Privacy and Information Security Training (2008-09)

1. Privacy and InformationSecurity Training(2008-09)

2. Why Respect Privacy and Confidentiality?

3. New Information Privacy and Security Policies • Access to Confidential Information (OP 10-40.07) • Protection and Security of Protected Health Information(OP 10-40.34) • Protection and Security of Research Health Information(OP 10-40.35) • Notification of Computerized Data Security Breach Involving Personal Information (OP 10-40.05)

4. Access to Confidential Information(OP 10-40.07) Access is granted on a need to know basis after successful completion of defined steps to identify the user and confirm authorization to access the VUMC Confidential Information. The minimum necessary rule is applied through restricted panel access where applicable. • VUMC Confidential Information is defined to include patient, research, student, employee, academic program, and VMC and/or third-party proprietary information in verbal, paper, or electronic form. • Workforce members are granted access, based upon job role, after completion of HIPAA training and signing the individual Confidentiality Agreement. • Business Associates and other external parties involved in treatment, payment, or health care operations may be granted access based upon a written contract with the company or individual that defines the allowable uses and disclosures of PHI and other Confidential Information and the consequences of failing to comply with VMC policies for privacy and information security. • Compliance or Research Monitors/Auditors are granted time-limited access to VUMC Confidential Information following a defined process that confirms the identity of the user and restricts access to minimum necessary to accomplish the required review Things You Need To Know:

5. Protection and Security of Protected Health Information(OP 10-40.34) The confidentiality and security of PHI must be protected from accidental or intentional destruction, alteration, loss, or inappropriate disclosure in verbal, written, or electronic format consistent with the Privacy and Security Rules of HIPAA and VMC policy. Things You Need To Know: PHI accessed and stored on mobile devices requires increased levels of protection, up to and including: Password protection on the device; and Encryption of the PHI stored on the device; Use of minimum necessary information to accomplish the business purpose (avoid the use of patient names as an identifier in conjunction with patient’s full social security number, medical record number or other identifiers) Immediately report loss or theft of any device containing PHI to VPD and the Privacy Office or the Help Desk. • VMC stores electronic PHI on protected network servers. If an authorized business purpose exists for storing electronic PHI somewhere other than a VMC secure network server, the individual storing the data is accountable for the protection and security of the PHI consistent with the standards of the HIPAA Security Rule.

6. Protection and Security of Research Health Information(OP 10-40.35) VUMC faculty and staff involved in research activities are required to implement safeguards to protect the confidentiality and security of Research Health Information (RHI) from accidental or intentional destruction, alteration, loss and/or inappropriate disclosure. Things You Need To Know: Research involving data from Veteran Affairs (VA) must comply with all specific requirements for the use of VA Sensitive Information. VA Sensitive Information may not reside on non-VA owned equipment unless specifically designated and approved in advance by the appropriate VA officials. Suspected or known loss, theft, or other breach of the confidentiality or security of RHI must be reported to the VUMC IRB Office and the Privacy Office. Theft of a computer or mobile device containing RHI must also be reported to VPD. • The Principal Investigator (PI) must define the safeguards that will be implemented in the research protocol submitted for review by the Institutional Review Board (IRB) prior to collection or storage of RHI. • Mobile devices have increased vulnerability to loss or theft and RHI accessed and stored on such devices require increased level of protection, up to and including: • Password protection on the device; and • Encryption of the RHI stored on the device; and • Use of minimum necessary information to accomplish the research purpose

7. Notification of Computerized Data Security Breach Involving Personal Information (OP 10-40.05) A security breach of unencrypted computerized data containing Personal Information requires notification to the individual whose personal information may have been exposed or stolen in accordance with defined policy and procedures. Things You Need To Know: Personal Information is defined as an individual’s first name or first initial and last name, in combination with a social security number; drivers license number; and/or account number, credit or debit card number, in combination with any required security code, access code or password. The State of Tennessee and most surrounding states have laws requiring companies to notify the individual when there is reasonable belief that unencrypted computerized data containing Personal Information about that individual may have been the subject of unauthorized acquisition or control. VMC policy defines the procedures to be followed in determining whether or not data breach notification is required, the notification method and timeframe, and additional notice and mitigation steps.

8. The Most Common Privacy/Security Incidents Reported • Careless handling of personal or confidential information • Unauthorized access or disclosure of patient information • Accidental access or disclosure of patient information • Sharing passwords or allowing others to work under the same user ID

9. Careless Handlingof Personal or Confidential Information Most Frequently Reported Incidents Printed documents containing patient or other confidential information left unattended in a public place. Data storage devices or cameras with unencrypted patient data or pictures lost or stolen. Avoid careless handling of personal or confidential information that may result in unauthorized disclosure • Reports or billing statements mailed to the wrong patient. • Documents containing patient information faxed to the wrong fax number. • Patient information discussed by staff or faculty in waiting rooms, elevators, or other public areas where others can overhear.

10. Careless Handling of Personal or Confidential Information Things You Need To Know: • Be sure when you are mailing correspondence about a patient that you are sending the correct patient’s information to the appropriately authorized recipient. • When faxing a document always use a cover sheet and double check the fax number. When you select a recipient for faxed documents from the StarPanel Fax Directory always confirmthat you have the correct provider by name, specialty, office location, and fax number. • Avoid conversations about patients in an area that is open to the public where you might be overheard. • Always place confidential information in a shredder bin for disposal.

