# Presentation: 370589

## OVERVIEW  FEDERAL PRIVACY ACT AND HIPAA PRIVACY RULE

_**PRESENTATION TO THE ANNUAL I/T/U HIM/BO PARTNERSHIP CONFERENCE **_
**APRIL 17-19, 2007**
**JOHN ASCUAGA’S NUGGET HOTEL**
**RENO, NEVADA**

## PRIVACY ACT AND HIPAA PRIVACY RULE

-   **Bill Tibbitts**
**IHS Privacy Act Officer**
**Address:****    ****Suite 450  (OMS/DRA)**
**	****        ****12300 Twinbrook Parkway**
**	****        ****Rockville, MD  20852**
**Telephone:   301-443-1116**
**Email:**           _[william.tibbitts@ihs.gov](mailto:william.tibbitts@ihs.gov)_

## Privacy Act of 1974(5 U.S.C. §552a)

- Limits collection of personal information
- No *secret* Government record systems
- No *secret* use of Government records
- Right to see and correct one’s own records
*Safeguards* for the security and accuracy
- Civil and Criminal remedies

**Notes:**
BULLET #1 – MANDATES THAT WE (FEDERAL AGENCY) LIMITES THE COLLECITON OF PERSONAL INFORMATION BUT ALSO ENSURES THAT INFORMATION WE COLLECT IS ACCURATE, RELEVANT, TIMELY, AND COMPLETE.
 BULLET #2 – FEDERAL AGENCIES CANNOT HAVE OR MAINTAIN A SECRET GOVERNMENT RECORD SYSTEM ON INDIVIDUALS WITHOUT BEING IN VIOLATION OF THE PRIVACY ACT.  THE PRIVACT ACT REQUIRES THAT AGENCIES MUST IDENTIFY AND ADVISE THE INDIVIDUALS OF THESE RECORD SYSTEMS (THIS, OF COURSE, IS DONE BY LISTING THEM IN THE FEDERAL REGISTER)
AND OF COURSE, FEDERAL AGENCIES SHOULD NOT BE USING A “SECRET” RECORD SYSTEM FOR WHATEVER PURPOSES – ANOTHER VIOLATION OF THE PRIVACY ACT.
BULLET #4 – GIVES AN INDIVIDUAL THEIR PRIVACY RIGHTS TO SEE AND CORRECT
BULLET #5 – PRIVACY ACT REQUIRES ALL FEDERAL AGENCIES TO ESTABLISH SAFEGUARDS ... OF THESE RECORD SYSTEMS.
BULLET #6 – OF COURSE, THE PRIVACY ACT ESTABLISHES CIVIL AND CRIMINAL REMEDIES.

## Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 CFR §§160 & 164)

- Official Name: “Standards for Privacy of Individually Identifiable Health Information”.
_**Provides**_ National standards for protecting PHI.
_**Regulates**_ how covered entities “use and disclose certain PHI.
_**Gives**_ patients more protection & control over their PHI.
_**Sets**_ boundaries on the use and release of health records.
_**Establishes**_ appropriate safeguards protecting the privacy of PHI.

**Notes:**
OF COURSE, HIPAA PRIVACY RULE SETS UP STANDARDS, USES AND/OR DISCLOSURES AND ADMINISTRATIVE REQUIREMENTS FOR THE INDIVIDUAL’S PHI (PROTECTED HEALTH INFORMATION).

## When is it a PA Records System?

- Group of records (more than one)
- Contains information about an individual
- Designed to be retrieved by name or other Personal Identifier

- Text

- Text

- Text

- Text

- Text

- Text

- Text

- Text

- Text

**Notes:**
NOTE JUST PERSONAL IDENTIFIERS OF AN INDIVIDUAL (I.E., SSN, HOME/EMAIL ADDRESS, HOME PHONE, ETC.) BUT, WE KNOW THAT MEDICAL INFORMATION AND/OR BILLING INFORMATION IS MAINTAINED IN THE FILE.

## Privacy Act Record

- “any item, collection, or group of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as finger or voice print or a photograph.”
- 	5 USC § 552a(a)(4)

## HIPAA Privacy Rule “Designated Record Set”

- A _group of records_ maintained by or for a covered entity that is:
- 	(i) the _medical_ records and _billing_ records about
- 	individuals maintained by or for a covered health care provider;
- 	(ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or
- 	(iii) used, in whole or in part, by or for the covered entity to make decisions about individuals.

## HIPAA Privacy Rule “Record” -Continuation

- The term “record” means any item, collection, or grouping of information that includes PHI and is maintained, collected, use, or disseminated by or for a covered entity.  45 CFR §164.501 – Definitions
- “HMMM – sounds like a Privacy Act Record to me.”

