Chapter 5

Question 1

HIPAA

Answer 1

passed in 1996
intent to reduce the administrative costs of healthcare

Question 2

Administrative Simplification Section of Title II

Answer 2

section of HIPAA that required the development of standardized transaction standards for content and transmission of the data, requirements for a single NPI number for all health care providers, as well as the Privacy and Security rules to protect the health information

Question 3

Privacy Rule

Answer 3

effective April 15, 2003
2 essential approaches
1. assigns rights to individual patients to provide them with some control over their own health information
2. provides standards for the ways that health care providers, health plans and health clearing houses are permitted to access, use and disclose information

Question 4

Security Rule

Answer 4

effective April 20, 2005

Question 5

Preemption

Answer 5

-HIPAA statute has a preemption clause and is often termed a “floor” in that it provides a national standard for the protection of health information that can be pre-empted by state laws in certain limited respects
-necessary to understand state laws and how they may preempt the federal HIPAA regulation in your state

Question 6

Health Information Technology for Economic and Clinical Health Act (HITECH)

Answer 6

-passed in February 2009
-designed to promote the widespread adoption and standardization of electronic health records
-includes notification requirements for breaches of unsecured information, increases the potential civil monetary penalties for violations of HIPAA, and strengthens certain privacy rights

Question 7

Genetic Information Nondiscrimination Act (GINA)

Answer 7

-effective March 23, 2013
-Became known as the Omnibus Rule
-Made several modifications to the privacy practices that covered entities must implement

Question 8

What does HIPAA Govern and Who must comply with these regulations?

Answer 8

HIPAA governs the use and disclosure or Protected health information by “covered entities” directly and their business associates indirectly

Question 9

Covered Entity

Answer 9

health care providers that transmit any health information in electronic form, a health plan with more than 50 participants, and a health care clearinghouse that receives, processes, and transmits health information for payment purposes

Question 10

Protected health information (PHI)

Answer 10

individually identifiable health information that is created, collected and stored by a covered entity and maintained in electronic or any other form

Question 11

3 elements to determine if information is PHI

Answer 11

-health information that describes the past, present, or future health, condition, care, treatment, of an individual, or payment for such care or treatment
-information must reasonably identify the individual
-the information must be maintained in electronic or any other form

all three elements are required for the information to be PHI

Question 12

De-identified Information

Answer 12

• approximately 18 identifying characteristics depending upon how they are categorized
  -the presence of 1 does not mean the information is PHI
  -All 18 identifiers must be removed for health information to be considered de-identified

Question 13

Patient privacy rights

Answer 13

an overriding theme to the privacy regulations is to place control over health information squarely in the hands of the individual who is the subject of the information

Question 14

Individual Rights under the Privacy Rule

Answer 14

-to access and obtain a copy of their PHI
-Right to amend their PHI
-Obtain an accounting or listing of disclosures of their PHI
-Right to receive a Notice of Privacy Practices
-to have communications about their PHI conducted in a confidential manner
-to restrict disclosure on certain uses and disclosures of their PHI
-to fine a complaint about a covered entity’s privacy practices to the covered entity as well as to the Office of Civil Rights (OCR)

Question 15

Notice of Privacy Practices

Answer 15

Covered entity is bound by the notice
Covered entity is required to make a good faith effort to obtain an acknowledgement from the individual
If the first episode of care was via telephone, the covered entity must mail its notice to the individual within 24 hours

Question 16

Access to health information

Answer 16

-individuals cannot necessarily have access to everything in the record

Question 17

Ways a Covered entity can restrict an individuals access to their PHI

Answer 17

-psychotherapy notes
-info a covered entity compiled to prepare for actual or anticipated litigation
-PHI that the covered entity is prohibited from sharing pursuant to the Clinical Laboratory Improvements Amendments (CLIA) 1988
-Correctional institution if it would put the security of the individual, another inmate, or the institution at risk
-if obtained during a research study and the individual agreed to the restricted access in the authorization signed at the beginning of the study

Question 18

Reasons a covered entity can deny an individual access to PHI

Answer 18

-sharing the information would put the individual or another person in danger
-the information was obtained from someone other than another health care provider and sharing the information would be reasonably likely to put that person at risk for substantial harm
-the request for access is by a personal representative and sharing the information would be reasonable likely to put the subject of the information or another person at substantial risk of harm

