Privacy Space. Public Place. How to Protect PHI and be HIPAA Compliant

Transcription

1 Privacy Space. Public Place. How to Protect PHI and be HIPAA Compliant Event Type Live Online ACPE Expiration Date 12/11/2016 Credits 1 Contact Hour Target Audience Pharmacy Technicians Program Overview As a pharmacy technician, being HIPAA-compliant in the pharmacy is the law. Violating privacy can lead to serious consequences including termination and heavy fines. You not only put yourself at risk, but you also put your fellow techs and pharmacists at risk as well. In this program, we will discuss and understand the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, Protected Health Information (PHI), Notice of Privacy Practices, the Health Information Technology for Economic and Clinical Health (HITECH) Act and describe how the affect a pharmacy technician in the daily operations of the pharmacy. Pharmacy Technician Educational Objectives Explain the basic concepts and requirements of Health Insurance Portability and Accountability Act (HIPAA) Describe the key elements of the Privacy Rule including who is covered, what information is protected and how Protected Health Information (PHI) can be used and disclosed Identify the information contained in the Notice of Privacy Practices, when and how it s received and why it must be signed Activity Type Knowledge Accreditation Pharmacy Technician L04-T

2 PharmCon, Inc. is accredited by the Accreditation Council for Pharmacy Education as a provider of continuing pharmacy education. PharmCon, Inc. has been approved as a provider of continuing education for nurses by the Maryland Nurses Association which is accredited as an approver of continuing education in nursing by the American Nurses Credentialing Center s Commission on Accreditation. Faculty Michelle O Brien, CPhT Pharmacy Technician Adjunct Instructor, PharmCon Financial Support Received From Pharmaceutical Education Consultants, Inc. Disclaimer PharmCon, Inc. does not view the existence of relationships as an implication of bias or that the value of the material is decreased. The content of the activity was planned to be balanced and objective. Occasionally, authors may express opinions that represent their own viewpoint. Participants have an implied responsibility to use the newly acquired information to enhance patient outcomes and their own professional development. The information presented in this activity is not meant to serve as a guideline for patient or pharmacy management. Conclusions drawn by participants should be derived from objective analysis of scientific data presented from this activity and other unrelated sources.

3 Page 1 Privacy Space. Public Place. How to Protect PHI and be HIPAA Compliant Accreditation Pharmacy Technicians: L04-T CE Credit(s) 1.0 contact hour(s) Faculty Michelle O Brien CPhT Pharmacy Technician Adjunct Instructor, PharmCon Faculty Disclosure Ms. O Brien has no actual or potential conflicts of interest in relation to this program. Learning Objectives Explain the basic concepts and requirements of Health Insurance Portability and Accountability Act (HIPAA) Describe the key elements of the Privacy Rule including who is covered, what information is protected and how Protected Health Information (PHI) can be used and disclosed Identify the information contained in the Notice of Privacy Practices, when and how it s received and why it must be signed Legal Disclaimer The material presented here does not necessarily reflect the views of Pharmaceutical Education Consultants (PharmCon) or the companies that support educational programming. A qualified healthcare professional should always be consulted before using any therapeutic product discussed. Participants should verify all information and data before treating patients or employing any therapies described in this educational activity. Objectives Explain the basic concepts and requirements of HIPAA Identify the key elements of the Privacy Rule including who is covered, what information is protected and how PHI can be used and disclosed Identify the information contained in the Notice of Privacy Practices, why it must be signed, when and how its received History of HIPAA August 21, 1996: Congress enacted the Health Insurance Portability and Accountability Act (HIPAA.) It required the Secretary of Health and Human Services (HHS) to propose standards protecting the privacy of individually identifiable health information by August 21, 1997.

