALL DISCLOSURES AND REPORTS WILL BE MADE BY EITHER THE CREW CHIEF, UNLESS REQUESTED BY THE CREW CHIEF ALLOW THEM TO MAKE ALL DISCLOSURES. THE END. THANK YOU FOR YOUR ATTENTION.