SendSafe Secure

Transcription

1 SendSafe Secure

2 By the end of the course, you will be able to: Recognize the importance of encrypting Identify items for encryption Encrypt Manage blocked Advise recipients on retrieving encrypted

3 What is SendSafe Secure ( SendSafe )? NYULMC s encryption system to secure sent to non-medical Center addresses Significantly reduce the risk of protected health information (PHI) and other Medical Center information from being exposed to unauthorized individuals during transmission Proactively comply with the Healthcare Insurance Portability and Accountability Act (HIPAA)

4 What is encryption? Encryption involves the use of computer software that makes electronically stored or transmitted data unusable, unreadable, or undecipherable to unauthorized individuals.

5 When do you encrypt ? Always encrypt that contains Protected Health Information (PHI) and is being sent to a non-medical Center address. PHI is individually identifiable health information that is transmitted or maintained orally, electronically, or on paper. Individually identifiable health information is any information that relates to: Physical or mental health of an individual Health care services received by an individual Patient billing information To be considered individually identifiable information, the information must either: Identify the individual Reasonable to believe that it could be used to identify the individual

6 Patient Identifiers Name Address Telephone number Fax number Social security number Medical record number Health plan number Account number Dates Photos Certificate/license number Vehicle identifiers Biometric identifiers Device identifiers address Web URL IP address Other unique identifiers

7 When do you encrypt ? You must encrypt s that contain PHI and are being sent outside the Medical Center. Consider encrypting other Medical Center information to reduce the risk of exposure to unintended individuals. Examples include but are not limited to: Research data Donor information Intellectual property Marketing ideas Financial information Student records or grades

8 When do you encrypt ? Be cautious when replying to or forwarding s that contain PHI. Replying to or forwarding an that contains PHI to the same person or others with a non-medical Center address still requires encryption. If the reply or forwarded contains PHI: Delete the portion of the that contains PHI Start a new with no PHI Encrypt the Requires encryption

9 What does being sent to a non-medical Center address mean? Medical Center is any address that ends med.nyu.edu Non-Medical Center addresses include, but are not limited yahoo.com Other mskcc.org Consultants or deloitte.com Government wellpoint.com New York nyu.edu

10 How to send an encrypted Step 1: Open your Medical Center and write a message as you normally would Step 2: Identify that your contains PHI Step 3: Type [safe] in the Subject line of your Step 4: Proceed to send as you normally would

11 Automatic Block The Medical Center system will automatically block unencrypted that appear to contain specific combinations of: Patient name Medical record number Date of birth, and/or Social security number Any numbers that resemble a social security number *Automatic blocking will only occur if the is sent to a non-medical Center address. * Automatic blocking does not change your responsibility to identify and encrypt PHI.

12 How to Manage Blocked If the system detects PHI or a Social Security Number (SSN) and automatically blocks your , you will receive an notification of the block in your inbox within seconds of clicking the send button.

13 How to Manage Blocked To: John Doe Attachments: Dear Colleague: Your with the subject line Requested patient information appears to contain protected health information (PHI) that may include patient name, medical record number, date of birth, and social security number (SSN). Your was automatically blocked from delivery to a non- Medical Center address. If it is necessary for you to send an containing PHI or SSN to a non- Medical Center address, you must encrypt the by including the word safe in square brackets, [safe], anywhere in the subject line of the . To learn more about encryption, visit the SendSafe Secure FAQs page or complete the SendSafe online tutorial available on idevelop. Thank you for your cooperation, NYULMC Internal Audit, Compliance & Enterprise Risk Management *Do not respond to the ComplianceDLP@nyumc.org, as this is not a monitored address. If you have questions please refer to the SendSafe webpage.

14 How to Manage Blocked To: Attachments: John Doe Review the original in your sent mailbox or the message as an attachment in the blocked notification Dear Colleague: Your with the subject line Requested patient information appears to contain protected health information (PHI) that may include patient name, medical record number, date of birth, and social security number (SSN). Your was automatically blocked from delivery to a non- Medical Center address. If it is necessary for you to send an containing PHI or SSN to a non- Medical Center address, you must encrypt the by including the word safe in square brackets, [safe], anywhere in the subject line of the . To learn more about encryption, visit the SendSafe Secure FAQs page or complete the SendSafe online tutorial available on idevelop. Identify items that appear to be PHI Remove PHI or encrypt by typing [safe] in the Subject line *Do not ignore a blocked notification because your will remain undelivered until you respond Thank you for your cooperation, NYULMC Internal Audit, Compliance & Enterprise Risk Management *Do not respond to the ComplianceDLP@nyumc.org, as this is not a monitored address. If you have questions please refer to the SendSafe webpage.

15 Help, My Does Not Contain PHI or SSN Automatic blocking may occur if: Text or characters in your may happen to match PHI in our system contains a 9 digit number that resembles a social security number Examples: Telephone numbers where a digit was left out: Account number made up of 9 digits that resemble a SSN: Foreign phone numbers Name (first or last) and a 9 digit string that resembles a SSN What to do? 1. Confirm that neither the main body nor attachments contain actual PHI 2. If there is no PHI, remove items that resemble PHI, if possible 3. If the items that resemble PHI are necessary for your , then encrypt the and send How to encrypt? Type [safe] anywhere on the Subject line of the

16 Remote Access It is easy to encrypt , but do not send PHI to your personal account in order to access information remotely. If you need to access PHI remotely, you should save your work on the network drive and access PHI through atnyulmc. If you need to transport PHI and cannot access atnyulmc, contact Medical Center IT for an Iron Key, a fully encrypted USB flash drive.

