Confidentiality & HIPAA Compliance

• Confidential communications are imperative in professions like law, journalism, medicine, academia, and business
• Breaching the trust of confidentiality is detrimental

Key Objectives

• Importance of confidentiality in healthcare is vital
• The Health Insurance Portability and Accountability Act (HIPAA) should be followed
• Violations of patient confidentiality have ramifications
• Medical information confidentiality breaches occur frequently
• The Privacy Rule is one such way to safe guard confidentiality

Key Terms

• Breach: A violation
• Confidentiality: Protecting personal information
• Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA)
• Healthcare Integrity and Protection Data Bank (HIPDB)
• HITECH
• Medical Identity Theft
• Patient Safety and Quality Improvement Act of 2005 (PSQIA)
• Portability
• Preexisting condition
• Privacy
• Privacy Act of 1974
• Privacy Rule
• Protected Health Information (PHI)
• Ransomware
• Release of information

Privacy vs Confidentiality

• Privacy: The absence of intrusion into a person's life and information from external sources
• In healthcare: Patient health information is securely held, accessible only to authorized individuals
• Confidentiality: Personal information shared with professionals, is vital in healthcare
• Privacy is about the general state of being free of intrusion
• Confidentiality is an ethical duty to protect shared information
• Privacy and confidentiality are legally protected
• Violations of both have legal consequences
• Doctor-patient relationship: An implied confidentiality agreement exists
• Patients must sign documents acknowledging understanding of health privacy policies and procedures

Susan's Story: Case Study

• Susan experienced severe abdominal pains, vomiting, and diarrhea
• Joseph, Susan's husband, took her to the Community Hospital emergency room
• ER doctor, Ali Patel, diagnosed Susan with E. coli and dehydration after a 2-hour wait
• Dr. Patel announced the diagnosis without entering or closing the examination room
• Nurses and others passing by overheard the diagnosis
• Dr. Patel violated confidentiality by allowing others to hear Susan's diagnosis, infringing on patient privacy

Hippocratic Oath

• Hippocrates recognized the importance of confidentiality in medicine dating back to 460–377 BC
• Sharing a person's personal health information is unethical, This remains pertinent
• Patients can expect their medical information to be confidential
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA) makes it illegal to do otherwise
• Protecting medical information is equivalent to confidentiality
• Healthcare professionals are entrusted with keeping medical information in confidence
• Physicians take the Hippocratic Oath, which emphasizes confidentiality
• Healthcare professionals must take steps to secure patient information

Confidentiality and the Health Industry

• Keeping personal medical information private is key
• This includes conditions, treatments, and the fact that a person sought treatment
• Professionals show respect when they protect a patient's medical information
• This builds patient trust and cooperation
• Confidentiality is mandated by law and is also ethical

Dr George Sheffield: Case Study

• As a medical assistant for Dr. George Sheffield a plastic surgeon, you cant tell your sister about his celebrity client.
• Mr. Morris who is your sister's favorite actor is seeking a face lift consultation
• Sharing this violates HIPAA laws resulting in penalties
• Confidentiality is serious and should be treated with care and the utmost professionalism
• Celebrities aren't entitled to better medical care or protection of medical information
• Treat each patient with respect, dignity, and standard of care.

Beginnings

• Federal government increased record maintenance in the 1960s
• Citizens and legislators questioned how private information was used
• The Department of Health, Education, and Welfare (HEW) issued a report in 1973
• The Privacy Act of 1974 (Public Law 93-579) was signed into law by President Gerald Ford
• The law isn't exclusive to medical information; addresses how sensitive information can be shared
• Applies to U.S. citizens and permanent residents
• Discussions surrounding the Privacy Act led to HIPAA

Common Breaches

• Patient confidentiality is vital legally and ethically
• Patient healthcare data is private
• Patients want to know who sees their data
• Individuals seek care when they believe their data is private
• By being open, patients give vital information
• Perry asks a patient in a public area "Why are you seeing the doctor today?"
• A sign-in sheet contains patient infomration
• Staff discuss patients where others can hear
• An insurance clerk leaves sensitive information on a computer while at lunch
• A custodian reads medical records

Scenarios

• Receptionists shouldn't ask about the visit reason in front of others
• Have patients come to the side, talk over the phone, or discuss it already when appoiontments are booked
• The sign-in sheet should have stickers
• Healthcare workers should speak in private with patient
• Insurance clerks should log out before leaving
• Passwords and auto shutoff settings can prevent some breaches
• Medical records should be locked when staff aren't around
• As access goes up chance of breaches also increases

HITECH

• HITECH: the Health Information Technology for Economic and Clinical Health Act
• Was assigned February 17, 2009
• Addressed confidentiality and appropriated 250 million towards technology
• Improve quality, safety, and efficiency
• Coordination should increase
• Improve health status
• Promote patient autonomy
• Assurance of privacy and security

Ransomeware

• An issue that poses data risks is ransomware, which is a malicious software used by computer hackers to block users from data in their own computer systems
• This can be referred to as digital extortion
• An average of 4000 attacks occur daily
• Since ransomeware compromises the user/owner access to its own electronic information, these recommendations can assist management:
• Conduct frequent computer system backups.
• Validating backed up data tests restorations
• Users should consider backing up offline and separate from theprimary network, also since some can remove or disrupt backups

Medical Identity Theft

• Stealing a patient’s personal information (name, address, social security number, etc.) to wrongly acquire insurance or prescriptions
• The wise medical consumer (patient) should be protective by:
• Review medical bills or insurance statements carefully
• Read medical collection notices
• Keep up with benefit (insurance) financial limits
• Contact healthcare if information is incorrect and get copies of medical records
• Keeping copies of records in a secure location to ensure it isn't leaked by third parties