4 Page 2 What is HIPAA and Privacy Rule? US Law designed to provide privacy standards to protect patients medical records and other health information Composed of two main rules-privacy of personally identifiable health information (HIPAA Privacy Rule) and electronic health information (HIPAA Security Rule) Provide patients with access to their medical records and more control over how their personal information is used and disclosed Final HIPAA Omnibus Rule Published in January 2013 September 23, 2013: Compliance deadline HIPAA modifications: Further enhances patients privacy rights Strengthens the Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification requirements Gives the Health and Human Services Office for Civil Rights expanded authority to pursue complaints about HIPAA violations, including civil and criminal punishments. Who Must Comply? A Health Care Provider A Health Plan A Health Care Clearing House This includes providers such as: Doctors Clinics Psychologists Dentists Chiropractors Nursing Homes Pharmacies...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. This includes: Health insurance companies HMOs Company health plans Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa. Why Is HIPAA Needed? The Privacy Rule establishes a Federal floor of safeguards to protect the confidentiality of medical information. With information broadly held and transmitted electronically, the Rule provides clear standards for the protection of personal health information. State laws which provide stronger privacy protections will continue to apply over and above the new Federal privacy standards.

5 Page 3 What is PHI? According to the U.S Department of Health and Human Services Health Information and Technology Improvement website, PHI is information that can relate to: The individual's past, present or future physical or mental health or condition, The provision of health care to the individual, or, The past, present, or future payment for the provision of health care to the individual. Identifiers Become PHI when Linked to a Patients Health Info Account numbers Any code or # that can be linked to an individual (i.e. RX #) address Health plan id numbers Identifying photos License numbers Social Security Number Open log books (controlled substance, pseudoephedrine, RX pick up) Address Birthday Fax number Health Care Record number IP address Name URL address Minimum Necessary Requirement The minimum amount of PHI that is reasonably needed to achieve the purpose of a requested use, disclosure or request for PHI. The minimum necessary requirement does not apply to: Uses, disclosures to, or requests by a healthcare provider for treatment purposes. Uses or disclosures made to the individual (patient). Uses or disclosures that are authorized by the individual pursuant to a valid authorization, signed by the patient or a personal representative, so long as the uses or disclosures are consistent with the authorization. Notice of Privacy Practices Notice of Privacy Practices must contain A description of the type of uses or disclosures A statement that other disclosures require an individual s written authorization A statement that the covered entity is required by law to maintain the privacy of the PHI A statement of individual s rights A statement that the individual may complain to the Secretary of HHS The identity of the person to contact at the pharmacy regarding privacy issues

6 Page 4 Notice of Privacy Practices Must be written in plain language The notice must include an effective date. Identifies who should be contacted at your pharmacy concerning any privacy issues Contains the wording: "This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Describe the types of disclosures to be made with and without patient consent or authorization Patients are not required to sign the privacy notice if they do not want to When and How Notice is Received A notice is received at a patient s first encounter in the pharmacy It is given to anyone who asks for it Must be available on any web site it maintains that provides information about its customer services or benefits May be ed to the patient if they agree to receive an electronic notice Authorization vs. Consent Authorization A detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. Consent Voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization Can PHI be Disclosed without Authorization? Yes, but only under certain circumstances to: Law enforcement, judicial proceedings Reports of abuse or neglect Coroners, funeral directors Organ and tissue donation Certain research activities Threat to public safety Worker s compensation

7 Page 5 Individual Rights Other Helpful PHI Info Patients have the right to specify who can pick up their prescriptions Patients can elect to pay out of pocket for prescriptions and not share information about these prescriptions with their insurer Patients can request a copy of PHI in an electronic format and designate where it can be sent to Request must be in writing, signed by the patient and clearly identify the designee and where to send a copy of the PHI Disclosure of immunization records to schools/daycare is ok without written authorization (previously required) Health information about deceased patients is allowed unless the patient previously expressed other preferences prior to death Health plans are prohibited from using genetic information for underwriting purposes (eligibility, premiums, or preexisting conditions) Health Information Technology for Economic and Clinical Health (HITECH) Act Enacted to promote the widespread adoption and meaningful use of electronic health records (EHRs) and related technologies Requires covered entities to provide electronic copies of PHI maintained in an EHR to the patient upon request Any business associate that contracts with a pharmacy will now be held to the same privacy standards as the pharmacy and will be subject to the same criminal and civil penalties for violations. Breach A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual. Previously, breaches only had to be reported if they posed harm to the patient but now all cases of impermissible acquisition, access, use, or disclosure of PHI are presumed to cause harm and be reportable unless the covered entity or business associate can demonstrate that there was a low probability that PHI was compromised

