# Presentation: 111806

## Slide 1

## Slide 2

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

## The Health Insurance Portability & Accountability Act (HIPAA)

- Passed by Congress in 1996
- Portability – Transfer of Health Insurance Coverage
- Accountability – Prevent Healthcare Fraud and Abuse
- Administrative Simplification – Decrease Costs and Administrative Burdens

**Overview**

**Notes:**
[NARRATOR] The Health Insurance Portability & Accountability Act was passed by Congress in 1996 to guarantee that individuals could move from one health plan to another without losing insurance coverage, or be denied coverage because of pre-existing conditions. HIPAA, which does not replace the Privacy Act of 1974, quickly became a sweeping attempt to remedy many of the problems in health care today. 

## Administrative Simplification

- Transaction and Code Sets – Mandates Standard Electronic Transaction Formats and Code Sets
- Security – Final Rule Pending
- Privacy Rule – Main Focus of Training

**Overview**

**Notes:**
[NARRATOR] The most complex of HIPAA’s  regulations, those associated with Administrative Simplification, are divided into three categories: Transaction & Code Sets, security, and privacy, which is the focus of this training.

## HIPAA Privacy Rule

- Increased Risks for Invasion of Privacy
- Public and Congressional Concern about Healthcare Privacy
- Support for Provider-Patient Relationship
- National Standards to Protect PHI
- National Boundaries on Use and Release of Health Records
- Appropriate Safeguards for Protection of PHI
- Disclosure for Public Health Purpose
- Civil and Criminal Penalties

**Overview**

**Notes:**
[NARRATOR] HIPAA’s Privacy Rules are designed to address public concern for healthcare privacy and the increased risks associated with new technologies.  The national standards, boundaries and safeguards support a good relationship between providers & patients and holds violators accountable for their actions.

## Individuals Have the Rights to
An Accounting of Disclosures
Release of Minimum Necessary
A Copy of Health Record
Request Corrections
Control Some Uses and Disclosures of PHI
File Complaints with IHS and Office for Civil Rights
Submit Written Requests for Notice of Information
Have Reasonable Requests for Confidential Communication of PHI Accommodated

- An Accounting of Disclosures
- Release of Minimum Necessary
- A Copy of Health Record
- Request Corrections
- Control Some Uses and Disclosures of PHI
- File Complaints with IHS and Office for Civil Rights
- Submit Written Requests for Notice of Information
- Have Reasonable Requests for Confidential Communication of PHI Accommodated

**Overview**

- HIPAA Privacy Rule

**Notes:**
[NARRATOR] HIPAA provides patients with the right to release, limit release, request corrections and/or amendments, and obtain a list of individuals and agencies to whom or which their protected health information has been released. When there are disputes, patients also have the right to file complaints.

## Who and What is Covered

- Healthcare Providers
- Government & Private Health Plans
- Healthcare Clearinghouses
- Business Associates

**Overview**

**Notes:**
[NARRATOR] HIPAA requirements apply to all covered entities including any healthcare providers who transmit information electronically, public and private health plans, clearinghouses, and our business associates. 

## Recent Misuses of Patient Health Information

- Banker Collects on Cancer Patients’ Mortgages
- Hospital Employee Sells Country Singer’s Medical Records for $2610
- Psychological Records of 62 Children Accidentally Posted on Web Site
- NC Physician’s Laptop with Patient Medical Histories Stolen
- health.org Exposes Customer Names, Addresses, Phone Numbers & Email Addresses on Web
- Washington DC Hospital Fined $25,000
- Sick Employee Fired by Self-Insured Employer

**Overview**

**Notes:**
[NARRATOR] Before HIPAA, we can find a wealth of examples of how the lack of legal protection led to invasion of privacy & use of many individual’s health information for profit, or worse. 

## Video – See Transcript in Notes Below

**Notes:**
SANDY TRENT, JD – Regional Counsel, Albuquerque Area IHS
HIPPA increases the security for patients by the promulgation of particular steps which have to be gone through before information can be released about a patient, certain notifications that must be provided to patients, certain restrictions against the agency itself, the Indian Health Service or the federal sector agencies before information can be released.

TERRY HUNTER, MPH - CEO Oklahoma City Indian Clinic
Indian communities are close knit. And I think one of the biggest educational issues that we have to overcome with HIPAA and privacy, the privacy standards, is the fact that we have to educate them to why we’re doing this. They’re used to coming in here, “is my uncle here? I need to see my uncle.” Now with HIPAA we can’t divulge that.

## Health Information & Protected Health Information (PHI)

- Health Information is Oral or Recorded Information that
- Is Created/Received by a Healthcare Provider, Health Plan, Public Health Authority, Employer, Life Insurer, School or University or Healthcare Clearinghouse
- Relates to the Past, Present and/or Future Physical or Mental Health or Other Health Condition
- Concerns the Provision of Healthcare
- Relates to Past, Present or Future Payment
- PHI is Defined as Health Information that is
- Individually identifiable
- Transmitted or Maintained in any Form or Medium

**Overview**

**Notes:**
[NARRATOR] Protected Health Information, or PHI, includes any health information, past, present, or future, physical or mental health or condition of an individual, & any payment information for the provision of health care (includes demographic information) which either specifically identifies the individual it describes or could be used to identify the individual.

## The Importance of PHI Security

- Required by Law
- Earns Patient Trust
- Privacy & Security of Information
- Sets Federal Minimum Standards & Safeguards to Protect PHI
- Preempts Weaker State Laws
- Does Not Supercede Federal Laws or Privacy Act

**Overview**

**Notes:**
[NARRATOR] Providing patients with quality healthcare includes protecting their confidential healthcare information. First because it is required by law, and because it helps patients trust their healthcare providers.

## Trust Impacts Quality of Care 

- Detection & Treatment of All Conditions
- Accurate & Complete Health Records
- Highest Quality Healthcare
- Reduces Healthcare Cost
- Patients Do Not Move from One Facility/Provider to Another
- If Patients Do Not Trust Us They
- Do Not Seek Treatment
- Give Incomplete or Inaccurate Information
- Move from One Provider to Another
- Ask the Provider Not to Record Their Actual Condition

**Overview**

**Notes:**
[NARRATOR] When trust is compromised, conditions may go undetected or untreated, health information may not be complete & accurate, people will be hesitant to ask for treatment, may pay for care out of pocket to avoid an insurance claim or move from one physician to another—all of which can compromise quality of care.

## Earn Patient’s Trust

- Know IHS Forms Policies & Procedures
- Respect Patient’s Right to Privacy
- Treat All Records as if They Are Your Own
- Be Sensitive to Privacy in All Situations

**Overview**

**Notes:**
[NARRATOR] To earn patient trust, know & use the IHS forms policies & procedures so that you can show sensitivity & respect toward the protected health information of all Native American & Alaska Natives.

## Training Requirements

- IHS Must Provide HIPAA Training to All
- 	Employees, Volunteers and Contractors
- New Employees Must Receive Training No Later Than 30 Days After Beginning Duty
- Department Specific Training
- Revised Training When Policies are Revised
- Training Must Be Documented and Maintained for 6 Years

**Overview**

**Notes:**
[NARRATOR] IHS is required to provide initial training to all employees, volunteers & contractors. New employees must receive training as soon as possible, but no later than 30 days after entering their position and training documentation must be kept for 6 years.

## Learn Train & Protect

- Train-the-trainer Kit, Includes
- Interactive CD
- Quick Reference Cards
- Forms, Policies & Procedures
- Web Support

**Overview**

**Notes:**
[NARRATOR] Learn Train & Protect includes training CDs, quick reference cards to help staff guide patients through filling out the forms, copies of the forms, policies and procedures, and most of the materials are also available on the Web. 

## Learn Train & Protect

- Training Provided to
- Area HIPAA Coordinators
- Privacy Act Liaison (PAL)
- Individual Providers
- HIPAA SU Coordinators
- IHS Consultants & Volunteers
- All Employees

**Overview**

**Notes:**
[NARRATOR] Trainers then take this information out to the field, ensuring that providers and employees through the Indian health community have received the required training.

## Non-Compliance?  Not An Option!

**Overview**

- Video – See Transcript in Notes Below

**Notes:**
LCDR GODWIN ODIA, MBA, MPA, RHIA, Senior Specialist Health Record Administrator, IHS HQE
Ultimately, training is required to prevent IHS and the facility and even the employee from being sued by the patients.

ANGELA KIHEGA - HIPAA Coordinator for Okalahoma Area
The HIPAA privacy standard does have teeth in it. 

ROB HAYES, DPH - Anti-Coagulation Clinic Director, Claremore Indian Hospital
If we don’t comply with HIPAA, the consequences are loss of licensure, accreditation.

TRENT:  The civil and criminal penalties which are available to the Office for Civil Rights, and to the Department of Justice, are both fines of substantial cumulative natures, as well as the possibility of criminal prosecution, conviction and imprisonment.

## Enforcement & Penalties For Non-Compliance

- Civil Monetary Penalties:
- $100 Per Violation
- Capped at $25,000 Per Calendar Year Per Violation
- Enforced by Office for Civil Rights

**Overview**

**Notes:**
[NARRATOR] Penalties for non-compliance are displayed on screen. The Office for Civil Rights enforces civil penalties and the US Dept of Justice imposes penalties for violations that are criminal in nature.

## Penalties for Non-Compliance

- Civil Service Employees May Face Discipline Up to & Including Termination
- Commissioned Corps Officers May Face Discipline Up to & Including Recommendation for Termination of Commission
- All Employees May Be Held Individually Accountable

**Overview**

**Notes:**
[NARRATOR] In cases of non-compliance, disciplinary actions are based partially upon which personnel system the employee is in.