*if denied the covered entity is required to provide a method for the individual to appeal the denial. Another licensed health care professional must review the decision and the covered entity must abide by the decision of the reviewing official

Question 19

Amending PHI

Answer 19

-have the right to request a covered entity to amend inaccurate or incomplete information
-original info documented in the medical record should not be altered in such a way as to completely eliminate the information
-not always required to amend the record
1. if entity determines the record is accurate and complete
2. or info was generated by another covered entity
3. Trying to amend info that he or she is not entitled to access
4. That info is not part of the designated record set

Question 20

3 requirements to not disclose health information to a health plan

Answer 20

1. Individual request that the info not be provided to the health plan
2. Individual or family member has paid out of pocket for the service in full
3. The health plan would normally obtain the info for payment or health care operations

Question 21

Communication of PHI

Answer 21

If an individual makes a reasonable request to have PHI communicated in a specific manor, a health care provider is required to accommodate the request.
E.g can only call a specific number and leave a message

Question 22

Accounting request of disclosures

Answer 22

HIPAA gives an individual the right to know who was received his or her PHI. If there is a request the covered entity must be prepared to provide the list of all disclosures it has made.

Question 23

Reasons an accounting of disclosures is not required

Answer 23

-treatment, payment or healthcare operations
-an incidental disclosure
-made in a limited data set
-made with an authorization from the individual
-made for national security purposes
-disclosure prior to the enforcement date of the privacy regulation, April 14,2003
-disclosure to the subject of the information
-disclosure that only required giving the individual an opportunity to object
-disclosure to a correctional institution or other law enforcement official having custody of the individual for purposes of providing appropriate care to the individual

Question 24

What’s included in the accounting of disclosure

Answer 24

-who
-date made
-brief description of information
-purpose of disclosure

May request an accounting that covers up to a six-year period

Question 25

Office of Civil Rights

Answer 25

OCR
A department of Health and Human Services
Complaints about a covered entities privacy practices can be filed here

Question 26

Three subcategories where PHI can be used or disclosed

Answer 26

1. Uses and disclosures the covered entity is required or permitted to make without an individuals explicit permission
2. Permitted uses and disclosures if the covered entity has given the individual an opportunity to object to the disclosure
3. Uses and disclosures only with the individuals explicit permission

Question 27

Permitted Disclosures

Answer 27

TPO - treatment, payment, and healthcare operations
If the use or disclosure of the PHI fits into one of these three definitions, the PHI can be used or disclosed without obtaining the explicit permission from the individual

Question 28

TPO -Treatment

Answer 28

A physician can call his or her colleague in another specialty to get the colleague’s input on the care being provided

Question 29

TPO-Payment

Answer 29

A physician’s staff can submit a bill to the individual’s insurance company to obtain payent for the service provided

Question 30

TPO-Health Care Operations

Answer 30

A physician’s compliance staff can access the individual’s PHI to conduct an assessment of the physician’s coding and documentation practices

Question 31

2 instances under the privacy regulations when a covered entity is required to disclose PHI

Answer 31

1. When the information is requested by a secretary fo the department of health and human services to investigate an allegation of a privacy violation
2. When the subject fo the information requests it

Question 32

Disclosure in the public interest without having to obtain the individual’s explicit permission

Answer 32

-required by law
-public health activities
-reporting on victims of abuse, neglect, or domestic violence
-reporting for health oversight activities
-judicial or administrative proceedings
-law enforcement purposes
-information to coroners, medical examiners, and funeral directors about decedents
-information for organ donation
-certain research purposes
-disclosures to avert a serious threat to health or safety
-specialized governmental functions
-workers’ compensation

Question 33

When covered entities have to provide an individual an opportunity to object prior to the use or disclosure occuring

Answer 33

*First purpose - when a covered entity includes limited information about the individual in its facility directory
—information in the directory could be name, location, general condition, and religious affiliation.
*Second disclosure - a disclosure can be made to family, friends, or others involved in the individual’s care or payment for the care
*Third- can disclose PHI under the provision for purposes of assisting in disaster relief
—Such disclosures would generally be made so the location and condition of the individual could be accessible to family and friends

