# Presentation: 652722

## Slide 1

**Notes:**
[TRAINER]
IHS, as a large plan and provider must comply with issues addressed in this training by April 14, 2003.  Some Tribal providers may be designated as small plans or small providers and have an additional year—until April 14, 2004, to comply. Discuss questions with legal counsel.
[NOTE TO TRAINER]  Training notes throughout this document are made up of:
 The exact, word-for-word, policy and/or procedure, from the most recent and revised IHS Policies & Procedures Circular Number 2002, and 
 Recommendations and/or additional input and suggestions that will help with training.
In some cases, the P&P in the notes section contains information that is in addition to the bullet points on-screen in the interactive training, because information was revised or added to the P&P after the training was developed.
To add your own information, update information, etc., just follow the directions for locating this Power Point Presentation on the Training CD, add or update the information in the Notes section of the power point, save the presentation as v.2 (or subsequent numbers) and use it as you would this one. 

## Slide 2

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## The Health Insurance Portability & Accountability Act (HIPAA)

- Passed by Congress in 1996
- Portability – Transfer of Health Insurance Coverage
- Accountability – Prevent Healthcare Fraud and Abuse
- Administrative Simplification – Decrease Costs and Administrative Burdens

**Overview**

**Notes:**
[NARRATOR] The Health Insurance Portability & Accountability Act was passed by Congress in 1996 to guarantee that individuals could move from one health plan to another without losing insurance coverage, or be denied coverage because of pre-existing conditions. HIPAA, which does not replace the Privacy Act of 1974, quickly became a sweeping attempt to remedy many of the problems in health care today. 

[TRAINER]
Portability – ability to transfer health insurance from one job to another – already in effect
Accountability – prevent health care fraud and abuse – already in effect
Administrative Simplification – to decrease costs and administrative burdens of providing health care
Does not replace privacy act of 1974

## Administrative Simplification

- Transaction and Code Sets – Mandates Standard Electronic Transaction Formats and Code Sets
- Security – Final Rule Pending
- Privacy Rule – Main Focus of Training

**Overview**

**Notes:**
[NARRATOR] The most complex of HIPAA’s  regulations, those associated with Administrative Simplification, are divided into three categories: Transaction & Code Sets, security, and privacy, which is the focus of this training.

[TRAINER] The Administrative Simplification, the most complex of the HIPAA regulations, mandates standard electronic transaction formats and code sets.  Technically it is already in effect, but IHS has asked for one year extension until October 2003. Final rule on security information to be entered here. 

You may introduce some humor here, if you think it’s appropriate because it’s funny that—typical of the government—the aspect of HIPAA that’s the most complicated has the word “simplification” in it.  Point out that this training does not address that aspect of HIPAA.

## HIPAA Privacy Rule

- Increased Risks for Invasion of Privacy
- Public and Congressional Concern about Healthcare Privacy
- Support for Provider-Patient Relationship
- National Standards to Protect PHI
- National Boundaries on Use and Release of Health Records
- Appropriate Safeguards for Protection of PHI
- Disclosure for Public Health Purpose
- Civil and Criminal Penalties

**Overview**

**Notes:**
[NARRATOR] HIPAA’s Privacy Rules are designed to address public concern for healthcare privacy and the increased risks associated with new technologies.  The national standards, boundaries and safeguards support a good relationship between providers & patients and holds violators accountable for their actions.

[TRAINER: Add any insight, stories or experience that is specific to your area of expertise, area, or facility.]
New Technology Increases Privacy Risk
Public and Congressional Concern About Health Care Privacy
Support for Provider/Patient Relationship
Creates National Standards to Protect PHI
Sets National Boundaries on the Use and Release of Health Records
Establishes Appropriate Safeguards for Protection of PHI
Strikes a Balance to Support Disclosure for Public Health Purpose
Holds Violators Accountable – Civil and Criminal Penalties

## Individuals Have the Rights to
An Accounting of Disclosures
Release of Minimum Necessary
A Copy of Health Record
Request Corrections
Control Some Uses and Disclosures of PHI
File Complaints with IHS and Office for Civil Rights
Submit Written Requests for Notice of Information
Have Reasonable Requests for Confidential Communication of PHI Accommodated

- An Accounting of Disclosures
- Release of Minimum Necessary
- A Copy of Health Record
- Request Corrections
- Control Some Uses and Disclosures of PHI
- File Complaints with IHS and Office for Civil Rights
- Submit Written Requests for Notice of Information
- Have Reasonable Requests for Confidential Communication of PHI Accommodated

**Overview**

- HIPAA Privacy Rule

**Notes:**
[NARRATOR] HIPAA provides patients with the right to release, limit release, request corrections and/or amendments, and obtain a list of individuals and agencies to whom or which their protected health information has been released. When there are disputes, patients also have the right to file complaints.

[TRAINER]
Right to Accounting of Disclosures
Limits Releases to the Minimum PHI that is Necessary
Gives Right to Obtain Copy of and Examine Their Health Record
Gives Right to Request Correction of Their Health Record
Empowers to Control Some Uses and Disclosures of Their PHI
Gives Right to File Complaints with IHS and Office For Civil Rights
Gives Right to Written Request of Notice of Information Practices From Providers and Health Plans
Gives Right to Have Reasonable Requests for Confidential Information Communications Accommodated

## Who and What is Covered

- Healthcare Providers
- Government & Private Health Plans
- Healthcare Clearinghouses
- Business Associates

**Overview**

**Notes:**
[NARRATOR] HIPAA requirements apply to all covered entities including any healthcare providers who transmit information electronically, public and private health plans, clearinghouses, and our business associates. 

[TRAINER] IHS is considered both a provider and a plan
Healthcare Providers Who Transmit Health Information in Electronic Transactions
Health Plans – Government and Private
Healthcare Clearinghouses – A Private or Public Entity That Facilitates the Transfer of Health Information from a Non-Standard Format into a Standard Format or Receives A Standard Information and Processes It into a Non-Standard Format on Behalf of Covered Entity. An Example is Fiscal Intermediary (FI)
Business Associates Relationships – Those Entities That Perform Business on Behalf of IHS that use Protected Health Information 
May not apply to all Tribal entities

## Recent Misuses of Patient Health Information

- Banker Collects On Cancer Patients’ Mortgages
- Hospital Employee Sells Country Singer’s Medical Records for $2610
- Psychological Records of 62 Children Accidentally Posted on Web Site
- NC Physician’s Laptop with Patient Medical Histories Stolen
- health.org Exposes Customer Names, Addresses, Phone Numbers & Email Addresses on Web
- Washington DC Hospital Fined $25,000
- Sick Employee Fired by Self-Insured Employer

**Overview**

**Notes:**
[NARRATOR] Before HIPAA, we can find a wealth of examples of how the lack of legal protection led to invasion of privacy & use of many individual’s health information for profit, or worse. 
[TRAINER: Provide details of these stories, or add your own, as you deem appropriate and point out that these are all in the private sector. IHS has always been bound by the privacy act and there were consequences. However, these examples are offered by way of example to raise awareness about intentional and incidental or accidental disclosures.]

Country singer Tammy Wynette’s medical records were sold to the National Enquirer & Star tabloids by a hospital employee for $2,610.  William Cox’s position at the hospital entitled him to authorized access to several medical record databases.  He retrieved medical information about Wynette and faxed it to the tabloids without her consent.  Last year Cox pleaded guilty to one count of wire fraud & was sentenced to six months in prison.
A banker, who also served on his county’s health board cross-referenced customer accounts that included patient information.  He called due the mortgages of anyone suffering from cancer.
About 400 pages of detailed psychological records concerning visits & diagnoses of at least 62 children and teenagers were accidentally posted on the University of Montana Web site for eight days.  In most cases, the information included names, dates of birth, sometimes home addresses, and schools attended with the results of the psychological tests.
A doctor’s laptop was stolen at a medical conference.  The computer contained the names & medical histories of his patients in North Carolina.
Due to a software flaw, thousands of consumers who requested pamphlets & brochures about drug and alcohol addiction had their names, address, telephone numbers & e-mail addresses exposed on Health.org, a government health information Web site.
A Washington DC jury ordered a local hospital to pay $25,000 for failing to keep a patient’s medical records confidential.  Coworkers learned of the victim’s HIV status after an employee at the Washington Hospital Center revealed information in his medical record.
Terry Sargent, a North Carolina resident, was fired from her job after being diagnosed with a genetic disorder that required expensive treatment.  Three weeks before being fired, Terri was given a positive review and a raise.  As such, she suspected that her employer, who is self-insured, found out about her condition, and fired her to avoid the projected expenses.

## Video – See Transcript in Notes Below

**Notes:**
SANDY TRENT, JD – Regional Counsel, Albuquerque Area IHS
HIPPA increases the security for patients by the promulgation of particular steps which have to be gone through before information can be released about a patient, certain notifications that must be provided to patients, certain restrictions against the agency itself, the Indian Health Service or the federal sector agencies before information can be released.

TERRY HUNTER, MPH - CEO Oklahoma City Indian Clinic
Indian communities are close knit. And I think one of the biggest educational issues that we have to overcome with HIPAA and privacy, the privacy standards, is the fact that we have to educate them to why we’re doing this. They’re used to coming in here, “is my uncle here? I need to see my uncle.” Now with HIPAA we can’t divulge that.

## Health Information & Protected Health Information (PHI)

- Health Information is Oral or Recorded Information that
- Is Created/Received by a Healthcare Provider, Health Plan, Public Health Authority, Employer, Life Insurer, School or University or Healthcare Clearinghouse
- Relates to the Past, Present and/or Future Physical or Mental Health or Other Health Condition
- Concerns the Provision of Healthcare
- Relates to Past, Present or Future Payment
- PHI is Defined as Health Information that is
- Individually identifiable
- Transmitted or Maintained in any Form or Medium

**Overview**

**Notes:**
[NARRATOR] Protected Health Information, or PHI, includes any health information, past, present, or future, physical or mental health or condition of an individual, & any payment information for the provision of health care (includes demographic information) which either specifically identifies the individual it describes or could be used to identify the individual.
[TRAINER] Health information is 
Any information, whether oral or recorded in any form or medium, that: (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearing house; and (2) relates to the past, present and future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual including demographic information. 
[ADD INFORMATION REGARDING HIGHLY SENSITIVE HEALTH INFORMATION]  Highly Sensitive Health Information.  Any patient health information relating to:
	Testing for the Human Immunodeficiency Virus (HIV) or other sexually transmitted diseases or treatment related to HIV or other sexually transmitted disease; Testing for cancer or other life-threatening illnesses; and The diagnosis, treatment, or referral for treatment of a mental illness and or alcohol or substance abuse.

## The Importance of PHI Security

- Required by Law
- Earns Patient Trust
- Privacy & Security of Information
- Sets Federal Minimum Standards & Safeguards to Protect PHI
- Preempts Weaker State Laws
- Does Not Supercede Federal Laws or Privacy Act

**Overview**

**Notes:**
[NARRATOR] Providing patients with quality healthcare includes protecting their confidential healthcare information. First because it is required by law, and because it helps patients trust their healthcare providers.

[TRAINER] NOTE TO TRAINER:  Add any additional information as you deem appropriate]
Does not replace the Privacy Act; works in conjunction with it
Required by Law
Earns Patient Trust
Privacy of Information
Security of Information
Sets Federal Minimum Standards & Safeguards to Protect PHI
Preempts Weaker State Laws 
Does Not Supercede Any Federal Laws
[TRAINER: Add any insight, stories or experience that is specific to your area of expertise, area, or facility.]

## Trust Impacts Quality of Care 

- Detection & Treatment of All Conditions
- Accurate & Complete Health Records
- Highest Quality Healthcare
- Reduces Healthcare Cost
- Patients Do Not Move from One Facility/Provider to Another
- If Patients Do Not Trust Us They
- Do Not Seek Treatment
- Give Incomplete or Inaccurate Information
- Move from One Provider to Another
- Ask the Provider Not to Record Their Actual Condition

**Overview**

**Notes:**
[NARRATOR] When trust is compromised, conditions may go undetected or untreated, health information may not be complete & accurate, people will be hesitant to ask for treatment, may pay for care out of pocket to avoid an insurance claim or move from one physician to another—all of which can compromise quality of care.

[TRAINER]
Detecting & Treating All Conditions 
Accurate & Complete Health Records 
Highest Quality Healthcare
Reduces Health Care Cost
Patients Do Not Move from One Facility/Provider to Another
If a patient does not trust us
They Do Not Seek Treatment
They Give Incomplete or Inaccurate Information
They Move from One Provider to Another
They Ask the Provider Not To Write Down Their Actual Condition

## Earn Patient’s Trust

- Know IHS Forms Policies & Procedures
- Respect Patient’s Right to Privacy
- Treat All Records as if They Are Your Own
- Be Sensitive to Privacy in All Situations

**Overview**

**Notes:**
[NARRATOR] To earn patient trust, know & use the IHS forms policies & procedures so that you can show sensitivity & respect toward the protected health information of all Native American & Alaska Natives.

[TRAINER]
Incidental disclosures are particularly important including any personnel of the facility who may discuss patient conditions, or release PHI in the following situations:
Grocery stores, car pools, van pools, family time; Discussion or answering questions in public areas of the medical facility such as hallways, waiting rooms, etc.; In churches (via asking for prayers and releasing specifics during that request); Using printed information that should be shredded or destroyed as a medium for taking notes; Leaving information laying around the mailroom that should be in envelopes; Jammed fax or copier machines left unattended; Leaving sensitive information unattended on desks; Viewing information on computer screens; Revealing more than minimum information necessary in ANY situation; Handing sign-in clipboards to patients that contain other patient information; and/or Discussing information on a phone located in public areas or areas where others may hear.

## Training Requirements

- IHS Must Provide HIPAA Training to All
- 	Employees, Volunteers and Contractors
- New Employees Must Receive Training No Later Than 30 Days After Beginning Duty
- Department Specific Training
- Revised Training When Policies are Revised
- Training Must Be Documented and Maintained for 6 Years

**Overview**

**Notes:**
[NARRATOR] IHS is required to provide initial training to all employees, volunteers & contractors. New employees must receive training as soon as possible, but no later than 30 days after entering their position and training documentation must be kept for 6 years.

[TRAINER]
IHS Must Provide HIPAA Training to All Employees, Volunteersand Contractors
New Employees Must Receive Training No Later Than 30 Days After Beginning Duty
Department specific training (i.e. Health Information Management)
Training to designated staff when policies are revised
Training to be documented and maintained in writing or electronically for six years
Documentation can be sign in sheets that are kept for 6 years

## Learn Train & Protect

- Train-the-trainer Kit, Includes
- Interactive CD
- Quick Reference Cards
- Forms, Policies & Procedures
- Web Support

**Overview**

**Notes:**
[NARRATOR] Learn Train & Protect includes training CDs, quick reference cards to help staff guide patients through filling out the forms, copies of the forms, policies and procedures, and most of the materials are also available on the Web. 

[TRAINER]
The forms, policies, and procedures, as well as other training and reference materials are available at www.ihs.gov Trainer to add any specific information about training schedules, dates, etc. here.

## Learn Train & Protect

- Training Provided to
- Area HIPAA Coordinators
- Privacy Act Liaison (PAL)
- Individual Providers
- HIPAA SU Coordinators
- IHS Consultants & Volunteers
- All Employees

**Overview**

**Notes:**
[NARRATOR] Trainers then take this information out to the field, ensuring that providers and employees through the Indian health community have received the required training.
[TRAINER] Adds information about training schedule details as they develop and may make suggestions to those they train as to how to set up training for individuals and groups based on their facility requirements; name and contact info of HIPAA coordinator at the facility where training is being conducted; note that HIPAA Coordinator and Privacy Advocate are not necessarily the same person. Responsibilities:
Director, IHS.  The Director ensures that IHS is in compliance with all requirements of the HIPAA legislation.
Director, Office of Public Health.  The Director, Office of Public Health is clinically and administratively responsible for direct health care. He is  responsible to the Director, IHS, for reporting HIPAA Privacy and other issues that could affect health care delivery. The OPH administratively monitors all HIPAA activities at each IHS facility, maintaining a current list of Service Unit HIPAA compliance activities. 
Area Director.  Each Area Director ensures their Area is in compliance with HIPAA regulations. The Director is responsible for providing an annual HIPAA activities report to the OPH on HIPAA implementation and ongoing training status of each IHS facility within their respective Area.  Area Directors are responsible for the development of Area HIPAA policies and procedures.
Health Record Consultants.  Health Record Consultants advise Area Directors, area staff, Service Unit Directors (SUD), and Service Unit Staff, on health record issues.  Headquarters Health Record Consultant advises the Director, OPH, on HIPAA activities and consults with Area Health Record Consultants on HIPAA activities. Area Health Record Consultants are responsible for advising the Area Directors, the SUDs, and their staff on HIPAA implementation activities within their geographic areas.  Health Record Consultants shall consult with the IHS Privacy Act Officer on overlapping HIPAA Rule and Privacy Act issues.
Service Unit Directors.  Each Service Unit Director is responsible to ensure compliance with HIPAA regulations including the development of policies and procedures and reporting the status of HIPAA compliance, complaints, violations, implementation, and ongoing training status of each IHS facility within their respective Service Unit to their respective Area Director.
Others.  Privacy Act Officers (HQ, Area, Service Unit) and Area HIPAA Coordinators in consultation with health record consultants are responsible
for HIPAA implementation and compliance within their geographic area. Area Privacy Act Officers advise service unit staff on Privacy Act issues and resolves differences with HIPAA privacy rules and incidences where Privacy Act Privacy Act of 1974 and its subsequent amendments overlap with HIPAA.  Some Health Record Consultants (if not all) also serve as Area Privacy Act Officers.

## Non-Compliance?  Not An Option!

**Overview**

- Video – See Transcript in Notes Below

**Notes:**
LCDR GODWIN ODIA, MBA, MPA, RHIA, Senior Specialist Health Record Administrator, IHS HQE
Ultimately, training is required to prevent IHS and the facility and even the employee from being sued by the patients.

ANGELA KIHEGA - HIPAA Coordinator for Okalahoma Area
The HIPAA privacy standard does have teeth in it. 

ROB HAYES, DPH - Anti-Coagulation Clinic Director, Claremore Indian Hospital
If we don’t comply with HIPAA, the consequences are loss of licensure, accreditation.

TRENT:  The civil and criminal penalties which are available to the Office For Civil Rights, and to the Department of Justice, are both fines of substantial cumulative natures, as well as the possibility of criminal prosecution, conviction and imprisonment.

## Enforcement & Penalties For Non-Compliance

- Civil Monetary Penalties:
- $100 Per Violation
- Capped at $25,000 Per Calendar Year Per Violation
- Enforced by Office for Civil Rights

**Overview**

**Notes:**
[NARRATOR] Penalties for non-compliance are displayed on screen. The Office For Civil Rights enforces civil penalties and the US Dept of Justice imposes penalties for violations that are criminal in nature.

[TRAINER]
Civil Monetary Penalties:
$100 Per Violation
Capped at $25,000 for each calendar year for each requirement of prohibition that is violated
Enforced by Office for Civil Rights
Criminal Penalties for Certain Violations:
Greater penalties for knowing violations of rule
Enforced by U.S. Department of Justice

## Penalties for Non-Compliance

- Civil Service Employees May Face Discipline Up to & Including Termination
- Commissioned Corps Officers May Face Discipline Up to & Including Recommendation for Termination of Commission
- All Employees May Be Held Individually Accountable

**Overview**

**Notes:**
[NARRATOR] In cases of non-compliance, disciplinary actions are based partially upon which personnel system the employee is in.

[TRAINER] Progressive Discipline Based on The Appropriate Personnel Systems Will Be Used
Civil Service May Face Sanctions Up To and Including Termination From The Federal Civil Service
Commissioned Officers May Face Sanctions to Include Recommendation For Termination of Commission
Employees May Be Held Individually Accountable Under the Privacy Act

## Penalties for Non-Compliance

- Up to $50,000 Fine & 1 Year Imprisonment for Knowingly Obtaining or Disclosing Individually Identifiable Health Information
- Up to $100,000 & 5 Years Imprisonment if Done Under False Pretenses
- Up to $250,000 & 10 Years Imprisonment if Done With Intent to Sell, Transfer, or Use for Commercial Advantage, Personal Gain or Malicious Harm
- Enforced by U.S. Department of Justice (DoJ)

**Overview**

**Notes:**
[NARRATOR] No Narration

## Q&A 

**Overview**

**Notes:**
[TRAINER] Tell trainees that any where they see PHI in the rest of the presentation it means Protected Health Information and anywhere they see P&P that means policy & procedures.

Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 22

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Notice of Privacy Practices 

- How to Review the Notice with Patients
- How to Respond to Their Questions
- What to Do in Emergency Situations
- What to Do When Patient Won’t Sign

**Privacy Notice**

**Notes:**
[NARRATOR] A good understanding of the notice of privacy practices is the foundation of this training and includes instruction on the bullets that appear on this screen.

[TRAINER] In this section of the training we’ll review the notice of privacy practices, how to review the notice with patients and explain their rights as well as our responsibilities, how to respond to their questions, what to do when the patient hasn’t signed the acknowledgement in case of emergencies, and what to do when they won’t sign it.