## Penalties for Non-Compliance

- Up to $50,000 Fine & 1 Year Imprisonment for Knowingly Obtaining or Disclosing Individually Identifiable Health Information
- Up to $100,000 & 5 Years Imprisonment if Done Under False Pretenses
- Up to $250,000 & 10 Years Imprisonment if Done With Intent to Sell, Transfer, or Use for Commercial Advantage, Personal Gain or Malicious Harm
- Enforced by U.S. Department of Justice (DoJ)

**Overview**

**Notes:**
[NARRATOR] No Narration

## Q&A 

**Overview**

## Slide 22

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Notice of Privacy Practices 

- How to Review the Notice with Patients
- How to Respond to Their Questions
- What to Do in Emergency Situations
- What to Do When Patient Won’t Sign

**Privacy Notice**

**Notes:**
[NARRATOR] A good understanding of the notice of privacy practices is the foundation of this training and includes instruction on the bullets that appear on this screen.

## Notice of Privacy Practices

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
PATRICIA ANNE GOWAN, RHIA, MPA, CPC, Privacy Act/FOIA Advocate, Phoenix Area: The notice of privacy practices is a long laundry list of how we tell our patients how we’re going to use and disclose their protected health information.

KIHEGA: The notice of privacy practices was developed in conjunction with regional counsel, as well as health information management consultants. We strongly urge anyone, tribal or federal entities, that utilize the notice of privacy practices that was developed not to change any of the language in there. 

TRENT:  It’s recommended that the wording not be changed because there might be an inadvertent dilution or omission of statutorily mandated language that the patient is required to receive from the agency.

## Reviewing with Patients

- Explain That Health Records Are Used to
- Plan for Care & Treatment
- Communicate Among Healthcare Professions
- Check Results & Improve Care
- Verify Services Billed
- Educate Healthcare Professionals
- Improve Health of All People
- Support Medical Research
- Conduct Facility Planning & Marketing
- Maintain Legal Healthcare Records

**Privacy Notice**

**Notes:**
[NARRATOR] When reviewing the notice of privacy practices with patients, before we ask them to sign the acknowledgement, we are required to explain what a health record is, or make sure the patient already knows what a health record is, and how the record is used. 

## Reviewing with Patients

- Explain That Patient Must Understand His/Her Own Health Record in Order to
- Ensure Accuracy
- Understand Why Others May Review His/Her PHI
- Make Informed Decisions Regarding Disclosures

**Privacy Notice**

**Notes:**
[NARRATOR] It is also important that patients understand their own health record so that they can help ensure it’s accuracy, understand why their information might be reviewed, and so they can make informed decisions.

## Reviewing with Patients

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  When you’re reviewing the notice of privacy practices with the patient, make sure that the patient understands what disclosures means and restrictions mean so that they will fully understand their patient rights. 

LOLA CAIN, DPH - Assistant Chief Pharmacist-Outpatient, Claremore Indian Hospital
When we talk about disclosure, we mean the release of a patient’s protected information.

KIHEGA:  A restriction means that a patient would ask that a certain individual is not entitled to see their record, or a certain portions of their record. 

CAIN:  There are patients who restrict access to their information because there may have been a breech of information in the past, so a patient can restrict release of information in any way they deem appropriate. 

## Reviewing with Patients

- Explain Patient’s Right to
- Receive & Inspect Health Records
- Request Restrictions
- Request Corrections and/or Amendments
- Request Confidential Communications
- Receive a List of Certain Disclosures
- Revoke Written Authorization to Disclose or UseHealth Information
- Receive a Paper Copy of the IHS Notice of Privacy Practices

**Privacy Notice**

**Notes:**
[NARRATOR] Once the patient understands how their health records are used by others, and what disclosures and restrictions are, we must make sure they understand their rights. 

## Reviewing with Patients

- Explain to Patient IHS’s Responsibilities to
- Maintain Privacy of Information
- Inform Individuals about Privacy Practices
- Notify Patients if Requests for Restriction are Denied
- Accommodate Reasonable Requests for Alternative Communications
- Honor All Terms of Notice of Privacy Practices

**Privacy Notice**

**Notes:**
[NARRATOR] The next step is to explain to the patient IHS’s responsibilities with regard to their PHI. 

## Notice of Privacy Procedures

- Beginning April 14, 2003
- Review Notice with Patient
- Answer Patient Questions
- Refer Unanswered Questions to SU Privacy Act Liaison (PAL)/SU HIPAA Coordinator
- Do Not Agree to Anything Verbally
- Obtain Patient Signature on Acknowledgement
- Place in Patient Health Record

**Privacy Notice**

**Notes:**
[NARRATOR] Beginning April 14, 2003 we are required to review the notice of privacy practices with every patient who comes into the facility for treatment. The procedure is described in the bullet points that appear on screen. 

## Notice of Privacy Procedures

- After April 14, 2003
- Check Record for Existing Acknowledgement
- If Acknowledgement Is in Record No Action Is Required
- If Acknowledgement Is Not in Record Follow Procedure for Reviewing & Obtaining Signed Acknowledgment

**Privacy Notice**

**Notes:**
[NARRATOR] The procedure after April 14th includes one additional step and that is to check the patient’s record for a copy of the acknowledgement first. If there is already an acknowledgement in the record, no additional action is required. 

## Notice of Privacy Procedures

- If Patient Refuses to Sign
- Note on Acknowledgement That Patient Received Notice
-   and Reason for Not Signing
- Sign & Note Date
- Do Not Agree to Anything Verbally
- Place Acknowledgement in Patient Record

**Privacy Notice**

**Notes:**
[NARRATOR]  If a patient will not sign the acknowledgement, note this on the acknowledgement, along with a reason if the patient gives one, then sign and date the notation and place the acknowledgement in the patient’s record.

## Notice of Privacy Procedures Q&A

**Privacy Notice**

- Video - See Transcript in Notes Below

**Notes:**
ODIA:  If a patient is incapacitated, our employee should document on the Acknowledgement form the reason for the patient not being able to sign that Acknowledgement form.

KIHEGA:  Later, when the patient awakens, then you would go ahead and have the patient sign that. 

ODIA:  That Acknowledgement form becomes part of the medical record.

## Notice of Privacy Procedures

- If Emergency or Incapacitation
- Note Situation on Acknowledgment Form, Sign, Date
-    & Place in Record
- Provide Form to Patient as Soon as They Are Capable
- 	of Signing
- Do Not Agree to Anything Verbally

**Privacy Notice**

**Notes:**
[]NARRATOR] If the patient is incapacitated or the emergency situation prevents staff from going over the notice and obtaining a signature, follow the procedure as described on screen and get back to the patient as soon as their condition allows.

## Notice of Privacy Procedures

**Privacy Notice**

- Video – See Transcript in Notes Below

**Notes:**
PATTI WHITE - Laboratory Manager, Claremore Indian Hospital: Sometimes patients ask us to do something verbally such leaving off a test on the report or sending it to another address and we cannot agree verbally to do anything like that for them. They must get proper release of information with medical records. 

KIHEGA:  The reason why the staff should not agree to anything verbally is because if you agree to it verbally, how would any other staff member know what restriction you had agreed to.

ODIA:  There may be a miscommunication between the patient and the IHS employee.  We want to make sure we restrict the right information the patient tells us to restrict.  The same is true of disclosure.

## Notice of Privacy Procedures

- Notice Must be Posted
- In a Public Place
- Inside or Outside Facility
- On Website

**Privacy Notice**

**Notes:**
[NARRATOR] The notice must also be posted in a public place such as waiting areas and treatment rooms.

## Q&A 

**Privacy Notice**

**Notes:**
Ask and answer questions as needed. Refer unanswered questions to Area Health Records Management.

## Slide 38

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Disclosures

- Helping Patient Fill Out Form 810
- Authorization for Use or Disclosure of Health Information
- Disclosure of Minors’ PHI
- Verification of Identity Prior to Disclosure

**Disclosures**

- Form IHS-810 Authorization for Use or Disclosure

**Notes:**
[NARRATOR] In this section, we cover Form IHS- 810, the Authorization for Use or Disclosure of Health Information, including  how to help patient obtain & fill out the form. Also covered are the policies & procedures associated with disclosures, including disclosure of minors’ phi, and verifying identify prior to disclosing  information.

## Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  IHS form 810 is a way patients authorize use or disclosure of the protected health information. It has to be signed with the original signature and dated. Or the patient can submit a written request that contains all the required information and their original signature and dated. 

## Form IHS-810

**Notes:**
[NARRATOR] Form 810, or a written request containing the same information, must be completed and signed, with an original signature prior to disclosing or releasing protected health information for any purpose other than treatment, payment, or healthcare operations. Only form 810 or written requests with an original signature will be processed. The form should be filled out using black ink; forms filled out in red ink will not be processed.

## Form IHS-810

- Provide Yellow Copy of the Signed IHS-810 to the Patient
- Original Form 810 Is Processed by Health Records Staff
- Original Form 810 Is Filed into Patient’s Health Record
- Account for the Disclosure on IHS Form 505 or Electronically
-    (ROI Software)
- Same Procedure Applies to Valid Written Requests
- Expires One Year from Date of Patient Signature Unless Otherwise Specified by Patient

**Disclosures**

**Notes:**
[NARRATOR] Once the patient has filled out and signed form 810, the yellow copy is provided to the patient. The original is submitted for processing and after processing is filed in the patient’s record and remains there for the life of the record. 

## Written Requests 

- Written Requests Must Contain
- Requestor’s Name & Address
- Date of Request
- Date of Birth
- Description of Requested Information
- Original Signature
- If Correct Fulfill Request

**Disclosures**

**Notes:**
[NARRATOR] Patients may submit a written request which may also be processed the same as form 810, if it contains a full description of information requested, and has an original signature and date.

## Form 810 or Written Request

- When a Request for Disclosure Is Incomplete
- Contact Requestor for Additional Information Prior to Disclosure
- Document Request Clarification with Date & Initials on Original Authorization Form or Written Request

**Disclosures**

**Notes:**
[NARRATOR] Staff may follow up on incomplete or unclear written requests by contacting the requestor for additional information, which is documented with date and initialed in the health record.