Question 34

Authorizations form for use and disclosures

Answer 34

Must include:
-description of PHI to be used or disclosed in a specific fashion
-who is authorized to make the use or disclosure
-who is authorized to receive the PHI
-description of purpose of each requested use or disclosure
-expiration date
-signature of the individual and date
-statement informing the individual of the right to revoke and instructions for how to revoke
-statement informing the individual that by signing is a precondition of treatment, participation in research, eligibility of benefits, or enrollment in a health plan if applicable

*if not all there the authorization is invalid and cannot rely on it to use or disclose PHI

Question 35

Fundraising

Answer 35

HIPAA privacy allows the use of limited PHI without authorization
—name, address, or other contact info, insurance status and date of care
If additional PHI is wanted an authorization would be required
HITECH requires there to be a way to opt out of receiving further fundraising requests
*The covered entity is also prohibited from conditioning treatment or payment on the individual’s choice to opt out.

Question 36

Marketing

Answer 36

The privacy rule prohibited the use of PHI for “marketing” proposes unless the patient had specifically authorized the disclosure of the info and that patient was notified by the provider that the provider was receiving direct or indirect remuneration for the disclosure of the information
* if marketing is face to face or if an item of minimal value is given to the individual, an authorization is not required
*HITECH requires a way to opt out

Question 37

Overarching principles that are equally important components of the privacy regulations

Answer 37

1. Minimum necessary standards
2. Verification
3. Disclosures to business associates, and breach notification requirements

Question 38

Minimum Necessary Standards

Answer 38

-The amount of PHI that can be used or disclosed in a particular circumstance

Question 39

Circumstances when minimum necessary evaluation is not required

Answer 39

-with and authorization
-to a provider for treatment
-to the subject of the information
-to the secretary of DHHS
-as required by law
-as required to comply with the regulations

*Case-by-case basis

Question 40

Minimum necessary- role-based access

Answer 40

Means only allowing employees and others access to the information that is needed to perform their role in the organization

Question 41

Minimum necessary- need-to-know

Answer 41

Is generally and education process
E.g. physician may be granted access to entire record

*the ability to access PHI does not equate to a need to know the information

Question 42

Level of access

Answer 42

Covered entities must determine the appropriate level of access to be granted to various individuals based on their role. Next step is to educate those individuals regarding the proper uses and disclosures of the PHI to which they have been given access

Question 43

Verification

Answer 43

A way to verify that the individual is who they say they are and has a right to receive the information

*Most important is that a covered entity has a process for verification, a rationale for why the process is reasonable, and evidence that the process is consistently followed.

Question 44

Business Associate

Answer 44

A contracted external company of individual to provide services that are part of their health care operations.

E.G. accounting, legal council, coding and billing, transcription services, vendors of EHR

Under HITECH Act, BA are accountable to HHS and directly liable for criminal and civil penalties for uses and disclosures that would be a violation of the privacy rule.
The Omnibus Rule further extended the BA requirements to subcontractors of BA

Question 45

What has to happen before PHI is shared with a business associate

Answer 45

The associate must provide satisfactory assurances that it will not use or disclose PHI in a manner that contradicts the Privacy Rule Agreements
A business associate agreement must define:
1. The function of the BA and the limitations on their uses and disclosures
2. What happens to PHI upon termination of agreement

Question 46

Exceptions to what constitute a breach

Answer 46

-disclosures where there is a good faith belief that the recipient of the information would not reasonably have been able to retain the information
-certain unintentional acquisition, access or use of the information by persons or employees acting under the authority of the covered entity or business associate
-certain inadvertent disclosures among persons similarly authorized to access protected health information of a business associate or covered entity

Question 47

Presumptively reportable

Answer 47

The covered entity must report any breach of unsecured PHI unless the covered entity determines that there is a low probability of compromise of the privacy and security of the PHI

Question 48

HITECH Act and Omnibus additions for breach

Answer 48

HITECH- created an obligation on the part of covered entities an their BA to notify individuals of the breach in the event that the breach meets the standard for a reportable breach
Omnibus - modified the standard for a reportable breach to make breaches presumptively reportable if there is a violation of the Privacy regulations and the information was unsecured

Question 49

National Institute of Standards and technology (NIST)

Answer 49

HHS issued guidance regarding securing health information and specifically the technologies and methodologies that would make the PHI unusual experience, unreadable and indecipherable.
The accepted methodology is encryption that is in compliance with NIST
NIST standards address data at rest, data in motion and data in use

Question 50

Non-electronic formats

Answer 50

Methodologies include de-identifying the information, or shredding, pulping or otherwise treating the material so the information cannot be reconstructed