If deemed appropriate, print (or use existing) copies of Notice of Privacy Practices and the acknowledgement form with each of the trainees and have trainees rehearse in each of the following sections, how they review the notice, respond to questions, handle emergency situations, and how to respond when patients won’t sign.  You may suggest that someone at each facility be designated as the patient advocate to handle situations where patients are particularly confused or reluctant to sign, as some facilities have already done.

[Trainer Note] For Areas that provide CHS directly through the Area Office, references to the SUD/CEO should be considered references to the Area Director’s designee, as applicable.

## Notice of Privacy Practices

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
PATRICIA ANNE GOWAN, RHIA, MPA, CPC, Privacy Act/FOIA Advocate, Phoenix Area: The notice of privacy practices is a long laundry list of how we tell our patients how we’re going to use and disclose their protected health information.

KIHEGA: The notice of privacy practices was developed in conjunction with regional counsel, as well as health information management consultants. We strongly urge anyone, tribal or federal entities, that utilize the notice of privacy practices that was developed not to change any of the language in there. 

TRENT:  It’s recommended that the wording not be changed because there might be an inadvertent dilution or omission of statutorily mandated language that the patient is required to receive from the agency.

## Reviewing with Patients

- Explain That Health Records Are Used to
- Plan for Care & Treatment
- Communicate Among Healthcare Professions
- Check Results & Improve Care
- Verify Services Billed
- Educate Healthcare Professionals
- Improve Health of All People
- Support Medical Research
- Conduct Facility Planning & Marketing
- Maintain Legal Healthcare Records

**Privacy Notice**

**Notes:**
[NARRATOR] When reviewing the notice of privacy practices with patients, before we ask them to sign the acknowledgement, we are required to explain what a health record is, or make sure the patient already knows what a health record is, and how the record is used. 

[TRAINER] Staff explains to patient that each time they receive healthcare a record is made of the treatment. These records are known as the patient’s Health Record. The Notice they are being asked to sign is an acknowledgment that the patient understands that the health record is used to: Plan for their care and treatment 
Communication source between health care professionals 
Tool with which we can check results and continually work to improve the care we provide 
Means by which Medicare, Medicaid or private insurance payers can verify the services billed 
Tool for education of health care professionals 
Source of information for public health authorities charged with improving the health of all Native American and Alaska Native people 
Source of data for medical research, facility planning and marketing 
Legal document that describes the care received

## Reviewing with Patients

- Explain That Patient Must Understand His/Her Own Health Record in Order to
- Ensure Accuracy
- Understand Why Others May Review His/Her PHI
- Make Informed Decisions Regarding Disclosures

**Privacy Notice**

**Notes:**
[NARRATOR] It is also important that patients understand their own health record so that they can help ensure it’s accuracy, understand why their information might be reviewed, and so they can make informed decisions.

[TRAINER]  Patients must understand what is in their health record and how the information is used because the patient can help ensure the accuracy  of the information, clearly understand why others may review their health information and make an informed decision when making decisions about when and why to allow others access to their health information.

## Reviewing with Patients

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  When you’re reviewing the notice of privacy practices with the patient, make sure that the patient understands what disclosures means and restrictions mean so that they will fully understand their patient rights. 

LOLA CAIN, DPH - Assistant Chief Pharmacist-Outpatient, Claremore Indian Hospital
When we talk about disclosure, we mean the release of a patient’s protected information.

KIHEGA:  A restriction means that a patient would ask that a certain individual is not entitled to see their record, or a certain portions of their record. 

CAIN:  There are patients who restrict access to their information because there may have been a breech of information in the past, so a patient can restrict release of information in any way they deem appropriate. 

## Reviewing with Patients

- Explain Patient’s Right to
- Receive & Inspect Health Records
- Request Restrictions
- Request Corrections and/or Amendments
- Request Confidential Communications
- Receive a List of Certain Disclosures
- Revoke Written Authorization to Disclose or UseHealth Information
- Receive a Paper Copy of the IHS Notice of Privacy Practices

**Privacy Notice**

**Notes:**
[NARRATOR] Once the patient understands how their health records are used by others, and what disclosures and restrictions are, we must make sure they understand their rights. 

[TRAINER] We want to make sure we explain to all patients that they are guaranteed the right to: 
Inspect and receive a copy of their health record. 
Request a restriction on certain uses and disclosures of their health information.  For example, you may ask that we not disclose their health information and or treatment to a family member.  IHS is not required to agree to the request; but if we do, we will comply with the request unless the information is needed to provide you with emergency services. 
Request a correction/amendment to their health record. If you believe the health information we have about you is incorrect or incomplete, we may amend their record or include their statement of disagreement.
Request confidential communications about their health information. You may ask that we communicate with you at a location other than their home or by a different means of communications such as telephone or mail.
Receive a listing of certain disclosures IHS has made of their health information upon request.  This information is maintained for six years or the life of the record, whichever is longer.
Revoke their written authorization to use or disclose health information.  This does not apply to health information already disclosed or used or in circumstances where we have taken action on their authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.  
Obtain a paper copy of the IHS Notice of Privacy Practices upon request.
Obtain a paper copy of the IHS Health and Medical Records; System Notice # 09-17-0001 upon request.
Any person, whether patient or not, can obtain a copy of the notice of privacy practices.
IHS owns the records, but patients own the information in their own health records.

## Reviewing with Patients

- Explain to Patient IHS’s Responsibilities to
- Maintain Privacy of Information
- Inform Individuals about Privacy Practices
- Notify Patients if Requests for Restriction are Denied
- Accommodate Reasonable Requests for Alternative Communications
- Honor All Terms of Notice of Privacy Practices

**Privacy Notice**

**Notes:**
[NARRATOR] The next step is to explain to the patient IHS’s responsibilities with regard to their PHI. 

[TRAINER] The Indian Health Service is required by law to:
Maintain the privacy of patients’ health information. 
Inform patients about IHS’s privacy practices regarding health information we collect and maintain. 
Notify the patient  if we are unable to agree to a requested restriction.
Accommodate reasonable requests from patients to communicate health information by alternative means or at alternative locations.
Honor the terms of this notice or any subsequent revisions of this notice.
IHS reserves the right to change its privacy practices and to make the new provisions effective for all protected health information it maintains.  IHS will post any revised Notice of Privacy Practices at public places in this facility and on its web site at www.ihs.gov within 60 days. Patients may request a copy of the notice.  Additionally, the revised notice must be mailed out to all active users within 60 days of a material revision.
IHS understands that health information is personal and is committed to protecting it.  
IHS will not use or disclose a patient’s health information without permission, except as described in this notice and as permitted by the Privacy Act and the IHS Health and Medical Records; System Notice 09-17-0001.

## Notice of Privacy Procedures

- Beginning April 14, 2003
- Review Notice with Patient
- Answer Patient Questions
- Refer Unanswered Questions to SU Privacy Act Liaison (PAL)/SU HIPAA Coordinator
- Do Not Agree to Anything Verbally
- Obtain Patient Signature on Acknowledgement
- Place in Patient Health Record

**Privacy Notice**

**Notes:**
[NARRATOR] Beginning April 14, 2003 we are required to review the notice of privacy practices with every patient who comes into the facility for treatment. The procedure is described in the bullet points that appear on screen. 

[TRAINER] The procedure for using the new Privacy notice begins with each patient who comes in for treatment at an IHS facility after April 14, 2003.  For the first few weeks or months after April 14, patients will not have received the notice or signed the acknowledgement. In this case, give the Notice to the patient, review it with them as previously described in this program, ask them if they have any questions, and if they don’t, have them sign the acknowledgement, and then place it in the patient’s record. Check with the Health Information Management (Health Records) Department to be advised on where to store the form.

Copies of the acknowledgement form may be downloaded in printable pdf format at the Website www.ihs.gov

## Notice of Privacy Procedures

- After April 14, 2003
- Check Record for Existing Acknowledgement
- If Acknowledgement Is in Record No Action Is Required
- If Acknowledgement Is Not in Record Follow Procedure for Reviewing & Obtaining Signed Acknowledgment

**Privacy Notice**

**Notes:**
[NARRATOR] The procedure after April 14th includes one additional step and that is to check the patient’s record for a copy of the acknowledgement first. If there is already an acknowledgement in the record, no additional action is required. 

[TRAINER] If there is no acknowledgement in the health record, then follow the procedure for going over the notice and obtaining the acknowledgement as previously described. The Acknowledgement remains in the patient’s record for the life of that record.

## Notice of Privacy Procedures

- If Patient Refuses to Sign
- Note on Acknowledgement That Patient Received Notice
-   and Reason for Not Signing
- Sign & Note Date
- Do Not Agree to Anything Verbally
- Place Acknowledgement in Patient Record

**Privacy Notice**

**Notes:**
[NARRATOR]  If a patient will not sign the acknowledgement, note this on the acknowledgement, along with a reason if the patient gives one, then sign and date the notation and place the acknowledgement in the patient’s record.

[TRAINER]  If the patient will not sign the form, registration staff must note in the patient’s record that the notice has been reviewed with the patient but that they would not sign the acknowledgement. The notation should be dated and signed. If the patient asks for any disclosures, restrictions, corrections, or amendments, do not agree to anything verbally. 

Rehearse with trainees how to respond to refusal and fill out acknowledgement form if deemed appropriate.

## Notice of Privacy Procedures Q&A

**Privacy Notice**

- Video - See Transcript in Notes Below

**Notes:**
ODIA:  If a patient is incapacitated, our employee should document on the Acknowledgement form the reason for the patient not being able to sign that Acknowledgement form.

KIHEGA:  Later, when the patient awakens, then you would go ahead and have the patient sign that. 

ODIA:  That Acknowledgement form becomes part of the medical record.

## Notice of Privacy Procedures

- If Emergency or Incapacitation
- Note Situation on Acknowledgment Form, Sign, Date
-    & Place in Record
- Provide Form to Patient as Soon as They Are Capable
- 	of Signing
- Do Not Agree to Anything Verbally

**Privacy Notice**

**Notes:**
[]NARRATOR] If the patient is incapacitated or the emergency situation prevents staff from going over the notice and obtaining a signature, follow the procedure as described on screen and get back to the patient as soon as their condition allows.

[TRAINER]  If the patient, due to emergency or incapacitation, cannot sign the form, this should be noted on the Acknowledgement form, signed and dated by the appropriate IHS staff.  The Notice is then provided to the patient as soon as they can resume making their own healthcare decisions.  Again, do not agree verbally to any verbal requests regarding the patient’s health information or record. If another individual is acting as the patient’s representative in making healthcare decisions on behalf of the patient, provide that person with the Notice and the Acknowledgment form.  
Discuss emergency situations if deemed appropriate, based on audience need. 

## Notice of Privacy Procedures

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
PATTI WHITE - Laboratory Manager, Claremore Indian Hospital: Sometimes patients ask us to do something verbally such leaving off a test on the report or sending it to another address and we cannot agree verbally to do anything like that for them. They must get proper release of information with medical records. 

KIHEGA:  The reason why the staff should not agree to anything verbally is because if you agree to it verbally, how would any other staff member know what restriction you had agreed to.

ODIA:  There may be a miscommunication between the patient and the IHS employee.  We want to make sure we restrict the right information the patient tells us to restrict.  The same is true of disclosure.

## Notice of Privacy Procedures

- Notice Must be Posted
- In a Public Place
- Inside or Outside Facility
- On Website

**Privacy Notice**

**Notes:**
[NARRATOR] The notice must also be posted in a public place such as waiting areas and treatment rooms.

[TRAINER] Suggests appropriate places to post the notice such as patient treatment rooms, lobby, waiting areas, etc. Notice may also been given to patients using video playing in waiting areas.

IHS is considered both a provider and a plan.  If notice is revised, the revised notice must be posted and would also need to be distributed by mail to all active users within 60 days of a material revision.

## Q&A 

**Privacy Notice**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 38

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Disclosures

- Helping Patient Fill Out Form 810
- Authorization for Use or Disclosure of Health Information
- Disclosure of Minors’ PHI
- Verification of Identity Prior to Disclosure

**Disclosures**

- Form IHS-810 Authorization for Use or Disclosure

**Notes:**
[NARRATOR] In this section, we cover Form IHS- 810, the Authorization for Use or Disclosure of Health Information, including  how to help patient obtain & fill out the form. Also covered are the policies & procedures associated with disclosures, including disclosure of minors’ phi, and verifying identify prior to disclosing  information.

[TRAINER] We also cover Policy & Procedure associated with patients’ written requests.

## Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  IHS form 810 is a way patients authorize use or disclosure of the protected health information. It has to be signed with the original signature and dated. Or the patient can submit a written request that contains all the required information and their original signature and dated. 

## Form IHS-810

**Notes:**
[NARRATOR] Form 810, or a written request containing the same information, must be completed and signed, with an original signature prior to disclosing or releasing protected health information for any purpose other than treatment, payment, or healthcare operations. Only form 810 or written requests with an original signature will be processed. The form should be filled out using black ink; forms filled out in red ink will not be processed.

## Form IHS-810

- Provide Yellow Copy of the Signed IHS-810 to the Patient
- Original Form 810 Is Processed by Health Records Staff
- Original Form 810 Is Filed into Patient’s Health Record
- Account for the Disclosure on IHS Form 505 or Electronically
-    (ROI Software)
- Same Procedure Applies to Valid Written Requests
- Expires One Year from Date of Patient Signature Unless Otherwise Specified by Patient

**Disclosures**

**Notes:**
[NARRATOR] Once the patient has filled out and signed form 810, the yellow copy is provided to the patient. The original is submitted for processing and after processing is filed in the patient’s record and remains there for the life of the record. 

[TRAINER] Form 810 is maintained in the patient’s record for the life of the record. The request expires one year from date of the patient’s signature unless another date is specified by the patient.

## Written Requests 

- Written Requests Must Contain
- Requestor’s Name & Address
- Date of Request
- Date of Birth
- Description of Requested Information
- Original Signature
- If Correct Fulfill Request

**Disclosures**

**Notes:**
[NARRATOR] Patients may submit a written request which may also be processed the same as form 810, if it contains a full description of information requested, and has an original signature and date.

[TRAINER] A written request received by mail or in person must identify the individual and description of the information desired such as date of visit or diagnosis/condition.  The request must contain the name and address of the requester, date of birth, signature for comparison purposes and date. If the written request is correct, it can be processed just the same as form 810.  

## Form 810 or Written Request

- When a Request for Disclosure Is Incomplete
- Contact Requestor for Additional Information Prior to Disclosure
- Document Request Clarification with Date & Initials on Original Authorization Form or Written Request

**Disclosures**

**Notes:**
[NARRATOR] Staff may follow up on incomplete or unclear written requests by contacting the requestor for additional information, which is documented with date and initialed in the health record.

[TRAINER]
If the authorization or written request does not contain sufficient information that identifies the patient or description of the information requested, the individual will be contacted that additional specific information is required in order to process the request.
Any additional information received will documented, dated and initialed on the original request.

If the information is totally incomplete you may offer to mail form 810 to the patient or inform them how to pick one up at the facility.

## Written Request Denied

- Procedure for Denying Written Request
- Notify Patient of Denial of Request
- Explain Why Denied
- List Specific Information Needed
- Inform Patient That They May Use Form 810
- A Patient May Obtain the Form by
-  Visiting or Calling the Nearest IHS Facility
-  Visiting the Forms Web Site http://forms.psc.gov

**Disclosures**

## Verification of Identity: In Person

- Responsible IHS Staff Knows Patient Personally
- If Not Known Personally, Require One Piece of Tangible Identification
- Driver’s License
- Military ID Card
- Tribal Registration Card
- Employment ID Card/Badge
- Passport
- Alien Registration Card

**Disclosures**

**Notes:**
[NARRATOR] Before a disclosure can be authorized, staff must note in the chart that they know the patient personally, or verify the requestor’s identification. 

[TRAINER] Verification of the ID of the individual requesting disclosure must be performed or comparison of the signature in the patient’s record. 
If request is made in person:
If id of the patient is personally known to the responsible IHS staff member, this is sufficient verification.
Otherwise must have one piece of tangible identification (preferably picture ID):
Driver’s license
Military ID card
Tribal Registration Card
Employment id card/badge
Passport
Alien registration card

## Verification of Identity: In Person

- Patient Requesting Own PHI Must Have Matching ID
- ID With Name Change Requires Supporting Evidence
- Additional Verification (i.e.Last Visit Made, Parents’ Names, or Place of Birth

**Disclosures**

**Notes:**
[NARRATOR] If the patient is requesting his or her own PHI, the name on the id presented must match name of patient. If it doesn’t, follow the procedure as described on-screen. 

[TRAINER] If the patient’s name has been legally changed, the patient must present evidence documenting the change, as well as verify particulars that can be confirmed by info already in record, such as last received medical treatment, parent’s names, or place of birth, etc.

## Verification of Identity: In Person

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
MICHELLE HEFLEY - Medical Records Technician, Claremore Indian Hospital:
Someone can certify in writing that they are who they say they are, and we just have to notify them that if they aren’t who they say they are then they can be fined for that, and that certification in writing we will put in the patient’s chart. 

## Verification of Identity: 3rd Party

- Law Enforcement Official Must Show
- Official Identification
- Law Enforcement Request or Court Order Requesting the Release of PHI

**Disclosures**

**Notes:**
[NARRATOR] Sometimes requests for PHI come from third parties. The following screens describe proper verification of identity procedures associated with third-party requests. 

[TRAINER] If a request is made by a law enforcement official, the official must verify his or her identity by producing a badge, official identification, or some other identification that shows that the law enforcement official has the authority to accept the PHI on behalf of the law enforcement agency.  The law enforcement official must also produce the law enforcement request or court order requesting the release of PHI if it is not already on file.

## Verification of Identity: 3rd Party

- Attorney, Attorney’s Assistant or Insurance Company Representative Must
- Show Valid Photo ID & Authority (i.e. Business Card)
- Show Proof of Authority to Act

**Disclosures**

**Notes:**
[NARRATOR] No narration on this screen.

[TRAINER] If a patient authorizes in writing PHI to be disclosed to an attorney, and the attorney comes to the IHS facility in person to pick up the records, the attorney must present valid photo identification and authority (e.g., business card) that is consistent with the patient authorization regarding to whom the PHI may be disclosed.  If a representative of the attorney comes in the attorney’s place, the representative must submit proof that the representative has authority to act on behalf of the attorney (e.g., agreement between a records company and an attorney).  This provision also applies to patient authorizations to disclose PHI to an insurance company representative.

## Verification of Identity: 3rd Party

- Other Individuals Must Present
- Photo ID Matching Individual Named in Patient Authorization

**Disclosures**

**Notes:**
[NARRATOR] No narration on this screen.

[TRAINER] If a patient authorizes in writing PHI to be disclosed to another individual (e.g., family member or friend), the individual must verify his or her identity with photo identification that matches the patient authorization to whom the PHI may be disclosed.

## PHI to Parent, Guardian or Personal Representative
Verify Identity of Requestor 
Verify Relationship 
Copy of a Birth Certificate
Court Order 
Previously Provided Evidence in Medical Record 
Other Evidence of Relationship 

- Verify Identity of Requestor
- Verify Relationship
- Copy of a Birth Certificate
- Court Order
- Previously Provided Evidence in Medical Record
- Other Evidence of Relationship

- Verification of Identity: 3rd Party

**Disclosures**

**Notes:**
[NARRATOR] If the request comes from a parent, guardian, or the patient’s personal representative, staff must verify the identity of the requestor as well as the relationship of the requestor to the person who’s PHI is being requested. 

[TRAINER] An individual who makes a request for PHI on behalf of a minor, a person who is legally incompetent, or another individual shall verify that he has authority to act by providing a copy of a birth certificate, a court order, or other competent evidence of the relationship or authority, e.g. health care power of attorney, in addition to verifying his own identity with photo identification (unless personally known to the IHS employee), unless the responsible IHS staff person can establish that evidence of the relationship or authority has previously been provided.

## Verification of Identity: 3rd Party

- Document Verification of Identity on Form 810
- Note Type of ID Presented/Used
- Note Documentation of Authority
- Initial & Date

**Disclosures**

**Notes:**
[NARRATOR] The  procedure described on-screen applies to documenting the verification of identity for all 3rd party requests.

[TRAINER] The type of identification and any documentation of authority used will be documented on the completed IHS-810 Form, e.g., “verified, Driver’s License.”  The staff making the verification must initial and date the form. 

If verifying ID for a court order, verify the Federal, State, or Tribal official/judge from which the court order came.

## Verification of Identity: Request By Mail

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
HEFLEY:   Requests by mail are particularly challenging because it’s hard for us to verify the person the has sent it. What I do is I will pull the chart and look and see if there’s anything in the record that the patient has already signed in the past, and I will use that signature to verify the release that we’ve received in the mail. 