## Written Request Denied

- Procedure for Denying Written Request
- Notify Patient of Denial of Request
- Explain Why Denied
- List Specific Information Needed
- Inform Patient That They May Use Form 810
- A Patient May Obtain the Form by
-  Visiting or Calling the Nearest IHS Facility
-  Visiting the Forms Web Site http://forms.psc.gov

**Disclosures**

**Notes:**
[NARRATOR] If a written request does not include all required information staff should notify the patient and take steps to obtain the required information as described on-screen.

## Verification of Identity: In Person

- Responsible IHS Staff Knows Patient Personally
- If Not Known Personally, Require One Piece of Tangible Identification
- Driver’s License
- Military ID Card
- Tribal Registration Card
- Employment ID Card/Badge
- Passport
- Alien Registration Card

**Disclosures**

**Notes:**
[NARRATOR] Before a disclosure can be authorized, staff must note in the chart that they know the patient personally, or verify the requestor’s identification. 

## Verification of Identity: In Person

- Patient Requesting Own PHI Must Have Matching ID
- ID With Name Change Requires Supporting Evidence
- Additional Verification (i.e.Last Visit Made, Parents’ Names, or Place of Birth

**Disclosures**

**Notes:**
[NARRATOR] If the patient is requesting his or her own PHI, the name on the id presented must match name of patient. If it doesn’t, follow the procedure as described on-screen. 

## Verification of Identity: In Person

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
MICHELLE HEFLEY - Medical Records Technician, Claremore Indian Hospital:
Someone can certify in writing that they are who they say they are, and we just have to notify them that if they aren’t who they say they are then they can be fined for that, and that certification in writing we will put in the patient’s chart. 

## Verification of Identity: 3rd Party

- Law Enforcement Official Must Show
- Official Identification
- Law Enforcement Request or Court Order Requesting the Release of PHI

**Disclosures**

**Notes:**
[NARRATOR] Sometimes requests for PHI come from third parties. The following screens describe proper verification of identity procedures associated with third-party requests. 

## Verification of Identity: 3rd Party

- Attorney, Attorney’s Assistant or Insurance Company Representative Must
- Show Valid Photo ID & Authority (i.e. Business Card)
- Show Proof of Authority to Act

**Disclosures**

**Notes:**
[NARRATOR] No narration on this screen.

## Verification of Identity: 3rd Party

- Other Individuals Must Present
- Photo ID Matching Individual Named in Patient Authorization

**Disclosures**

**Notes:**
[NARRATOR] No narration on this screen.

## PHI to Parent, Guardian or Personal Representative
Verify Identity of Requestor 
Verify Relationship 
Copy of a Birth Certificate
Court Order 
Previously Provided Evidence in Medical Record 
Other Evidence of Relationship 

- Verify Identity of Requestor
- Verify Relationship
- Copy of a Birth Certificate
- Court Order
- Previously Provided Evidence in Medical Record
- Other Evidence of Relationship

- Verification of Identity: 3rd Party

**Disclosures**

**Notes:**
[NARRATOR] If the request comes from a parent, guardian, or the patient’s personal representative, staff must verify the identity of the requestor as well as the relationship of the requestor to the person who’s PHI is being requested. 

## Verification of Identity: 3rd Party

- Document Verification of Identity on Form 810
- Note Type of ID Presented/Used
- Note Documentation of Authority
- Initial & Date

**Disclosures**

**Notes:**
[NARRATOR] The  procedure described on-screen applies to documenting the verification of identity for all 3rd party requests.

## Verification of Identity: Request By Mail

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
HEFLEY:   Requests by mail are particularly challenging because it’s hard for us to verify the person the has sent it. What I do is I will pull the chart and look and see if there’s anything in the record that the patient has already signed in the past, and I will use that signature to verify the release that we’ve received in the mail. 

## Verification of Identity: Request By Mail

-  Mail to Another Individual
- Request Must Be on Form 810 or Approvable Written Request
- Verify that Name, Address, Particulars & Signature on Request Match Those in Patient File
- Note or File Request in Medical Record
- Note that PHI Was Released in Medical Record
- Release PHI to Name & Address of Individual Listed Only

**Disclosures**

**Notes:**
[NARRATOR] If a patient requests by mail that his or her PHI be sent to another individual, extra care must be taken to ensure the identity of the person making the request. 

## Verification of Identity: Request by Mail

- Request From Other Than Patient
- Requestor Must Show Valid ID & Documentation of Authority
- Staff Will Note on Form 810 or Valid Written Request the ID and Authority Used
- Initial and Date

**Disclosures**

**Notes:**
[NARRATOR] When law enforcement officers, attorneys, insurance company representatives or other individuals mail in a request for a patient’s PHI, document the type of ID or authorization presented, in the patient record, then date and initial the entry. 

## Verification of Identity: Request by Mail

- Variations or Missing Information in Written Requests
- Contact Requestor
- Obtain Explanation and Compliant Documentation
- Note on Form 810 or Valid Written Request the Explanation, ID and Authority Used
- Initial and Date

**Disclosures**

**Notes:**
[NARRATOR] If a request received by mail does not contain the proper verification of ID or authority, staff must obtain the information before fulfilling the request for disclosure. 

## Verification of Identity: Healthcare Provider

- When Receiving Request for PHI in Emergency
- Obtain Requesting Provider’s Name, Facility Name, Location &  Telephone Number
- Verify Requestor Identity by Telephoning the Number Provided
- Document Call & Identity of Individual Who Received the Call
- Document the Information Being Sought or Requested
- Document the Reason for the Request
- Provide Minimum Necessary PHI
- Provide Additional Information Requested as in Non-Emergency

**Disclosures**

**Notes:**
[NARRATOR] Emergency situations sometimes require other healthcare providers to phone in a request for PHI. The on-screen bullets describe the correct procedure for verifying identity, documenting required information, and fulfilling a telephone request made for emergency treatment purposes. 

## Verification of Identity: Subpoena/Court Order

- When Receiving Request for PHI via Court Order Refer to Area Health Records Consultant or Regional Attorney

**Disclosures**

**Notes:**
[NARRATOR] When Receiving Request for PHI via a subpoena or Court Order refer the request to  the Area Health Records Consultant or Regional Attorney. 

## Required Stamp or Label: All PHI Disclosures

*"This information has been disclosed to you from records whose confidentiality is protected by federal law.  Federal regulations (45 CFR Part 2) prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by such regulations.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.“*

**Disclosures**

**Notes:**
[NARRATOR] All disclosures must contain the statement that appears on-screen. 

## Required Stamp or Label: Alcohol/SubstanceAbuse Disclosures

*“**This information has been disclosed to you from records protected by federal confidentiality regulations (42 CFR Part 2). The federal regulations prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by 42 CFR Part 2.  A general authorization for the release of medical or other information is NOT sufficient for this purpose.  The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.”*

**Disclosures**

**Notes:**
[NARRATOR] The statement that appears on-screen must be labeled or stamped onto disclosures about alcohol or substance abuse when disclosed from designated centers. 

## Psychotherapy Notes

- Notes Recorded by a Mental Health Professional that
- Document or Provide Analysis of Conversation in Private, Group, Joint or Family Counseling Session
- Are Maintained Separate From the Medical Record
- Owned by the Mental Health Professional Who Recorded Them

**Disclosures**

**Notes:**
[NARRATOR] Psychotherapy notes include information recorded in any medium by a mental health professional documenting or analyzing the contents of conversations held during counseling sessions. They are the property of the mental health professional and are kept  separate from the rest of the patient’s medical record. 

## Psychotherapy Notes

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  Psychotherapy notes are defined in HIPAA’s privacy standards preamble as records that are kept by the mental health professional psychiatrist. They’re only used for that person’s purposes and so they are kept separate from the record and the mental health profession may choose to share them with the patient, but is not required to release them anyone else or to any other organization. 

## Psychotherapy Notes

- Psychotherapy Notes Do Not Include
- Medication Prescription & Monitoring
- Counseling Session Start & Stop Times
- Modalities & Frequencies of Treatment Furnished
- Results of Clinical Tests
- Summary of
- Diagnosis
- Functional Status
- Treatment Plans
- Symptoms
- Prognosis
- Progress to Date

**Disclosures**

**Notes:**
[NARRATOR] To further clarify, psychotherapy notes do not include information listed onscreen because it is included in the medical record. 

## P & P for Psychotherapy Notes: Disclosureto Patient or Other

- Form 810 Must Be Dated & Signed by
- The Patient;
- Legal Guardian if Patient is Minor or Incompetent; or
- Patient’s Personal Representative
- Psychotherapy Notes Must Be Checked on Form 810
- Authorization Does Not Apply to Other Disclosures

**Disclosures**

**Notes:**
[NARRATOR] When disclosing psychotherapy notes to the patient or to another individual, Form 810 must be dated, signed by the patient, or patient’s personal representative, & the box for Psychotherapy Notes must be checked. The authorization should not be used in conjunction with other disclosures or uses.

## P & P for Psychotherapy Notes: No Authorization Required

- Use by the Originator of the Notes for Treatment
- Use or Disclosure for Supervised Mental HealthTraining Programs
- Use or Disclosure by IHS in Legal Action or Proceedings Initiated by the Individual

**Disclosures**

**Notes:**
[NARRATOR] The mental health professional who wrote and owns the psychotherapy notes does not need authorization to use & disclose those notes. Neither is an authorization required for use in supervised mental health training programs or by IHS in legal actions that are initiated by the patient to whom the notes pertain.