**Notes:**
LIKE THE SAYING SAYS “HMMM- SOUNDS LIKE A PRIVACY ACT RECORDS TO ME.”  OR LETS SAY IT SMELLS LIKE; LOOKS LIKE AND TASTE LIKE FRYBREAD, THEN IT MUST BE FRYBREAD. (AYE)

## Privacy Act covers:

**U.S. citizens**
**Aliens lawfully admitted for permanent residence**

- _Privacy Act does NOT cover:_

** ****Non-resident** aliens
** ****Deceased ***
** ****Organizations**
** ****Tribal Governments (PL93-638 excludes the   **
**    ****5 U.S.C. requirements (PA, FOIA, etc.)**

**Notes:**
 *EXCEPTIONS ON DECEASED: SUPREME COURT 2003 (VINCENT FOSTER) RULING STATES THAT PRIVACY CAN BE CONSIDERED FOR THE IMMEDIATE FAMILY OF AN DECEASED INDIVIDUAL IF DISCLOSURE OF MEDICAL INFORMATION (AUTOPSY PHOTOS) COULD CAUSE A CLEAR UNWARRANTED INVASION OF PERSONAL PRIVACY AND EMOTIONAL HARM FOR THE FAMILY; ALSO UNDER THE HIPAA PRIVACY RULE 164.502(F)&(G)(4) PERSONAL REPRESENTATIVES IS A CONSIDERATION.
BUT THE PRIVACY ACT NOR THE HIPAA PRIVACY RULE WOULD PROHIBIT THE RELEASE, FOIA EXEMPTION 6 MAY PROHIBIT THE DISCLOSURE OR RELEASE

## Limit Collection of Information

- Necessary to carry out an Agency function
- SSN – only when legally authorized otherwise ***voluntary***
- Inform individual of purpose and use of records collected:   Privacy Act System of Record Notice Statement

**Notes:**
PRIVACY ACT MANDATES THAT WE (FEDERAL AGENCY) TO INFORM PEOPLE AT THE TIME OF COLLECTION (THIS IS DONE BY PUBLISHING A FEDERAL REGISTER NOTICE ON WHY THE INFORMATION IS BEING COLLECTED AND HOW IT WILL BE USED.
AND NOT TO REPEAT MYSELF AGAIN BUT TO ENSURE THAT THE INFORMATION BEING COLLECTION IS ACCURATE, RELEVANT, TIMELY, AND COMPLETE.

## Social Security Numbers (SSN)

- Before collection, must state whether: (1) disclosure is mandatory or voluntary, (2) by what statutory or other authority such number is solicited, and (3) what uses will be made of it.  If no statutory or law, then SSN is voluntary by the individual.
- May _**not**_ deny any right, benefit, or privilege provided by law due to refusal to provide SSN unless the SSN is required by federal statute.
- SSN is ***voluntary**** *for Medical Records.  SSN are required only for hiring, payroll, financial etc.

**Notes:**
THIS IS SELF-EXPLANATORY – IF NOT AUTHORITY TO COLLECT – DO NOT COLLECT.

## No Secret Government Records

- Publish a Privacy Act System Notice in the Federal Register _before_ collecting data.
- System Notice:  brief description of the type of record system and how the Government intends to manage and protect the system.
- IHS has three (3) SOR Notices
-    (1) Medical, Health and Billing Records,
-    (2) Scholarship and Loan Repayment Program and
-    (3) Medical Staff Credentials & Privileges Record

**Notes:**
ALL THREE (3) IHS SOR ARE CURRENT AS OF 2006 AND 2007.

## PA

- Of
- 1974
- (5 USC 552a)

- Computer
- Matching and
- Privacy Protection
- Act of 1988

- Government Wide
- PA SOR Notices
- (currently 21)

- HHS
- PA Regulation
- (45 CFR 5b)

- US Citizen

- Federal Agencies and
- its Contractors

- IHS PA
- System of Records
- 09-17-0001

- IHS PA
- System of Records
- 09-17-0002

- IHS PA
- System of Records
- 09-17-0003

- (Medical, Health and Billing
-  Record)

- (Scholarship and Loan
- Repayment Program)

- (Medical Staff Credentials
- and Privileges Record)

- Specifically defined
- for HHS Agencies and
- its Contractors

- HIPAA Privacy /
-  Security Standards
- 45 CFR 160 & 164

**Notes:**
OK THIS IS HOW THE PRIVACY ACT AND HIPAA PRIVACY AFFECT OUR SOR NOTICES.  OF COURSE, SOMEONE SAID THOSE EYES LOOK LIKE A MALE SO..........