## Verification of Identity: Request By Mail

-  Mail to Another Individual
- Request Must Be on Form 810 or Approvable Written Request
- Verify that Name, Address, Particulars & Signature on Request Match Those in Patient File
- Note or File Request in Medical Record
- Note that PHI Was Released in Medical Record
- Release PHI to Name & Address of Individual Listed Only

**Disclosures**

**Notes:**
[NARRATOR] If a patient requests by mail that his or her PHI be sent to another individual, extra care must be taken to ensure the identity of the person making the request. 

[TRAINER] If the patient is requesting PHI to be sent to another individual and encloses an IHS Form 810, verify the identity in accordance with the procedures we’ve already discussed  and release the information only to the name and address of the individual authorized to receive the PHI in accordance with the patient authorization. 

## Verification of Identity: Request by Mail

- Request From Other Than Patient
- Requestor Must Show Valid ID & Documentation of Authority
- Staff Will Note on Form 810 or Valid Written Request the ID and Authority Used
- Initial and Date

**Disclosures**

**Notes:**
[NARRATOR] When law enforcement officers, attorneys, insurance company representatives or other individuals mail in a request for a patient’s PHI, document the type of ID or authorization presented, in the patient record, then date and initial the entry. 

[TRAINER] If another individual requests (including requests by law enforcement, attorneys, or insurance company representatives) PHI of a patient, the requestor must include documentation of authority (e.g., law enforcement requests must be on letterhead, requests by attorneys must include a completed patient authorization verified in accordance with the above).  Such documentation will be maintained in the patient health record.

## Verification of Identity: Request by Mail

- Variations or Missing Information in Written Requests
- Contact Requestor
- Obtain Explanation and Compliant Documentation
- Note on Form 810 or Valid Written Request the Explanation, ID and Authority Used
- Initial and Date

**Disclosures**

**Notes:**
[NARRATOR] If a request received by mail does not contain the proper verification of ID or authority, staff must obtain the information before fulfilling the request for disclosure. 

[TRAINER] If there is any variation, the responsible IHS staff person shall obtain from the requestor an explanation and documentation in a form that complies with this Policy and Procedure.  For example, a requestor who is a guardian must supply a birth certificate, a court order, or other competent evidence of the authority or relationship; a name change must be documented.  The type of documentation provided and the date of request shall be noted in the patient health record by the IHS staff member.

If documentation is adequate under the policy & procedure, release the PHI, and the type of documentation provided and the date of request shall be noted in the patient health record by the IHS staff member.

## Verification of Identity: Healthcare Provider

- When Receiving Request for PHI in Emergency
- Obtain Requesting Provider’s Name, Facility Name, Location &  Telephone Number
- Verify Requestor Identity by Telephoning the Number Provided
- Document Call & Identity of Individual Who Received the Call
- Document the Information Being Sought or Requested
- Document the Reason for the Request
- Provide Minimum Necessary PHI
- Provide Additional Information Requested as in Non-Emergency

**Disclosures**

**Notes:**
[NARRATOR] Emergency situations sometimes require other healthcare providers to phone in a request for PHI. The on-screen bullets describe the correct procedure for verifying identity, documenting required information, and fulfilling a telephone request made for emergency treatment purposes. 

[TRAINER] Telephone Request Made for Emergency Treatment Purposes 
a.	Take the provider’s name, facility name, location, and the telephone number of the requesting entity, and verify the identity of the requesting 	individual by telephoning the number provided.
b.	Document the call and the individual who received the call on the provider’s behalf; this serves as identification verification.
c.	Document the information being sought or requested.
d.	Document the reason for the request.
e.	Provide only the PHI that the requesting entity indicates is necessary to be provided by telephone at that time.  Provide the rest of the requested 	PHI by the same means as it would be provided to the requesting entity in a non-emergency circumstance.
Note:  Do not withhold if the entire record is required for medical treatment purposes.

## Verification of Identity: Subpoena/Court Order

- When Receiving Request for PHI via Court Order Refer to Area Health Records Consultant or Regional Attorney

**Disclosures**

**Notes:**
[NARRATOR] When Receiving Request for PHI via a subpoena or Court Order refer the request to  the Area Health Records Consultant or Regional Attorney. 

[TRAINER] Process under IHS Policy and Procedure for responding to requests for PHI by subpoena/court order and referral to the Area Health Record Consultant.

Provide name & contact info of Area Health Records Consultant and Regional Attorney to trainees.

## Required Stamp or Label: All PHI Disclosures

*"This information has been disclosed to you from records whose confidentiality is protected by federal law.  Federal regulations (45 CFR Part 2) prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by such regulations.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.“*

**Disclosures**

**Notes:**
[NARRATOR] All disclosures must contain the statement that appears on-screen. 

[TRAINER] 
 Information disclosed may be subject to re-disclosure by the recipient & no longer protected. The information disclosed must be accompanied by the following statement:
""This information has been disclosed to you from records whose confidentiality is protected by federal law.  Federal regulations (45 CFR Part 2) prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by such regulations.  A general authorization for the release of medical or other information is NOT sufficient for this purpose."

## Required Stamp or Label: Alcohol/SubstanceAbuse Disclosures

*“**This information has been disclosed to you from records protected by federal confidentiality regulations (42 CFR Part 2). The federal regulations prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by 42 CFR Part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.”*

**Disclosures**

**Notes:**
[NARRATOR] The statement that appears on-screen must be labeled or stamped onto disclosures about alcohol or substance abuse when disclosed from designated centers. 

[TRAINER] This statement applies only to designated alcohol/substance abuse facilities.
 Information disclosed by a designated alcohol/substance abuse facility must be accompanied by the following statement:

This information has been disclosed to you from records protected by federal confidentiality regulations (42 CFR Part 2).  The federal regulations prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by 42 CFR Part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

A copy of the signed authorization, IHS-810, must be provided to the individual and the original signed authorization or valid written request must be filed in the patient’s record.

## Psychotherapy Notes

- Notes Recorded by a Mental Health Professional that
- Document or Provide Analysis of Conversation in Private, Group, Joint or Family Counseling Session
- Are Maintained Separate From the Medical Record
- Owned by the Mental Health Professional Who Recorded Them

**Disclosures**

**Notes:**
[NARRATOR] Psychotherapy notes include information recorded in any medium by a mental health professional documenting or analyzing the contents of conversations held during counseling sessions. They are the property of the mental health professional and are kept  separate from the rest of the patient’s medical record. 
[TRAINER]  This does not apply to progress notes, which are recorded on the PCC Encounter form.
PURPOSE:  To establish the policy and procedure on the maintenance, use and disclosure of psychotherapy notes.
POLICY:  All psychotherapy notes recorded on any medium (paper, electronic), by a mental health professional such as a psychologists or psychiatrist must be kept by the author and filed separately from the rest of the patient’s medical record to maintain a higher standard of protection.
Definition:
Psychotherapy notes means process notes (not progress notes) recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session for his or her use only, and are separated from the rest of the patient’s medical record.

## Psychotherapy Notes

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  Psychotherapy notes are defined in HIPAA’s privacy standards preamble as records that are kept by the mental health professional psychiatrist. They’re only used for that person’s purposes and so they are kept separate from the record and the mental health profession may choose to share them with the patient, but is not required to release them anyone else or to any other organization. 

## Psychotherapy Notes

- Psychotherapy Notes Do Not Include
- Medication Prescription & Monitoring
- Counseling Session Start & Stop Times
- Modalities & Frequencies of Treatment Furnished
- Results of Clinical Tests
- Summary of
- Diagnosis
- Functional Status
- Treatment Plans
- Symptoms
- Prognosis
- Progress to Date

**Disclosures**

**Notes:**
[NARRATOR] To further clarify, psychotherapy notes do not include information listed onscreen because it is included in the medical record. 

[TRAINER] Information other than psychotherapy notes that is included in the patient record includes
Medication prescription and monitoring;
Counseling session start and stop times;
The modalities & frequencies of treatment furnished;
Results of clinical tests; and
Any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, & progress to date.

## P & P for Psychotherapy Notes: Disclosureto Patient or Other

- Form 810 Must Be Dated & Signed by
- The Patient;
- Legal Guardian if Patient is Minor or Incompetent; or
- Patient’s Personal Representative
- Psychotherapy Notes Must Be Checked on Form 810
- Authorization Does Not Apply to Other Disclosures

**Disclosures**

**Notes:**
[NARRATOR] When disclosing psychotherapy notes to the patient or to another individual, Form 810 must be dated, signed by the patient, or patient’s personal representative, & the box for Psychotherapy Notes must be checked. The authorization should not be used in conjunction with other disclosures or uses.

[TRAINER] When disclosing psychotherapy notes to the patient or to another individual, the “Authorization for Use and Disclosure of Health Information”, Form IHS-810, must be dated, signed by the patient, legal guardian if the patient is a minor or incompetent, or the patient’s personal representative and the box for Psychotherapy Notes must be checked.  The authorization should not be used in conjunction with other disclosures or uses.

Check for updates on P&P for psychotherapy notes and, if they’ve been revised, have copy on hand during training.

## P & P for Psychotherapy Notes: No Authorization Required

- Use by the Originator of the Notes for Treatment
- Use or Disclosure for Supervised Mental HealthTraining Programs
- Use or Disclosure by IHS in Legal Action or Proceedings Initiated by the Individual

**Disclosures**

**Notes:**
[NARRATOR] The mental health professional who wrote and owns the psychotherapy notes does not need authorization to use & disclose those notes. Neither is an authorization required for use in supervised mental health training programs or by IHS in legal actions that are initiated by the patient to whom the notes pertain.

[TRAINER] An authorization is not needed to use and disclose psychotherapy notes for:
use by the originator of the notes for treatment;
use or disclosure for mental health training programs under supervision within the IHS facility;
use or disclosure by IHS in a legal action or other proceedings brought by the patient, in consultation with Office of the General Counsel.

[cont. on Next Screen]

## P & P for Psychotherapy Notes:No Authorization Required, Cont’d

- Use or Disclosure That Is Required by Law
- Authorized Disclosure to a Health Oversight Authority With Respect to the Oversight of the Originator of the Psychotherapy Notes and Used to Report a Serious and Imminent Threat to the Health and Safety of the Patient or a Third Party
- Disclosure Required by the Secretary of DHHS to Investigate IHS Facility Compliance With HIPAA
- Certain Disclosures about Deceased Patients to Coroners or Medical Examiners

**Disclosures**

**Notes:**
[NARRATOR] An authorization is also not required for uses as described on-screen. 

[TRAINER] 
An authorization is not needed to use and disclose psychotherapy notes for: cont. from previous screen

use or disclosure that is required by law, authorized disclosure to a health oversight authority with respect to the oversight of the originator of the psychotherapy notes, or use to report a serious and imminent threat to the health and safety of the patient or a third party 
disclosure required by the Secretary, DHHS to investigate IHS facility compliance with the HIPAA Privacy Rule.
certain disclosures to coroners or medical examiners about deceased patients to determine identity, cause of death, or to perform duties as authorized by law.

## Policy for Disclosure of Minors PHI 

- Procedure Is Governed by
- HIPAA Laws
- Applicable State Laws

**Disclosures**

**Notes:**
[NARRATOR] In addition to HIPAA requirements, it is important to know and understand state laws regarding the disclosure of a minor’s PHI. 

[TRAINER] PURPOSE:  To establish the policy and procedure for disclosing and providing access to protected health information (PHI) of un-emancipated minors under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Part 164; Privacy Act of 1974, 5 USC 552a; Privacy Act Regulations, 45 CFR Part 5b; Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; and the applicable law the state in which the IHS facility is located.

POLICY:  The Health Information Management (Health Records) Director or designee shall be responsible for determining whether or not to release the PHI of an un-emancipated minor to the minor or to the minor’s parent or legal guardian.  

The definition of a minor is that which is defined by law of the state in which the IHS facility is located. Provide information about state laws that apply to the facility in the state in which the facility is located if possible, or refer questions to area Health Information Management or Regional Counsel.

## Policy For Disclosure of Minors PHI 

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
ODIA:  If a minor wants to release information from his or her own record, they would generally complete IHS form 810, just like an adult would.  And whatever is released is governed by the applicable law in the area where the IHS facility is located.

## P&P for PHI of Minors: Request by Minor

- Minor Shall
- Designate a Review Representative
- Have Direct Access to PHI if Responsible Department Official (RDO) Determines There Will Be No Adverse Effect
- Provide Identification as Described in Individuals’ Rights to Access, Inspect & Obtain Copy of PHI

**Disclosures**

**Notes:**
[NARRATOR] Minors may have access to their own PHI when it has been determined that having the information will not have an adverse affect on them. The designation of a review representative and determination by the responsible departmental official are key to this procedure.
[TRAINER] 
A minor who requests access to his/her medical record shall, at the time of the request, designate a representative in writing (e.g., physician or other health representative or responsible person), who would be willing to review the record and inform the minor of its contents at the representative’s discretion.
The minor will be granted direct access to his/her medical record if the Responsible Department Official ( e.g., Health Records Director) determines that direct access is not likely to have an adverse effect on the minor. 
If the Responsible Department Official believes s/he is not qualified to determine, or has determined, that access by the minor is likely to have an adverse effect on the minor, the record will be sent to the designated representative.  The minor will be informed in writing that the record has been sent. 
[Trainer, at your discretion, and with input from Area Health Information Management and/or Regional Counsel, may want to offer trainees appropriate information about how to review and/or provide information to minor in ways that will limit/minimize the adverse effect.]

## P&P for PHI of Minors: Parents, Guardian, or in Loco Parentis

- Requests Must Comply with Verification of Identify Policy & Procedure
- Parent or Guardian Shall Designate Health Professional to Whom Records Will Be Sent
- Designated Health Professional Makes Judgment As to Whether Invasion of Privacy Is an Issue
- Reasonable Efforts Will Be Made to Inform the Minor

**Disclosures**

**Notes:**
[NARRATOR] Sometimes the request for a minor’s protected health information comes from parents or someone acting in place of the parents. State law, as well as HIPAA requirements determine how these requests are handled. Proper verification of ID is required.
[TRAINER] Requests for health information by parent, guardian, or individual acting in loco parentis, cont.
Where a health record on an un-emancipated minor exists, it will be sent to the designated health professional.  However, if the parent, guardian or in loco parentis had consented to the treatment documented in the health record being requested, then the parent may have direct access to such PHI in accordance with the Privacy Act.  
If the disclosure of the record would constitute an invasion of the minor’s privacy, that fact will be brought to the attention of the designated health professional who will be asked to consider the effect that disclosure of the record to the parent, guardian or in loco parentis would have on the minor in determining whether the record should be made available to the parent, guardian or individual acting in loco parentis.
In cases in which the minor’s record is sent to the designated health professional, the requestor will be notified of this action, and reasonable efforts will be made to inform the minor.
All requests must comply with P&P on Verification of ID

## P&P for PHI of Minors: Request by Parents, Guardian, or in Loco Parentis

- Where Law Prohibits, IHS Shall Not Disclose the Minor’s PHI to
- 	the Parent, Guardian or *in Loco Parentis*
- Where State Law Permits, IHS May Disclose the Minor’s PHI to
-  	the Parent, Guardian or *in Loco Parentis* Unless
- Parental Rights Have Been Terminated
- Disclosure Might Endanger Minor
- Disclosure is Not In Best Interest of Minor

**Disclosures**

**Notes:**
[NARRATOR] State laws vary significantly. Make sure you know whether state law prohibits or permits disclosure to parents, guardians, or anyone acting in the parental role. 

[TRAINER]
If the applicable law prohibits disclosure of a minor’s PHI to the parent or guardian of the minor, IHS shall not disclose the minor’s PHI to the parent, guardian or in loco parentis.
If the applicable law permits or requires disclosure of a minor’s PHI to the parent or guardian of the minor, or there is no state law, IHS may disclose the minor’s PHI to the parent or guardian, following the above procedures, unless:
The parent or guardian or individuals acting in loco parentis lacks authority to act on behalf of the minor (for example, where parental rights have been terminated);
A physician or health professional determines in writing that disclosure of the PHI to the parent, guardian or in loco parentis would constitute an unwarranted invasion of the minor’s privacy, there is a reasonable belief that such disclosure might endanger or cause harm to the minor, or such disclosure would otherwise not be in the best interest of the minor;
[Cont. on Next Slide]

## P&P for PHI of Minors: Request by Parents, Guardian, or in Loco Parentis

- Where State Law Permits, IHS May Disclose the Minor’s PHI to the Parent or Guardian Unless **(cont.)**
- Minor Has Consented to Service Where Parental Consent is Not Required Under State Law
- Minor Has Requested Parent/Guardian Not Be Treated as Personal Representative
- Parent/Guardian Agrees to Agreement of Confidentiality between IHS and Minor
- The Health Information Management Director or Designee Shall Determine Whether or Not to Release a Minor’s PHI to the Minor’s Parent or Guardian

**Disclosures**

**Notes:**
[NARRATOR] State laws vary significantly. Make sure you know whether state law prohibits or permits disclosure to parents, guardians, or anyone acting in the parental role. 

[TRAINER]
[Cont’d from Previous Slide]

The minor has consented to a health care service for which parental consent is not required under the law of the State in which the facility is located, and the minor has not requested that the parent, guardian or in loco parentis be treated as his personal representative; 
The parent or guardian agrees to an agreement of confidentiality between IHS and the minor.  Such an agreement should be documented in the minor’s health record; or
The Privacy Act otherwise prohibits the disclosure.

## P&P for PHI of Minors:Request Requirements

- Acceptable Request Submissions
- Form IHS-810
- Written Letter From the Parent/Legal Representative
- A Valid Authorization for Disclosure of PHI From Another Entity

**Disclosures**

**Notes:**
[NARRATOR] The procedure for requesting minors’ PHI is the same as other requests for disclosure.

[TRAINER] All requests must contain the following:
Original signature of the minor patient and/or the parent or guardian, as appropriate;
Date of signature;
Description of information requested; and
Purpose of the disclosure.  [TRAINER PLEASE NOTE: This is not included on-screen because while it is still included in the official P&P. It is generally believed that, just like the Adult request for Disclosures, the patient is not required to include a purpose, as is stated on following screen.  Contact Regional Counsel or Area Health Management Information Consultant with any questions.]

The original authorization or written request will be filed in the minor patient’s health record.

## P&P for PHI of Minors:Request Requirements 

- All Requests Must Have
- Original Signature of the Parent or Legal Representative
- Date of Signature
- Description of Information Requested

**Disclosures**

**Notes:**
[NARRATOR] All requests for a minor’s PHI must contain the original signature of the parent or legal representative, date of signature, and description of information requested. 

[TRAINER] Purpose for request is not required.  

The information released will be documented in the Disclosure Accounting Record, IHS-505  or electronically using the Release of Information (ROI) software package.  See the Policy and Procedures for Matters Related to Accounting of Disclosures of Protected Health Information for guidance.
All requests for notification or access to a minor’s record will comply with the Policy and Procedures on Verification of Identity Prior to Disclosure of Protected Health Information.

## P&P for PHI of Minors: Other

- Subpoena/Court Order: Contact Area Health Record Consultant for Guidance Before Release
- Law Enforcement: Process Pursuant to Requirements of Law Enforcement Exception
- Law Firms & Insurance Companies: Original Signed Authorization by the Individual, Parent, or Guardian Must Accompany Request
- Medical Examiners: Access to Relevant Information Granted for Performance of Duties As Required by Law

**Disclosures**

**Notes:**
[NARRATOR] When requests for PHI come from the judicial system, courts, law enforcement officials, attorneys, insurance companies or medical examiners, process those requests as described on-screen.
[TRAINER]
Requests for health information by other third parties
Subpoena/Court Order: Upon receipt of a subpoena/court order for a minor’s health record, the Area Health Records Consultant must be consulted before any release is made.
Law Enforcement: Requests from law enforcement will be accomplished pursuant to the requirements of the law enforcement exception contained in the Privacy Act, 5 USC § 552a (b)(7) and HIPAA Privacy Rule, 45 CFR § 164.512 (f)(1)(ii)(C).
Law Firms or Insurance Companies: An original signed authorization by the minor patient must accompany the request.  An authorization from the parent or legal guardian or individuals acting in loco parentis will not be accepted.  If the parent or legal guardian wishes to disclose health records to a third party (e.g., attorney or insurance company), then the parent or legal guardian must request access to the minor’s health record following the procedures in the policy and procedure. 
Medical Examiners: May access relevant health information about deceased minors in the performance of their duties when required by applicable law.

## P&P for PHI of Minors:

- Prohibition-Redisclosure Statement
*	**“**This information is intended only for the use of the person or office to which it is addressed, and contains privileged or confidential information protected by law.  Unauthorized re-disclosure, distribution, or copying of this communication is strictly prohibited from disclosing this health information to any other party unless required by law.”*
- File Original Authorization or Written Request in Patient’sHealth Record
- Document Information Released in the Disclosure Accounting Record IHS-505

**Disclosures**

**Notes:**
[NARRATOR] Disclosure of Minor’s PHI must contain the Prohibition Redisclosure Statement that appears on screen. Once processed, the authorization is filed in the patient’s health record and the information released is documented in the accounting of disclosures log. 

