one photo; Nata-Lia / shutterstock.com
Throughout a patient’s lifetime, providers are entrusted with their most intimate and personal information, which they expect to be kept private and confidential. Unfortunately, the healthcare system can face serious implications if any part of a patient’s privacy or information is breached.
Under the Health Information Portability & Accountability Act (HIPAA) and state laws healthcare providers are required to comply with very specific rules relating to patient rights and release of medical information. Under HIPAA, the Department of Health and Human Services (HHS) created national criteria for all health plans, providers and clearinghouses (also known as covered entities) as they relate to the use and disclosure of personally identifiable information that pertains to a patient’s privacy and personal health information.¹ The Privacy Rule also gives patients rights over their health information and the right to access their own medical records. Giving patients more accessibility allows consumers to have more control over their medical information, including how it is used by and distributed among healthcare providers and organizations.
Patient health information and any identifying information, in any medium or format, whether in files, email, audio, video or verbal communication, is protected under the Privacy Rule. The rule considers any of the following as private health information:
- Name;
- Date of birth or death;
- Treatment dates or any other dates relating to patient’s illness or care;
- Telephone number(s);
- Address;
- Email;
- Social Security number;
- Medical record numbers;
- Photographs;
- License/certification numbers;
- Fingerprints; and
- Any other unique identifying number or account number.
The HIPAA rules apply to all covered entities that electronically transmit any health information, particularly such transactions as billing, reimbursement for services or verification of insurance coverage. Practices should keep in mind that if vendors or outside organizations, known as business associates (BA), have access to protected health information (PHI), it is imperative to have a written BA agreement on file. The agreement must state how the patient health information will be used, disclosed and protected. The HIPAA Security Rule requires covered entities and business associates to implement policies and procedures regarding the disposal and reuse of hardware and electronic media containing PHI in electronic form (ePHI).² Improper disposal of electronic devices and media puts the information stored on such devices as computer equipment, desktops, laptops, tablets, copiers, servers, smartphones, hard drives, USB drives or any electronic storage device at risk for a potential breach.
Compliance is not an option; it is required. Employees are obligated to comply with their practice’s or organization’s privacy and security policies and procedures, because patients place their trust in medical practices to preserve the privacy of their sensitive and personal information. If practices or individuals choose not to follow the rules:
- Individuals could be put at risk for personal penalties and sanctions; and
- The organization is at risk for financial and reputational harm.
In 2003, the Department of Health and Human Services Office of Civil Rights (OCR) began enforcing the Privacy Rule, and there are penalties for non-compliance. Civil penalties are up to $1.5 million per year for identified types of violations, which may include willful neglect violations. Criminal penalties vary:
- $50,000 fine and one year in prison for knowingly obtaining and wrongfully sharing information;
- $100,000 fine and five years in prison for obtaining and disclosing information through false pretenses; or
- $250,000 fine and 10 years in prison for obtaining and disclosing information for commercial advantage, personal gain or malicious harm.
Practices and organizations must implement policies and procedures designed to comply with the Department of Health and Human Services Breach and Privacy Rules. Changes to policies and procedures must be made as necessary and appropriate to comply with changes in the law and maintain consistency between policies, procedures and the Notice of Privacy Practices.
If you are aware or suspicious of an accidental or intentional HIPAA violation, it is your responsibility to report it. Actions, with resolution and corrective actions, must be documented in written or electronic form. Document all changes made to policies and procedures and maintain all policies for six years. It is important for practices and organizations to train employees on changes made to policies and procedures related to HIPAA compliance.
Practices are required to provide training for all current and new employees, along with periodic refresher training. Although no clear definition for periodic is given, it is considered the best practice for all organizations to conduct HIPAA training annually. In the world of HIPAA privacy and security, training and awareness are among the most important aspects of prevention—especially given the possibility of an OCR audit.
For questions, training or additional information on HIPAA security and privacy training, contact the ACR Practice Management Department at practice@rheumatology.org.
References
- The HIPAA Privacy Rule. HHS.gov.
- HIPAA security series. 3 security standards: Physical safeguards. Centers for Medicare & Medicaid Services. 45 C.F.R. §§164.310(d)(2)(i)-(ii). 2005 Feb (revised 2007 Mar).