17 Prepare recipients Notification Registration: Create a Password & Select Delivery Option Message Retrieval Recipient Resources: Quick Reference Guide for Recipients

18 Recipient receives notification

19 First time recipients, click on link to register

20 Prompt to create a password

21 Settings is defaulted to SendSafe Secure On-Line Default option is already selected

22 With default settings, recipients can read their messages, access their inbox, and reply to messages securely

23 Available Resources Office of Internal Audit, Compliance & Enterprise Risk Management website: Frequently Asked Questions Medical Center Training Manual Quick Reference Guide for Medical Center Senders Quick Reference Guide for Recipients Registration Process Quick Reference Guide for Recipients PDF Attachment For technical inquiries, open a MCIT ticket or contact the Help Desk at

24 Let s Review

25 SendSafe Quiz Question 1 of 7 You are a Medical Center employee. You use your Medical Center to send PHI to a NYULMC colleague s Medical Center . Do you need to encrypt the ? A. Yes B. No 25

26 SendSafe Quiz Question 1 of 7 You are a Medical Center employee. You use your Medical Center to send PHI to a NYULMC colleague s Medical Center . Are you required to encrypt the ? A. Yes B. No 26

27 SendSafe Quiz Question 2 of 7 You are a billing staff member. An insurance payor requests additional information to process a claim. You respond to the request by using Medical Center . Are you required to encrypt the ? A. Yes B. No 27

28 SendSafe Quiz Question 2 of 7 You are a billing staff member. An insurance payor requests additional information to process a claim. You respond to the request by using Medical Center . Are you required to encrypt the ? A. Yes B. No 28

29 Always encrypt that contains PHI and is being sent outside the Medical Center. The information should only include the minimum necessary PHI for treatment, payment, or health care operations. 29

30 SendSafe Quiz Question 3 of 7 You are a specialist provider. After rendering a consultation to a patient, you write a consultation letter to the referring physician, scan the letter into PDF format, and send the PDF as an attachment to the referring physician at another hospital. Are you required to encrypt the ? A. Yes B. No 30

31 SendSafe Quiz Question 3 of 7 You are a specialist provider. After rendering a consultation to a patient, you write a consultation letter to the referring physician, scan the letter into PDF format, and send the PDF as an attachment to the referring physician at another hospital. Are you required to encrypt the ? A. Yes B. No 31

32 SendSafe Quiz Question 4 of 7 You will be attending an out-of-state conference for the next two days but need to work on a project that has a spreadsheet with patient names, date of birth, and diagnoses. To work remotely, you send the spreadsheet to your personal Yahoo account. Since you can easily encrypt , is it okay to do this? A. Yes B. No 32

33 SendSafe Quiz Question 4 of 7 You will be attending an out-of-state conference for the next two days but need to work on a project that has a spreadsheet with patient names, date of birth, and diagnoses. To work remotely, you send the spreadsheet to your personal Yahoo account. Since you can easily encrypt , is it okay to do this? A. Yes B. No 33

34 SendSafe Quiz Question 5 of 7 Most of the patients who are seen at your office participate in MyChart, the Medical Center s secure online patient access to medical information in the Epic electronic health record. An established patient who does not participate in MyChart requests that your office send his lab results to his personal . Are you required to encrypt the ? A. Yes, but B. No 34

35 SendSafe Quiz Question 5 of 7 Most of the patients who are seen at your office participate in MyChart, the Medical Center s secure online patient access to medical information in the Epic electronic health record. An established patient who does not participate in MyChart requests that your office send his lab results to his personal . Are you required to encrypt the ? A. Yes, but B. No 35

36 MyChart Encourage patients to participate in MyChart for secure online access to their medical information. If it is necessary to PHI, always type [safe] anywhere in the Subject line to encrypt the . For more information about MyChart, visit 36

37 SendSafe Quiz Question 6 of 7 A patient sends an message that contains PHI to your Medical Center . After reading the , you click Reply and type Thank you in the body of the message. Are you required to encrypt the ? A. Yes B. No 37

38 SendSafe Quiz Question 6 of 7 A patient sends an message that contains PHI to your Medical Center . After reading the , you click Reply and type Thank you in the body of the message. Are you required to encrypt the ? A. Yes B. No 38

39 Replying to an that contains PHI When you click on Reply you are transmitting the entre message, including the PHI on the patient s , outside the Medical Center. You may choose to delete the portion of the that contains PHI, start a new to thank the patient, or encrypt the by typing [safe] anywhere in the Subject line. 39

40 SendSafe Quiz Question 7 of 7 Your unencrypted that contains a patient s name and social security number was automatically blocked from delivery to a non-medical Center address. The information included in your is necessary to perform your job duties, and for this reason, you must send this with PHI. Are you required to encrypt the ? A. Yes B. No Auto-blocked 40

41 SendSafe Quiz Question 7 of 7 Your unencrypted that contains a patient s name and social security number was automatically blocked from delivery to a non-medical Center address. The information included in your is necessary to perform your job duties, and for this reason, you must send this with PHI. Are you required to encrypt the ? A. Yes B. No Auto-blocked 41

42 Thank you for completing this training