## P & P for Psychotherapy Notes:No Authorization Required, Cont’d

- Use or Disclosure That Is Required by Law
- Authorized Disclosure to a Health Oversight Authority With Respect to the Oversight of the Originator of the Psychotherapy Notes and Used to Report a Serious and Imminent Threat to the Health and Safety of the Patient or a Third Party
- Disclosure Required by the Secretary of DHHS to Investigate IHS Facility Compliance With HIPAA
- Certain Disclosures about Deceased Patients to Coroners or Medical Examiners

**Disclosures**

**Notes:**
[NARRATOR] An authorization is also not required for uses as described on-screen. 

## Policy for Disclosure of Minors PHI 

- Procedure Is Governed by
- HIPAA Laws
- Applicable State Laws

**Disclosures**

**Notes:**
[NARRATOR] In addition to HIPAA requirements, it is important to know and understand state laws regarding the disclosure of a minor’s PHI. 

## Policy For Disclosure of Minors PHI 

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
ODIA:  If a minor wants to release information from his or her own record, they would generally complete IHS form 810, just like an adult would.  And whatever is released is governed by the applicable law in the area where the IHS facility is located.

## P&P for PHI of Minors: Request by Minor

- Minor Shall
- Designate a Review Representative
- Have Direct Access to PHI if Responsible Department Official (RDO) Determines There Will Be No Adverse Effect
- Provide Identification as Described in Individuals’ Rights to Access, Inspect & Obtain Copy of PHI

**Disclosures**

**Notes:**
[NARRATOR] Minors may have access to their own PHI when it has been determined that having the information will not have an adverse affect on them. The designation of a review representative and determination by the responsible departmental official are key to this procedure.

## P&P for PHI of Minors: Parents, Guardian, or in Loco Parentis

- Requests Must Comply with Verification of Identify Policy & Procedure
- Parent or Guardian Shall Designate Health Professional to Whom Records Will Be Sent
- Designated Health Professional Makes Judgment As to Whether Invasion of Privacy Is an Issue
- Reasonable Efforts Will Be Made to Inform the Minor

**Disclosures**

**Notes:**
[NARRATOR] Sometimes the request for a minor’s protected health information comes from parents or someone acting in place of the parents. State law, as well as HIPAA requirements determine how these requests are handled. Proper verification of ID is required.

## P&P for PHI of Minors: Request by Parents, Guardian, or in Loco Parentis

- Where Law Prohibits, IHS Shall Not Disclose the Minor’s PHI to
- 	the Parent, Guardian or *in Loco Parentis*
- Where State Law Permits, IHS May Disclose the Minor’s PHI to
-  	the Parent, Guardian or *in Loco Parentis* Unless
- Parental Rights Have Been Terminated
- Disclosure Might Endanger Minor
- Disclosure is Not In Best Interest of Minor

**Disclosures**

**Notes:**
[NARRATOR] State laws vary significantly. Make sure you know whether state law prohibits or permits disclosure to parents, guardians, or anyone acting in the parental role. 

## P&P for PHI of Minors: Request by Parents, Guardian, or in Loco Parentis

- Where State Law Permits, IHS May Disclose the Minor’s PHI to the Parent or Guardian Unless **(cont.)**
- Minor Has Consented to Service Where Parental Consent is Not Required Under State Law
- Minor Has Requested Parent/Guardian Not Be Treated as Personal Representative
- Parent/Guardian Agrees to Agreement of Confidentiality between IHS and Minor
- The Health Information Management Director or Designee Shall Determine Whether or Not to Release a Minor’s PHI to the Minor’s Parent or Guardian

**Disclosures**

**Notes:**
[NARRATOR] State laws vary significantly. Make sure you know whether state law prohibits or permits disclosure to parents, guardians, or anyone acting in the parental role. 

## P&P for PHI of Minors:Request Requirements

- Acceptable Request Submissions
- Form IHS-810
- Written Letter From the Parent/Legal Representative
- A Valid Authorization for Disclosure of PHI From Another Entity

**Disclosures**

**Notes:**
[NARRATOR] The procedure for requesting minors’ PHI is the same as other requests for disclosure.

## P&P for PHI of Minors:Request Requirements 

- All Requests Must Have
- Original Signature of the Parent or Legal Representative
- Date of Signature
- Description of Information Requested

**Disclosures**

**Notes:**
[NARRATOR] All requests for a minor’s PHI must contain the original signature of the parent or legal representative, date of signature, and description of information requested. 

## P&P for PHI of Minors: Other

- Subpoena/Court Order: Contact Area Health Record Consultant for Guidance Before Release
- Law Enforcement: Process Pursuant to Requirements of Law Enforcement Exception
- Law Firms & Insurance Companies: Original Signed Authorization by the Individual, Parent, or Guardian Must Accompany Request
- Medical Examiners: Access to Relevant Information Granted for Performance of Duties As Required by Law

**Disclosures**

**Notes:**
[NARRATOR] When requests for PHI come from the judicial system, courts, law enforcement officials, attorneys, insurance companies or medical examiners, process those requests as described on-screen.

## P&P for PHI of Minors:

- Prohibition-Redisclosure Statement
*	**“**This information is intended only for the use of the person or office to which it is addressed, and contains privileged or confidential information protected by law.  Unauthorized re-disclosure, distribution, or copying of this communication is strictly prohibited from disclosing this health information to any other party unless required by law.”*
- File Original Authorization or Written Request in Patient’sHealth Record
- Document Information Released in the Disclosure Accounting Record IHS-505

**Disclosures**

**Notes:**
[NARRATOR] Disclosure of Minor’s PHI must contain the Prohibition Redisclosure Statement that appears on screen. Once processed, the authorization is filed in the patient’s health record and the information released is documented in the accounting of disclosures log. 

## P&P for PHI of Minors: Alcohol/Drug Abuse 

- Release of PHI to Minor
- Where Law Does Not Require Parental or Guardian Consent, Access May Be Given Only by the Minor Patient
- Where Law Requires Parental or Guardian Consent, Authorization Must Be Obtained from both Minor & Parentor Guardian

**Disclosures**

**Notes:**
[NARRATOR] Laws regarding release of minors’ alcohol and/or drug abuse health information vary. Refer questions to your Area Health Information Manager. 

## P&P for PHI of Minors: Alcohol/Drug Abuse

- Minor’s Application for Treatment May Be Communicated to the Parent, Guardian, or Other Authorized Person
- With Minor’s Written Consent for Disclosure
- If Minor Lacks Capacity to Make a Rational Choice Regarding Consent
- As Allowed or Prohibited by State Law
- With Unique Federal Court Order
- After Consultation with IHS Regional Attorney
- Minor’s Application for Treatment May Not Be Disclosed to Law Enforcement

**Disclosures**

**Notes:**
[NARRATOR] Unless the minor lacks the capacity to make a rational decision, or in other circumstances as described on screen, the fact that a minor has applied for alcohol or drug abuse treatment can only be released to the parent, guardian, or other authorized person with the minor’s written consent. A minor’s application for treatment may not be disclosed in response to a law enforcement request. 

## P&P for PHI of Minors: Un-Emancipated Minors

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
PAUL ADAIR MOBLEY, DO - Clinical Director, Claremore Indian Hospital
Release of information from a minor varies from, I know, from state to state, and it would also depend on whether it was routine information or if it was due to the patient becoming emancipated. 

WILLIAM L. BUCHANAN, DO – Doctor of Osteopathy, Claremore Indian Hospital
Most specifically an emancipated minor is someone who’s married, or someone who’s a parent of a child, even though they’re, you know, under age 18, we consider that they are emancipated. They can be treated legally as an adult. 

KIHEGA:  Sometimes minors are declared emancipated if they went to court and been officially declared emancipated through the court system or by virtue of being pregnant or if they’re married. 

## P&P for PHI of Minors: Un-Emancipated Minors

- Determination of Whether or Not an Individual Is an Emancipated or Un-Emancipated Minor Is Determined in the State in Which the IHS Facility Is Located

**Disclosures**

**Notes:**
[NARRATOR] In all cases, the determination of whether or not an individual is an emancipated or un-emancipated minor shall be determined by the law of the state in which the facility is located. 

## P&P for Minimum Necessary

- Limit the Use & Disclosure of PHI to the Minimum Necessary Except to
-  The Patient Requesting Own PHI
-  Pursuant to a Valid Authorization
- CEO or Service Unit HIPAA Coordinator Identifies Level of Access for Staff

**Disclosures**

**Notes:**
[NARRATOR] Unless disclosing his or her own PHI to the patient, or to an entity the patient has requested via a valid authorization, IHS must make reasonable efforts to limit the use & disclosure to the minimum necessary in order to accomplish the intended purpose. The facility CEO or Service Unit HIPAA Coordinator may identify under what conditions staff need access, and the level of access individual staff members may have.

## P&P for Minimum Necessary

- IHS Determines What Is Minimum Necessary, but May Rely on the Judgment of
- Public Official
- Another Healthcare Provider, Health Plan or Healthcare Clearinghouse
- Professional Who Is Employee or Contractor of IHS
- Researcher with Appropriate Documentation From IRB

**Disclosures**

**Notes:**
[NARRATOR] IHS retains right to determine what is the minimum necessary disclosure, but may rely on the judgment of others as described on-screen.

## P&P for Minimum Necessary

- When Requesting PHI From Others, IHS Must Limit Request to That Which Is Necessary to Accomplish Purpose
- Entire Medical Record Shall Only Be Disclosed Upon Justified Request
- SUD/CEO-Designated Person Shall Monitor Compliance with the “Minimum Necessary” Requirement

**Disclosures**

**Notes:**
[NARRATOR] The same guidance regarding minimum necessary disclosure applies when IHS requests  PHI from other providers or facilities. 