11. Unauthorized Accessor Disclosure of Patient Information • Staff or faculty accessing a co-worker’s or a co-worker’s family member’s medical record without having written authorization (out of curiosity or concern or for deliberate use of the information). • Staff or faculty accessing medical records of others (family, friends, others) without a job-duty related need or documented authorization. • Failure to ask visitors and family members to leave the patient’s room prior to discussing confidential information with the patient. Patient information is to be accessed and disclosed only as authorized, on a need-to-know basis, or as required by law. Most Frequently Reported Incidents

12. Unauthorized Accessor Disclosure of Patient Information • Things You Need to Know: • Whenever possible, allow the patient to determine which family members or others involved in their care are communicated with regarding the patient’s care and services. Do not assume that the patient agrees for a visitor or family member in the patient’s room to see or hear any personal health information. • Prior to accessing a patient’s medical record for any reason other than completion of your assigned job duties, there should be documentation in the medical record showing the patient has granted you permission prior to accessing the record. Written authorization may be in the from of a note entered into the medical record documenting verbal permission or, preferably, a signed copy of an authorization form granting the access.

13. Unauthorized Access or Disclosure of Patient Information • Things You Need to Know: • The Privacy Office regularly audits the medical records of all VUMC staff and faculty that are admitted to VUMC for access by co-workers. Patients may request an audit of the medical record if they believe a staff or faculty member has accessed their record without appropriate authorization. • Gossiping about a faculty/staff member’s health information resulting in the individual filing a complaint, gossiping about a VUMC patient’s health information, or gossiping or sharing PHI secured through your role at VUMC are all considered privacy violations and will result in disciplinary action. All incidents/complaints are investigated and all violations result in disciplinary action, up to and including termination.

14. WHEN IN DOUBT Always Get Written Patient Authorization

15. Accidental Access/Disclosure Accidental access or disclosure is not incidental and is considered unauthorized. Accidental disclosure requires disclosure tracking. Most Frequently Reported Incidents Accidental access of a patient’s medical record by selecting the wrong patient in the search by name or entering wrong medical record number. Release of information to a person answering the patient’s phone or claiming to be authorized by the patient PHI scanned into wrong medical record

16. Accidental Access/Disclosure • Things You Need to Know: • When looking for a patient’s medical record, attempt to use more than first and last name to identify the correct patient; e.g. birth date or middle name to avoid accidental access or disclosure. • Accidental disclosure of patient information is a violation of HIPAA even if it is unintentional. Accidental disclosure of PHI should be recorded in the Disclosure Tracking System. • Check the medical record to see if the patient has authorized communication with a family member or friend before you proceed to release information.

17. Sharing Passwords and Using Someone Else's User ID Individual user identification is essential to maintaining the accuracy,integrity, and confidentiality of the electronic information systems and thepatient’s medical record. • Staff or faculty member logs onto electronic workstation in a shared work area and leaves the device allowing others to access patient information under the user identification first used. • Manager directs or allows an employee to work on a computer workstation previously logged in under another person’s user name and password. • A faculty member or director shares his/her User-ID and password with another employee to facilitate work getting done in a timely fashion. • Staff and/or faculty share user name and password in order to share access to common reports or files. Most Frequently Reported Incidents

18. Sharing Passwords andElectronic Signatures • Things You Need to Know: • Individually assigned passwords to VUMC systems, applications, or devices are confidential codes. Even though the password might not allow access to PHI it is still considered a security violation if it is shared or if you use someone else’s password to access confidential systems or information. • Sharing your user name/password or using someone else’s user name/password that allows access to a restricted system and confidential information or PHI of others is an even more serious violation and may result in Final PIC for staff, written warning for faculty and house staff. • Workstations must be secured by locking the screen or logging off whenever the user walks away. Failure to lock the computer screen may result in others using the system under someone else’s user identification which is a data integrity concern. If you fail to log off a computer or lock the screen and someone else uses the computer under your user identification, you may be held accountable for any activity that results (e.g., unauthorized access to a patient’s record, inappropriate use of the Internet).

19. Sharing Passwords andElectronic Signatures Things You Need to Know: • As explicit roles are defined within applications and systems, user ID and password will be used to drive communication and escalation of alerts and messages. Corrupting the integrity of the unique user ID and password may seriously disrupt that communication and result in harm to the patient. • Commitment to maintain the confidentiality of your user ID and password is a matter of personal integrity. • Do not share your confidential passwords with anyone including a manager or system administrator. Contact your LAN manager or system administrator to set up shared drives or folders as a secure means for sharing access to files or databases without sharing individual user identification .

20. Conclusion • Some privacy/security breaches occur from individuals being careless while others occur from deliberate actions. • Follow the practices set forth in this training presentation and you will avoid committing the most frequent type of breaches that occur at VUMC. • If you have any questions or need to report a concern, please contact the Privacy Office at (615) 936-3594 or privacy.office@vanderbilt.edu___________________________________________________ • You must complete the TESTassociated with this lesson in order to be marked complete for the HIPAA training. • Close this window and then select the link to TESTbeside the name of the Lesson (Privacy and Information Security Training).