Transcript SECURITY REGULATION STATUS - NC DHHS Office of Privacy …

HIPAA - PRIVACY RULES
HOW TO OPERATIONALIZE
Presentation for
NCHIMA - BEHAVIORAL HEALTH SECTION
September 27, 2001
Presented By:
9/27/01
Sarah Brooks, MPA, RHIA
NC DHHS - HIPAA PMO
1
PRIVACY REGULATION STATUS
Compliance Date Unchanged
Must Comply by
April 14, 2003
9/27/01
NC DHHS - HIPAA PMO
2
SECURITY REGULATION STATUS
FINAL RULE NOT PUBLISHED
 Speculation About Final Security Rule
– Substantial content changes are not
anticipated
– US DHHS is trying to more closely align
Security Regulations with the final Privacy
Regulations
– Anticipated Date - UNKNOWN
9/27/01
NC DHHS - HIPAA PMO
3
PRIVACY AND SECURITY
OFFICERS



Required Under HIPAA
Should Report to Upper Level Management
Agencies Must Determine if Full-time
Positions Are Needed, Joint Positions or
Assign Responsibilities to Current Staff
9/27/01
NC DHHS - HIPAA PMO
4
PRIVACY AND SECURITY
OFFICERS (continued)

Begin Process for Establishing These
Positions NOW to:
– Provide leadership in the planning, design
and evaluation of Privacy and Security
related projects
– Establish sense of ownership and
responsibility as result of early involvement
9/27/01
NC DHHS - HIPAA PMO
5
PRIVACY OFFICER ROLES






Leadership Role for Implementing Privacy
Regulations
Collaborative Role for Security Implementation
Education Role for Privacy Awareness and
Training
Liaison with Agency and Legal Authorities
Consultant Role to Business Associates
Compliance Role for State/Federal Requirements
9/27/01
NC DHHS - HIPAA PMO
6
PRIVACY OFFICER
RESPONSIBILITIES

Develop Privacy Program to:
– Analyze current Privacy practices
– Establish and implement Privacy policies and
procedures
– Address training requirements
– Implement monitoring system for agency
compliance and Business Associates accountability
– Handle complaints
– Establish Internal Privacy Audit Program
– Provide Maintenance of Privacy Program
9/27/01
NC DHHS - HIPAA PMO
7
SECURITY OFFICER ROLES
AND RESPONSIBILITIES






Responsible for Initial and Ongoing Security
Awareness Training
Develop and Implement Security Policies/Procedures
Focal Point for Security Incidents
Responsible for Ensuring Disaster Recovery Plans Are
Adequate
Ensure Physical Security of Buildings
Ensure Final Disposition of Electronic Data Is
Properly Handled
9/27/01
NC DHHS - HIPAA PMO
8
JOB DESCRIPTIONS
NC DHHS PMO Is Developing Drafts of
Privacy & Security Officer Job Descriptions Availability Unknown
 Refer to Following Web Site URL for
NC Healthcare Information and
Communications Alliance, Inc. (NCHICA):

http://www.nchica.org/HIPAA/HIPAAjobs.html
9/27/01
NC DHHS - HIPAA PMO
9
PMO DELIVERABLES
 EDI Assessment Tools
http://dirm.state.nc.us/hipaa/newsite/focusgroup/edi/edi.html

Information Flow Assessment Questionnaire (IFA),
IFA User Guide and Facilitator Training
http://dirm.state.nc.us/hipaa/newsite/focusgroup/operation/
IFA.html



Attorney General Opinions
Frequently Asked Questions on NC DHHS Web Site
HIPAA Awareness Presentations
9/27/01
NC DHHS - HIPAA PMO
10
PMO DELIVERABLES
(continued)



Core Privacy Training (under development)
Privacy Toolkit (under development) Assessment and Gap Analysis Tool
Security Assessment (under development)
9/27/01
NC DHHS - HIPAA PMO
11
NCHICA DELIVERABLES

NCHICA Web Site contains:
http://www.nchica.org/HIPAA/HIPAA_intro.html
– Presentations
– HIPAA EarlyView™ tool (Security available; Privacy
under development)

The Following Deliverables Are Under Development:
– Security Policy and Procedures Matrix
– Security Training Modules - Core Level in test
– Privacy Models (Notice, Consent, Authorization,
Business Associate Agreement)
9/27/01
NC DHHS - HIPAA PMO
12
NCHICA DELIVERABLES
(continued)
– Minimum Necessary Decision Tree
– Review of NC Statutes
– HIPAA Privacy Checklists

Relationship Between NCHICA and NC DHHS
Deliverables
– DHHS Staff are working with NCHICA Focus Groups
– DHHS PMO and Divisions will review and revise various
deliverables to better meet DHHS needs
– AG Office review when necessary
9/27/01
NC DHHS - HIPAA PMO
13
WHAT TO DO NOW?