## P&P for Minimum Necessary

- Does Not Apply to Requests/Disclosures
- By Healthcare Providers for Treatment Purposes
- With Valid Patient Authorization
- If Required by Statutes & Regulations
- If Required for Compliance with Standard HIPAA Transactions
- To Secretary of DHHS, or as Required by HIPAA

**Disclosures**

**Notes:**
[NARRATOR] The minimum necessary rule does not apply to disclosures described on-screen. 

## P&P for Disaster Relief 

- IHS May Use or Disclose PHI During Disaster and/or Disaster Relief Situations to
- Government Agencies Engaged in Disaster Relief Activities
- Private Disaster Relief or Disaster Assistance Agencies

**Disclosures**

**Notes:**
[NARRATOR] IHS may use PHI in the case of a disaster. A disaster is any event that overwhelms normal medical capability of the local facility and that triggers mass casualty medical readiness. Facility leadership, Tribal, County, State, or Federal officials are authorized to declare an emergency situation. 

## P&P for Disaster Relief 

- If Patient is Present
- Provide Opportunity for Patient to Object or Obtain Patient Agreement
- Complete Verification of Identity Prior to Disclosing PHI
- Document Verification in Health Record
- If Patient is Not Present or is Incapacitated
- Use Professional Judgment
- Disclose Only Relevant PHI
- Complete Verification of Identity Prior to Disclosing PHI
- Document Verification in Health Record

**Disclosures**

**Notes:**
[NARRATOR] IHS may use or disclose PHI in the case of a disaster to identify and notify family members, personal representatives, patients, or others responsible for the care of patients, to determine a patient’s location, or to notify others of general condition or death of a patient. The procedure for use or disclosure when the patient is present, as well as if the patient is not present or is incapacitated is described on-screen.  Follow previously described procedures for verification of identity. 

## P&P for Disaster Relief 

**Disclosures**

- Video – See Transcript in Notes Below

**Notes:**
ODIA:  During a disaster relief effort if a patient had to be transferred to another facility for treatment purposes, we would release patient information for treatment purposes.  However, we’ll release only the minimum necessary for the treatment of that patient without authorization from the patient.

## Q&A 

**Disclosures**

## Slide 90

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

## P&P for Correction/Amendment

- Understanding Form IHS-917
- Helping Patient Fill Out Form IHS-917
- Execution of Approvals
- Execution of Denials
- Appeals and Complaints

**Corrections**

**Notes:**
[NARRATOR] In this section we will review form IHS-917, the Request for Correction and/or Amendments to PHI. You will also learn how to help patient obtain & fill out the form, & become familiar with all of the associated policies & procedures. 

## P&P for Correction/Amendment

**Corrections**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  The patient has the right to request a correction or amendment to the protected health information if they feel that the information is incorrect or incomplete.

KIHEGA:  You know, if they come in and their left arm was hurting and we wrote down right arm, we’re going to probably change those things. A lot of patients want to change medical opinions and judgments, psychiatric opinions and judgments, those things won’t be changed but they do have a right to request that it be changed and we will file that request in the medical record whether or not we agree to amend or correct that record. IHS cannot change, or amend, information created by another provider or facility, because we have no idea of knowing what is correct.

## P&P for Correction/Amendment

**Notes:**
[NARRATOR] Form IHS-917 must be completed, dated, and signed in ink with an original signature prior to correcting or amending health information. The form should be filled out using black ink, and forms filled out in red ink will not be processed. 

## P&P for Correction/Amendment

- Patient Must Complete Form IHS-917
- All Requests Must Be Made in Writing
- SUD/CEO Will Date Stamp the Form
- Patient Receives Copy of Date Stamped Form within 10 Business Days
- If Decision Can Be Made Within 10 Business Days, Patient Will Be Notified at the Same Time He/She Receives Copy of Form 917

**Corrections**

**Notes:**
[NARRATOR] Patients have the right to request corrections or amendments to their PHI. If a patient believes his or her information is inaccurate or incomplete, they may fill out and submit form IHS-917. The procedure for processing the request is described on screen. 

## P&P for Correction/Amendment

- If Patient Requests Changes to PHI Created by Another Agency, IHS Will Forward Request to That Agency
- Patient Will Be Notified of Approval or Denial Within 60 Days After Receipt of Request
- IHS May Extend Time Period for 30 Days As Allowed by Law
- If IHS Extends Time Period, Patient Will Be Notified of Reasons & Date Request Will Be Acted Upon
- Only One 30 Day Extension Is Allowed
- File Form at Site of Contested Entry in the Health Record & Maintain for Life of Health Record

**Corrections**

**Notes:**
[NARRATOR] If the patient requests that IHS change information that was created by another facility or provider, IHS will make every effort to forward the request to the appropriate entity. Otherwise, patients will be notified of approval or denial within 60 days after receipt of request, unless IHS extends time period for 30 days as allowed by law.  If IHS extends the time period, the patient will be notified of the reasons, and the date request will be acted upon.

## P&P for Correction/Amendment

- Execute Approved Corrections As Follows:
- Without Erasure or Other Obliteration
- Use Single Line Through Incorrect Data
- Correct the Information
- Add Reason for the Correction
- Include Date & Corrector’s Signature

**Corrections**

**Notes:**
[NARRATOR] If the request is approved, follow the directions as listed on screen to make the correction or add the amendment. You may not erase information that exists in the record in order to make a correction.

## P&P for Correction/Amendment

- With Patient Approval, Submit Correction to Persons/Organizations
- That Received Information in the Past
- That May Have Relied, or May Rely in the Future, on the Information
- Are Identified by the Patient As Needing the Correction or Amendment
- With Required Statement “This Is an Amendment to the Information That Was Previously Sent on ________Date___________._”
- Document the Correction in the Accounting Disclosure Record
- Notify the Patient in Writing of Approval

**Corrections**

**Notes:**
[NARRATOR] If the correction or amendment needs to be sent to someone else or another organization who may have received the information in the past, or who may rely on that information in the future, obtain the patient’s agreement and provide the information using the procedure described on-screen. 

## P&P for Correction/Amendment

- Execute Denial As Follows:
- SUD/CEO or Designee Documents Denial on
- 	Form IHS-917
- Send Copy to Patient Within 60 Days
- File Original Form in Health Record_ _

**Corrections**

**Notes:**
[NARRATOR] If the request for correction or amendment is denied, in whole or in part, the denial must be documented on Form 917, and a copy sent to the patient within 60 days. The original form is filed in the patient’s health record. 

## P&P for Correction/Amendment

- IHS Will Only Deny a Request for Correction or Amendment Because
- The Health Information Is Not Part of IHS’s Designated Record Set
- IHS Did Not Create the Record
- The Record Is Not Available to the Patient Under Federal Law
- The Record Is Accurate & Complete

**Corrections**

**Notes:**
[NARRATOR] IHS will only deny a request for correction or amendment if the health information is not part of IHS’s designated record set, if IHS did not create the original record, if the record is not available to the patient under federal law; or if the record is accurate & complete. 

## P&P for Correction/Amendment

- If IHS Did Not Create the Record at Issue and the Originator of the Health Information Is No Longer Available to Act on the Request, IHS Will Address
- Notification of Denial Must Include Notification of Right to Appeal

**Corrections**

**Notes:**
[NARRATOR] If the correction or amendment refers to a record that IHS did not create and the patient provides a reasonable basis to believe that the originator of the health information is no longer available to act on the request, IHS will address the request.  If a request is denied, the patient must be notified that they have a right to appeal as well as the procedure to appeal. 

## P&P for Correction/Amendment

- Appeal Rights: Non-US Citizen
- Patient May Submit a Written Description of the Disagreement
- IHS May Prepare a Written Rebuttal to Patient’s Statement
- IHS Will Provide Patient a Copy of the Rebuttal
- IHS Written Rebuttal Is Not Subject to Correction or Amendment

**Corrections**

**Notes:**
[NARRATOR] Non-US Citizens may appeal a denial for correction or amendment. If the patient submits a description of the disagreement to the SUD/CEO for appeal, IHS may rebut the patient’s statement and no further appeal is allowed by law. The patient’s submission, as well as IHS’s rebuttal are filed in the health record, and at the patient’s request, must be disclosed with other PHI disclosures that relate the issue in dispute. 

## P&P for Correction/Amendment

- Appeal Rights: Non-US Citizen** (cont.)**
- IHS Must Include Patient Statement, or Accurate Summary, with  Subsequent Disclosures of PHI to Which the Disagreement Relates
- If the Patient Has Not Submitted a Written Statement of Disagreement, Patient May Request that the Request for Amendment, Denial, and/or  Accurate Summary Be Included with Future PHI Disclosures that Relate to the Requested Action

**Corrections**

**Notes:**
[NARRATOR]No Narration

## P&P for Correction/Amendment

- Appeal Rights: US Citizens/Legal Aliens
- Patient May Appeal the Refusal to Correct or Amend the Requested Information to the Area Director
- Area Director Must Act on the Appeal Within 30 Working Days of the Patient’s Appeal
- Area Director May Extend the Period for an Additional 30 Working Days for Good Cause
- Area Director Will Inform the Patient in Writing of Any Extension of the Appeal Period & Reason(s) for the Delay

**Corrections**

**Notes:**
[NARRATOR] If the patient is a U.S. citizen or legal alien, he or she may appeal a refusal to correct or amend to the Area Director, who must act on the appeal within 30 days, or extend the period, if there is good cause, for an additional 30 days. The patient must be made aware, in writing, of any extensions and reasons for them. 

## P&P for Correction/Amendment

- If Area Director Denies Appeal, or Patient Elects Not to Appeal
- Area Director Will Patient in Writing of the Reasons for Denial
- Area Director Will Advise Patient of His/Her Rights to Submit a Written Statement of Disagreement & to Seek Judicial Review of Denial
- Patient May Submit a Statement of Disagreement
- If the Patient Submits a Written Statement of Disagreement
- Statement & Area Director’s Reasons for Denying Appeal (If an Appeal Was Filed) Will Be Sent to Recipients of Disputed Record, Where an Accounting of the Previous Disclosure
- 	Was Made

**Corrections**

**Notes:**
[NARRATOR] If the patient does not appeal or the appeal is denied, the patient must be informed in writing and advised that he or she has the right to seek a judicial review and to submit a statement of disagreement. When a patient does appeal, the statement of disagreement and the Area Directors reasons for denial will be provided to organizations that previously received the disputed information. 