[TRAINER] Prohibition-Redisclosure Statement 
	“This information is intended only for the use of the person or office to which it is addressed, and contains privileged or confidential information protected by law.  Unauthorized re-disclosure, distribution, or copying of this communication is strictly prohibited from disclosing this health information to any other party unless required by law.”
The information released will be documented in the Disclosure Accounting Record, IHS-505 or electronically using the Release of Information (ROI) software package.  See the Policy and Procedures for Matters Related to Accounting of Disclosures of Protected Health Information for guidance.
All requests for notification or access to a minor’s record will comply with the Policy and Procedures on Verification of Identity Prior to Disclosure of Protected Health Information.

## P&P for PHI of Minors: Alcohol/Drug Abuse 

- Release of PHI to Minor
- Where Law Does Not Require Parental or Guardian Consent, Access May Be Given Only by the Minor Patient
- Where Law Requires Parental or Guardian Consent, Authorization Must Be Obtained from both Minor & Parentor Guardian

**Disclosures**

**Notes:**
[NARRATOR] Laws regarding release of minors’ alcohol and/or drug abuse health information vary. Refer questions to your Area Health Information Manager. 

[TRAINER] 
If applicable law does not require the parent or guardian or individual acting in loco parentis consent for the minor to receive alcohol/drug abuse treatment, written authorization for disclosure may be given by, and access may be provided to, the minor patient only.

If applicable law requires the parent, guardian, or individual acting in loco parentis  to consent for the minor to receive alcohol/drug abuse treatment, written authorization for disclosure of the minor’s records must be given by both the minor and the parent/guardian or individual acting in loco parentis.

## P&P for PHI of Minors: Alcohol/Drug Abuse

- Minor’s Application for Treatment May Be Communicated to the Parent, Guardian, or Other Authorized Person
- With Minor’s Written Consent for Disclosure
- If Minor Lacks Capacity to Make a Rational Choice Regarding Consent
- As Allowed or Prohibited by State Law
- With Unique Federal Court Order
- After Consultation with IHS Regional Attorney
- Minor’s Application for Treatment May Not Be Disclosed to Law Enforcement

**Disclosures**

**Notes:**
[NARRATOR] Unless the minor lacks the capacity to make a rational decision, or in other circumstances as described on screen, the fact that a minor has applied for alcohol or drug abuse treatment can only be released to the parent, guardian, or other authorized person with the minor’s written consent. A minor’s application for treatment may not be disclosed in response to a law enforcement request. 
[TRAINER] 
Where applicable law requires parental consent to alcohol/drug abuse treatment, a minor’s application for such treatment may be communicated to the parent, guardian, or other authorized person only if:  (i) the minor has given written consent to the disclosure of the application; or (ii) the minor lacks the capacity to make a rational choice regarding such consent (e.g., due to extreme youth or mental or physical condition).
Alcohol/drug abuse records may only be disclosed pursuant to the minor patient’s authorization (and/or authorization by parent, guardian, or individual acting in loco parentis), unique Federal court orders, and in other limited circumstances.  Such records shall NOT be disclosed pursuant to a law enforcement request.  
Any requests for disclosure of a minor’s alcohol/drug abuse records should be reviewed in consultation with the appropriate Office of General Counsel.

## P&P for PHI of Minors: Un-Emancipated Minors

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
PAUL ADAIR MOBLEY, DO - Clinical Director, Claremore Indian Hospital
Release of information from a minor varies from, I know, from state to state, and it would also depend on whether it was routine information or if it was due to the patient becoming emancipated. 

WILLIAM L. BUCHANAN, DO – Doctor of Osteopathy, Claremore Indian Hospital
Most specifically an emancipated minor is someone who’s married, or someone who’s a parent of a child, even though they’re, you know, under age 18, we consider that they are emancipated. They can be treated legally as an adult. 

KIHEGA:  Sometimes minors are declared emancipated if they went to court and been officially declared emancipated through the court system or by virtue of being pregnant or if they’re married. 

## P&P for PHI of Minors: Un-Emancipated Minors

- Determination of Whether or Not an Individual Is an Emancipated or Un-Emancipated Minor Is Determined in the State in Which the IHS Facility Is Located

**Disclosures**

**Notes:**
[NARRATOR] In all cases, the determination of whether or not an individual is an emancipated or un-emancipated minor shall be determined by the law of the state in which the facility is located. 

[TRAINER] 
The definition of a minor is that which is defined by State law of the state in which the IHS facility is located. 

[TRAINER] Our training does not include information about each state’s specific laws, and you must be familiar with the laws in your own state before acting on any request involving un-emancipated minors. If minor is in the military, State Law determines whether or not the minor is emancipated.

## P&P for Minimum Necessary

- Limit the Use & Disclosure of PHI to the Minimum Necessary Except to
-  The Patient Requesting Own PHI
-  Pursuant to a Valid Authorization
- CEO or Service Unit HIPAA Coordinator Identifies Level of Access for Staff

**Disclosures**

**Notes:**
[NARRATOR] Unless disclosing his or her own PHI to the patient, or to an entity the patient has requested via a valid authorization, IHS must make reasonable efforts to limit the use & disclosure to the minimum necessary in order to accomplish the intended purpose. The facility CEO or Service Unit HIPAA Coordinator may identify under what conditions staff need access, and the level of access individual staff members may have.
[TRAINER]  PURPOSE:  To establish the policy and procedure for limiting to the minimum necessary:  (1) the use or disclosure of protected health information (PHI); and (2) PHI requested by IHS from other health care providers and health plans. 
POLICY:  The health record shall be maintained confidentially and shall not be disclosed except as provided by the Privacy Act of 1974 (5 U.S.C. 552a), the Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule (45 C.F.R. 164), the Freedom of Information Act (5 U.S.C. 552) and other relevant HHS and IHS regulations and guidance.
IHS must make reasonable efforts to limit the use and disclosure of and requests for PHI to the minimum necessary in order to accomplish the intended purpose of the use, disclosure, or request, except to the subject patient, or pursuant to a valid authorization. The Service Unit Director/Chief Executive Officer (SUD/CEO) or Service Unit HIPAA Coordinator shall identify, in writing, individual staff or classes of staff who have a need to know for access to PHI in order to perform their official duties.

## P&P for Minimum Necessary

- IHS Determines What Is Minimum Necessary, but May Rely on the Judgment of
- Public Official
- Another Healthcare Provider, Health Plan or Healthcare Clearinghouse
- Professional Who Is Employee or Contractor of IHS
- Researcher with Appropriate Documentation From IRB

**Disclosures**

**Notes:**
[NARRATOR] IHS retains right to determine what is the minimum necessary disclosure, but may rely on the judgment of others as described on-screen.

[TRAINER]
The SUD/CEO or Service Unit HIPAA Coordinator shall identify, in writing, the category or categories of PHI for each staff person or class of staff who have a need to know for access, and any conditions appropriate for such access.
Although IHS retains the right to make its own minimum necessary determination for disclosures, IHS may rely on the judgment of the party requesting the disclosure as to the minimum amount of information needed, when the request is reasonable and made by:
A public official for a disclosure permitted under 45 CFR 164.512 (Uses and disclosures for which an authorization or opportunity to agree or object is not required), if such official represents that the information requested is the minimum necessary for the stated purpose;
Another covered health care provider, health plan, or health care clearinghouse;
A professional who is an employee or contractor (business associate) of IHS, for the purpose of providing professional services to IHS, if the professional represents that the information requested is the minimum necessary for the stated purpose; or
A researcher with appropriate documentation from an Institutional Review Board or Privacy Board.

## P&P for Minimum Necessary

- When Requesting PHI From Others, IHS Must Limit Request to That Which Is Necessary to Accomplish Purpose
- Entire Medical Record Shall Only Be Disclosed Upon Justified Request
- SUD/CEO-Designated Person Shall Monitor Compliance with the “Minimum Necessary” Requirement

**Disclosures**

**Notes:**
[NARRATOR] The same guidance regarding minimum necessary disclosure applies when IHS requests  PHI from other providers or facilities. 

[TRAINER] 
When requesting PHI from other covered entities, IHS must limit any such request to that which is reasonably necessary to accomplish the purpose for which IHS is making the request.
For requests made on a routine and recurring basis (for example, CHS referrals), IHS must limit the PHI requested to the amount reasonably necessary to accomplish the purpose for which the request is made.  
All other requests must be reviewed on an individual basis to determine that the PHI sought is limited to the information reasonably necessary to accomplish the purpose for which the request is made.
The entire medical record shall only be disclosed when specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.
The responsible IHS staff person, as designated by the SUD/CEO shall monitor compliance with the “minimum necessary”.

## P&P for Minimum Necessary

- Does Not Apply to Requests/Disclosures
- By Healthcare Providers for Treatment Purposes
- With Valid Patient Authorization
- If Required by Statutes & Regulations
- If Required for Compliance with Standard HIPAA Transactions
- To Secretary of DHHS, or as Required by HIPAA

**Disclosures**

**Notes:**
[NARRATOR] The minimum necessary rule does not apply to disclosures described on-screen. 

[TRAINER] The “minimum necessary” requirement does not apply to:
Disclosures to or requests by a healthcare provider for treatment purposes;
Disclosures to the patient; 
Uses or disclosures made pursuant to a valid authorization, IHS-810 signed by the patient or personal representative, so long as the use or disclosure is consistent with the authorization;
Uses or disclosures that are required by statutes and regulations (unless prohibited by the Privacy Act);
Uses or disclosures required for compliance with standard HIPAA transactions or other HIPAA Administrative Simplification regulations;
Disclosures to the Secretary, Department of Health and Human Services, required under HIPAA for enforcement purposes.

## P&P for Disaster Relief 

- IHS May Use or Disclose PHI During Disaster and/or Disaster Relief Situations to
- Government Agencies Engaged in Disaster Relief Activities
- Private Disaster Relief or Disaster Assistance Agencies

**Disclosures**

**Notes:**
[NARRATOR] IHS may use PHI in the case of a disaster. A disaster is any event that overwhelms normal medical capability of the local facility and that triggers mass casualty medical readiness. Facility leadership, Tribal, County, State, or Federal officials are authorized to declare an emergency situation. 

[TRAINER] 
PURPOSE:  To establish a policy and procedure on the use and disclosure of protected health information for disaster relief purposes.

POLICY:   IHS may use or disclose protected health information (PHI) during disaster and disaster relief to government agencies (federal, state, local, or tribal) engaged in disaster relief activities, as well as to private disaster relief or disaster assistance organizations (e.g., Red Cross) authorized by law or by its charter to assist in disaster relief efforts, for the purposes of coordinating such efforts to allow them to carry out their responsibilities.
Disaster:  For the purpose of this policy, a disaster is any event that overwhelms normal medical capability of the local facility and that triggers mass casualty medical readiness of the facility.  A disaster may be declared by the facility leadership or by the tribal, county, state and federal government.

## P&P for Disaster Relief 

- If Patient is Present
- Provide Opportunity for Patient to Object or Obtain Patient Agreement
- Complete Verification of Identity Prior to Disclosing PHI
- Document Verification in Health Record
- If Patient is Not Present or is Incapacitated
- Use Professional Judgment
- Disclose Only Relevant PHI
- Complete Verification of Identity Prior to Disclosing PHI
- Document Verification in Health Record

**Disclosures**

**Notes:**
[NARRATOR] IHS may use or disclose PHI in the case of a disaster to identify and notify family members, personal representatives, patients, or others responsible for the care of patients, to determine a patient’s location, or to notify others of general condition or death of a patient. The procedure for use or disclosure when the patient is present, as well as if the patient is not present or is incapacitated is described on-screen.  Follow previously described procedures for verification of identity. 
[TRAINER] Procedures:
Notification:  IHS may use and disclose PHI for the purpose of notification or assisting in notification and identification or location of a family member, personal representative of the patient, or another person responsible for the care of the patient, of the patient’s location, general condition, or death.
If patient is present, IHS will release information if:
obtains patient’s agreement;
provides patient opportunity to object and patient does not; or
reasonably infers from circumstances, based on professional judgment, that patient does not object.
If patient is not present, or is not possible due to patient’s incapacity or emergency condition:
IHS provider, using professional judgment, may determine that is in best interests of patient, and only use or disclose PHI that is directly relevant to government agency’s or disaster relief organization’s involvement with the patient’s health care; and
must comply with above to the extent that it does not interfere with ability to respond to emergency circumstance.
Verification of Identity should be completed prior to disclosing PHI of patient.
Disclosures for disaster relief should be documented.
Discuss applicable events, or possible events with trainees.

## P&P for Disaster Relief 

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
ODIA:  During a disaster relief effort if a patient had to be transferred to another facility for treatment purposes, we would release patient information for treatment purposes.  However, we’ll release only the minimum necessary for the treatment of that patient without authorization from the patient.

## Q&A 

**Disclosures**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 90

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## P&P for Correction/Amendment

- Understanding Form IHS-917
- Helping Patient Fill Out Form IHS-917
- Execution of Approvals
- Execution of Denials
- Appeals and Complaints

**Corrections**

**Notes:**
[NARRATOR] In this section we will review form IHS-917, the Request for Correction and/or Amendments to PHI. You will also learn how to help patient obtain & fill out the form, & become familiar with all of the associated policies & procedures. 

## P&P for Correction/Amendment

**Corrections**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  The patient has the right to request a correction or amendment to the protected health information if they feel that the information is incorrect or incomplete.

KIHEGA:  You know, if they come in and their left arm was hurting and we wrote down right arm, we’re going to probably change those things. A lot of patients want to change medical opinions and judgments, psychiatric opinions and judgments, those things won’t be changed but they do have a right to request that it be changed and we will file that request in the medical record whether or not we agree to amend or correct that record. IHS cannot change, or amend, information created by another provider or facility, because we have no idea of knowing what is correct.

## P&P for Correction/Amendment

**Notes:**
[NARRATOR] Form IHS-917 must be completed, dated, and signed in ink with an original signature prior to correcting or amending health information. The form should be filled out using black ink, and forms filled out in red ink will not be processed. 

## P&P for Correction/Amendment

- Patient Must Complete Form IHS-917
- All Requests Must Be Made in Writing
- SUD/CEO Will Date Stamp the Form
- Patient Receives Copy of Date Stamped Form within 10 Business Days
- If Decision Can Be Made Within 10 Business Days, Patient Will Be Notified at the Same Time He/She Receives Copy of Form 917

**Corrections**

**Notes:**
[NARRATOR] Patients have the right to request corrections or amendments to their PHI. If a patient believes his or her information is inaccurate or incomplete, they may fill out and submit form IHS-917. The procedure for processing the request is described on screen. 

[TRAINER] 
A patient who believes his/her health information is inaccurate or incomplete may submit a request to the Service Unit Director/Chief Executive Officer (SUD/CEO) or designee for amendment of the record in question.
The patient must complete IHS Form 917, Request for Amendment of Protected Health Information.  All requests must be in writing unless the patient makes a request in person and the SUD/CEO or designee amends the record at that time.
The SUD/CEO or designee receiving the request will date stamp IHS Form 917.
The patient must receive a date stamped copy of the completed IHS Form 917 as an acknowledgement of the receipt of the request within 10 working days.
If a decision on the request for amendment can be made within 10 working days of IHS’ receipt of the request, then IHS will simultaneously notify the patient of the receipt and its decision within that 10-day period.

## P&P for Correction/Amendment

- If Patient Requests Changes to PHI Created by Another Agency, IHS Will Forward Request to That Agency
- Patient Will Be Notified of Approval or Denial Within 60 Days After Receipt of Request
- IHS May Extend Time Period for 30 Days As Allowed by Law
- If IHS Extends Time Period, Patient Will Be Notified of Reasons & Date Request Will Be Acted Upon
- Only One 30 Day Extension Is Allowed
- File Form at Site of Contested Entry in the Health Record & Maintain for Life of Health Record

**Corrections**

**Notes:**
[NARRATOR] If the patient requests that IHS change information that was created by another facility or provider, IHS will make every effort to forward the request to the appropriate entity. Otherwise, patients will be notified of approval or denial within 60 days after receipt of request, unless IHS extends time period for 30 days as allowed by law.  If IHS extends the time period, the patient will be notified of the reasons, and the date request will be acted upon.
[TRAINER]
If the patient requests amendment of records that are governed by the regulations of another government agency, IHS will forward the request to that agency, and patient will be notified of that referral.
The patient will be notified of the acceptance or denial of the request within 60 days after receipt of the request, unless IHS extends the time period for no more than 30 days as allowed by law.  If IHS extends the time period, the patient will be notified of the reasons for the extension and the date by which IHS will act on the request.
The SUD/CEO or designee in consultation with the appropriate staff member will review the request for amendment and will inform the patient within sixty (60) days, for approval or denial.  IHS may extend the time frame one time only for no more than 30 days if it informs the patient of the reasons for the delay and the date by which IHS will act on the request.
The IHS Form 917 will be filed at the site of the contested entry in the health record and maintained for the life of the health record.

## P&P for Correction/Amendment

- Execute Approved Corrections As Follows:
- Without Erasure or Other Obliteration
- Use Single Line Through Incorrect Data
- Correct the Information
- Add Reason for the Correction
- Include Date & Corrector’s Signature

**Corrections**

**Notes:**
[NARRATOR] If the request is approved, follow the directions as listed on screen to make the correction or add the amendment. You may not erase information that exists in the record in order to make a correction.

[TRAINER]
Correction of medical record data shall be accomplished as follows:
No erasure or other obliteration shall be made.
Incorrect data shall be lined out with a single line.
The date of amendment, the signature of the person making the amendment, the amended information, and the reason for the amendment shall be added.

Providers may correct their own information. This applies to patient-requested corrections or amendments.

## P&P for Correction/Amendment

- With Patient Approval, Submit Correction to Persons/Organizations
- That Received Information in the Past
- That May Have Relied, or May Rely in the Future, on the Information
- Are Identified by the Patient As Needing the Correction or Amendment
- With Required Statement “This Is an Amendment to the Information That Was Previously Sent on ________Date___________._”
- Document the Correction in the Accounting Disclosure Record
- Notify the Patient in Writing of Approval

**Corrections**

**Notes:**
[NARRATOR] If the correction or amendment needs to be sent to someone else or another organization who may have received the information in the past, or who may rely on that information in the future, obtain the patient’s agreement and provide the information using the procedure described on-screen. 

[TRAINER]
Subject to the individual’s agreement, the amended information will be provided: (a) to persons/organizations that IHS knows received the information in the past and who may have relied or may foreseeably rely on such information to the detriment of the patient; and (b) to those persons/organizations identified by the patient as having received the health information and needing the amendment.  When such information is sent, it should be accompanied by a statement, “This is an amendment to the information that was previously sent on _______date___________.” 
Disclosure of the amended health information will be documented manually or electronically in the Accounting Disclosure Record.
The patient will be notified in writing that the request for amendment of the health information has been approved. 

## P&P for Correction/Amendment

- Execute Denial As Follows:
- SUD/CEO or Designee Documents Denial on
- 	Form IHS-917
- Send Copy to Patient Within 60 Days
- File Original Form in Health Record_ _

**Corrections**

**Notes:**
[NARRATOR] If the request for correction or amendment is denied, in whole or in part, the denial must be documented on Form 917, and a copy sent to the patient within 60 days. The original form is filed in the patient’s health record. 

[TRAINER]
If denied: 
If the request for amendment is denied, in whole or in part, the SUD/CEO or designee will document the denial on IHS Form 917 and a copy of the form will be sent to the patient within 60 days. The original form will be filed in the appropriate health record also will be notified of applicable appeal rights. 

## P&P for Correction/Amendment

- IHS Will Only Deny a Request for Correction or Amendment Because
- The Health Information Is Not Part of IHS’s Designated Record Set
- IHS Did Not Create the Record
- The Record Is Not Available to the Patient Under Federal Law
- The Record Is Accurate & Complete

**Corrections**

**Notes:**
[NARRATOR] IHS will only deny a request for correction or amendment if the health information is not part of IHS’s designated record set, if IHS did not create the original record, if the record is not available to the patient under federal law; or if the record is accurate & complete. 

[TRAINER] IHS will only deny a request for amendment for the following reasons: 
the health information is not part of the IHS’s designated record set;
IHS did not create the record;
the record is not available to the patient under federal law; or
the record is accurate and complete. 

NOTE: Patient owns the information in their health record, but IHS owns the physical record. If the information is not a part of the IHS physical record or designated record set, they will deny the request.

## P&P for Correction/Amendment

- If IHS Did Not Create the Record at Issue and the Originator of the Health Information Is No Longer Available to Act on the Request, IHS Will Address
- Notification of Denial Must Include Notification of Right to Appeal

**Corrections**

**Notes:**
[NARRATOR] If the correction or amendment refers to a record that IHS did not create and the patient provides a reasonable basis to believe that the originator of the health information is no longer available to act on the request, IHS will address the request.  If a request is denied, the patient must be notified that they have a right to appeal as well as the procedure to appeal. 

[TRAINER] Offer examples in which IHS can, and cannot, address the request. For instance, if the facility at which the record resides is still in existence, or no longer in existence. If it no longer exists, then IHS can have no knowledge of what is, or is not, correct.

