I-H-01 Protected Health Information 01/05/2021

Authorized Representative

• Legally designated person to make health care decisions for a customer/patient or their estate.
• Treated equally as the customer/patient concerning uses and disclosures of Protected Health Information (PHI).

Business Associate

• Entity or person assisting a Covered Entity with tasks involving use/disclosure of Individually Identifiable Health Information (IIHI).
• Functions include claims processing, data analysis, quality assurance, billing, and management services.

Chief Privacy Officer

• Key individual responsible for enforcing departmental privacy policies, resolving complaints, and providing privacy information.

Confidentiality

• Mechanism to protect identifiable and personal customer information from unauthorized disclosure.

Covered Entity

• Categories include Health Plans, Healthcare Clearinghouses, or Healthcare Providers transmitting health information electronically.

Customer/Patient

• Refers to individuals or groups served or employed by MDFR, interchangeable with the term patient in policy context.

Departmental Privacy Liaison

• Department-level individual responsible for developing privacy policies and handling complaints related to PHI.

Designated Record Set (DRS)

• Under HIPAA, includes covered PHI relevant for decision-making, excluding operational data like quality assurance reports.
• Components may consist of ePCR, Florida EMS Report, amendments to PHI, and statements of disagreement.

Health Insurance Portability and Accountability Act (HIPAA)

• Aims to enhance healthcare efficiency by implementing security standards, data standardization, and unique health identifiers.

Health Plan

• Customer’s plan providing medical or social service care, encompassing individual/group plans, HMOs, and more.

Healthcare Clearinghouse

• Entity that processes health information for standard electronic transactions.

Healthcare Provider

• Entity offering medical and health services, including hospitals, clinics, and licensed practitioners.

Identifiable, Personal, Confidential Information

• Includes the individual’s name, social security number, address, phone number, and medical information.

Notice of Privacy Practices (NOPP)

• Details the ways a Covered Entity can use and disclose PHI and outlines patient rights regarding privacy.

Preemption

• Whenever state law divides from HIPAA to offer more stringent privacy rights, state law prevails.

Privacy Rule

• Established under HIPAA to govern the use and disclosure of PHI by Covered Entities and safeguard individuals' privacy rights.

Protected Health Information (PHI) / Individually Identifiable Health Information (IIHI)

• Encompasses any health-related information that identifies the individual, regardless of its form or medium.

Exceptions to Disclosure of PHI

• Specific legal requirements, public health activities, law enforcement activities, and serious threats to safety may permit disclosures.

Security Measures

• Encompasses physical, technical, and administrative safeguards protecting the confidentiality and integrity of health information.

Trading Partner

• An organization exchanging health information electronically with a Covered Entity.

Authorized Uses and Disclosures

• Prohibition against releasing customer/patient information outside MDFR unless for treatment, payment, or operations.
• Internal discussions on PHI limited to necessary exchanges for patient care and organizational functions.

Individual Rights

• Patients receive a copy of NOPP upon treatment and are encouraged to sign for confirmation.

Access to PHI

• Requests limited to information in DRS; requires submission of a request form to the Records Bureau, operational during business hours.

Amendment of PHI

• Customers/patients may request amendments, which must be acted upon by the MDFR Privacy Liaison within a specified timeframe.

Documentation and Record Retention

• All procedural steps for actually handling patient data must be documented, including access requests, amendments, and complaints received.### Designated Record Set Maintenance
• Effective April 14, 2003, MDFR is responsible for maintaining the Designated Record Set (DRS) of patients' Protected Health Information (PHI).
• The retention period for PHI is seven years from its creation, encompassing amendments and restrictions made by MDFR or business associates.

Enforcement and Penalties for Non-Compliance

• Non-compliance with the policy results in informal and formal counseling for MDFR personnel, along with potential disciplinary actions as per Miami-Dade County Administrative Order 7-3.
• Civil penalties by the U.S. Department of Health and Human Services (HHS) can reach 100perviolationofthePrivacyRule,cappedat100 per violation of the Privacy Rule, capped at 100perviolationofthePrivacyRule,cappedat50,000 per year for multiple violations.
• Penalties may be waived if the violation was due to reasonable cause, not willful neglect, and the issue is corrected within 30 business days after awareness.

Criminal Penalties

• Individuals knowingly disclosing or obtaining Individually Identifiable Health Information (IIHI) in violation of HIPAA can face fines of $50,000 and up to one year in prison.
• Penalties escalate to 100,000to100,000 to 100,000to250,000 and up to ten years of imprisonment for violations intended for commercial advantage, personal gain, or malicious harm.
• Criminal enforcement is conducted by the Department of Justice.