## P&P for Correction/Amendment

- Patients May File Complaints About IHS Policies & Procedures with
- Service Unit Director
- Secretary of Department of Health & Human Services
- Patients Who Receive a Denial of His/Her Request for Correction/Amendment May Submit a Written Statement of Disagreement to the SUD/CEO or Designee Within
- 	30 Days of Denial

**Corrections**

**Notes:**
[NARRATOR] If the patient has a complaint about IHS’ policies & procedures regarding health information, he/she may file such a complaint with the Service Unit Director or with the Secretary, Department of Health & Human Services in Washington DC. The request form and all subsequent information become part of the patient’s permanent health record. Patients have the right to submit a statement of disagreement and IHS must respond to the complaint using the procedure described on screen. 

## P&P for Correction/Amendment (cont.)

- The SUD/CE0 or Designee Must Respond to Complaint Within 30 Working Days From Receipt of Patient Request for Appeal
- Altered Model Response Letters Should Be Reviewed by Legal Counsel Prior to Use

**Corrections**

**Notes:**
[NARRATOR] No Narration

## P&P for Correction/Amendment

**Corrections**

- Video – See Transcript in Notes Below

**Notes:**
HEFLEY: A patient has the right to ask that their record be corrected or amended if they feel as if something is inaccurate in it. For instance, we had a patient that applied for life insurance. One of our nurses had inadvertently put in her record that she was a smoker when she was not and she was denied life insurance based on that fact. She came to our office and put in writing that she was not a smoker and that she would like that to be corrected. We went to the nurse and the nurse made the correction in the chart that the patient was not a smoker. 

KIHEGA:  We have model letters that go out to the patient regarding correction amendment of the medical record or protected health information. Those were reviewed by legal counsel. We suggest that anybody that utilizes those forms that they don’t change any word, any sentence at all, unless you have them reviewed by your own local counsel. 

TRENT:  If you were to change the language of the model letters you may be at risk of omitting or even adding information that is in violation of the statute. 

## Q&A 

**Corrections**

## Slide 109

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

Click on any button to access training specific to the forms, policies, and procedures associated with each menu title.

## P&P for Restrictions

- Understanding Form IHS-912-1
- Helping Patient Fill Out Form IHS-912-1
- Patient Rights
- Approved Restrictions
- Directories

**Restrictions**

**Notes:**
[NARRATOR] In this section we will review form IHS-912-1, the Request for Restrictions to PHI. You will also learn how to help patient obtain & fill out the form, & become familiar with all of the policies & procedures associated with Restrictions. 

## P&P for Restrictions

**Restrictions**

- Video – See Transcript in Notes Below

**Notes:**
GEORGE CHIARCHIARO, DDS, MHA –Co-Chair HIPAA Committee in Oklahoma Area:
Patients can ask for any kind of a restriction on how their health information is used. A patient might ask for a restriction on their health information if they’re concerned about a family member inadvertently receiving a mail correspondence or a telephone message that has to do with test results or some other health information that they want to keep personal. They may also want to restrict the availability of their health information to certain providers that they might not be comfortable with. Under HIPAA we’re not required to get consent to use their health information if it’s for treatment, billing or healthcare operations. 

## P&P for Restrictions

**Notes:**
[NARRATOR] Form IHS-912-1 must be completed and signed in ink, with an original signature prior to restricting health information. 

## P&P for Restrictions

- Patients Have the Right to Request Restrictions on the Use & Disclosure of Their PHI to
- Carry Out Treatment
- Payment & Healthcare Operations
- Hospital Directories
- Relatives & Family Members
- Close Friends
- Healthcare Givers
- Any Other Person
- IHS Only Required to Agree to Request for Restriction from Hospital Directory

**Restrictions**

**Notes:**
[NARRATOR] Patients have the right to request restrictions on the use & disclosure of their PHI to carry out treatment, payment & health care operations, disclosure in hospital directories, disclosure to relatives & family members, close friends, health care givers & any other person identified by the patients. If the patient is unable to fill out the form, family, or staff may assist.  IHS is only required to agree with the request for restriction from the hospital directory, and may not verbally agree to any restrictions. 

## P&P for Restrictions

- Request Must Be in Writing
- Patient Is Not Required to Provide a Reason
- The SUD/CEO or Designee & Appropriate Official Will Review the Request Prior to Patient Notification (Except for Acceptance of Requests to Omit PHI from Hospital Directories)
- IHS Is Not Required to Agree to Restriction Requests
- Before Agreeing to the Restriction, Attempt to Contact the
- 	Regional Attorney

**Restrictions**

**Notes:**
[NARRATOR] The request for restriction must be in writing, however, the patient is not required to provide a reason for the request. Once the request is reviewed  by the SUD/CEO or designee, the patient must be notified whether approved or denied. Restricted information may still be disclosed to provide emergency treatment but must display the Restricted Information statement that appears on-screen. 

## P&P for Restrictions (cont.)

- With Approved Restriction, PHI May Be Used or Disclosed by IHS or Its Business Associate(s) If Restricted PHI is Needed by IHS or Another Healthcare Provider to Provide Emergency Treatment
- Restricted Information Disclosed to a Healthcare Provider for Emergency Treatment Requires the Following Statement:
*“**This Is Restricted Information, Provided for the Purpose of Emergency Treatment, Which Should Not Be Further Disclosed or Used Without the Permission of the Patient to Whom the Information Pertains.”*

**Restrictions**

**Notes:**
[NARRATOR]No Narration

## P&P for Restrictions

- Approved Restrictions Do Not Prevent the Following Uses or Disclosures:
- Patients Who Request Access to Own Information
- Disclosures Required by the Secretary of HHS to Investigate or Determine Compliance by IHS with the HIPAA Privacy Rule
- Uses & Disclosures of PHI for Hospital Directories Where the Patient Has Not Objected to Such Uses & Disclosures
- Uses & Disclosures Required by Law
- Disclosures About Victims of Abuse, Neglect or Domestic Violence

**Restrictions**

**Notes:**
[NARRATOR] IHS approved restrictions do not prevent use of the information for the purposes described on-screen. 

## P&P for Restrictions

- Approved Restrictions Do Not Prevent the Following Uses or Disclosures **(cont.)**:
- Uses & Disclosures for Health Oversight Activities
- Disclosures for Judicial & Administrative Proceedings
- Disclosures for Law Enforcement Purposes
- Uses & Disclosures About Decedents
- Uses & Disclosures for Organ, Eye or Tissue Donation Purposes
- Uses & Disclosures for Research Purposes
- Uses & Disclosures to Avert a Serious Threat to Health or Safety
- Disclosures for Workers’ Compensation
- Uses or Disclosures for Which No Authorization Is Required

**Restrictions**

**Notes:**
[NARRATOR]No Narration

## P&P for Restrictions

- IHS May Terminate Approved Restrictions If
- The Patient Agrees to, or Requests, the Termination in Writing
- IHS Informs the Patient That It Is Terminating the Agreement, in Which Case the Termination Will Be Effective with Respect to PHI Created or Received After IHS Has So Informed the Patient
- When IHS Informs the Patient That It Is Terminatingthe Agreement, Note Method of Informing, Date & Signature of the SUD/CEO or Designee in the Record

**Restrictions**

**Notes:**
[NARRATOR] Approved restrictions may be terminated with patient’s written permission, if IHS informs the patient it is terminating. If IHS terminates the agreement, the information must be noted in the record with the SUD/CEO or designee’s signature. 

## P&P for Directory

**Restrictions**

- Video – See Transcript in Notes Below

**Notes:**
KIHEGA:  A hospital directory is a listing of all inpatients in the hospital. Sometimes patients don’t want their name on the directory because of a disease or disease process and they don’t want any of their family to know or sometimes they could be a public figure in the community and they don’t want anybody to know they’re in the hospital. 

## P&P for Directory

- Present Patient with Notice of Privacy Practices & Follow P&P for Notice of Privacy Practices
- Note Restrictions in Patient’s Record
- List Unrestricted Information in Directory
- If Incapacitated or Emergency & Patient Cannot Review Notice, Facility May Disclose in Accordance With Previously Stated Preferences, or in Patient’s Best Interest If Not Previously Stated

**Restrictions**

**Notes:**
[NARRATOR] To allow an opportunity to keep their information out of the hospital directory, present patients with the Notice of Privacy Practices and follow the procedure as described in the training section called Privacy. Note patient-requested restrictions in the record and do not disclose in the directory. 

## P&P for Directory

- IHS May Disclose in Directory Without Patient’s Written Authorization the Patient’s
- Name
- Location in the Facility
- General Condition Description
- Religious Affiliation to Clergy

**Restrictions**

**Notes:**
[NARRATOR] If there are no stated restrictions, you may disclose patient name, location within the facility, condition in general terms and religious affiliation. 

## Q&A 

**Restrictions**

## Slide 123

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Accounting of Disclosures

- Understanding Form IHS-913
- Helping Patient Fill Out Form IHS-913
- P&P for Accounting of Disclosures
- Disclosures That Do Not Require Accounting
- Temporary Suspensions

**Accountings**

**Notes:**
[NARRATOR] In this section we will review form IHS-913, the Request for Accounting of Disclosures. You will learn how to help patient obtain & fill out the form, & become familiar with all of the policies & procedures associated with accounting of disclosures including those that do not require an accounting, as well as temporary suspensions of accountings of disclosure. 

## P&P for Accounting of Disclosures

**Accountings**

- Video – See Transcript in Notes Below

**Notes:**
CAIN:   A patient might need to know who had received health information about them because it could have implications for employment, it could have implications as they apply for health insurance coverage and it could affect them socially, depending upon chronic diseases that they might not want other individuals, or other agencies, to be aware of. 