[From Procedure] However, if IHS did not create the record at issue, but the patient provides a reasonable basis to believe that the originator of the health information is no longer available to act on the request, IHS will address the request.  When the patient is notified of the denial of his/her request, he/she also will be notified of applicable appeal rights. 

## P&P for Correction/Amendment

- Appeal Rights: Non-US Citizen
- Patient May Submit a Written Description of the Disagreement
- IHS May Prepare a Written Rebuttal to Patient’s Statement
- IHS Will Provide Patient a Copy of the Rebuttal
- IHS Written Rebuttal Is Not Subject to Correction or Amendment

**Corrections**

**Notes:**
[NARRATOR] Non-US Citizens may appeal a denial for correction or amendment. If the patient submits a description of the disagreement to the SUD/CEO for appeal, IHS may rebut the patient’s statement and no further appeal is allowed by law. The patient’s submission, as well as IHS’s rebuttal are filed in the health record, and at the patient’s request, must be disclosed with other PHI disclosures that relate the issue in dispute. 

[TRAINER]
If the patient is not a U.S. citizen or legal alien admitted for permanent residence and the request is denied:
He/she may submit to the SUD/CEO or designee a written statement (reasonable in length) disagreeing with the denial and the basis of such disagreement.  The law does not allow any further appeal.
IHS has the right to prepare a written rebuttal to any statement of disagreement.  IHS will provide a copy of any rebuttal statement to the patient. Any written rebuttal prepared by IHS is not subject to correction or amendment.

[Cont. on Next Slide]

## P&P for Correction/Amendment

- Appeal Rights: Non-US Citizen** (cont.)**
- IHS Must Include Patient Statement, or Accurate Summary, with  Subsequent Disclosures of PHI to Which the Disagreement Relates
- If the Patient Has Not Submitted a Written Statement of Disagreement, Patient May Request that the Request for Amendment, Denial, and/or  Accurate Summary Be Included with Future PHI Disclosures that Relate to the Requested Action

**Corrections**

**Notes:**
[NARRATOR]No Narration

[TRAINER]
If the patient is not a U.S. citizen or legal alien admitted for permanent residence and the request is denied [Cont. from Previous Slide]
If the patient has submitted a statement of disagreement, IHS must include such statement or an accurate summary thereof with any subsequent disclosure of the health information to which the disagreement relates.  
If the patient has not submitted a written statement of disagreement, IHS must include the patient’s request for amendment and its denial, or any accurate summary of such information, with any subsequent disclosure of the health information only if the patient has requested such action. 

## P&P for Correction/Amendment

- Appeal Rights: US Citizens/Legal Aliens
- Patient May Appeal the Refusal to Correct or Amend the Requested Information to the Area Director
- Area Director Must Act on the Appeal Within 30 Working Days of the Patient’s Appeal
- Area Director May Extend the Period for an Additional 30 Working Days for Good Cause
- Area Director Will Inform the Patient in Writing of Any Extension of the Appeal Period & Reason(s) for the Delay

**Corrections**

**Notes:**
[NARRATOR] If the patient is a U.S. citizen or legal alien, he or she may appeal a refusal to correct or amend to the Area Director, who must act on the appeal within 30 days, or extend the period, if there is good cause, for an additional 30 days. The patient must be made aware, in writing, of any extensions and reasons for them. 

[TRAINER]
If the patient is a U.S. citizen or alien admitted for permanent residence, 
He/she may appeal the refusal to amend the requested information to the Area Director.  The Area Director must act on the appeal within 30 working days of the patient’s appeal, unless the Area Director extends the period for up to an additional 30 working days for good cause. 
The Area Director will inform the patient in writing of any extension of the appeal period and the reason(s) for the delay. 

## P&P for Correction/Amendment

- If Area Director Denies Appeal, or Patient Elects Not to Appeal
- Area Director Will Patient in Writing of the Reasons for Denial
- Area Director Will Advise Patient of His/Her Rights to Submit a Written Statement of Disagreement & to Seek Judicial Review of Denial
- Patient May Submit a Statement of Disagreement
- If the Patient Submits a Written Statement of Disagreement
- Statement & Area Director’s Reasons for Denying Appeal (If an Appeal Was Filed) Will Be Sent to Recipients of Disputed Record, Where an Accounting of the Previous Disclosure
- 	Was Made

**Corrections**

**Notes:**
[NARRATOR] If the patient does not appeal or the appeal is denied, the patient must be informed in writing and advised that he or she has the right to seek a judicial review and to submit a statement of disagreement. When a patient does appeal, the statement of disagreement and the Area Directors reasons for denial will be provided to organizations that previously received the disputed information. 
[TRAINER] In the event the Area Director denies the appeal, or if the patient elects not to appeal, he/she may submit a statement of disagreement in accordance with paragraph 1 in this section of the policy.
When an appeal is denied, the Area Director will inform the patient in writing of the reasons for the denial, and advise the patient of his/her rights to submit a written statement of disagreement and to seek judicial review of the denial. 
If the patient submits a written statement of disagreement, such statement along with a statement of the Area Director’s reasons for denying the appeal (if an appeal was filed) will be provided to previous recipients of the disputed record where an accounting of the previous disclosure was made. 
TRAINER: ADDITIONAL FROM P&P: Any request for correction/amendment and any subsequent information pertaining to such request will become part of the patient’s permanent health record.
A patient who receives a denial of his/her request for amendment has the right to submit a written statement of disagreement to the SUD/CEO or designee, within 30 days of the denial. 
The SUD/CEO or designee must respond to any written statement of disagreement within thirty (30) working days from receipt of the patient request for appeal.

## P&P for Correction/Amendment

- Patients May File Complaints About IHS Policies & Procedures with
- Service Unit Director
- Secretary of Department of Health & Human Services
- Patients Who Receive a Denial of His/Her Request for Correction/Amendment May Submit a Written Statement of Disagreement to the SUD/CEO or Designee Within
- 	30 Days of Denial

**Corrections**

**Notes:**
[NARRATOR] If the patient has a complaint about IHS’ policies & procedures regarding health information, he/she may file such a complaint with the Service Unit Director or with the Secretary, Department of Health & Human Services in Washington DC. The request form and all subsequent information become part of the patient’s permanent health record. Patients have the right to submit a statement of disagreement and IHS must respond to the complaint using the procedure described on screen. 

[TRAINER]
A patient who receives a denial of his/her request for correction/amendment has the right to submit a written statement of disagreement to the SUD/CEO or designee, within 30 days of the denial. 

## P&P for Correction/Amendment (cont.)

- The SUD/CE0 or Designee Must Respond to Complaint Within 30 Working Days From Receipt of Patient Request for Appeal
- Altered Model Response Letters Should Be Reviewed by Legal Counsel Prior to Use

**Corrections**

**Notes:**
[NARRATOR] No Narration

[TRAINER]
The SUD/CEO or designee must respond to any written statement of disagreement within thirty (30) working days from receipt of the patient request for appeal.
The patient also has the right to file a complaint directly to the Secretary, Department of Health & Human Services (DHHS), Washington, D.C. 20201.
Following in the Policy and Procedures is the sample letters that address each of these.  The individual Service Units may alter the model letters, but they should then be reviewed by their legal counsel. 

## P&P for Correction/Amendment

**Corrections**

- Video – See Transcript in Notes Below

**Notes:**
HEFLEY: A patient has the right to ask that their record be corrected or amended if they feel as if something is inaccurate in it. For instance, we had a patient that applied for life insurance. One of our nurses had inadvertently put in her record that she was a smoker when she was not and she was denied life insurance based on that fact. She came to our office and put in writing that she was not a smoker and that she would like that to be corrected. We went to the nurse and the nurse made the correction in the chart that the patient was not a smoker. 

KIHEGA:  We have model letters that go out to the patient regarding correction amendment of the medical record or protected health information. Those were reviewed by legal counsel. We suggest that anybody that utilizes those forms that they don’t change any word, any sentence at all, unless you have them reviewed by your own local counsel. 

TRENT:  If you were to change the language of the model letters you may be at risk of omitting or even adding information that is in violation of the statute. 

## Q&A 

**Corrections**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 109

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## P&P for Restrictions

- Understanding Form IHS-912-1
- Helping Patient Fill Out Form IHS-912-1
- Patient Rights
- Approved Restrictions
- Directories

**Restrictions**

**Notes:**
[NARRATOR] In this section we will review form IHS-912-1, the Request for Restrictions to PHI. You will also learn how to help patient obtain & fill out the form, & become familiar with all of the policies & procedures associated with Restrictions. 

[TRAINER] Make clear to trainees that patients must be told that IHS will make a reasonable effort to comply with all patient requested restrictions.

## P&P for Restrictions

**Restrictions**

- Video – See Transcript in Notes Below

**Notes:**
GEORGE CHIARCHIARO, DDS, MHA –Co-Chair HIPAA Committee in Oklahoma Area:
Patients can ask for any kind of a restriction on how their health information is used. A patient might ask for a restriction on their health information if they’re concerned about a family member inadvertently receiving a mail correspondence or a telephone message that has to do with test results or some other health information that they want to keep personal. They may also want to restrict the availability of their health information to certain providers that they might not be comfortable with. Under HIPAA we’re not required to get consent to use their health information if it’s for treatment, billing or healthcare operations. 

## P&P for Restrictions

**Notes:**
[NARRATOR] Form IHS-912-1 must be completed and signed in ink, with an original signature prior to restricting health information. 

## P&P for Restrictions

- Patients Have the Right to Request Restrictions on the Use & Disclosure of Their PHI to
- Carry Out Treatment
- Payment & Healthcare Operations
- Hospital Directories
- Relatives & Family Members
- Close Friends
- Healthcare Givers
- Any Other Person
- IHS Only Required to Agree to Request for Restriction from Hospital Directory

**Restrictions**

**Notes:**
[NARRATOR] Patients have the right to request restrictions on the use & disclosure of their PHI to carry out treatment, payment & health care operations, disclosure in hospital directories, disclosure to relatives & family members, close friends, health care givers & any other person identified by the patients. If the patient is unable to fill out the form, family, or staff may assist.  IHS is only required to agree with the request for restriction from the hospital directory, and may not verbally agree to any restrictions. 

[TRAINER] The “any other person” includes anyone involved in the patient’s care or payment.  

The Service Unit Director/Chief Executive Officer (SUD/CEO) or designee, in consultation with an appropriate official, must review the request, before the patient is notified of the decision, except for acceptance of the request to omit PHI from hospital directories.  

## P&P for Restrictions

- Request Must Be in Writing
- Patient Is Not Required to Provide a Reason
- The SUD/CEO or Designee & Appropriate Official Will Review the Request Prior to Patient Notification (Except for Acceptance of Requests to Omit PHI from Hospital Directories)
- IHS Is Not Required to Agree to Restriction Requests
- Before Agreeing to the Restriction, Attempt to Contact the
- 	Regional Attorney

**Restrictions**

**Notes:**
[NARRATOR] The request for restriction must be in writing, however, the patient is not required to provide a reason for the request. Once the request is reviewed  by the SUD/CEO or designee, the patient must be notified whether approved or denied. Restricted information may still be disclosed to provide emergency treatment but must display the Restricted Information statement that appears on-screen. 

[TRAINER]
The request must be in writing. 
The patient is not required to provide a reason for the request.
The Service Unit Director/Chief Executive Officer (SUD/CEO) or designee, in consultation with an appropriate official, must review the request, before the patient is notified of the decision, except for acceptance of the request to omit PHI from hospital directories. 
IHS is not required to agree to the requested restriction.
Before agreeing to the requested restriction, attempt to contact the regional attorney.

[Cont. on next screen]

## P&P for Restrictions (cont.)

- With Approved Restriction, PHI May Be Used or Disclosed by IHS or Its Business Associate(s) If Restricted PHI is Needed by IHS or Another Healthcare Provider to Provide Emergency Treatment
- Restricted Information Disclosed to a Healthcare Provider for Emergency Treatment Requires the Following Statement:
*“**This Is Restricted Information, Provided for the Purpose of Emergency Treatment, Which Should Not Be Further Disclosed or Used Without the Permission of the Patient to Whom the Information Pertains.”*

**Restrictions**

**Notes:**
[NARRATOR]No Narration

[TRAINER] [Cont’d from previous screen]
If IHS agrees to a restriction, PHI may not be used or disclosed by IHS or its Contractor(s) (Business Associate(s)) in violation of such restriction except if the restricted PHI is needed by IHS or another health care provider to provide emergency treatment of the patient.

Restricted Information Disclosed to a Healthcare Provider for Emergency Treatment Requires the Following Statement:
“This Is Restricted Information, Provided for the Purpose of Emergency Treatment, Which Should Not Be Further Disclosed or Used Without the Permission of the Patient to Whom the Information Pertains.”

[NOTE] The disclosure statement may be stamped or typed on the information that is released, or may be provided verbally if the information is verbally transmitted in the case of an emergency. If transmitted verbally, fully notate what and why was transmitted in the record, initial and date the entry.

## P&P for Restrictions

- Approved Restrictions Do Not Prevent the Following Uses or Disclosures:
- Patients Who Request Access to Own Information
- Disclosures Required by the Secretary of HHS to Investigate or Determine Compliance by IHS with the HIPAA Privacy Rule
- Uses & Disclosures of PHI for Hospital Directories Where the Patient Has Not Objected to Such Uses & Disclosures
- Uses & Disclosures Required by Law
- Disclosures About Victims of Abuse, Neglect or Domestic Violence

**Restrictions**

**Notes:**
[NARRATOR] IHS approved restrictions do not prevent use of the information for the purposes described on-screen. 

[TRAINER] A restriction agreed to by IHS shall not prevent the following uses or disclosures: 
disclosures to a patient who requests access to PHI about him/her; 
disclosures required by the Secretary of HHS to investigate or determine compliance by IHS with the HIPAA privacy rule;
uses and disclosures of PHI for hospital directory where the patient has not objected to such uses and disclosures; 
uses and disclosures required by law; 
disclosures about victims of abuse, neglect or domestic violence; 
[Cont. on Next Screen]

## P&P for Restrictions

- Approved Restrictions Do Not Prevent the Following Uses or Disclosures **(cont.)**:
- Uses & Disclosures for Health Oversight Activities
- Disclosures for Judicial & Administrative Proceedings
- Disclosures for Law Enforcement Purposes
- Uses & Disclosures About Decedents
- Uses & Disclosures for Organ, Eye or Tissue Donation Purposes
- Uses & Disclosures for Research Purposes
- Uses & Disclosures to Avert a Serious Threat to Health or Safety
- Disclosures for Workers’ Compensation
- Uses or Disclosures for Which No Authorization Is Required

**Restrictions**

**Notes:**
[NARRATOR]No Narration

[TRAINER] [Cont. From Previous Screen]
A restriction agreed to by IHS shall not prevent the following uses or disclosures: 
uses and disclosures for health oversight activities;  
disclosures for judicial and administrative proceedings; 
disclosures for law enforcement purposes; 
uses and disclosures about decedents;  
uses and disclosures for organ, eye or tissue donation purposes; 
uses and disclosures for research purposes; 
uses and disclosures to avert a serious threat to health or safety;  
disclosures for workers’ compensation; or 
uses or disclosures for which no authorization is required.

## P&P for Restrictions

- IHS May Terminate Approved Restrictions If
- The Patient Agrees to, or Requests, the Termination in Writing
- IHS Informs the Patient That It Is Terminating the Agreement, in Which Case the Termination Will Be Effective with Respect to PHI Created or Received After IHS Has So Informed the Patient
- When IHS Informs the Patient That It Is Terminatingthe Agreement, Note Method of Informing, Date & Signature of the SUD/CEO or Designee in the Record

**Restrictions**

**Notes:**
[NARRATOR] Approved restrictions may be terminated with patient’s written permission, if IHS informs the patient it is terminating. If IHS terminates the agreement, the information must be noted in the record with the SUD/CEO or designee’s signature. 

[TRAINER]
If IHS has agreed to a requested restriction, it may terminate its agreement if: 
the patient agrees to or requests the termination in writing using IHS Form 912-2, Request for Revocation of Restriction(s), or 
IHS informs the patient that it is terminating the agreement, in which case the termination will be effective with respect to PHI created or received after IHS has so informed the patient. 

When IHS informs the patient that it is terminating the agreement, the method of informing, together with the date and signature of the SUD/CEO or designee, shall be noted in the file. 

## P&P for Directory

**Restrictions**

- Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  A hospital directory is a listing of all inpatients in the hospital. Sometimes patients don’t want their name on the directory because of a disease or disease process and they don’t want any of their family to know or sometimes they could be a public figure in the community and they don’t want anybody to know they’re in the hospital. 

## P&P for Directory

- Present Patient with Notice of Privacy Practices & Follow P&P for Notice of Privacy Practices
- Note Restrictions in Patient’s Record
- List Unrestricted Information in Directory
- If Incapacitated or Emergency & Patient Cannot Review Notice, Facility May Disclose in Accordance With Previously Stated Preferences, or in Patient’s Best Interest If Not Previously Stated

**Restrictions**

**Notes:**
[NARRATOR] To allow an opportunity to keep their information out of the hospital directory, present patients with the Notice of Privacy Practices and follow the procedure as described in the training section called Privacy. Note patient-requested restrictions in the record and do not disclose in the directory. 
[TRAINER] PURPOSE:  To establish a policy & procedure for using and disclosing protected health information (PHI) for directory purposes.
PHI that may be disclosed from a patient directory is limited to the individual’s name, the individual’s location in the facility, and the individual’s condition (e.g., stable), described in general terms that do not communicate specific information.  An individual’s religious affiliation may be disclosed only to clergy, if the patient has not objected to such disclosure.
An IHS facility must provide all patients with a copy of the Notice of Privacy Practices.
The policy and procedure on the Notice of Privacy Practices must be followed.
Any restriction(s) on the use or disclosure of an individual’s PHI will be noted and such information will not be disclosed from the facility’s directory of patients.
If there are no stated restrictions to the release of an individual’s PHI, the facility may disclose the individual’s name, location within the facility, and condition in general terms upon request, by name of individual.
Religious affiliation may also be disclosed to clergy who request such information, but clergy need not ask by patient’s name.
If the individual is incapacitated, or in emergency treatment and does not have the opportunity to review the IHS Notice of Privacy Practices, the facility may disclose some or all of the directory information if such disclosure is consistent with any previously stated preferences. Any disclosure of directory information about an individual who had not had an opportunity to review the IHS Notice of Privacy Practices must be in the individual’s best interest.  The IHS facility must provide the individual with an opportunity to agree or object to any releases of his/her directory information as soon the individual resumes making his/health care decisions.

## P&P for Directory

- IHS May Disclose in Directory Without Patient’s Written Authorization the Patient’s
- Name
- Location in the Facility
- General Condition Description
- Religious Affiliation to Clergy

**Restrictions**

**Notes:**
[NARRATOR] If there are no stated restrictions, you may disclose patient name, location within the facility, condition in general terms and religious affiliation. 

[TRAINER]
An Indian Health Service facility may maintain a directory of patients & disclose limited PHI from that directory without the individual’s written authorization, provided the individual was informed of the intended use or disclosure in advance & had the opportunity to either agree to or prohibit the use or disclosure.
PHI that may be disclosed from a patient directory is limited to:
the individual’s name;
the individual’s location in the facility;
the individual’s condition (e.g., stable), described in general terms that do no communicate specific information;
An individual’s religious affiliation may be disclosed only to clergy, if the patient has not objected to such disclosure.

## Q&A 

**Restrictions**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 123

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Accounting of Disclosures

- Understanding Form IHS-913
- Helping Patient Fill Out Form IHS-913
- P&P for Accounting of Disclosures
- Disclosures That Do Not Require Accounting
- Temporary Suspensions

**Accountings**

**Notes:**
[NARRATOR] In this section we will review form IHS-913, the Request for Accounting of Disclosures. You will learn how to help patient obtain & fill out the form, & become familiar with all of the policies & procedures associated with accounting of disclosures including those that do not require an accounting, as well as temporary suspensions of accountings of disclosure. 

## P&P for Accounting of Disclosures

**Accountings**

- Video – See Transcript in Notes Below

**Notes:**
CAIN:   A patient might need to know who had received health information about them because it could have implications for employment, it could have implications as they apply for health insurance coverage and it could affect them socially, depending upon chronic diseases that they might not want other individuals, or other agencies, to be aware of. 

KIHEGA:  A patient might request an accounting of disclosures because they want to know who all information was sent to, how many places, did an attorney ask for it? I’ve been involved in a car wreck, did the other insurance company ask for it? They’ve refused to pay for such and such and I want to know if they’ve actually asked for that record. 

## P&P for Accounting of Disclosures

**Notes:**
[NARRATOR] Form IHS-913 must be completed and signed in ink, with an original signature prior to obtaining an accounting of disclosures of health information.  Forms completed in red ink will not be processed; black ink is recommended. 