Determine if Your Agency is a Covered Entity,
Hybrid Entity, Business Associate and/or
Trading Partner by Using These Resources:
– Information Flow Assessment Questionnaire
– EDI Assessment
– Consultation with Agency Attorney
9/27/01
NC DHHS - HIPAA PMO
14
COVERED ENTITY

Health Plan (provides or pays the cost of medical
care - e.g., Medicaid, HMOs, BC/BS, Medicare, Champus).

Health Care Clearinghouse

Health Care Provider Who Transmits Any
Health Information in an Electronic
Transaction (e.g., Hospitals, Physicians, Public Health
(routes electronic
data between payers & providers - e.g., billing services).
Departments, Group Homes, Home Health).
9/27/01
NC DHHS - HIPAA PMO
15
HYBRID ENTITY



Applies to Privacy Regulations only as they relate
to Uses and Disclosures (164.504)
Defined as, “a single legal entity that is a
covered entity and whose covered functions are
not its primary functions.”
Need to identify those health care components
within the Hybrid Entity that perform covered
functions and other components that would
normally be a Business Associate
9/27/01
NC DHHS - HIPAA PMO
16
BUSINESS ASSOCIATES



Definition: Person who performs a function or
activity on behalf of a Covered Entity, involving
the use and/or disclosure of PHI.
Excludes person who is part of the Covered
Entity’s workforce (e.g., Employees,
Physicians with Staff Privileges)
Excludes Covered Entities who disclose PHI
to providers for treatment purposes
9/27/01
NC DHHS - HIPAA PMO
17
BUSINESS ASSOCIATES
(continued)


Must protect PHI and help a Covered
Entity comply with its obligations under
the Privacy Rule
DO NOT have to comply with HIPAA
Privacy Rules such as:
– Appointment of a Privacy Officer
– Develop Policies and Procedures for use and
disclosure of PHI
9/27/01
NC DHHS - HIPAA PMO
18
BUSINESS ASSOCIATES
(continued)

Are Covered Entities Held Liable for
Privacy Violations of Business Associates?
– Covered Entities are not required to actively
monitor Business Associates
– Contracts must obligate Business Associate to
advise Covered Entity when violations have
occurred
– If a Covered Entity is aware of violations or
breach of Business Associate obligations,
Covered Entity must take ‘reasonable steps’ to
cure the breach or end the violation
9/27/01
NC DHHS - HIPAA PMO
19
WHAT TO DO NOW?

Thorough Review of Privacy Regulations
–
–
–
–

Establish internal workgroup
Involve Legal Counsel
Complete Privacy Assessment/Gap Analysis
Slow Process
Don’t Make Hasty/Costly Decisions
– Reasonableness
– Scalability
9/27/01
NC DHHS - HIPAA PMO
20
WHAT TO DO NOW?

Continuous Education and Review of HIPAA
Information
– Review potential changes to Privacy Regulations




Phone-in Prescriptions filled before getting consent
Referral Appointments for 1st time patients before getting
patient’s consent
Broaden Allowable Communications for quick and effective
health care
Change Minimum Necessary Scope
– Monitor HIPAA Web Sites

9/27/01
http://dirm.state.nc.us/hipaa/newsite/resource.html
NC DHHS - HIPAA PMO
21
WHAT TO DO NOW? (continued)
Complete Information Flow Assessment and
EDI Assessment
 Inventory EDI, Security, Privacy Policies and
Procedures

– Readily available when assessments are done
– Identify policies and procedures that may need
to be remediated
9/27/01
NC DHHS - HIPAA PMO
22
WHAT TO DO NOW?
(continued)

Review Privacy Guidance Documents from
HHS
– http://aspe.os.dhhs.gov/admnsimp/final/
pvcguide1.htm
– First in a series issued July 6, 2001
– Explains and clarifies important provisions of
the privacy regulations relative to the
following areas:
9/27/01
NC DHHS - HIPAA PMO
23
PRIVACY GUIDANCE
DOCUMENT

Consent
– Consent is required before using or disclosing PHI for
Treatment, Payment, or health care Operations (TPO)
– Consent grants general permission to use or disclose
PHI for TPO
– Authorization is limited to purposes and parties
specified in the authorization
– Health care provider needs to obtain consent only
once - rather than annually - and it can cover multiple
visits and different medical conditions
9/27/01
NC DHHS - HIPAA PMO
24
PRIVACY GUIDANCE
DOCUMENT (continued)