KIHEGA:  A patient might request an accounting of disclosures because they want to know who all information was sent to, how many places, did an attorney ask for it? I’ve been involved in a car wreck, did the other insurance company ask for it? They’ve refused to pay for such and such and I want to know if they’ve actually asked for that record. 

## P&P for Accounting of Disclosures

**Notes:**
[NARRATOR] Form IHS-913 must be completed and signed in ink, with an original signature prior to obtaining an accounting of disclosures of health information.  Forms completed in red ink will not be processed; black ink is recommended. 

## P&P for Accounting of Disclosures

- Record Disclosures of PHI that Are Subject to an Accounting
- In the Disclosure Accounting Record (IHS Form 505)
- Electronically in RPMS Release of Information (ROI) Software
- Accountings of Oral Disclosures of PHI Should Also Include the Name, Signature & Title of Staff Who Made the Oral Disclosure

**Accountings**

**Notes:**
[NARRATOR] A patient has the right to request & receive (with certain exceptions) an accounting of both written and oral disclosures of their PHI, that IHS has released for a period of six years prior to the date on which the accounting is requested, or for the life of the record, whichever is longer.  The accounting shall include disclosures made to or by IHS business associates, and IHS will require business associates to report back to IHS any disclosures they have made. 

## P&P for Accounting of Disclosures

- Patient-Requested Accountings of Disclosure
- Must Be in Writing
- Must Include Disclosures to & by IHS Business Associates
- Must Include for Each Disclosure:
- Date of Disclosure
- Name & Address of Recipient of Disclosure
- Brief Description of the PHI Disclosed
- Brief Statement of the Purpose of the Disclosure or Copy of Request for Disclosure

**Accountings**

**Notes:**
[NARRATOR] Accountings of disclosure must be in writing, include disclosures to and by IHS business associates, and must include the information as displayed on-screen. 

## P&P for Accounting of Disclosures

- Disclosures That Do Not Require Accounting Include
- Disclosures to Officers & Employees of the DHHS Who Have a Need for the Information for Purposes of Treatment, Payment,
- 	or Operations
- Disclosures to the Secretary That Are Required in Order to Investigate or Determine Compliance with Privacy Requirements
- Disclosures to the Patient
- Patient-Authorized Disclosures
- Disclosures Required Under the Freedom of Information Act (FOIA)

**Accountings**

**Notes:**
[NARRATOR] Some disclosures do not have to be accounted for, including disclosures to DHHS officials who require the information, those disclosures to the Secretary of DHHS as required by investigations or to ensure compliance, disclosures to the patient and those the patient has authorized, as well as disclosures under the freedom of information act. 

## P&P for Accounting of Disclosures

- When Processing Accountings of Disclosure, IHS
- Must Act on the Request No Later Than 60 Days After Receipt of the Request
- May Extend an Additional 30 Days
- Must Inform the Patient in Writing of the Reason(s) for the Extension
- Must Inform the Patient of the Date by Which the Patient Can Expect the Accounting
- Will Retain Copy of Explanation in the Health Record

**Accountings**

**Notes:**
[NARRATOR] When processing requests for accountings of disclosure, IHS will have 60 days to act on the request, with an additional 30 day extension allowed. If an extension is required, the patient must be informed of the extension and the date by which they can expect the accounting. 

## P&P for Accounting of Disclosures:Temporary Suspensions

- Procedure for Law Enforcement Official or Health Oversight Agency to Suspend a Patient’s Right to Receive an Accounting of Disclosures
- Official/Agency Must Submit a Written Statement that Accounting to the Patient Would Impede the Agency or Official’s Duties
- Request Must Specify Term of Suspension
- Disclosures Requiring Accounting Must Be Documented During Suspension
- Patient’s Right to Receive an Accounting Is Reinstated at End of the Suspension

**Accountings**

**Notes:**
[NARRATOR] Law enforcement and health oversight officials may request a temporary suspension on providing patients with an accounting of disclosures, in writing, or orally. The request must specify that providing an accounting to the patient would impede an investigation as well as the length of time of the suspension. 

## P&P for Accounting of Disclosures:Temporary Suspensions

- Oral Requests for Suspension Require Documenting the Identity of the Agency or Official Making the Request
- Oral Requests May Exclude Disclosure(s) for No Longer Than 30 Days From the Date of the Request
- If the Agency or Official Provides a Valid Written Request Within 30 Days of the Oral Request, IHS Must Temporarily Suspend the Patient’s Right to an Accounting for the Time Period Specified in the Written Request

**Accountings**

**Notes:**
[NARRATOR] Oral requests for suspensions require documentation of  the identity of the agency or official who made the request and may only exclude the disclosures for a period not to exceed 30 days from the date of the oral request, unless a valid written request is subsequently submitted. 

## P&P for Accounting of Disclosures

**Accountings**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN:  Law enforcement may request that we suspend an Accounting of Disclosures so that when a patient comes in and requests an Accounting of Disclosures, that information will not be on the Accounting of Disclosure.  Because law enforcement does not want the patient to know that they have requested that information to do an investigation.

## Q&A 

**Accountings**

## Slide 135

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Patient Access to Their PHI

- Understanding Patients’ Rights
- Requirements for Obtaining PHI
- IHS Requirements for Responding to Requests
- Procedure When Access is Granted
- Procedure When Access is Not Granted

**Patient Access**

**Notes:**
[NARRATOR] Individuals have the right, under certain circumstances, to access, inspect and obtain copies of their own PHI. In this section we will review those rights, along with the requirements patients must meet in order to obtain their PHI, how to respond to those requests, and the procedures to follow when access to the information is granted or not granted. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

**Patient Access**

- Video – See Transcript in Notes Below

**Notes:**
RICK WELLER – Albuquerque HIPAA Area Coordinator:
Patients do have the right, under HIPAA, to see their records, to get copies of their records.  They own the information that is in the records while the government holds the records for them.  Under the Privacy Act, patients have had the right to view their records and to get copies of information in them.  HIPAA does not change that.  It does make it a more formal process now. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- Patient Requirements for Requesting Access:
- Submit Written Request to SUD/CEO or Designee Specifying the Records the Patient Wants to Access
- Designate a Representative to Review the Record & Inform the Patient of the Contents
- Authorize Presence of Any Other Individual Present During Any Discussion of a Record
- Patient May Request Copies of Records in Accordance with the Fee Schedule

**Patient Access**

**Notes:**
[NARRATOR] The patient must submit a written request to SUD/CEO or designee of the facility specifying the records he or she wants to access, then designate a representative to review the record and inform him or her of the contents. If another person is with the patient, obtain the patient’s authorization for that person’s presence before discussing the information. IHS is allowed to charge reasonable fees for copies. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- IHS Requirements for Responding to Patient Requests for Access:
- SUD/CEO Must Act on Request Within 30 Days If Maintained or Accessible On-site
- SUD/CEO Must Act on Request Within 60 days If Not Maintained or Accessible On-site
- SUD/CEO May Have One 30 Day Extension
- Must Provide Patient With Written Statement of Reason(s) for Extension & Date on Which IHS Will Respond
- All Requests Must Be Maintained in Patient’s Health Record

**Patient Access**

**Notes:**
[NARRATOR] If the records are on-site, the SUD/CEO has 30 days to act on the request. If the records are not onsite the SUD/CEO has 60 days to respond, and in either case, one 30-day extension may be granted. If an extension is require, the patient must be notified of the extension and given the date at which they can expect a response. This information must also be documented in the health record. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- When Access Is Granted in Whole or in Part:
- SUD/CEO Shall Inform Patient in Writing
- IHS Must Produce the PHI Only Once Per Request
- Must Produce in Format Requested, if Producible, or Legible Hard Copy
- A Summary or Explanation of the PHI May Be Provided in Lieu of the Underlying Information If Patient Agrees in Advance, but Patient Still Retains Right to See Entire PHI

**Patient Access**

**Notes:**
[NARRATOR] When access is granted in whole or in part, follow the procedure as described on-screen. 

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- When Access Is Granted in Whole or in Part **(cont.)**:
- Must Be Provided at Mutually Convenient Time & Place for Inspection or Copying
- Can Be Mailed If Patient Pays Copying Fee
- Note Date the Copy Is Provided in Patient Chart
- Follow P&P for Verification of ID

**Patient Access**

**Notes:**
[NARRATOR] No Narration

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- IHS May Deny Request If
- Does Not Maintain Requested PHI
- If Knows Where It Is Located, Must Inform Patient & Direct Request to That Place
- Reasonable Anticipation of, or for Use In, Civil, Criminal, or Administrative Actions or Proceedings
- Contact Regional Attorney’s Office & Do Not Note in Patient Health Record

**Patient Access**

**Notes:**
[NARRATOR] IHS may deny a patient’s request to access their own PHI if the information requested is not in the record or at the facility, or if IHS anticipates that the PHI is going to be used in civil, criminal, or administrative actions. If you know where the information is located, you must inform the patient so that they can follow up, and if you anticipate that it is being requested for legal or administrative actions, contact Regional Counsel. Do not note that action in the health record.

## P&P for Patients’ Rights to Access, Inspect & Obtain a Copy of Their Protected PHI

- If IHS Cannot Determine Whether Direct Access to the Record Will Have Adverse Effect on Patient
- Deny Direct Access to the Patient
- Forward Records to Designated Representative to Review
- Notify Patient in Writing
- Provide Patient Direct Access If Designated Representative Does Not Provide the Patient with the Record

**Patient Access**

**Notes:**
[NARRATOR] If you are concerned that access to information will have an adverse effect on the patient, utilize the procedure allowing you to designate a representative to review the information first and inform the patient that you have done so. Then follow the direction of the personal representative. 