## P&P for Accounting of Disclosures

- Record Disclosures of PHI that Are Subject to an Accounting
- In the Disclosure Accounting Record (IHS Form 505)
- Electronically in RPMS Release of Information (ROI) Software
- Accountings of Oral Disclosures of PHI Should Also Include the Name, Signature & Title of Staff Who Made the Oral Disclosure

**Accountings**

**Notes:**
[NARRATOR] A patient has the right to request & receive (with certain exceptions) an accounting of both written and oral disclosures of their PHI, that IHS has released for a period of six years prior to the date on which the accounting is requested, or for the life of the record, whichever is longer.  The accounting shall include disclosures made to or by IHS business associates, and IHS will require business associates to report back to IHS any disclosures they have made. 

[Trainer] 	
Disclosures of PHI that are subject to an accounting should be recorded in the “Disclosure Accounting Record, IHS Form 505” or electronically utilizing the Release of Information (ROI) software package of the RPMS.  
Accountings of oral disclosures of PHI should also include the name, signature and title of staff who made the oral disclosure.
Patient can determine the length of time they would like an accounting for.
Per the Privacy Act, records must be supplied, even if they need to be pulled out of storage.

## P&P for Accounting of Disclosures

- Patient-Requested Accountings of Disclosure
- Must Be in Writing
- Must Include Disclosures to & by IHS Business Associates
- Must Include for Each Disclosure:
- Date of Disclosure
- Name & Address of Recipient of Disclosure
- Brief Description of the PHI Disclosed
- Brief Statement of the Purpose of the Disclosure or Copy of Request for Disclosure

**Accountings**

**Notes:**
[NARRATOR] Accountings of disclosure must be in writing, include disclosures to and by IHS business associates, and must include the information as displayed on-screen. 

[TRAINER]  Each accounting (which will be given to the patient upon request) must be in writing, must include disclosures to & by IHS business associates, & must include for each disclosure:
Date of disclosure;
Name & address of the person or organization who received the PHI;
Brief description of the PHI disclosed, e.g., immunization record, labs, x-ray; and
Brief statement of the purpose of the disclosure (or include a copy of the written request for disclosure, if appropriate).

## P&P for Accounting of Disclosures

- Disclosures That Do Not Require Accounting Include
- Disclosures to Officers & Employees of the DHHS Who Have a Need for the Information for Purposes of Treatment, Payment,
- 	or Operations
- Disclosures to the Secretary That Are Required in Order to Investigate or Determine Compliance with Privacy Requirements
- Disclosures to the Patient
- Patient-Authorized Disclosures
- Disclosures Required Under the Freedom of Information Act (FOIA)

**Accountings**

**Notes:**
[NARRATOR] Some disclosures do not have to be accounted for, including disclosures to DHHS officials who require the information, those disclosures to the Secretary of DHHS as required by investigations or to ensure compliance, disclosures to the patient and those the patient has authorized, as well as disclosures under the freedom of information act. 

[TRAINER] The following disclosures do not require accounting:
Disclosures to officers and employees of the Department of Health and Human Services who have a need for the information for purpose of treatment, payment or operations, including disclosures to the Secretary that are required in order to investigate or determine compliance with privacy requirements;
Disclosures to the patient; 
Disclosures pursuant to the patient’s written authorization; and 
Disclosures required under the Freedom of Information Act (FOIA).
Note:  Despite the numerous exceptions in the HIPAA Privacy Rule, the Privacy Act requires an accounting of many of the disclosures HIPAA- and the PA gives no provision that these accountings are exempt from a patient’s request for an accounting.  

## P&P for Accounting of Disclosures

- When Processing Accountings of Disclosure, IHS
- Must Act on the Request No Later Than 60 Days After Receipt of the Request
- May Extend an Additional 30 Days
- Must Inform the Patient in Writing of the Reason(s) for the Extension
- Must Inform the Patient of the Date by Which the Patient Can Expect the Accounting
- Will Retain Copy of Explanation in the Health Record

**Accountings**

**Notes:**
[NARRATOR] When processing requests for accountings of disclosure, IHS will have 60 days to act on the request, with an additional 30 day extension allowed. If an extension is required, the patient must be informed of the extension and the date by which they can expect the accounting. 
[TRAINER] A request for an accounting of disclosures must 
Be in writing.
Should be made on IHS Form 913, “Request for an Accounting of Disclosures”.  The Form should be submitted to the Health Information (Health Records) Department that is responsible for receiving and processing such requests.
When a patient requests an accounting of disclosures, the patient must present valid identification unless the patient is personally known to the employee responding to the patient request.  Guidance on identification procedures is found in the Policy and Procedures for Verification of Identity.
IHS must act on the request no later than 60 days after receipt of the request, and may extend this time for an additional 30 days, so long as it informs the patient in writing of the reason(s) for the delay and the date by which the patient can expect the accounting.
The explanation sent to the patient must be retained in the patient’s health record. 

## P&P for Accounting of Disclosures:Temporary Suspensions

- Procedure for Law Enforcement Official or Health Oversight Agency to Suspend a Patient’s Right to Receive an Accounting of Disclosures
- Official/Agency Must Submit a Written Statement that Accounting to the Patient Would Impede the Agency or Official’s Duties
- Request Must Specify Term of Suspension
- Disclosures Requiring Accounting Must Be Documented During Suspension
- Patient’s Right to Receive an Accounting Is Reinstated at End of the Suspension

**Accountings**

**Notes:**
[NARRATOR] Law enforcement and health oversight officials may request a temporary suspension on providing patients with an accounting of disclosures, in writing, or orally. The request must specify that providing an accounting to the patient would impede an investigation as well as the length of time of the suspension. 

[TRAINER]
Temporary Suspensions of Accounting for Disclosures to Health Oversight Agencies or Law Enforcement Officials.
A health oversight agency or law enforcement official may ask IHS to suspend a patient’s right to receive an accounting of disclosures if the agency or official provides a written statement that such an accounting to the patient would be reasonably likely to impede the agency or official’s duties.  The agency or official must specify how long the right to receive an accounting must be suspended.  During the period of suspension, any disclosures requiring an accounting must still be accounted (documented).  At the end of the suspension, a patient’s right to receive an accounting is reinstated. 
Discuss situations that have happened, or in which might happen, and a temporary suspension might be requested.

## P&P for Accounting of Disclosures:Temporary Suspensions

- Oral Requests for Suspension Require Documenting the Identity of the Agency or Official Making the Request
- Oral Requests May Exclude Disclosure(s) for No Longer Than 30 Days From the Date of the Request
- If the Agency or Official Provides a Valid Written Request Within 30 Days of the Oral Request, IHS Must Temporarily Suspend the Patient’s Right to an Accounting for the Time Period Specified in the Written Request

**Accountings**

**Notes:**
[NARRATOR] Oral requests for suspensions require documentation of  the identity of the agency or official who made the request and may only exclude the disclosures for a period not to exceed 30 days from the date of the oral request, unless a valid written request is subsequently submitted. 

[TRAINER] If the request for temporary suspension is made orally, IHS must document the identity of the agency or official who made the request and must exclude the disclosure(s) for no longer than 30 days from the date of the request, unless a written request is provided during that time.  If the agency or official provides a written request that meets the requirements previously stated, IHS must temporarily suspend the patient’s right to an accounting for the time period specified in the written request.

Business associate agreements will be available on the Web.

## P&P for Accounting of Disclosures

**Accountings**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  Law enforcement may request that we suspend an Accounting of Disclosures so that when a patient comes in and requests an Accounting of Disclosures, that information will not be on the Accounting of Disclosure.  Because law enforcement does not want the patient to know that they have requested that information to do an investigation.

## Q&A 

**Accountings**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 135

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Patient Access to Their PHI

- Understanding Patients’ Rights
- Requirements for Obtaining PHI
- IHS Requirements for Responding to Requests
- Procedure When Access is Granted
- Procedure When Access is Not Granted

**Patient Access**

**Notes:**
[NARRATOR] Individuals have the right, under certain circumstances, to access, inspect and obtain copies of their own PHI. In this section we will review those rights, along with the requirements patients must meet in order to obtain their PHI, how to respond to those requests, and the procedures to follow when access to the information is granted or not granted. 

[TRAINER]   PURPOSE:  To establish policy and procedure on rights of patients to access, inspect and obtain a copy of their protected health information (PHI).
POLICY:  The Health Insurance Portability and Accountability Act (HIPAA) provides individuals the right, under certain circumstances, to access, inspect and obtain copies of PHI about them that is maintained in a designated record set.  The Privacy Act of 1974, 5 U.S.C. § 552a, and the implementing regulations at 45 CFR Part 5b, also provide patients the right to access, inspect, and obtain copies of records about them that is maintained in a system of records.  The policy of IHS is to provide patients their maximum rights under these statutes.

With respect to access by or on behalf of minors, please refer to the Policy and Procedure on Protected Health Information of Un-emancipated Minors.

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

**Patient Access**

- Video – See Transcript in Notes Below

**Notes:**
RICK WELLER – Albuquerque HIPAA Area Coordinator:
Patients do have the right, under HIPAA, to see their records, to get copies of their records.  They own the information that is in the records while the government holds the records for them.  Under the Privacy Act, patients have had the right to view their records and to get copies of information in them.  HIPAA does not change that.  It does make it a more formal process now. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- Patient Requirements for Requesting Access:
- Submit Written Request to SUD/CEO or Designee Specifying the Records the Patient Wants to Access
- Designate a Representative to Review the Record & Inform the Patient of the Contents
- Authorize Presence of Any Other Individual Present During Any Discussion of a Record
- Patient May Request Copies of Records in Accordance with the Fee Schedule

**Patient Access**

**Notes:**
[NARRATOR] The patient must submit a written request to SUD/CEO or designee of the facility specifying the records he or she wants to access, then designate a representative to review the record and inform him or her of the contents. If another person is with the patient, obtain the patient’s authorization for that person’s presence before discussing the information. IHS is allowed to charge reasonable fees for copies. 
[TRAINER]
Officer (SUD/CEO) or designee of the facility that maintains the PHI, specifying the records the patient would like notification of or access to.  
At the time of the request, the patient must designate a representative in writing who would be willing to review the record and inform the patient of its contents.  The representative may be a physician or other responsible individual.
If the patient requests access to a record pertaining to him or her, and is accompanied by another individual, the patient must affirmatively authorize the presence of the other individual during any discussion of a record to which access is requested.
In addition to requesting notification and access to records, the patient may also request copies be made of such records in accordance with the fee schedule set forth at 45 CFR 5b.13.

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- IHS Requirements for Responding to Patient Requests for Access:
- SUD/CEO Must Act on Request Within 30 Days If Maintained or Accessible On-site
- SUD/CEO Must Act on Request Within 60 days If Not Maintained or Accessible On-site
- SUD/CEO May Have One 30 Day Extension
- Must Provide Patient With Written Statement of Reason(s) for Extension & Date on Which IHS Will Respond
- All Requests Must Be Maintained in Patient’s Health Record

**Patient Access**

**Notes:**
[NARRATOR] If the records are on-site, the SUD/CEO has 30 days to act on the request. If the records are not onsite the SUD/CEO has 60 days to respond, and in either case, one 30-day extension may be granted. If an extension is require, the patient must be notified of the extension and given the date at which they can expect a response. This information must also be documented in the health record. 
[TRAINER]
The SUD/CEO or designee must act on the request within 30 days of its receipt if the information is maintained or accessible on-site and within 60 days if it is not.  A one-time 30-day extension may be granted by the SUD/CEO or designee in writing, provided that within the respective 30-day or 60-day time frame, the SUD/CEO or designee provides the patient with a written statement of the reason(s) for the delay and the date by which IHS will complete its action on the request.  
IHS shall also provide access to information in a designated record set of its Contractor(s) (Business Associate(s)) unless the information is the same as information maintained by IHS.
All requests, designations, and correspondence relating to the patient’s request for access should be maintained in the patient’s health record.

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- When Access Is Granted in Whole or in Part:
- SUD/CEO Shall Inform Patient in Writing
- IHS Must Produce the PHI Only Once Per Request
- Must Produce in Format Requested, if Producible, or Legible Hard Copy
- A Summary or Explanation of the PHI May Be Provided in Lieu of the Underlying Information If Patient Agrees in Advance, but Patient Still Retains Right to See Entire PHI

**Patient Access**

**Notes:**
[NARRATOR] When access is granted in whole or in part, follow the procedure as described on-screen. 
[TRAINER]
Access Granted in Whole or in Part
If direct access is granted, in whole or in part, the SUD/CEO or designee shall inform the patient in writing that s/he may inspect and/or obtain a copy of his or her PHI.
IHS is only required to produce the PHI once per request even if the record is maintained in more than one location or in more than one designated set of records.
IHS must provide the information in the requested form or format if it is readily producible in that form or format.  If it is not, IHS must produce a readable hard copy in another form or format upon which both the patient and IHS have agreed.
Subject to the patient’s agreement in advance, a summary or an explanation of the PHI may be provided in lieu of the underlying information, but the patient retains the right of access to both summaries and underlying information.
[Cont. on Next Slide]

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- When Access Is Granted in Whole or in Part **(cont.)**:
- Must Be Provided at Mutually Convenient Time & Place for Inspection or Copying
- Can Be Mailed If Patient Pays Copying Fee
- Note Date the Copy Is Provided in Patient Chart
- Follow P&P for Verification of ID

**Patient Access**

**Notes:**
[NARRATOR] No Narration

[TRAINER] [Cont. From Previous Slide]
Access Granted in Whole or in Part
Access must be provided at a mutually convenient time and place for inspection or copying.  If requested, IHS must mail the PHI, but may charge a cost-based fee for copying, in addition to postage.  (See the fee schedule at 45 CFR 5b.13.)
When a copy is provided, the date on which the copy is delivered should be entered in the patient chart.
The Policy and Procedures for Verification of Identity Prior to Disclosure of Protected Health Information must be followed.

TRAINER NOTE: Provide Trainees with information on how to find out if there are copying fees, and/or how much they are if there are fees.

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- IHS May Deny Request If
- Does Not Maintain Requested PHI
- If Knows Where It Is Located, Must Inform Patient & Direct Request to That Place
- Reasonable Anticipation of, or for Use In, Civil, Criminal, or Administrative Actions or Proceedings
- Contact Regional Attorney’s Office & Do Not Note in Patient Health Record

**Patient Access**

**Notes:**
[NARRATOR] IHS may deny a patient’s request to access their own PHI if the information requested is not in the record or at the facility, or if IHS anticipates that the PHI is going to be used in civil, criminal, or administrative actions. If you know where the information is located, you must inform the patient so that they can follow up, and if you anticipate that it is being requested for legal or administrative actions, contact Regional Counsel. Do not note that action in the health record.
[TRAINER]
Generally, requests for notification of and access to a patient’s PHI made by the subject patient should be honored.  There are limited situations in which access to a patient’s record may be denied or suspended.
IHS may deny access to information compiled in reasonable anticipation of, or for use in, civil, criminal, or administrative actions or proceedings.  Note:  This type of information should never be in the patient’s medical record.  Should such information be found in the patient’s medical record, contact the Regional Attorney’s Office. 
IHS may deny a request to access PHI, because IHS does not maintain the requested PHI; however, if IHS knows where it is maintained, IHS shall inform the patient where the PHI is maintained and direct the request to that place.
TRAINER NOTE: Since IHS may deny access to information compiled in reasonable anticipation of, or for use in, civil, criminal, or administrative actions or proceedings, This type of information should never be in the patient’s medical record.  Should such information be found in the patient’s medical record, contact the Regional Attorney’s Office. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- If IHS Cannot Determine Whether Direct Access to the Record Will Have Adverse Effect on Patient
- Deny Direct Access to the Patient
- Forward Records to Designated Representative to Review
- Notify Patient in Writing
- Provide Patient Direct Access If Designated Representative Does Not Provide the Patient with the Record

**Patient Access**

**Notes:**
[NARRATOR] If you are concerned that access to information will have an adverse effect on the patient, utilize the procedure allowing you to designate a representative to review the information first and inform the patient that you have done so. Then follow the direction of the personal representative. 

[TRAINER]
IHS may initially deny direct access to the patient and utilize the patient’s designated representative to review the records if IHS determines that, or cannot determine whether, providing the patient with direct access is likely to have an adverse effect on the patient.  In such cases, the health record will be sent to the patient’s designated representative and the patient will be notified in writing that the record has been sent to the designated representative.  
If IHS has sent the record to the patient’s designated representative, the representative should then provide the record to the patient, after considering whether there would be any adverse effects on the patient. The patient will be allowed access to his/her record consistent with a determination by the patient’s designated representative of the manner of disclosure, if any, that would limit any likely adverse effect on the patient.
Clinician is the only person who can determine if there is an adverse effect on the patient.  The Health Information Management staff cannot make the determination.

## Q&A 

**Patient Access**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 145

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## P&P for Use & Disclosure of PHI for Research Purposes

- Understanding Use & Disclosure for Research
- IRB Approval Process
- IRB Waiver Requirements
- Reviews of PHI Prior to Research
- Research Involving Decedents’ PHI
- Creating Limited Data Sets
- De-Identification & Re-Identification of PHI

**Research**

**Notes:**
[NARRATOR] In this portion of the training you will become familiar with the policies and procedures for use & disclosure for research purposes including the IRB Approval Process, IRB Waiver Requirements, Reviews of PHI Prior To Research, Research Involving Decedents’ PHI, and issues associated with creating limited data sets.

[TRAINER]
PURPOSE:  To establish policy and procedures on how Indian Health Service may use or disclose PHI for research purposes without authorization by a patient.
POLICY:  To establish policy and procedure for the use and disclosure of Protected Health Information (PHI) for research purposes in accordance with the HIPAA Privacy Rule and Privacy Act.  For research authorizations, follow HHS research guidance.

## P&P for Use & Disclosure of PHI for Research Purposes

**Research**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN: The IRB is the Institutional Review Board which is responsible for making sure that regulations are followed in regards to research in any of our healthcare facilities. 

MIKE HOPE, RPH – Oklahoma Area Pharmacy Consultant
The Indian Health Service will disclose protected health information for the purposes of research providing that research has been approved by the IRB of the Indian Health Service. The IRB will maintain appropriate records regarding the research, they will assure that the researchers have a plan to protect the identity or identifiers of the patients in the research, they will assure that the researchers destroy the protected health information identifiers at the earliest possible date, and they will assure that the researchers have a plan to protect the privacy and confidentiality of participants. 

## P&P for Use & Disclosure of PHI for Research Purposes

- IHS May Use & Disclose PHI for Research When IRB Has Approved, in Whole or in Part, a Waiver of the Patient’s Authorization for Its Use & Disclosure

**Research**

**Notes:**
[NARRATOR] The IRB must approve a waiver of patient authorization, in whole or in part, before PHI can be used or disclosed for research purposes. 

[TRAINER] Institutional Review Board (IRB) Approval of Waiver of Authorization
IHS will use and disclose PHI for research when its IRB has approved, in whole or in part, a waiver of the patient’s authorization for its use and disclosure.

Provide IRB Contact Information if appropriate.

## P&P for Use & Disclosure of PHI for Research Purposes

- Review/Approval Process
- The IRB or Designee Signs Statement That Waiver Was Reviewed & Approved Under Normal and/or Expedited Review Procedures

**Research**

**Notes:**
[NARRATOR] The IRB chair, or designee, processes the request for use or disclosure for research as described on-screen. 

[TRAINER] REVIEW/APPROVAL PROCESS
The IRB chair, or his/her designee, shall sign a statement that the alteration or waiver of authorization was reviewed and approved under normal and/or expedited review procedures.  The statement shall also set out that an IRB followed the requirements of the Common Rule (45 CFR Part 46) as applicable.

## P&P for Use & Disclosure of PHI for Research Purposes

- Documentation of IRB Approval of Waiver Must Include:
- A Statement Identifying the IRB & the PHI for Which the Use/Disclosure Has Been Determined to Be Necessary by the IRB
- Date on Which the Alteration or Waiver of Authorization Was Approved
- Justification that the Research Could Not Practically Be Conducted Without the Alteration or Waiver
- Justification that the Research Could Not Practically Be Conducted Without Access to & Use of the PHI

**Research**

**Notes:**
[NARRATOR] The documentation must include the information described on-screen. 

[TRAINER]
Documentation of IRB approval of waiver must include the following:
Identification:  A statement identifying the IRB and the PHI for which the use/disclosure has been determined to be necessary by the IRB;
Date of Action:  Date on which the alteration or waiver of authorization was approved;
Justification that the research could not practically be conducted without the alteration or waiver; and that the research could not practically be conducted without access to and use of the PHI.

## P&P for Use & Disclosure of PHI for Research Purposes

- Statement That IRB Has Determined That Alteration or Waiver, in Whole or in Part, Satisfies the Following:
- Use or Disclosure of PHI Involves No More than Minimal Risk to the Privacy of Individuals
- An Adequate Plan to Protect the Identifiers from Improper Use/Disclosure, Including Reasonable Administrative, Technical & Physical Safeguards Against Unauthorized Use/Disclosure

**Research**

**Notes:**
[NARRATOR] The IRB waiver is issued when researchers have demonstrated that there is only a minimal risk to an individual’s privacy, that there is an adequate plan to protect the identifiers from improper use or disclosure, that the identifiers will be destroyed at the earliest opportunity, and that the PHI will not be re-used or disclosed, except as may be required by law.