Minimum Necessary
– Agencies need to take reasonable steps to comply with
the minimum necessary standard
– Each agency will need to identify and classify who within
the agency needs access to PHI and establish
policies/procedures for the use and disclosure of PHI
– Does not apply when PHI is:






9/27/01
Disclosed to provider for treatment
Disclosed directly to patient at their request
Used or disclosed with patient authorization
Used or disclosed to comply with EDI transaction standards
Disclosed to HHS for enforcement purposes
Used or disclosed when required by other laws
NC DHHS - HIPAA PMO
25
PRIVACY GUIDANCE
DOCUMENT (continued)

Oral Communications
– Final Privacy regulations cover paper,
electronic and oral communications of PHI
– Health care providers must be free to discuss
PHI with each other in treatment settings
– Calling out patient names in waiting rooms
is permitted

9/27/01
Some agencies are changing current practices
however (e.g., separate sign in sheets rather than
log; page patients by number rather than name)
NC DHHS - HIPAA PMO
26
PRIVACY GUIDANCE
DOCUMENT (continued)

Business Associate Contracts
– Health care organizations:





9/27/01
are not automatically legally responsible for Business
Associate Privacy violations
are not required to actively monitor the conduct and
practices of Business Associates
must include provisions in their Business Associate
Contracts requiring the Business Associate to notify
them of any Privacy violations
must take reasonable steps to stop or fix any known
Privacy violation or breach by their Business Associates
are out of compliance only if they fail to take such steps
NC DHHS - HIPAA PMO
27
PRIVACY GUIDANCE
DOCUMENT (continued)

Parents and Minors
– Agency may not be required to disclose a child’s PHI to
the parent when:



Parent agrees to confidential relationship between
child & health care provider of the child
Provider believes child has been abused or
neglected by parent
Disclosing information to parent could endanger the child
– State law controls disclosure or non-disclosure of
minor’s PHI to a parent (e.g., state law may allow
minors to consent to mental health treatment without
parental consent)
9/27/01
NC DHHS - HIPAA PMO
28
PRIVACY GUIDANCE
DOCUMENT (continued)

Health-Related Communications and Marketing
– Generally, authorization is required when using or
disclosing PHI for marketing purposes
– Examples that are not considered marketing:






9/27/01
Describing the participating plans or providers in its
network
Identifying a pharmacy that accepts a particular drug
coverage
Describing services offered by a provider
Recommending brand name or over the counter drug
Making referrals
Sending appointment reminders
NC DHHS - HIPAA PMO
29
PRIVACY GUIDANCE
DOCUMENT (continued)

Medical Research
– Allow use or disclosure of PHI for medical research
purposes without authorization under certain
circumstances:


PHI has been de-identified
Institutional Review Board or Privacy Board grants
a waiver of such authorization
– PHI may continue to be used or disclosed under
certain circumstances for an ongoing research
project as long as the patient gave legal permission
(such as consent or authorization) prior to the
compliance date
9/27/01
NC DHHS - HIPAA PMO
30
PRIVACY GUIDANCE
DOCUMENT (continued)

Government Access to PHI
– Government operated health plans and providers, such
as Medicare and Medicaid, are subject to the same HIPAA
requirements as all other health care organizations
– Office of Civil Rights is granted access to PHI, but only for
investigative or enforcement purposes, and the
information OCR requests will be limited and protected
– Regulations allow certain disclosures to be made for law
enforcement purposes but any state law that has tighter
limits on such uses and disclosures of PHI will control
9/27/01
NC DHHS - HIPAA PMO
31
PRIVACY GUIDANCE
DOCUMENT (continued)

Payment
– Explains conditions under which PHI may be used or
disclosed for payment purposes



Billing and Collection
Determining health plan eligibility
Disclosures to consumer reporting agencies
– Limited disclosure of PHI to consumer reporting and debt
collection agencies
– Appears to be no conflict between privacy regulations and
the Fair Credit Reporting or Fair Debt Reporting Acts
– Clarifies that a collections agency hired by a health care
organization would be a Business Associate
9/27/01
NC DHHS - HIPAA PMO
32
WHAT TO DO NOW?

