What to Do About Protected Health Information?

1. What to Do About Protected Health Information? Randy Benson Rural Healthcare Quality Network May 14, 2013

2. What to Do About Protected Health Information? The Definition: “Protected Health Information (PHI)” Any individually identifiable information, whether oral or recorded (in any form or medium) that is created by a healthcare provider and relates to past, present or future physical or mental health condition of an individual, their provision of health care, or their past, present or future payment for health care.

3. What to Do About Protected Health Information? HIPAA: the Healthcare Insurance Portability and Accountability Act of 1996 What’s the Difference Between the HIPAA Privacy Rule and the HIPAA Security Rule: • The HIPAA Privacy Rule covers protected health information in any form (written, oral, electronic) • The HIPAA Security Rule covers electronic protected health information only

4. What to Do About Protected Health Information? • De-identification Standard: • Removal of all individual identifiers from the information so that no one could reasonably identify the person (names, geographic locations, dates, identification numbers, photographs, healthcare provider identity, facility identity)

5. What to Do About Protected Health Information? • Staying In Compliance With the HIPAA Standards for PHI • Access To Information • Storage of Generated Information • Disposal of Information (paper) • Training of Everyone Who Handles PHI • Business Associates: Agreements With Others With Whom the PHI Is Shared

6. What to Do About Protected Health Information? • Access: • Who? All Staff , Selected Staff, Trained Staff • How? Paper, Computer, Visual (White Board at the Nurse’s Station • When? At Work Only, Remote Access • Why? Does the Job Function Require Access

7. What to Do About Protected Health Information? • Storage: • What Happens To PHI Generated In The Lab, Pharmacy, Therapies, Nursing Unit, Medical Records, Clinic • The Cardboard Box Phenomenon • Lock and Key

8. What to Do About Protected Health Information? • Disposal: • Who? • How? • How Often? • Security of Disposal Site?

9. What to Do About Protected Health Information? • Training: • How Much? Generic, Department Specific • How Often? Orientation, Annually • Who? New Standards for Business Associates • Observation of Competency? By Whom, How Often

10. What to Do About Protected Health Information? • Business Associates: A person or entity who either provides services on behalf ofyour facility, or toyour facility which involves the use, disclosure, or handlingof PHI. This person or entity is NOT a member of your workforce • Much Stricter Standards • How Much Access • Documentation of Competence

11. What to Do About Protected Health Information? • Ditch the Cardboard Boxes • Get Locking Bins (32 gal or smaller) for PHI and Lock Them • Check Computer Monitors (time out) • Check White Boards at Nurse’s Station • Check Around Copiers and Fax Machines • Remove PHI to a Secure Setting Daily • Supervise Paper Shredding Technician • Secure Work Area

12. What to Do About Protected Health Information? QUESTIONS? Randy Benson randyb@wsha.org 206 577-1821