Transcript Hipaa security - Community Health Network

HIPAA SECURITY
COMMUNITY HEALTH NETWORK
ON-LINE MANDATORY TRAINING
OBJECTIVES OF TRAINING
• HIPAA Fundamentals
• Privacy Rule Basics
• Security Rule Basics
• Security Components
• Security Policies and Procedures
• Instructions: On-line mandatory training
WHAT DOES HIPAA STAND FOR?
• Health
• Insurance
• Portability
• Accountability
• Act
HIPAA POLICIES
CHN has 25 policies that relate to HIPAA , they can be
found on the CHN Intranet.
• “Policies & Procedures – CHN Policies – Section 20
Information Technology”
• “CHN Manuals & General Info – HIPAA”
HIPAA OVERVIEW
HIPAA passed in 1996, the goal:
• Standardizing records- Transaction coding and
compliance more simple thereby saving money in the
long-term.
• Portability- Allows for easy transfer of medical
information.
• Accountability- The responsibility piece, keeping the
information private and secure.
• Therein lies two rules that we need to comply with:
• The Privacy Rule
• The Security Rule
HIPAA: PRIVACY RULE
Privacy Rule:
• Restricts what information can be disclosed and
who should have access to it. Specifically in
relation to:
• Individually Identifiable Information
• Personal Health Information (PHI)
HIPAA: PRIVACY RULE
Individually Identifiable Information:
• A subset of health information, created or received by
a Covered Entity relating to a condition, treatment, or
payment which could be used to identify a client.
• Any information that can be traced back to a specific
person is then considered Individually Identifiable
Information.
HIPAA: PRIVACY RULE
Public Health Information (PHI):
• Any health or personal information given to a covered
entity, whether verbal, written or electronic needs to
remain confidential. This includes information that can
connect the patient to the medical record:
• Name
• Address
• Social Security number
• Other identification numbers (MRN)
• Physicians personal notes
• Billing information
HIPAA: PRIVACY RULE
Covered Entity:
• Any health plan, clearinghouse, or provider who
transmits health information (CHN).
• Covered entities MUST:
• Allow patients to see and receive copies of their PHI.
• Designate a Privacy Officer and a means to contact
them.
• Develop a Notice of Privacy Practice document for
patients to read and sign.
• Provide training to new employees and affiliates.
• Develop and utilize a complaints process.
• Ensure business associates also comply with the privacy
ruling.
HIPAA: PRIVACY RULE
Business Associate:
• A person or organization that performs a function on behalf
of a Covered Entity using individually identifiable
information.
• Are required to sign a Business Associate Agreement.
• States the organization is held to the same degree of responsibility
as the Covered Entity in regards to keeping information private.
• If the Business Associate should need to share information
with another organization they must continue the same
process of establishing the Business Associate Agreement.
• The chain on private information cannot be broken.
• Patients can file a grievance if they think their rights have been
violated.
HIPAA: PRIVACY OFFICER
Ann Trombley: Privacy Officer
• Develops a Notice of Privacy Practice document.
• Investigates complaints and violations.
• Ensures Business Associates also comply with the privacy
ruling.
• Ensures CHN and it’s employees are compliant in regards to
the privacy rule.
• Ensures privacy standards comply with statutory and
regulatory requirements.
• Maintains HIPAA privacy policies and procedures.
HIPAA: SECURITY RULE
• Ensures that electronic information is kept private.
• Four Requirements of Security:
• Ensures confidentiality, integrity, and availability of electronic
PHI.
• Protects against possible threats and hazards to the
information.
• Hackers, viruses, natural disasters or system failures.
• Protects against unauthorized uses or disclosures.
• Ensures compliance by the workforce through
security regulations and policies/procedures.
• Three Components of Security:
• Administrative Safeguards
• Physical Safeguards
• Technical Safeguards
HIPAA: SECURITY RULE
Administrative Safeguards:
• Documentation kept for 6 years.
• Corrective action:
• CHN has a ZERO TOLERANCE POLICY for non-compliance, the noncompliant individual will be immediately dismissed.
• Violations of a severe nature may result in notification to law enforcement
officials as well as regulating, accrediting, and/or licensing organizations.
• Internal system audits minimize security violations.
• Logins, file accesses, and or security incidents.
