HIPAA

1. HIPAA Health Insurance Portability & Accountability Act P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

2. HIPAA • Does not preempt more protective state law • First federal privacy law P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

3. Covered Entities • Health Care Providers • Health Plans • Health Care Clearinghouses Key - Transmit information electronically Compliance by April 14, 2003 P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

4. Does Not Include • Employers (with special rules) • Casualty and property insurers • Workers compensation carriers P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

5. Enforcement • Civil and criminal penalties • No right to a federal lawsuit P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

6. HIPAA Covers: All health information including electronic and paper records as well as oral communication Patient consent is not required (with some exceptions)/patient must be notified of rights & how information will be used disclosed P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

7. HIPAA • Entities are required to make a “good faith effort” to inform patients in a notice of privacy practices about how sensitive information is used disclosed • Reasonable efforts must be made to use/disclose minimum amount of information necessary P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

8. HIPAA Use & disclosure of protected health information without consent: • For their own treatment • Payment • Health care operations • To other covered entities for specified purposes P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

9. HIPAA • Patients have a right to inspect, copy, amend & receive an accounting of disclosures P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

10. HIPAA Patient must be informed in advance and be given opportunity to agree to, object to or restrict certain uses and disclosures • Info in health care facility directory • Disclosure to person’s involved with the patient’s care P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

11. Patient Ability to Restrict Disclosure • Patient must be provided with the opportunity to restrict disclosure for treatment, payment and health care operations • Health care providers and plans must accommodate reasonable requests about how and where to communicate with patient/may require statement re: danger • Entities may refuse to treat person’s personal representative & refuse access to patient’s health info P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

12. Psychotherapy Notes • Entities must obtain authorization from the individual to use and disclose psychotherapy notes • Notes can be disclosed in certain circumstances P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

13. Minors • A parent is the personal representative of an unemancipated minor/in most cases minor does not have rights associated with his/her own medical information • Exception - minors authorized by law to consent to treatment, parent/guardian assents to an agreement of confidentiality between provider and minor P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

14. Minors Right to Consent • To test for or treat pregnancy, STDs and AIDS (HIV testing) • To receive contraceptives, including emergency contraception from clinics receiving federal funding for family planning services through Title X (law silent on other providers) P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

15. Minors Right to Consent • Medical care for sexual assault with the exception of child abuse • Diagnosis or treatment of drug and/or alcohol abuse • 14 and up - voluntary inpatient mental health treatment (parents are notified) • 14 and up -no law re: outpatient mental health counseling P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

16. Minors Right to Consent • Under 18 - if graduated from high school, married, has been pregnant • Female who is or has been married or given birth may consent to all health care services for her child (law silent on males) P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

17. Reporting Requirements Health info may be disclosed for limited public policy purposes: • Child abuse and neglect • Abuse, neglect or domestic violence under certain circumstances - individual agrees; disclosure required by law, statute or regulation; victim must be informed unless there is a perceived risk • Law- enforcement under certain circumstances P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

18. CAUTION Individuals seeking health information in judicial and administrative proceedings must make reasonable efforts to notify individuals who are the subject of the information that their health information had been requested P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

19. Employers Those with health care components and those that sponsor group health plans must erect firewalls, adopt policies and identify individuals that can have access to health information to ensure that information is not used in employment determinations P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

20. HIPAA • Entities must obtain authorization to use and disclose health information for purposes other than treatment, payment and health care operations • Health plans may condition enrollment, eligibility for benefits, payment of claims for certain benefits on the individual signing an authorization to disclose information P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

21. So now what? Health plans - payers or insurers of health care Health care clearinghouses- entities that engage in activities such as billing services, repricing, community health info systems & “Value added” networks that receive or process health info Health care providers - only providers or health or medical services who transmit info in electronic forum in connection with certain insurance related transactions P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

22. Are you a health care provider? Health care services related to the health of an individual • Preventative, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, counseling, service, assessment or procedure with respect to the physical or mental condition or functional status of an individual or that affects the structure or function of the body P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

23. Are you a health care provider? • Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription • Do you furnish or provide, bill for or receive payment for health care services in the normal course of business? P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

24. Health Care Services • Physician services • Services commonly furnished by physician offices • Hospital services incident to physician’s services rendered to outpatients • Various diagnostic services provided by a hospital P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

25. Health Care Services • Outpatient physical therapy • Rural health clinic services & federally qualified health center services • Qualified psychologist services • Clinical social worker services P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

26. Business Associates An entity that conducts an activity involving the use and disclosure of protected health information on behalf of a covered entity P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

27. Business Associates Covered entities are not required to have business associate contracts with providers to whom they disclose information for treatment of an individual P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

28. Business Associates Sign a business associate contract? Obtain a release of information? Protect your confidentiality privilege P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

29. Hybrid entities Be clear Establish policies P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

30. If you are a covered entity? • Designate a privacy official responsible for policies and a contact person to receive complaints • Retain copies of policies for 6 years from date of implementation or change • Develop safeguards to protect the privacy of health info P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

31. If you are a covered entity • Develop a complaint process and document all complaints received and disposition • Train all of the workforce on HIPAA and document the training • Provide clients with a notice of privacy practices P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE

32. Resources • http://www.hhs.gov/ocr/hipaa/ • http://www.healthprivacy.org P E N N S Y L V A N I A C O A L I T I O N A G A I N S T D O M E S T I C V I O L E N C E P E N N S Y L V A N I A C O A L I T I O N A G A I N S T RAPE