8 Page 6 Scenario #1 Mary comes to pick up her 90-year-old mother s prescription. As you are cashing her out she requests to speak with the pharmacist. She asks the pharmacist questions about the medication and the pharmacist continues to counsel her on the medication. Has the pharmacist violated HIPAA? HIPAA Violation? No The pharmacist did not disclose any personally identifiable protected health information. The pharmacist counseled Mary on the prescription she was picking up. Discussing side effects and precautions with Mary does not violate HIPAA. If the pharmacist had mentioned a drug interaction with a medication that her mother was taking, it would then constitute a HIPAA violation. That was not the case here and thus no HIPAA violation occurred. Scenario #2 Mr. Clark s physician wrote a prescription for Diovan, a drug used to lower blood pressure. The pharmacy benefits manager kicks back the prescription because it is a nonformulary drug. The message he receives states that another anti-hypertensive drug, lisinopril, should be tried instead. Having reviewed Mr. Clark s profile, the pharmacist knows she has taken lisinopril in the past and developed a cough due to the medication. The pharmacist calls the pharmacy benefit manager (PBM) to ask for permission to fill the prescription for Diovan. Before the PBM gives the permission, they alert the pharmacist that they are collecting information about people with high blood pressure for a drug manufacturer. The agent begins asking the pharmacist detailed questions about Mr. Clark s medical history. The pharmacist willingly shares information from Mr. Clark s profile. HIPAA Violation? Yes The pharmacist has gone beyond the minimum necessary to obtain payment for the Diovan. Under the Privacy Rule, he is allowed to contact Mr. Clark s PBM to pursue permission to fill the prescription and release the information that he had a reaction to the lisinopril. The information is necessary for payment. It would not be unusual for an insurance company to ask that a patient try a formulary drug, in this case lisinopril, before allowing payment for a nonformulary drug, Diovan. The pharmacist violated HIPAA by answering questions about Mr. Clark s medical information.

9 Page 7 Consequences So, what are the consequences that you can face if you break HIPPA regulations? You could be terminated by your employer Violations in which the offender didn t realize he or she violated the Act and would have handled the matter differently if he or she had. This results in a $100 fine for each violation, and the total imposed for such violations cannot exceed $25,000 for the calendar year. (Tier A) Violations due to reasonable cause, but not willful neglect. The result is a $1,000 fine for each violation and the fines cannot exceed $100,000 for the calendar year. (Tier B) Violations due to willful neglect that the organization ultimately corrected. The result is a $10,000 fine for each violation and the fines cannot exceed $250,000 for the calendar year. (Tier C) Violations of willful neglect that the organization did not correct. The result is a $50,000 fine for each violation and the fines cannot exceed $1,500,000 for the calendar year. (Tier D) Consequential Precedence Pharmacy Pays $2.25 Million and Toughens Practices to Settle HIPAA Privacy Case HIPAA Violation Results In $1.44 Million Jury Verdict Against Pharmacy, Pharmacist Hospice Gets $50,000 HIPAA Penalty- First Settlement After a Breach Affecting Fewer Than 500 How do We Stay Compliant Final Thoughts Reveal only the minimum necessary Telephone Drive-thru or counter service Insurance companies Make sure to always give the correct patient back their correct insurance card and/or ID Speak lowly if necessary to prevent other patients from hearing your conversation Always be conscious to safeguard PHI Be careful with electronic devices that contain PHI If something doesn t seem right, ask! Most pharmacists and pharmacies are covered entities under HIPAA, and will be held responsible for complying with the various federal rules Treat patients personal information like you want your personal information to be treated!