Begin development of HIPAA Workplan
9/27/01
NC DHHS - HIPAA PMO
33
HIPAA COMPLIANCE PROCESS
Understanding
HIPPA
• What is HIPPA
• Why do HIPPA
• What are the HIPPA
requirements?
Baselining
the Organization
Planning
Compliance
Strategies
• Where do we stand vs..
these requirements?
(i.e., what needs fixing?)
• How do we close the
gaps?
Key considerations
Key considerations
• Who needs what
information?
• Who’s covered?
• Develop SME’s on
HIPAA
• Compliance plans
needed
• Who is doing what?
Process and Tools
• Which policies?
• Which procedures?
• Which tools and
systems?
Process and Tools
 Master Plan
 Awareness training
 Roles & Responsibilities
 Participation in
external organizations
 BIFA
 Strategic Plan
 EDI/TCI assessments
 Security/Privacy
assessments
Validating
Compliance
• How do we know
we’re compliant?
Maintaining
Compliance
• How do we stay
compliant?
Key considerations
Key considerations
• Enterprise vs.. local fixes
• Risk and cost/benefit
analysis
• $how me the money
Key considerations
Key considerations
• Ongoing training
• Enterprise strategies
• Self-certification
techniques
• Educating future new
DHHS employees
• Certification of EDI
transactions
• Will need ongoing
auditing & certification
practices
• Thorough testing
• Mandated deadlines
• Security
certifications
Process and Tools
Process and Tools
• Change
Management
Process and Tools
 Enterprise & Individual
Compliance Strategies
 Testing Strategies
 Security/privacy
maintenance plans
 Technical infrastructure
 Privacy related
business templates
 Self-certification
Techniques
 3rd party
certifications
 Enterprise Training
Plans
Process and Tools
 Change management
process & procedures
 Roles & responsibilities
 Scope matrix
 Detailed Work-plans
9/27/01
• Let’s go fixing
• Which people?
 HIPAA Web Site
 Expansion Budget
Remediating
the Organization
 Enterprise privacy &
security policies/proc
 quality assurance
reviews
 Privacy & security
related policy/proc
templates
NC DHHS - HIPAA PMO
 Templates
34
UNDERSTANDING HIPAA
• What is HIPPA
• Why do HIPPA
• What are the HIPPA Requirements?

Key Considerations

Process and Tools
– Who needs what
information?
 HIPAA Web Site
– Develop SME’s on HIPAA
 Awareness training
– Compliance plans needed
 Participation in external
organizations
– Who is doing what?
 Expansion Budget
 Strategic Plan
9/27/01
NC DHHS - HIPAA PMO
35
BASELINING THE
ORGANIZATION
Where Do We Stand vs.. These Requirements
(i.e., What Needs Fixing)?

Key Considerations

Process and Tools
– Who’s covered?
 Master Plan
– Which policies?
 Roles & Responsibilities
– Which procedures?
 BIFA
– Which tools and systems?
 EDI/TCI assessments
– Which people?
 Security/Privacy assessments
9/27/01
NC DHHS - HIPAA PMO
36
PLANNING COMPLIANCE
STRATEGIES
How Do We Close the Gaps?

Key Considerations

– Enterprise vs. Local Fixes
– Risk and Cost/Benefit
Analysis
– $how Me the Money
Process and Tools
 Enterprise & Individual
Compliance Strategies
 Technical Infrastructure
 Change Management Process
& Procedures
 Roles & Responsibilities
 Scope Matrix
 Detailed Workplans
9/27/01
NC DHHS - HIPAA PMO
37
REMEDIATING THE
ORGANIZATION
Let’s Go Fixing

Key Considerations

Process and Tools
– Enterprise Strategies
 Testing Strategies
– Thorough Testing
 Privacy Related Business
Templates
– Mandated Deadlines
 Enterprise Privacy &
Security Policies/Procedures
 Privacy &Security Related
Policy/Procedure Templates
9/27/01
NC DHHS - HIPAA PMO
38
VALIDATING COMPLIANCE
How Do We Know We’re Complaint?


Key Considerations
Process and Tools
– Self-Certification Techniques
 Self-Certification Techniques
– Certification of EDI
Transactions
 3rd Party Certifications
 Quality Assurance Reviews
– Security Certification
9/27/01
NC DHHS - HIPAA PMO
39
MAINTAINING COMPLIANCE
How Do We Stay Complaint?

Key Considerations

– Ongoing Training
– Educating Future New
DHHS Employees
– Will Need Ongoing
Auditing & Certification
Practices
Process and Tools
 Security/Privacy
Maintenance Plans
 Enterprise Training plans
 Templates
– Change Management
9/27/01
NC DHHS - HIPAA PMO
40
HIPAA WORKPLAN

Phase
– Based on Compliance Model

Activity
– High level activity to be planned

Task
– Primary tasks to be accomplished
– Subtasks associated with primary tasks


Anticipated and Actual Start/Finish
Resources
9/27/01
NC DHHS - HIPAA PMO
41
QUESTIONS ?
?
9/27/01
NC DHHS - HIPAA PMO
42