[TRAINER]
Waiver Criteria:  The IRB must include a statement that it has determined that alteration or waiver, in whole or in part, of the authorization satisfies the following:
Use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals based on, at a minimum, the presence of the following elements:
An adequate plan to protect the identifiers from improper use/disclosure, including reasonable administrative, technical and physical safeguards against unauthorized use/disclosure;
[Cont. on Next Slide]

## P&P for Use & Disclosure of PHI for Research Purposes

- Statement That IRB Has Determined That Alteration or Waiver, in Whole or in Part, Satisfies the Following **(cont.)**:
- An Adequate Plan to Destroy the Identifiers at the Earliest Opportunity Consistent with Conduct of the Research, Unless There Is a Health or Research Justification for Retaining the Identifiers, or Such Retention Is Otherwise Required by Law
- Adequate Written Assurances that the PHI Will Not Be Reused or Disclosed to Any Other Person or Entity, Except As Required by Law, for Authorized Oversight of the Research Study if Personal Identifiers Are Removed at the Earliest Opportunity Consistent with the Oversight Activity or for Other Research for Which the Use/Disclosure of PHI Would Be Permitted Under the HIPAA Privacy Rule, the Privacy Act & any other Applicable Law

**Research**

**Notes:**
[NARRATOR] No Narration
[TRAINER] [Cont. from Previous Slide]
An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law; for authorized oversight of the research study, if personal identifiers are removed at the earliest opportunity consistent with the oversight activity or for other research for which the use/disclosure of PHI would be permitted under the HIPAA Privacy Rule, the Privacy Act and any other applicable law.

## P&P for Use & Disclosure of PHI for Research Purposes

- Reviews Prior to Research
- An IHS Facility May Allow PHI to Be Reviewed in Preparation for Research if the Researcher Demonstrates
- The PHI for Which Use/Disclosure Is Sought Is Necessary for Research Purposes
- That Use/Disclosure Is Sought Solely As Necessary in Preparation for Research or to Prepare a Research Protocol
- That No PHI Will Be Removed From the Facility by the Researcher in the Course of the Review

**Research**

**Notes:**
[NARRATOR] In preparation for use of PHI for research, IHS may allow the review of PHI, if the researcher demonstrates that the information sought is truly for use in research, that it is required for research preparation, and will not be removed from the facility during the review period. 

[TRAINER]
REVIEWS PRIOR TO RESEARCH
An IHS facility may allow PHI to be reviewed in preparation for research if the researcher represents that: 
The use/disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes in preparation for research; 
No PHI will be removed from the facility by the researcher in the course of the review; and
The PHI for which use/disclosure is sought is necessary for the research purposes.

## P&P for Use & Disclosure of PHI for Research Purposes

- Research Involving Decedents’ PHI
- IHS May Use & Disclose Decedents’ PHI if the Researcher
- Demonstrates the Use/Disclosure Is Sought Solely for Research
- Demonstrates the PHI for Which Use/Disclosure is Sought is Necessary for the Research Purposes
- Can Provide Documentation of the Decedent’s Death if Requested

**Research**

**Notes:**
[NARRATOR] When research requires the use or disclosure of information about an individual or group of individuals who have passed away, IHS may disclose or use that PHI if the researcher can show that the information is solely for research purposes, and can provide documentation of the decedent’s death if it is requested. 

[TRAINER]
RESEARCH INVOLVING DECEDENTS’ PHI 
IHS may use and disclose PHI if the researcher represents that:
the use/disclosure is sought solely for research on the PHI of decedents; and 
the PHI for which use/disclosure is sought is necessary for the research purposes. 
IHS may require the researcher to provide documentation of the subject individuals’ death.  

## P&P for Use & Disclosure of PHI for Research Purposes

**Research**

- Video – See Transcript in Notes Below

**Notes:**
CHIARCHIARO:   Sometimes we need to get protected health information for patients that have passed away. The most common example of that is to determine mortality rates and also to look at causes of death. And that enables us to focus our resources on those risks that our patients face so that we can help them lead a healthier life. 

## P&P for Creating a Limited Data Set

**POLICY:**  For Purposes of Research, Public Health, or Healthcare Operations, IHS May Disclose Information That Is Not Fully De-identified If It Creates a Limited Data Set That Complies With the Terms of the Health Insurance Portability & Accountability Act (HIPAA) Regulations, 45 CFR 164.514(e), & This Policy.  All Such Disclosures Must Be Made in Accordance With the Policy & Procedure for Limiting the Use or Disclosure of Protected Health Information to the Minimum Necessary.

**Research**

**Notes:**
[NARRATOR] The policy for creating a limited data set is displayed on screen. 

[TRAINER]
PURPOSE:  To establish a policy and procedures for creating a limited data set for the use or disclosure of protected health information (PHI) only for the purposes of research, public health, or health care operations. 

POLICY:  For purposes of research, public health, or health care operations, IHS may disclose information that is not fully de-identified if it creates a limited data set that complies with the terms of the Health Insurance Portability & Accountability Act (HIPAA) regulations, 45 CFR 164.514(e), and this Policy.  Any disclosure by IHS must be made pursuant to a data use agreement with the recipient of the limited data set and must comply with the terms of this policy.  All such disclosures must be made in accordance with the Policy and Procedure for Limiting the Use or Disclosure of Protected Health Information to the Minimum Necessary.

## P&P for Creating a Limited Data Set

**Definitions:**
- _Protected Health Information_ Is Health Information that Identifies a Patient, or to Which There Is a Reasonable Basis to Believe that the Information Can Be Used to Identify the Patient
- _Limited Data Set_ Is PHI That Excludes Specified Identifiers Such as Name, Provider Name, Chart Number, Social Security Number, etc., but that Can Still Potentially Be Linked to a Particular Patient Because it Contains Dates (Including Birth Date, Admission Date, Discharge Date, & Date of Death) and/or Information about the Patient’s City, State or Zip Code

**Research**

**Notes:**
[NARRATOR] Protected Health Information is information that specifically identifies, or could possibly be used to identify a patient. Creating a limited data set excludes those key identifiers. 

[TRAINER]
DEFINITIONS:
Protected Health Information is health information that identifies a patient, or to which there is a reasonable basis to believe that the information can be used to identify the patient (for example, information contained in a primary health record or a third party billing claim record), excluding education records covered by the Family Educational Rights and Privacy Act, health records of students who are 18 years of age and older and DHHS employment records.

Limited Data Set is PHI that excludes specified identifiers (such as name, provider name, chart number, social security number, etc.), but that can still potentially be linked to a particular patient because it contains dates (including birth date, admission date, discharge date, and date of death) and/or information about the patient’s city, state or nine-digit zip code. 

## P&P for Creating a Limited Data Set

**PROCEDURE:** The Following Procedures Shall Be Used to Create a Limited Data Set, Which May Be Created Only for the Purposes of Research, Public Health, or Healthcare Operations:
- Exclude the Following Direct Identifiers of the Patient, Relatives, Employers, or other Household Members
- Names
- Postal Addresses
- Telephone Numbers
- Fax Numbers
- Electronic Mail Addresses
- Social Security Numbers
- Medical Record Numbers
- Health Plan Beneficiary Numbers
- Account Numbers
- Certificate/license Numbers
- Vehicle Identifiers & Serial Numbers, Including License Plate Numbers
- Device Identifiers & Serial Numbers
- Web Universal Resource Locators (URLs)
- Internet Protocol *(*IP) Address Numbers
- Biometric Identifiers, Including Finger & Voice Prints
- Full Face Photographic Images & Any Comparable Images

**Research**

**Notes:**
[NARRATOR] The information displayed on-screen describes the procedure for creating a limited data set. 
[TRAINER]
The following procedures shall be used to create a limited data set, which may be created only for the purposes of research, public health, or health care operations:
A limited data set is PHI that excludes the following direct identifiers of the patient or relatives, employers, or household members of the patient:
Names
Postal address (in some cases may retain city, State, & zip code)
Telephone numbers
Fax numbers
Electronic mail addresses
Social security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate/license numbers
Vehicle identifiers & serial numbers, including license plate numbers
Device identifiers & serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric identifiers, including finger & voice prints
Full face photographic images & any comparable images

## P&P for Creating a Limited Data Set

- A Limited Data Set May Contain
- Dates of Admission & Discharge
- Dates of Birth & Death
- Zip Codes, City, & State Information
- IHS May Use or Disclose PHI to a Business Associate in Order to Create a Limited Data Set Whether or Not It is to Be Used by IHS

**Research**

**Notes:**
[NARRATOR] A valid limited data set may contain admission & discharge dates, dates of birth and death, zip codes, city and state information. IHS may disclose protected health information to a business associate who needs to prepare a limited data set, whether that data set will be used by IHS or not.

[TRAINER]
A limited data set may contain:
Dates of admission and discharge, as well as dates of birth and death; and
Nine-digit zip codes, city, and State information.
In order to create a limited data set, IHS may use PHI, or disclose PHI pursuant to a contract or other arrangement with a business associates for such purpose, whether or not the limited data set is to be used by IHS. 

NOTE: Business associate agreements will be posted on the HIPAA Website for download and use.

## P&P for Creating a Limited Data Set

- A Limited Data Set Recipient Must
- Agree in Writing to Use or Disclose the Information Only for the Purposes or Research, Public Health, or Healthcare Operations
- Sign a Written Data-Use Agreement that Recipient Will
- Establish Permitted Uses & Disclosures of the Information
- Define Who Is Permitted to Use or Receive the Limited Data Set
- Limit Use or Further Disclose the Information Other Than As Permitted by the Data Use Agreement or As Otherwise Required by Law

**Research**

**Notes:**
[NARRATOR] Recipients of limited data sets must agree in writing to use or disclose the information only for the purposes of research, public health or healthcare operations, and sign a data use agreement that includes all the information displayed on-screen.

[TRAINER]
A limited data set recipient must agree, in writing, to use or disclose the information only for the purposes of research, public health, or health care operations.  A written data use agreement between IHS and the limited data set recipient must also:
Establish the permitted uses and disclosures of the information;
The data use agreement may not authorize the limited data set recipient to use or further disclose the information in any manner that IHS could not;
Establish who is permitted to use or receive the limited data set; and
Provide that the limited data set recipient will:
--Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;
[Cont. on Next Slide]

## P&P for Creating a Limited Data Set

- A Limited Data Set Recipient Must
- Sign a Written Data-Use Agreement that Recipient Will **(cont.)**
- Include Appropriate Safeguards to Prevent Use or Disclosure of the Information Other Than As Provided for by the Data Use Agreement
- Report to the Designated IHS Person Any Improper Use or Disclosure of the Information Not Provided For by Its Data Use Agreement of Which It Becomes Aware
- Ensure That Any Agents, Including Subcontractors, to Whom It Provides the Limited Data Set Agrees to the Same Restrictions & Conditions that Apply to the Limited Data Set Recipient with Respect to Such Information
- Not Identify the Information or Contact the Patients

**Research**

**Notes:**
[NARRATOR] No Narration.

[TRAINER] [Cont. from Previous Slide]
--Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement
--Report to the IHS (individual to be named in the agreement) any improper use or disclosure of the information not provided for by its data use agreement of which it becomes aware;
--Ensure that any agents, including a subcontractor, to whom it provides the limited data set agrees to the same restrictions and conditions that apply to the limited data set recipient with respect to such information; and
--Not identify the information or contact the patients.

## P&P for Creating a Limited Data Set

- If Data Use Agreement Is Violated, IHS Must Take Reasonable Steps to End the Violation & if Unsuccessful, Must
- Discontinue Disclosure of PHI to the Recipient
- Report the Problem to the Secretary of DHHS

**Research**

**Notes:**
[NARRATOR] If a data use agreement is violated, IHS must take the responsibility for ending the violation, discontinuing the disclosure, and must report the problem to the Secretary of DHHS. 

[TRAINER]
IHS becomes aware of a pattern of activity or practice of the recipient of the limited data set that constitutes a material breach or violation of the data use agreement, IHS must take reasonable steps to cure the breach or end the violation, as applicable.  If such steps are unsuccessful, the IHS must:
Discontinue disclosure of PHI to the recipient; and
Report the problem to the Secretary of DHHS.

## P&P for Creating a Limited Data Set

- IHS & It’s Employees Must Also
- Comply with the Terms of Any Limited Data Set Agreement Under Which it Receives Information
- Address Specific Questions Regarding the Implementation of this Policy to the SUD/CEO

**Research**

**Notes:**
[NARRATOR] IHS and its employees are required to comply with the terms of any data use agreement under which it receives information. If you have questions regarding the implementation of this policy, bring them to the attention of the SUD or CEO at your facility.

[TRAINER]
IHS must comply with the terms of any limited data set agreement under which it receives information.
Specific questions regarding the implementation of this policy should be directed to the SUD/CEO.  

Trainer should insert the specific information about to whom to address these issues in their specific area or facility.

## Research

- Video – See Transcript in Notes Below

**Notes:**
CHIARCHIARO:   A full data set would include all of the patient’s information, including date of birth, social security number, name. A limited data set might have those identifiers removed but have some of the other data, their blood pressure or their fasting blood sugar or their hemoglobin A-1-C, still there. In other words, you couldn’t tell by looking at the data set who the patient was. 

## P&P for De-Identification & Re-Identification of PHI

- De-identification Is Making PHI Individually Un-Identifiable Through
- The Removal of Identifiers
- Determination Based Upon Statistical & Scientific Methods

**Research**

**Notes:**
[NARRATOR] It is important to understand the policies and procedures associated with de-identifying and re-identifying PHI. De-identification ensures that PHI cannot be traced back to a specific individual by removing key identifiers, or through statistical and scientific methods. 
[TRAINER] PURPOSE:  To establish policy and procedures for determining when health information is not individually identifiable or for the de-identification of protected health information (PHI), and for any subsequent re-identification. 
POLICY:  IHS may determine when health information is not individually identifiable or when to de-identify PHI for disclosures other than healthcare purposes in accordance with the Health Insurance Portability & Accountability Act (HIPAA) regulations at 45 CFR Part 164.  IHS may also determine when it is necessary to re-identify previously de-identified PHI.  To adequately de-identify PHI, and to ensure proper re-identification, IHS must comply with the terms of this policy. 
Just to review, Protected Health Information or PHI is health information that identifies a patient, or to which there is a reasonable basis to believe that the information can be used to identify the patient (for example, information contained in a primary health record or a claims record).
De-identification is the process by which PHI is rendered individually unidentifiable through the removal of such identifiers described in the “Procedure” section of this Policy or through a determination based upon statistical and scientific methods.

## P&P for De-Identification & Re-Identification of PHI

- Re-identification Is Assigning a Code or Other Means of Record Identification to Allow De-Identified PHI to Be Retrieved & Identified While Maintaining the Anonymity of the Individual

**Research**

**Notes:**
[NARRATOR] Once PHI is de-identified, it must be re-identified in order to retrieve the information while, at the same time, maintaining the anonymity of the individual patient to whom it pertains. Often, this is accomplished by using assigning a code to the de-identified PHI.

[TRAINER] Re-identification is the process of assigning a code or other means of record identification in order to allow de-identified PHI to be retrieved/identified by IHS but still maintaining the anonymity of the patient(s) described in the “Procedure” section of this Policy.

## P&P for De-Identification of PHI

- The Determination of Whether Health Information Is Individually Identifiable or Whether PHI May Be De-identified Will Occur
- When There is no "Need to Know" the Identity of the Patient
- On a Case-by-Case Basis Depending on the Nature of the Request

**Research**

**Notes:**
[NARRATOR] IHS has defined a procedure for determining whether health information is identifiable, or whether it must be de-identified based upon whether it’s necessary to know who the identify of the patient is, and on a case-by-case basis, depending upon the request.

[TRAINER]
De-Identification:  The following procedures shall be used to de-identify PHI or to determine when health information is not individually identifiable:
The determination of whether health information is individually identifiable or whether PHI may be de-identified will occur when there is no "need to know" the identity of the patient.  This determination will be made on a case-by-case basis depending on the nature of the request.  Examples may be situations related to research or a cancer registry where there is no “need to know” the identity of the patient.

## P&P for De-Identification of PHI

- Removal of Identifiers, Including
- Names
- All Elements of a Street Address, City, County, Precinct, Zip Code & Equivalent Geocodes, Except for the Initial Three Digits of Zip Code
- All Elements of Dates, Except Year, for Dates Directly Related to the Patient (Except for Age 90 or Older)
- Telephone Numbers, Fax Numbers, E-mail Addresses
- Social Security Numbers, Medical Record Numbers
- Health Plan Beneficiary Numbers, Account Numbers

**Research**

**Notes:**
[NARRATOR] If a Health Information Management or Health Records professional, or other health care professional de-identifies patient records that contain PHI by removing the identifiers displayed on screen, IHS must NOT have actual knowledge that the remaining information could be used alone or in conjunction with other information to identify the patient. This also applies to electronic records. 
[TRAINER] If a Health Information Management (Health Record) professional or health care professional de-identifies patient records (including electronic records) containing PHI by removing the following identifiers of the patient or of the patient’s relatives, employers, or household members:
Names;
all elements of a street address,  city, county, precinct, zip code, & their equivalent geocodes, except for the initial three digits of a zip code for areas that contain over 20,000 people;
all elements of dates (except year) for dates directly related to the individual, (e.g., birth date, admission/discharge dates, date of death); and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
telephone numbers;
fax numbers;
e-mail addresses;
social security numbers;
medical record numbers;
health plan beneficiary numbers;
account numbers;                               [Cont. on Next Slide]

## P&P for De-Identification of PHI

- Certificate/License Numbers
- License Plate Numbers, Vehicle Identifiers & Serial Numbers
- Device Identifiers & Serial Numbers
- URL Addresses & Internet Protocol (IP) Address Numbers
- Biometric Identifiers, Including Finger & Voice Prints
- Full Face Photographic Images & Comparable Images
- Any Other Unique Identifying Number

**Research**

**Notes:**
[NARRATOR] No Narration

[TRAINER] [Cont. from Previous Slide]
certificate/license numbers;
license plate numbers, vehicle identifiers and serial numbers;
device identifiers and serial numbers;
URL addresses;
Internet Protocol (IP) address numbers;
Biometric identifiers, including finger and voice prints;
Full face photographic images and comparable images;
Any other unique identifying number except as created by IHS to re-identify the information.
This determination also requires that IHS does NOT have actual knowledge that the remaining information could be used alone or in combination with other information to identify the patient.

## P&P for De-Identification of PHI

- Knowledgeable Experienced Person
- Applies Appropriate Methods & Determines Risk is Very Small that the Information Could Be Used Alone, or in Combination with Other Available Information, by an Anticipated Recipient of Such Information, to Identify the Patient
- Documents the Methods & Results of the Analysis that Justify the Determination

**Research**

**Notes:**
[NARRATOR] IHS may also determine that health information is not individually identifiable if a person with knowledge & experience of statistical & scientific methods, designated by the SUD/CEO,  determines the risk of identifying the patient is very small.   This designated person must document the methods & results of the analysis that justify the determination.

[TRAINER] The second way that IHS may determine that health information is not identifiable is:

If a person with knowledge and experience of generally accepted statistical and scientific methods for rendering information not individually identifiable, designated by the SUD/CEO or designee (or through a business associates contract), applies such methods and determines that the risk is very small that the information could be used alone, or in combination with other available information, by an anticipated recipient of such information to identify the patient.  This designated person with knowledge and experience of statistical and scientific methods must document the methods and results of the analysis that justify the determination.

## P&P for De-Identification of PHI

- De-identification Will Be Performed at the Origin of the Data, or, in the Case of the Determination Made by a Designated Person,Where Such Person Is Located, As Appropriate
- Hardcopy PHI Will Be De-Identified by Obliterating (Making Unreadable & Unrecognizable) the Individual Identifier(s)

**Research**

**Notes:**
[NARRATOR] De-identification must be performed at the origin of the data, or, if made by the SUD/CEO-designated individual, where that person is located, as appropriate. Hardcopy PHI will be de-identified by obliterating—that is making unreadable & unrecognizable--the individual identifier(s).

[TRAINER]
De-identification will be performed at the origin of the data, or, in the case of the determination made by the designated person named above, where such person is located, as appropriate.
Hardcopy PHI will be de-identified by obliterating (making unreadable and unrecognizable) the individual identifier(s).

## P&P for Re-Identification of PHI

- IHS May Assign a Code or Other Means of Record Identification to Allow Information to Be Re-Identified by IHS Provided that:
- The Code Is Not Derived From or Related To the Information About the Patient
- The Code Is Not Capable of Being Used to Identify the Patient
- IHS Does Not Use or Disclose the Code for Any Other Purpose
- IHS Does Not Disclose the Mechanism for Re-Identification that Could Be Used to Link the Code with the Patient

**Research**

**Notes:**
[NARRATOR] Once information has been de-identified, it is re-identified using a code or other means, so that the information can be retrieved in a way that does not require use of the individual patient’s name or other key identifiers. The code cannot be related to patient information, must ensure that it can’t be used to identify a patient, and cannot be disclosed for any other purpose. The mechanism for creating the code also cannot be disclosed.
[TRAINER]
Re-identification:  The following procedures will be used to re-identify previously de-identified PHI:
IHS may assign a code or other means of record identification to allow de-identified information to be re-identified by IHS, provided that, 
such code is not derived from or related to information about the patient (i.e., code is not derived from the patient’s social security number); 
such code is not capable of being used to identify the patient;  
IHS does not use or disclose the code for any other purpose; and
IHS does not disclose the mechanism for re-identification (tables, algorithms, etc.) that could be used to link the code with the patient.
A re-identification code does not constitute a “unique, identifying number, characteristic, or code.”