Question 51

Who is to be notified if there is a reportable breach

Answer 51

-the individual or their representative
-Office for Civil Rights (OCR)
-if individuals are deceased the notice must go to their next of kin

Question 52

Undeliverable notices of breach

Answer 52

-the covered entity must provide a substitute notice ASAP - email or phone
-more than 10 then the covered entity must post information about the breach in a conspicuous place on the homepage of its website along with a toll free number for individuals to obtain information about the breach

Question 53

Four factors to assess to determine low probability of compromise

Answer 53

1. Content
2. Person
3. Access
4. Mitigation

Question 54

How and when to report breaches when over 500 individuals

Answer 54

-involving over 500 individuals must be reported immediately to HHS via an online reporting system on the OCR website. The individuals violated must be notified ASAP but no later than 60 days after breach occurred
-if it is more than 500 in a singe state or jurisdiction, media outlets in the areas must be notified

Question 55

How and when to report breaches when under 500 individuals

Answer 55

The covered entity must report the breaches in an annual disclosure to HHS within 60 days of the end of the prior calendar year through the same online reporting mechanism

Question 56

The breach notice to individuals must include:

Answer 56

-a description of what happened, including the date of the breach and the date of the discovery
-description of the types of information involved in the breach
-steps individuals can take to protect themselves from harm
-description of what the covered entity is doing to investigate the breach, to mitigate harm to individuals and protect against future breaches
-contact information for individuals to ask questions

Question 57

Who is responsible for the enforcement of the privacy rule?

Answer 57

The Office for Civil Rights (OCR)

Question 58

HITECH tiers of penalty amounts

Answer 58

-Violations in which there was an inadvertent violation and the covered entity would have taken different action if they were aware of the violation, with a penalty for each violation of a minimal of $100 up to $50,000

-Violations due to reasonable cause but not willful neglect with penalties from a minimum of $1,000 up to $50,000.

-Violations due to willful neglect but the problem was corrected - $10,000 up to $50,000

-Violations due to willful neglect and the problem has not been corrected starts at a minimum of $50,000

The calendar year cap for any identical violation was raised from $25,000 under HIPAA to $1.5 million under HITECH

Question 59

Privacy

Answer 59

Refers to the right of an individual to control his or her personal info and to keep it from being divulged or used by others against his or her wishes

Question 60

Confidentiality

Answer 60

Is a means of protecting that information, usually by safeguarding it from unauthorized disclosure

-this only becomes an issue once an individual’s personal information has been received by another entity

Question 61

Security

Answer 61

Applies to the spectrum of physical, technical, and administrative safeguards put in place to protect the integrity, availability and confidentiality of information and the systems in which it is stored

Question 62

Distinction between security and privacy

Answer 62

Security regulations only apply to PHI maintained in the electronic medium (ePHI), whereas privacy rule applies to all PHI held by a covered entity

Question 63

Three new terms related to business arrangements

Answer 63

-Organized Health Care Arrangements (OCHA)
-Affiliated Covered Entities (ACE)
-Hybrid Covered Entities (HCE)

Question 64

Organized health care arrangements (OCHA)

Answer 64

Is a clinically integrated setting where the individual typically received health care from more than one health care provider

Example - hospital and its medical staff

*if a physician participates in an OHCA and agrees to join the joint notice, it is important to understand that the notice only applies to services provided within the OHCA. This means that the physician must still distribute a notice to the patients seen in a private practice clinic

Question 65

Joint Notice

Answer 65

Agreeing to participate in an OHCA allows the covered entities to have a joint notice which covers the manner in which all members of the OHCA will use and disclose PHI about the individual

Question 66

Affiliated Covered Entities (ACE)

Answer 66

Is a group of legally separate covered entities that share common ownership or control

Common ownership exists if an entity or entities possess 5% or greater ownership interest in another entity

Common control exists if one covered entity has the ability to significantly influence the actions or policies and procedures of another covered entity, either directly or indirectly

An ACE allows a group of covered entities to function as one covered entity for most purposes under HIPAA. However, the designation as an ACE does not make all the legally separate entities liable for privacy violations of the other entities

Question 67

Hybrid Covered Entities (HCE)

Answer 67

Is a business that has, as one of its functions, an activity or activities that make it a health care provider, a health plan and/or a health care clearinghouse.