The Health Insurance Portability and Accountability Act

• Signed into law in 1996 to address continuation of health insurance coverage in healthcare
• Provided patients with more control of information.
• Five forms required to protect patient information.
• Privacy notice.
• Signature of patient indication
• Patient's permission to provide medical information
• Trading partner specifying
• Contractual statement

Key Components of the Act

• The twofold goal: To improve conditions when individuals changing health insurance and to ensure no lapse of coverage and preexisting conditions covered
• Portability means no lapse of healthcare coverage when a person changes from one job to another
• Preexisting conditions: Diseases that the patient had before coverage begins
• Preexisting conditions often limit coverage
• Designed to help the patient get needed coverage
• Continuous coverage through the Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA).
• In final HIPAA legislation, “add ons”
• Protection of private medical information.
• Standardized and simplified forms.
• Strategies to prevent fraud, waste, and abuse.
• The George Herbert Walker Bush administration chose to introduce the law in three phases:
• Federal privacy regulations
• Insurance claims
• Clearinghouse of electronic medical claims
• You must continually ask, “How can I achieve confidentiality for the sake of the patient?”
• Your best defense: professional silence and secure data management
• You must be aware of what actions are against HIPAA laws
• Access to a patient’s does not imply permission to go into that record
• As a medical receptionist, it is not likely you will require to access patient records
• A "need to know" clause should be present
• Five primary components:
• Insurance Portability
• Administrative Simplification
• Medical Savings and Tax Deduction
• Group Health Plan Provisions
• Revenue Offset Provisions

The Consolidated Omnibus Budget Reconciliation Act

• COBRA of 1985 mandated businesses with 20+ employees to provide extended health insurance for up to 18 months when they leave
• Insurance can be at the expense of the company but usually is paid for by the employee
• Most employees have free health insurance through the company.
• Employees leaving the job can then decide to purchase the coverage until other coverage begins

The Privacy Rule

• Went into effect between 2001 and 2003.
• Pertains to personal data, known as protected health information (PHI).
• PHI is specific medical info pertaining to the patient (name, DOB, SSN)
• Treatment of PHI:
• PHI can come in three forms: written, electronic, and oral.
• Exceptions to PHI may include child and spousal abuse and medical research.
• Varies by state.
• PHI doesn't include a range of information

HIPAA Exceptions

• Laws can't always cover evertying and are limited
• Financial documents (credit information, banking records)
• Information as maintained by the Central Intelligence Agency (CIA)
• Educational records etc
• Subpoenas for medical records needed in court cases
• Databases of private companies
• Employee records etc
• Other laws may act on documents. For example: FMLA

Healthcare Integrity and Protection Data Bank

• HIPDB established in 2000 under HIPAA
• Aggressive move to prevent fraudulent and/or abusive healthcare practitioners
• The Social Security Act outlines areas being monitored
• Licensure and certification actions
• Federal and state healthcare exclusion
• Healthcare judgements
• Cases of revoking criminal conduct
• Designed to improve a go-to place to prevent the unethical
• Better Business Bureau of Healthcare.

Release Of Information

• A patient’s medical information is protected:
• A physician can not dicuss their patient’s medical information
• A release of information form grants third parties information of a patient's medical record

Releasing Medical Information

• Carol in the case study discovered that only the employee's spouse had a release of information
• Carol can only state that Ms. Reid is not authorized and can not mention the spouse authorized permission
• Third parties require a permission for a medical record to be shared

Patient Safety and Quality Improvement Act

• Published in 2005 to provide better patient care
• System for violations of patient safety
• Protection of those who report
• Those who report feel more comfortable therefore violations occur more often

The quote from the Health and Human Services

• Providers may report and examine patient safety events without the worry of increased liability risk
• The Office for Civil Rights works with Agency for Healthcare Research and Quality

Exceptions to Confidentiality

• HIPAA does not cover exceptions that include at least:
• Child abuse
• Elder abuse
• Mental health patients
• Vulnerable populations
• The Medical Information Bureau

Child Abuse

• It has affected every socioeconomic group and poses an important issue
• Less when 18 who is emancipated
• Physical, emotional, and and/or sexual abuse
• Federal definitions include
• Any recent act or failure to act by them.
• An act of failure to act which has a big risk of serious harm
• Child abuse should be reported by a doctor
• Child abuse should be reported by a nurse
• Child abuse should be reported by a dentist
• Child abuse should be reported by mental health professional
• Child abuse should be reported by social worker
• Child abuse should be reported by a teacher
• Child abuse should be reported by a day care worker
• Child abuse should be reported by law enforcement personnel
• Clery and camp counselors can also report it
• Certain states require people who suspect or feel abuse is occuring to report it
• Healthcare professionals can report suspicions
• All have the right and are legally obligated
• Department of Human Services can be contacted

Elder Abuse

• Like child abuse, it is an issue that's unreported
• The age can vary state by state
• Is harmful treatment including physical, emotional, or sexual abuse
• One thing is neglect the senior
• Financially abusing
• Self-abuse
• Estimate 1 and 2 million 65 and older have been mistreated
• Report all cases, contact Department of Human Services
• In certain states, it is punishable by the law

Mental Health Patients that pose threat

• Mental illness- 1 in 5 are Americans and that can be a specific thing to look for
• Those professional encounter a patient with mental illness
• Any healthcare professional can report a suspicious
• Should self-harm or are harming someone else

William Gladstone Case Study

• Employed for a furniture company named Superior
• After a picnic, he felt with symptoms of nausea and vomiting
• Medical Staff concluded for food poisoning
• Potato salad at the picnic for 2 hours had spoiled and triggered poisoning
• All were exposed so it all had to come out

Putting It All Together

• Benefits from reporting outweigh the potential benefits of medical info.