## IHS PA

- System of Records
- 09-17-0001

- System of Records
- 09-17-0002

- System of Records
- 09-17-0003

- HHS
- PA Regulation
- (45 CFR 5b)

- Government wide
- PA SOR Notices
- (currently 21)

- Computer
- Matching and
- Privacy Protection
- Act of 1988

- PA
- Of
- 1974
- (5USC 552a)

-  US Citizen

- Federal Agencies and
- Its Contractors

- Specifically defined
- for HHS Agencies and
- its Contractors

- (Medical, Health and Billing Record)

- (Scholarship and Loan
- Repayment Program)

- (Medical Staff Credentials
- and Privileges Record)

- HIPAA Privacy/
- Security Standards
- (45 CFR 160 & 164)

**Notes:**
HERE IS THE FEMALE VERSION, NO CHANGE TO THE CHART – JUST A WINK OF TWO.

## Parts of a System Notice

**Number**
**Name**
**Security classification**
**Location**
**Who it covers**
**Types of Records**
**Authority for Collection**
**Purpose of System**
**Routine Uses: 3****rd**** Party Disclosures**
**Storage**

**How information is retrieved**
**Safeguards:  Authorized users, physical and procedural safeguards**
**Retention and Disposal**
**System Manager(s) address**
**Notification procedure**
**Record access procedure**
**Authority for Collection**
**Contesting record procedure**
**Record source categories**
**Exemptions**

## No Secret Use of PA Records

- _System Managers or designees __**MAY**__ disclose records_:
***with*** consent of individual
*	*(Get in writing, as narrow as appropriate)
***without***** **consent of individual
*	*** *12 provisions(disclosures) from the Privacy Act
-     * Routine Uses for the IHS three (3) SORs (same
-        applies for recording of information)
- (Disclosures #3-#12 of PA and RU#1-24 of IHS
- Medical, Health & Billing Records, you _**must**_ keep an
- accounting, includes: Name and address of person/
- agency to whom disclosure is made, date, nature and
- purpose)

**Notes:**
(DISCLOSURES #3-#12 OF PA AND RU#1-23 OF IHS MEDICAL, HEALTH AND BILLING RECORDS, YOU MUST KEEP AN ACCOUNTING AS REQUIRED BY THE PRIVACY ACT FOR IHS (ALSO RE-ENFORCED BY THE HIPAA PRIVACY RULE 164.528), THIS INCLUDES: NAME AND ADDRESS OF PERSON/ AGENCY TO WHOM DISCLOSURE IS MADE, DATE, NATURE AND PURPOSE OR USE – (UTILIZE THE IHS ROI SOFTWARE PACKAGE OR FOR THOSE WHO WANT TO USE THE IHS 505 FORM)

## 12 Provisions of Disclosure

**Employees with legitimate “Need to Know”**
**Required under FOIA**
**Routine Use (not mandatory)**
**Bureau of Census**
**Statistical Use (Can’t Identify Individual)**
**National Archives**
**Civil or criminal law enforcement**

**Compelling circumstances affecting health or safety of individual (must be justified)**
**House of Congress (oversight capacity)**
**Comptroller General (GAO activities)**
**Court Order from a Court of Competent Jurisdiction  (Subpoenas signed by a **_**judge**_**)****
**Consumer Reporting Agency**
**** HHS OGC decision that only “federal courts” and not tribal courts are a Court of Competent Jurisdiction for **_**Privacy Act Purposes**_**.**

## ACCOUNTING OF DISCLOSURES

**When the 3****rd**** Party Requestor cites the Privacy Act (we) **_**must**_** keep a record of:**
**	***** date, nature, and purpose of each**
**	****   ****disclosure,**
**	***** name and address of the person or agency**
**	****   ****to whom the disclosure is made.**
- (HIPAA Privacy Rule sets the same reqts. –
- 	45 CFR 164.528)

**Notes:**
FOR IHS PURPOSES, WE MUST COMPLY WITH THE PA REQUIREMENT FOR THE ACCOUNTING OF DISCLOSURE PROVISIONS; RE-ENFORCED BY THE HIPAA PRIVACY RULE 164.528.  IHS MAY USE THE MANUAL PROCESS OR THE IHS ROI SOFTWARE PACKAGE.    ANOTHER REASON WHY IS THAT THE # OF FIRST PARTY AND THIRD PARTY REQUESTORS ARE REPORTABLE TO THE IHS FOIA OFFICE ANNUALLY.