• Information access management:
• Access to PHI based on what is needed to preform the job.
• Once computer access is requested, it will take 48-72 hours to implement
due to complexity of security system.
• Security awareness and training:
• Security updates, incident reporting, log-in, and password management.
• Security incidents will be reported if suspected or if there is an
actual breach.
HIPAA: SECURITY RULE
Physical Safeguards:
• Safeguard the facility and equipment, from
unauthorized physical access, tampering, and theft.
• Workstations positioned so monitor screens/ keyboards are not
directly visible to unauthorized persons. Use of privacy screens
when applicable. Physical access to the server room limited to
key IT personnel.
• Workstation use and security.
•
•
•
•
•
Log on as themselves. Log off prior to leaving the workstation,
Inspect the last logon information, report any discrepancies.
Comply with all applicable password policies and procedures.
Close files not in use.
Perform memory-clearing functions.
HIPAA: SECURITY RULE
Technical Safeguards:
• Access controls:
• User password setup is for one-time use initially. Allowing
the individual to choose their own unique password for
future access.
• User passwords reset every 180 days.
• Citrix sessions automatically close after 60 minutes of
inactivity.
• Meditech sessions automatically close at different
intervals depending on place within the program.
• Initial log-on screens close within seconds of inactivity.
• Screens further into specific modules, close and back up
to the previous screen, ranging from seconds to minutes
of inactivity.
HIPAA SECURITY OFFICER
Mike Bartman- Primary Security Officer
• Maintains appropriate security measures to guard against
unauthorized access to electronically stored and/or transmitted
patient data and protect against reasonably anticipated threats
and hazards.
• Oversees and/or performs on-going security monitoring of
organization information systems.
• Ensures compliance through adequate training programs and
periodic security audits.
• Ensures security standards comply with statutory and regulatory
requirements.
• Maintains HIPAA security policies and procedures.
**Backup Security Officer: Tom Krystowiak (Compliance Officer)
HIPAA VIOLATIONS
• Significant issues beyond CHN jurisdiction can be
reported to :
• Centers for Medicare & Medicaid Services (CMS)
• Office for Civil Rights (OCR)
• Department of Justice (DOJ)
• HIPAA violations can and do result in civil and criminal
penalties, which could be faced individually :
• May range from a $100 civil penalty up to a maximum of
$25,000 per year for each standard violated.
• May become a criminal penalty for knowingly disclosing
PHI, a penalty that could escalate to a maximum of
$25,000 for visibly malice offenses.
WHO IS RESPONSIBLE FOR HIPAA?
EVERYONE at CHN (including our affiliates) has an
obligation to maintain privacy and security, for example:
• IT Managers/Staff:
• Implement safeguards for the computer systems.
• Medical Professionals:
• Create and access the majority of patient information.
• Managers and Supervisors:
• Develop and implement policies and procedures that relate to
security and ensure their staff are trained properly.
• Clerical Staff:
• Create and access patient information.
• Volunteers:
• Have access to patient information in various setting such as
lobbies and waiting rooms.
TIPS FOR HIPAA COMPLIANCE
•
•
•
•
•
•
•
•
Log on and off the network appropriately.
Never let others use your ID or work under your ID.
Do NOT write your password down.
Do NOT disable anti-virus software or install unapproved
software. Never introduce new hardware or media.
E-mail may be, but is not always, a secure form of data
transmission. Do NOT e-mail PHI unless using encrypted
means.
Use caution in opening e-mail files from unknown sources.
Do NOT access non-permitted information or give nonpermitted information to unauthorized employees.
Be aware of, and report, security threats to the Security
Officer.
FOLLOWING THE PRESENTATION
• Be sure to complete the two required forms as documentation of
completion. Successful completion of this on-line mandatory
training is required to receive your computer access privileges.
CHN HIPAA Security Quiz
•
•
•
•
Click HERE to take the quiz.
Print the form.
Answer the questions (No more than 3 wrong on the quiz).
Fill in the top of the form and sign at the bottom.
Policy – Internet/Intranet Acceptable Use
• Click HERE to read the Policy.
• Read the policy.
• Print page 3 – “Office Technology Use Agreement”
• Fill in the top of the form and sign/date at the bottom.
**Complete both items and return them to the applicable
Department (HR or Education) PRIOR to your first day.**