## Q&A 

**Research**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 174

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Delegation of Authority
FAX Machine Usage 
Transmittal of Confidential Communication by Alternate Means
Instructions on Administrative Requirements

- FAX Machine Usage
- Transmittal of Confidential Communication by Alternate Means
- Instructions on Administrative Requirements

**Administrative**

**Notes:**
[NARRATOR] Administrative training includes understanding the delegation of authority, new requirements for the use of fax machines and the transmittal of confidential information by other alternative means, as well as other instruction on administrative requirements.

[TRAINER]
PURPOSE:  To establish the policy and procedure on the Administrative requirements of the Health Insurance Portability & Accountability Act (HIPAA).
POLICY:  IHS facilities shall formulate policies and procedures in accordance with local policies and procedures and HIPAA to implement the provisions of this Section.

## Delegation of Authority

- Not Substantially Different Than Previous Policy
- SUD/CEO May Delegate to a Medical Records/Business Office Staff or Other Management Staff Member
- Only the Person Listed in the Document Can Accept or Deny a Change to Records
- Nothing Can Be Agreed to Verbally

**Administrative**

**Notes:**
[NARRATOR] The procedure for delegating authority is not substantially different than before implementing HIPAA requirements. The SUD/CEO may delegate authority to  a medical records, business office, or other management employee to review, accept, deny, issue written notifications, coordinate action on patient records, sign appropriate correspondence, and/or file requests for issues associated with restrictions and corrections or amendments. Only the person to whom the authority is delegated may accept or deny changes to records, and nothing can be agreed to verbally.

[TRAINER]
This is not substantially different then what they have already done in the past; SUD/CEO may delegate to a medical records staff member or a business office staff member, but anyone in a management position may be designated.
Only the person listed in the document can accept or deny a change to any documents.
Nothing can be agreed to verbally.
Trainer:  Provide contact information to trainees if SUD/CEO has delegated authority to someone else in the facility.

## Delegation of Authority

**Administrative**

- Video – See Transcript in Notes Below

**Notes:**
ODIA: Under the privacy rule, IHS has designated the SUD, CEO as the System of Record Manager for their facility.

KIHEGA:  A delegation of authority could be used if a CEO is going to be gone for an extended period of time, or if the CEO or SUD decides that they don’t want to deal with this on a regular basis. Maybe they don’t want to handle patients coming in asking for  restrictions or the correction or amendment of records. 

ODIA:  The delegation of authority memo is what we will use to accomplish this.

## FAX Machine Usage 

- Location:
- Not in a Public Area
- Use Can Be Monitored Only by the Person(s) Designated to Conduct Monitoring
- Only Authorized Staff Can Have Direct Access to FAX Machine
- Medical Records Fax Cover Page Must Include:
- Facility's Identification
- Date of Transmission
- Number of Pages Being Transmitted (Including Cover Page)
- To: Authorized Receiver's Name, Telephone Number, & FAX Number
- From: Sender's Name, Provider's Name (If Applicable), Sender's Telephone Number & FAX Number
- Remarks or Special Instructions (If Appropriate)
- Confidentiality Statement

**Administrative**

**Notes:**
[NARRATION] Taking extra care to protect PHI is especially important when using a fax machine to transmit information.  The fax machine should not be located in a public area, should be monitored by the appropriate person, and only be accessible to authorized staff.  Fax cover sheets must include the information appearing on your screen. 
[TRAINER] P&P for fax machine usage is extensive. Consider printing a copy of it and going over additional details not included on the training screens if you deem appropriate for your audience.
The FAX machine shall be physically located so that:
It is not in a public area; Its use can be monitored by the person(s) designated by the facility to conduct such monitoring; Only authorized staff can have direct access to the FAX machine.
Medical Records FAX Cover Page: Before transmitting any patient medical records, the sender must fill out a Medical Record FAX cover page containing, at a minimum, the following information:
Facility's Identification; Date of transmission; Number of pages being transmitted (including cover page); Authorized receiver's name; Authorized receiver's telephone number; Authorized receiver's FAX number; Sender's name; Provider's name (if applicable); Sender's telephone number; Sender's FAX number; and Remarks or Special Instructions (if appropriate).
The following is an example of an acceptable confidentiality statement:
THIS FAX IS INTENDED ONLY FOR THE USE OF THE PERSON OR OFFICE TO WHOM IT IS ADDRESSED, AND CONTAINS PRIVILEGED OR CONFIDENTIAL INFORMATION PROTECTED BY LAW.  ALL RECIPIENTS ARE HEREBY NOTIFIED THAT INADVERTENT OR UNAUTHORIZED RECEIPT DOES NOT WAIVE SUCH PRIVILEGE, AND THAT UNAUTHORIZED DISSEMINATION, DISTRIBUTION, OR COPYING OF THIS COMMUNICATION IS PROHIBITED.  IF YOU HAVE RECEIVED THIS FAX IN ERROR, PLEASE DESTROY THE ATTACHED DOCUMENT(S) AND NOTIFY THE SENDER OF THE ERROR BY CALLING (enter applicable service unit or area office phone number and extension).
[TRAINER NOTE] Consider adding this confidentiality statement to outgoing eMails.

## Sending Information Via FAX

- Call Receiving Facility to Inform that Records Are Being Sent
- Confirm Fax Number
- Confirm That  Fax Machine Is in a Secure Area or Request that Recipient Stand by Machine to Receive
- Reconfirm After Dialing that the Number Displayed on Fax Machine Is Correct Before Hitting “Send”

**Administrative**

**Notes:**
[NARRATOR] Prior to sending a fax, follow the procedure displayed on-screen to ensure that confidential information is not faxed to the wrong number, received by the wrong person, or, if is sent in error, that it is destroyed.  Place a copy of the cover sheet and the confirmation of fax in the patient record. 

[TRAINER]
Sending Information
Whenever the facility's authorized FAX user(s) intends to send a FAX, he/she shall comply with the following:
Telephone the receiving facility to inform them that patient medical records are being FAXed, confirm the FAX number, and determine whether the FAX machine is located in a secured area.  If the FAX machine is not in a secured area, request the authorized individual at the receiving facility to stand by the receiving facility's FAX machine.
Reconfirm the destination FAX number prior to transmission by checking the telephone number displayed on the FAX machine screen before transmitting the FAX.	
[Cont. on Next Screen]

## Sending Information Via FAX

- Confirm Receipt by Calling Recipient or CheckingTransmission Report
- If Fax Is Sent to Wrong Machine Contact Recipient & Request Fax Be Destroyed
- Place Copy of Cover Page & Confirmation of Fax Receipt in Patient’s Medical Record

**Administrative**

**Notes:**
[NARRATOR]No Narration

[TRAINER] (cont. from previous slide)
Confirm the success of the transmission by calling the intended recipient or by checking the FAC Report.
In the event that the FAX is erroneously transmitted to the wrong FAX number and the sender is aware that this error has occurred, he/she should immediately contact the erroneous recipient and request that the FAX be destroyed.
A copy of the FAX cover page, or equivalent documentation, shall be placed in the patient's medical record.  The FAX cover page, or equivalent documentation, shall include confirmation of receipt of FAX.

## Receiving Information Via Fax (cont.)

- Remove Medical Information from Machine ASAP
- Count Number of Pages
- If Missing Pages Contact Sender & Request Re-transmittal
- Read Fax Cover Page & Follow Instructions
- If Facility Has ARJ, Document Receipt of Fax
- If Fax is Printed on Thermal Paper, Photocopy & Destroy Original Thermal

**Administrative**

**Notes:**
[NARRATOR] It is just as important to follow procedure for receiving information via fax. Remove faxed  information from the  machine as soon as possible, confirm that the page count is correct and if anything is missing, call the sender and request the information be re-transmitted. Follow any instructions on the fax cover sheet, and execute additional procedures as described on-screen. 
[TRAINER]
Receiving Information
Whenever the facility's authorized FAX user(s) receives an incoming medical record FAX, he/she shall comply with the following:
Remove the FAXed medical information from the FAX machine as soon as possible, once he/she is aware that the FAX has been received.
Count the number of pages received to verify the number of pages against the FAX cover page.  If page(s) are missing, the sender must be contacted and requested to retransmit the document.
Read the FAX cover page and follow any instructions.
If the facility maintains an ARJ, document receipt of the FAXed document on the ARJ.
If the FAXed medical information is printed on thermal paper, the thermal paper must be photocopied.  Upon photocopying the information, the thermal copy must be shredded.

## Receiving Information Via Fax (cont.)

- Notify Intended Recipient that Fax Was Received
- Faxed Medical Information that Is Not in a Secure Area Must Be
- Hand Delivered or
- Placed in a Sealed Envelope & Delivered ASAP
- If Fax Is Erroneously Received at Facility
- Inform Sender of Error
- Destroy Fax
- Note in ARJ if Applicable

**Administrative**

**Notes:**
[NARRATOR] No Narration

[TRAINER]
Receiving Information
Whenever the facility's authorized FAX user(s) receives an incoming medical record FAX, he/she shall comply with the following: (cont.)
Notify the intended recipient that a FAX was received.
Unless the FAXed medical information will at all times remain in a secured area, the FAXed medical information must be hand delivered or placed in a sealed envelope and delivered to the intended recipient as soon as possible.
If a FAX has been erroneously transmitted to an IHS facility, the authorized FAX machine user who received the FAX shall inform the sender of the error.  The fax must then be destroyed and these actions would be notated in the ARJ, if applicable.

## P&P for the Transmittal of Confidential Communication by Alternate Means

- Individual Has the Right to Request Transmittal of PHI by Alternate Means or to an Alternate Location
- Request Must Be Submitted in Writing, Contain the Requested Form of Alternate Means/Location & Be Addressed to the Patient Registration Office or Other Appropriate Department
- Basis for the Request Is Not Required

**Administrative**

**Notes:**
[NARRATOR] HIPAA grants individuals the right to request transmittal of PHI by alternate means or to an alternate location. The request must be submitted in writing, contain complete information about how and where the information will be sent, and/or addressed, and should be forwarded to Patient Registration or other appropriate department for execution. The patient does not have to give a reason for the request. Follow other procedures as described on-screen.
[TRAINER] A basis for the request is not required
PURPOSE:  To establish the policy and procedure for allowing patients to request the transmission to them of protected health information (PHI) by alternate means or to an alternate location.
POLICY:  An individual has the right to request the transmission of protected health information (PHI) by alternate means or to an alternate location if the individual makes a written request and the request is reasonable.
DEFINITIONS:     Confidential communications means transmissions of a patient’s PHI from the IHS.
Alternate means are methods of sending confidential communications that are different from the usual methods (e.g., e-mail, registered mail, etc.).
Alternate location means an address different from that listed as the mailing address.  For example, the patient can ask that we contact him at work instead of at home or vice versa.
All requests for confidential communications to be sent by alternate means or to an alternate location shall be in writing, contain the requested form of alternate means/location and shall be addressed to the Patient Registration office or other appropriate department.  A basis for the request is not required.
					[Cont. on Next Screen]

## P&P for the Transmittal of Confidential Communication by Alternate Means (cont.)

- CEO/SUD Will Approve or Disapprove All Requests
- Whenever Possible, Decision Will Be Given Prior to the Patient Leaving the Facility
- When Alternate Means Would Affect Third-Party Payment the Individual Must Specify How Payment Will Be Handled
- Requests Must Be Filed in Health Record

**Administrative**

**Notes:**
[NARRATOR] No Narration

[TRAINER] [Cont. from Previous Screen]
The Chief Executive Officer/Service Unit Director (SUD/CEO) or designee will approve or disapprove all requests.  Whenever possible, the decision will be given to the patient prior to the patient leaving the facility.  May only disapprove if request is not reasonable.
If applicable, when an alternate means would affect third party payment, the individual must specify how payment will be handled.
Requests will be filed in the health record after the patient has been notified of the decision of approval or disapproval.

## Instructions on Administrative Requirements

- Designate Official HIPAA Contact Person
- Training:
- To All Employees, Volunteers & Contactors
- New Employees – Within 30 Days
- To Designated Staff As Policies Are Revised
- Shall Be Documented & Documentation Maintained for 6 Years
- Safeguards:
- Enact Policies & Procedures to Safeguard PHI in Compliance with Privacy Act & HIPAA Regulations for Both Paper & Electronic Records

**Administrative**

**Notes:**
[NARRATOR] HIPAA requires each Service Unit to designate an official contact person and to provide training to all employees, as described on-screen. The policies & procedures covered in this training are a response to the HIPAA safeguards requirement that is designed to ensure compliance for both paper and electronic records. 
[TRAINER] Designation of Privacy Official and Contact Person 
Each IHS facility shall designate a Privacy Official (Officer) and/or a contact person who shall be responsible for development of local policies and procedures for HIPAA compliance within the Service Unit area.  The Privacy Officer and the contact person can be the same individual.  The Privacy Officer and/or contact person must be knowledgeable and able to provide information covered in the IHS Notice of Privacy Practices and receive complaints and possibly resolve HIPAA issues.
Provide trainees with appropriate contact information.
Training IHS facilities must provide initial HIPAA overview training to all employees, volunteers and onsite contractors.  New employees must receive training as soon as possible, but no later than 30 days after entering on duty.   Function specific training must also be provided to other categories of staff such as Health Information Management staff, Business Office, and Nursing & Medical Staff.  Training must also be provided to designated staff when policies & procedures are revised.  Training provided to staff shall be documented and maintained in writing or electronically for six years.   
Safeguards IHS facilities shall put in place policies and procedures to safeguard PHI in accordance with the Privacy Act and HIPAA regulations for both electronic and paper records to include administrative, technical and physical safeguards.  
Examples:  Administrative Safeguards includes orientation and termination policies, incident reporting polices, access, contingency and disaster recovery.
Examples:  Technical Safeguards:  User access and restrictions, user monitoring, authentication, and password issuance.
Examples:  Physical Safeguards:  Physical access control during and after hours, shredding policies, and health record removal from facility.

## Instructions on Administrative Requirements

- Complaints Shall Be Addressed to SUD/CEO or Designee & Must Be Documented, Maintained & Filed with Explanation of Resolution
- IHS & Its Facilities Shall Not Invoke Sanctions Against Its Employees Under the Following Conditions:
- Whistleblower
- Health Oversight or Public Health Authority Authorized by Law to Investigate
- Attorney Retained by Employee for Purpose of Determining Legal Options
- Disclosure of Employees Who Are Victims of Crime to a Law Enforcement Official, with Limitations

**Administrative**

**Notes:**
[NARRATOR] All complaints should be directed to the SUD/CEO or designee, and must be documented, maintained, and filed, along with a brief explanation of the resolution of the complaint, if there is one. IHS must also ensure that employees are not penalized for reporting HIPAA violations or suspected violations, for retaining an attorney to determine legal options if they need it, or for other actions as described on screen. 
[TRAINER]    All complaints regarding HIPAA and Privacy Act violations shall be addressed to the Service Unit Director/Chief Executive Officer or designee.  The complaints must be documented, maintained, filed and a brief explanation of resolution, if any.
Note: Individuals can file complaints directly to the Secretary, DHHS. 
Sanctions: IHS and its facilities shall not invoke sanctions against employees, volunteers and onsite contractors under the following conditions:
Whistleblower - if an employee discloses PHI provided s/he believes in good faith that the facility is in violation of HIPAA, or other clinical or health care standards or that facility activities or conditions could potentially endanger one or more patients, workers or members of the public:
A health oversight authority or public health authority authorized by law to investigate such violations or accreditation organization for the purpose of reporting the failure to meet standards or misconduct by an IHS facility; or
An attorney retained by the employee for the purpose of determining his or her legal options with regards to an IHS facility’s conduct.
Disclosure by employees who are victims of a crime to a law enforcement official provided that PHI disclosed is about the suspected criminal and PHI disclosed is limited to the following:
--Name and address; Date and place of birth; Social security number; ABO blood type and Rh factor; Type of injury; Date and time of treatment; Date and time of death, if applicable; A description of distinguishing physical appearance including height, weight, gender, race, hair and eye color, presence or absence of facial hair, scars and tattoos.

## Instructions on Administrative Requirements

**Administrative**

- Video – See Transcript in Notes Below

**Notes:**
TRENT: In the instance where an individual becomes aware of a violation of HIPAA and reports it, that individual would be protected under the Whistle Blowers Act from criminal or civil prosecution. 

REBECCA LOVING, RN, MS – Oklahoma Area Acting Director, Division of Health Care Systems
HIPAA offers protection for employees who report violations of HIPAA against retaliation from their co-workers, their employers, their supervisors. 

TRENT:  Or any sort of negative impact on themselves or their workplace environment or their position as a federal employee because they engaged in disclosing what they believed at the time was a violation of the act.

## Instructions on Administrative Requirements

- IHS Shall Take Reasonable Steps to Ensure Mitigation of a Disclosure or Violation
- IHS Shall Refrain From Intimidating Acts Against Patients & Employees for Exercising Rights Under HIPAA Privacy Rule
- IHS Shall Not Require Individuals to Waive Right toFile Complaints
- IHS Shall Develop Policies & Procedures for HIPAA & a Process Shall Be Established for Revisions to ReflectFuture Changes

**Administrative**

**Notes:**
[NARRATOR] HIPAA regulations also require IHS to take steps to minimize the impact of any disclosure violations, and to make sure that individuals who exercise their rights under HIPAA are not victimized by intimidating acts. IHS cannot force individuals to waive their rights to file complaints, and must develop a process to accommodate future changes in policy and procedure. 
[TRAINER] When IHS facility becomes aware of possible violation of the use or disclosure of PHI by its employee or business associate, the facility shall take reasonable steps to ensure mitigation of the disclosure or violation.  For example, when PHI has been improperly disclosed, steps shall be taken to mitigate its improper use based on knowledge on how such information might be used.  The last bullet refers to establishing a procedure for distributing changes in any of the forms policies and procedures. Information on this is still to come, but all revisions to forms policies & procedures will be posted on the IHS HIPAA Website.
Refraining from Intimidating or Retaliatory acts
IHS shall not intimidate, threaten, coerce, discriminate against, or take retaliatory action against individuals including employees for exercising their rights under the HIPAA Privacy Rule, or for participating in any process established for:
   filing complaints with the Secretary, DHHS; testifying, assisting or participating in an investigation, compliance review, proceeding, or hearing; and opposing any act or unlawful practice & the manner of opposition is reasonable and does not involve a disclosure of PHI not permitted.
 Waiver of rights IHS facilities shall not require individuals to waive their rights under the HIPAA Privacy Rule, including but not limited to, their rights to file complaints with the Secretary, DHHS, as a condition for the provision of treatment, payment, eligibility (CHS), or other benefits.
Policies & Procedures, & Documentation  IHS shall develop policies & procedures in each of the relevant section of the HIPAA Privacy Rule & a process shall be established for revisions to reflect future changes.

## Q&A 

**Administrative**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 190

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

[TRAINER: Determine your audience’s needs and pre-plan whether you’ll provide training on all sections.]

## Summary

- Learn Train & Protect

- Know IHS HIPAA Forms, Policies & Procedures
- Avoid Incidental Disclosures
- Refer Questions or Concerns to HIPAA Coordinator, Area Health Records Management or Regional Counsel

**Notes:**
[NARRATOR] While it puts in place many new forms, policies, and procedures, it is very important to remember that HIPAA is not designed to prevent or get in the way of providing patients with the high quality healthcare they deserve. It is designed to protect privacy and engender trust. Questions and/or concerns should be addressed to HIPAA Coordinators, Area Health Records Management or Regional Counsel. 
[TRAINER— Provide any contact information that is appropriate at this point.] NOTE: The following information on incidental exposures is the same as in overview section but an opportunity to discuss during close of training rather than beginning if more appropriate.]
Incidental disclosures are particularly important including any personnel of the facility who may discuss patient conditions, or release PHI in the following situations:
Grocery stores, car pools, van pools, family time
 Discussion or answering questions in public areas of the medical facility such as hallways, waiting rooms, etc.; In churches (via asking for prayers and releasing specifics during that request); 
Using printed information that should be shredded or destroyed as a medium for taking notes;
Leaving information laying around the mailroom that should be in envelopes; Jammed fax or copier machines left unattended; 
Leaving sensitive information unattended on desks; Viewing information on computer screens; Revealing more than minimum information necessary in ANY situation;
Handing sign-in clipboards to patients that contain other patient information; and/or 
Discussing information on a phone located in public areas or areas where others may hear.

## Training Materials, Forms, Policies, Procedures, Updates, FAQs, Quick Reference Cards, and More are Available at www.ihs.gov

**Summary**

## Q&A 

**Summary**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.