## Right to See and Correct Data

**An individual has some degree of control over information government collects on them:**
**	***** **_**Right to Access**_** (except for the ten exemptions)**
**	****   ****-System Manager must reasonably satisfy**
**	****    ****themselves of an individual’s identity**
**	***** **_**Right to Correct/Amend**_
**	****   ****-May change only factual information and**
**	****    ****cannot change matters of opinion**
**	***** **_**Right to Appeal**_** denial of amendment**
**   ****(Keep appeals at the lowest level: CEO>>AD)**
**(HIPAA Privacy Rule sets the same reqts. - as defined in**
**45 CFR 164.522; 164.534; and 164.526)**

**Notes:**
FOR MEDICAL RECORDS/PHI PURPOSES, THIS IS RE-ENFORCED BY THE HIPAA PRIVACY RULE 164.522 (RIGHTS TO REQUEST PHI) AND 164.524 (ACCESS OF INDIVIDUALS PHI).
THE TEN EXEMPTIONS WHICH DO NOT APPLY TO IHS BUT FOR THIS EXERCISE PURPOSES THEY ARE AS FOLLOW:

## Safeguards

- Must collect information from individual, to greatest extent possible that is consistent with the Purpose.
- Establish appropriate administrative, technical and physical safeguards to insure security (physical, IT and confidentiality)
- Do risk analysis every 3 years or less
- (HIPAA Privacy Rule sets the same reqts. as defined in 164.530(c)(1)

**Notes:**
FOR MEDICAL RECORDS/PHI, IHS MUST COMPLY WITH THE PRIVACY ACT SAFEGUARDS AS WELL AS THE HIPAA PRIVACY AND SECURITY STANDARDS.

## Relationship to FOIA

**FOIA: **_**3**__**rd**__** party requests**_**  (annual reporting)**
**Privacy Act: **_**1**__**st**__** party requests**_** (annual reporting to FOIA)**
**FOIA: 9 Exemptions or Full/Partial Release vs. Privacy Act: 12 Exceptions or written consent of the individual**
**FOIA Exemption 6 (Personal Privacy)**
**	*****Parts of files may be withheld if disclosure “would constitute a clearly unwarranted invasion of personal privacy”**
**	*****Must consider personal privacy interest of individual (or even the immediate family) balanced against the public interest (Supreme Court Decision: NARA v. Favish)**

**Notes:**
INVOKING EXEMPTIONS
INVOKING A FOIA EXEMPTION: THE DECISION TO WITHHOLD A DOCUMENT FROM A FOIA REQUESTER IS NOT MADE UNTIL AFTER RECEIPT OF THE REQUEST AND AFTER THE SEARCH HAS BEEN COMPLETED.  AT THAT POINT, SOME MUST REVIEW THE STACK OF REQUESTED DOCUMENTS TO DETERMINE IF ANY OF THE 9 FOIA EXEMPTIONS APPLY. IF SO, THE EXEMPT MATERIAL IS DELETED FROM THE REQUESTERS’ COPY.  OTHERWISE, A FULL RELEASE IS MADE IF NO EXEMPTIONS IS FOUND.

INVOKING A PRIVACY ACT EXEMPTION.  THE DECISION TO WITHHOLD A DOCUMENT FROM A PRIVACY ACT REQUESTER IS MADE LONG BEFORE A REQUEST IS EVER RECEIVED.  IT IS MADE AT THE TIME THE SYSTEM OR RECORDS NOTICE AND EXEMPTION RULE ARE BEING DEVELOPED.  THE “EXEMPTIONS” PARAGRAPH OF THE NOTICE STATES WHICH PRIVACY ACT EXEMPTIONS THE AGENCY INTENDS TO INVOKE WHEN A REQUEST IS RECEIVED.  IF NO EXEMPTIONS HAVE BEEN CLAIMED FOR THE SYTEM, A FULL RELEASE MUST GENERALLY BE MADE.

## Supervisor’s Notes

- They are _NOT_ agency records when:
- 	*Personal property of supervisor only
- 	*Never shared with others (i.e., not circulated)
- 	*Never passed to replacement supervisor
- 	*memory joggers only
- 	*no official use (i.e. not required by agency)
- Considered part of employee’s personnel record (agency record) when:
- 	*Used as basis for employment action
- 	*Otherwise treated as official Agency records

**Notes:**
CONCERNING WHEN SUPERVISOR NOTES BECOME A PRIVACY ACT RECORD OR SUBJECT TO FOIA
REFERENCING THE SECOND BULLETS – IF THE NOTES BECOME PART OF THE EMPLOYEE’S RECORD, THE PRIVACY ACT ALLOWS THE RELEASE TO THE INDIVIDUAL OF THE RECORD.   IF THE NOTES BECOME A AGENCY RECORD AND CANNOT BE RETRIEVED BY AN IDENTIFER THE RECORD IS SUBJECT TO FOIA.

## IHS KEY PLAYERS

**Notes:**
LIST OF CURRENT AREA PRIVACY ACT ADVOCATES IN YOUR PACKET.

## Area Privacy Act Advocates (PAA)

- Coordinates with the IHS PA Officer
- Advises Area/SU on PA & HIPAA Privacy issues and policy
- Supports and provides Area/SU level training
- Investigate and resolve local PA & HIPAA Privacy complaints at the lowest level (SU>AD)

## System Manager Responsibilities

- Tracks location of covered records
- Staff Training: inform users of requirements
- Security: enforce safeguards
- Approval/Denial of access
- Track access and amendments to records
- Ensure records are complete/accurate/timely/relevant
- Monitor contractor compliance
- Follow IHS Records Schedule
- Ensure Notification Statement is on data collection forms
- Report Requirements: annual updates/reports

## Computer Data: When it is a Record?

- If a computer system is set up to be used, or is used in practice, to retrieve information by individual identifiers (name, SSN, assigned tracking number) and the system contains personal information, the computer data is covered as a Privacy Act system of records.
- (Example(s):  Resource and Patient Management System (RPMS) and Electronic Health Record)

**Notes:**
CAN SOMEONE IN THE AUDIENCE GIVE US AN EXAMPLE WHAT COMPUTER SYSTEM MAY APPLY?  CLICK

## Civil Remedies (PA vs. HIPAA)

_**WHAT VIOLATIONS LEAD TO CIVIL**_
_**PENALTIES**_
- Unlawful refusing to amend a record or grant access
- Failure to maintain accurate, relevant, timely and complete data
- Failure to comply with any Privacy Act/ HIPAA Privacy Rule provision or agency rule that results in any adverse effect.

**Notes:**
AN INDIVIDUAL MAY BRING CIVIL ACTION AGAINST AN AGENCY IN DISTRICT COURT OF THE US FOR VIOLATIONS OF THE PRIVACY ACT.  IF THE COURT DETERMINES THAT THE AGENCY ACTED IN A MANNER THAT WAS INTENTIONAL OR WILLFUL, THE AGENCY CAN BE HELD LIABLE IN AN AMOUNT EQUAL TO THE SUM OF ACTUAL DAMAGES SUSTAINED BY THE INDIVIDUAL AND THE COSTS OF THE SUIT TOGETHER WITH REASONABLE ATTORNEY FEES>>>>>>>>OF COURSE, THE BOTTOM LINE FOR THE AGENCY IS TO REMOVE THE EMPLOYEE OR EMPLOYEES FROM EMPLOYMENT IS THE VIOLATION OCCURRED.   ZERO TOLERANCE WHEN IT COMES TO OUR MEDICAL, HEALTH AND BILLING RECORDS – IF YOU HAVE VIOLATED THE PRIVACY ACT AND HIPAA PRIVACY RULE, ADVERSE ACTION WILL BE TAKEN AND IN MOST CASES, REMOVAL FROM THE JOB.

## Civil Remedies (PA vs. HIPAA) - Continuation

_**Penalties:**_
- Actual Damages
- Attorney Fees
- Removal from Employment
- Under HIPAA (PL 104-191, Title II, Part C Administrative Simplification, Sec. 1176), it states any person who violates a provision of this part _**shall impose a penalty of not more than $100 for each violation **_except that the total amount imposed on the person for all violations of an identical requirement or prohibition during a CY may not exceed $25,000.

## Criminal Remedies (PA vs. HIPAA)

- Applies to individual(s)
- Fine up to $5,000 + court costs
- 	*If an officer or employee of agency knowingly  releases  records improperly to a person not entitled  to receive.
- 	*Willfully maintains PA system without publishing in FR.
- 	*Knowingly requests or obtains a record about  individual under false pretenses.

## Criminal Remedies (PA vs. HIPAA) - Continuation

- Under HIPAA (PL 104-191, Title II, Part C Administrative Simplification, Sec. 1177), it states a person who knowingly violates this part (wrongfully uses, obtain or discloses) _**shall be punished and fined not more than $50,000, imprisoned not more than 1 year, or both; if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and if the offense is committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.**_

## IHS PRIVACY ACT WEBSITE

**Go to:****  ****	**_[www.ihs.gov/](http://www.ihs.gov/)_
**Click on:****	**_**Resources for IHS Management**_
**Click on:****	**_**Privacy Act**_
**         **
**Intranet Website:  **_[home.ihs.gov](http://home.ihs.gov/)_
**Click on Privacy Act (Training Material Only)**