## Q&A 

**Patient Access**

## Slide 145

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## P&P for Use & Disclosure of PHI for Research Purposes

- Understanding Use & Disclosure for Research
- IRB Approval Process
- IRB Waiver Requirements
- Reviews of PHI Prior to Research
- Research Involving Decedents’ PHI
- Creating Limited Data Sets
- De-Identification & Re-Identification of PHI

**Research**

**Notes:**
[NARRATOR] In this portion of the training you will become familiar with the policies and procedures for use & disclosure for research purposes including the IRB Approval Process, IRB Waiver Requirements, Reviews of PHI Prior To Research, Research Involving Decedents’ PHI, and issues associated with creating limited data sets.

## P&P for Use & Disclosure of PHI for Research Purposes

**Research**

- Video – See Transcript in Notes Below

**Notes:**
GOWAN: The IRB is the Institutional Review Board which is responsible for making sure that regulations are followed in regards to research in any of our healthcare facilities. 

MIKE HOPE, RPH – Oklahoma Area Pharmacy Consultant
The Indian Health Service will disclose protected health information for the purposes of research providing that research has been approved by the IRB of the Indian Health Service. The IRB will maintain appropriate records regarding the research, they will assure that the researchers have a plan to protect the identity or identifiers of the patients in the research, they will assure that the researchers destroy the protected health information identifiers at the earliest possible date, and they will assure that the researchers have a plan to protect the privacy and confidentiality of participants. 

## P&P for Use & Disclosure of PHI for Research Purposes

- IHS May Use & Disclose PHI for Research When IRB Has Approved, in Whole or in Part, a Waiver of the Patient’s Authorization for Its Use & Disclosure

**Research**

**Notes:**
[NARRATOR] The IRB must approve a waiver of patient authorization, in whole or in part, before PHI can be used or disclosed for research purposes. 

## P&P for Use & Disclosure of PHI for Research Purposes

- Review/Approval Process
- The IRB or Designee Signs Statement That Waiver Was Reviewed & Approved Under Normal and/or Expedited Review Procedures

**Research**

**Notes:**
[NARRATOR] The IRB chair, or designee, processes the request for use or disclosure for research as described on-screen. 

## P&P for Use & Disclosure of PHI for Research Purposes

- Documentation of IRB Approval of Waiver Must Include:
- A Statement Identifying the IRB & the PHI for Which the Use/Disclosure Has Been Determined to Be Necessary by the IRB
- Date on Which the Alteration or Waiver of Authorization Was Approved
- Justification that the Research Could Not Practically Be Conducted Without the Alteration or Waiver
- Justification that the Research Could Not Practically Be Conducted Without Access to & Use of the PHI

**Research**

**Notes:**
[NARRATOR] The documentation must include the information described on-screen. 

## P&P for Use & Disclosure of PHI for Research Purposes

- Statement That IRB Has Determined That Alteration or Waiver, in Whole or in Part, Satisfies the Following:
- Use or Disclosure of PHI Involves No More than Minimal Risk to the Privacy of Individuals
- An Adequate Plan to Protect the Identifiers from Improper Use/Disclosure, Including Reasonable Administrative, Technical & Physical Safeguards Against Unauthorized Use/Disclosure

**Research**

**Notes:**
[NARRATOR] The IRB waiver is issued when researchers have demonstrated that there is only a minimal risk to an individual’s privacy, that there is an adequate plan to protect the identifiers from improper use or disclosure, that the identifiers will be destroyed at the earliest opportunity, and that the PHI will not be re-used or disclosed, except as may be required by law.

## P&P for Use & Disclosure of PHI for Research Purposes

- Statement That IRB Has Determined That Alteration or Waiver, in Whole or in Part, Satisfies the Following **(cont.)**:
- An Adequate Plan to Destroy the Identifiers at the Earliest Opportunity Consistent with Conduct of the Research, Unless There Is a Health or Research Justification for Retaining the Identifiers, or Such Retention Is Otherwise Required by Law
- Adequate Written Assurances that the PHI Will Not Be Reused or Disclosed to Any Other Person or Entity, Except As Required by Law, for Authorized Oversight of the Research Study if Personal Identifiers Are Removed at the Earliest Opportunity Consistent with the Oversight Activity or for Other Research for Which the Use/Disclosure of PHI Would Be Permitted Under the HIPAA Privacy Rule, the Privacy Act & any other Applicable Law

**Research**

**Notes:**
[NARRATOR] No Narration

## P&P for Use & Disclosure of PHI for Research Purposes

- Reviews Prior to Research
- An IHS Facility May Allow PHI to Be Reviewed in Preparation for Research if the Researcher Demonstrates
- The PHI for Which Use/Disclosure Is Sought Is Necessary for Research Purposes
- That Use/Disclosure Is Sought Solely As Necessary in Preparation for Research or to Prepare a Research Protocol
- That No PHI Will Be Removed From the Facility by the Researcher in the Course of the Review

**Research**

**Notes:**
[NARRATOR] In preparation for use of PHI for research, IHS may allow the review of PHI, if the researcher demonstrates that the information sought is truly for use in research, that it is required for research preparation, and will not be removed from the facility during the review period. 

## P&P for Use & Disclosure of PHI for Research Purposes

- Research Involving Decedents’ PHI
- IHS May Use & Disclose Decedents’ PHI if the Researcher
- Demonstrates the Use/Disclosure Is Sought Solely for Research
- Demonstrates the PHI for Which Use/Disclosure is Sought is Necessary for the Research Purposes
- Can Provide Documentation of the Decedent’s Death if Requested

**Research**

**Notes:**
[NARRATOR] When research requires the use or disclosure of information about an individual or group of individuals who have passed away, IHS may disclose or use that PHI if the researcher can show that the information is solely for research purposes, and can provide documentation of the decedent’s death if it is requested. 

## P&P for Use & Disclosure of PHI for Research Purposes

**Research**

- Video – See Transcript in Notes Below

**Notes:**
CHIARCHIARO:   Sometimes we need to get protected health information for patients that have passed away. The most common example of that is to determine mortality rates and also to look at causes of death. And that enables us to focus our resources on those risks that our patients face so that we can help them lead a healthier life. 

## P&P for Creating a Limited Data Set

**POLICY:**  For Purposes of Research, Public Health, or Healthcare Operations, IHS May Disclose Information That Is Not Fully De-identified If It Creates a Limited Data Set That Complies With the Terms of the Health Insurance Portability & Accountability Act (HIPAA) Regulations, 45 CFR 164.514(e), & This Policy.  All Such Disclosures Must Be Made in Accordance With the Policy & Procedure for Limiting the Use or Disclosure of Protected Health Information to the Minimum Necessary.

**Research**

**Notes:**
[NARRATOR] The policy for creating a limited data set is displayed on screen. 

## P&P for Creating a Limited Data Set

**Definitions:**
- _Protected Health Information_ Is Health Information that Identifies a Patient, or to Which There Is a Reasonable Basis to Believe that the Information Can Be Used to Identify the Patient
- _Limited Data Set_ Is PHI That Excludes Specified Identifiers Such as Name, Provider Name, Chart Number, Social Security Number, etc., but that Can Still Potentially Be Linked to a Particular Patient Because it Contains Dates (Including Birth Date, Admission Date, Discharge Date, & Date of Death) and/or Information about the Patient’s City, State or Zip Code

**Research**

**Notes:**
[NARRATOR] Protected Health Information is information that specifically identifies, or could possibly be used to identify a patient. Creating a limited data set excludes those key identifiers. 

## P&P for Creating a Limited Data Set

**PROCEDURE:** The Following Procedures Shall Be Used to Create a Limited Data Set, Which May Be Created Only for the Purposes of Research, Public Health, or Healthcare Operations:
- Exclude the Following Direct Identifiers of the Patient, Relatives, Employers, or other Household Members
- Names
- Postal Addresses
- Telephone Numbers
- Fax Numbers
- Electronic Mail Addresses
- Social Security Numbers
- Medical Record Numbers
- Health Plan Beneficiary Numbers
- Account Numbers
- Certificate/license Numbers
- Vehicle Identifiers & Serial Numbers, Including License Plate Numbers
- Device Identifiers & Serial Numbers
- Web Universal Resource Locators (URLs)
- Internet Protocol *(*IP) Address Numbers
- Biometric Identifiers, Including Finger & Voice Prints
- Full Face Photographic Images & Any Comparable Images

**Research**

**Notes:**
[NARRATOR] The information displayed on-screen describes the procedure for creating a limited data set. 

## P&P for Creating a Limited Data Set

- A Limited Data Set May Contain
- Dates of Admission & Discharge
- Dates of Birth & Death
- Zip Codes, City, & State Information
- IHS May Use or Disclose PHI to a Business Associate in Order to Create a Limited Data Set Whether or Not It is to Be Used by IHS

**Research**

**Notes:**
[NARRATOR] A valid limited data set may contain admission & discharge dates, dates of birth and death, zip codes, city and state information. IHS may disclose protected health information to a business associate who needs to prepare a limited data set, whether that data set will be used by IHS or not.

## P&P for Creating a Limited Data Set

- A Limited Data Set Recipient Must
- Agree in Writing to Use or Disclose the Information Only for the Purposes or Research, Public Health, or Healthcare Operations
- Sign a Written Data-Use Agreement that Recipient Will
- Establish Permitted Uses & Disclosures of the Information
- Define Who Is Permitted to Use or Receive the Limited Data Set
- Limit Use or Further Disclose the Information Other Than As Permitted by the Data Use Agreement or As Otherwise Required by Law

**Research**

**Notes:**
[NARRATOR] Recipients of limited data sets must agree in writing to use or disclose the information only for the purposes of research, public health or healthcare operations, and sign a data use agreement that includes all the information displayed on-screen.

## P&P for Creating a Limited Data Set

- A Limited Data Set Recipient Must
- Sign a Written Data-Use Agreement that Recipient Will **(cont.)**
- Include Appropriate Safeguards to Prevent Use or Disclosure of the Information Other Than As Provided for by the Data Use Agreement
- Report to the Designated IHS Person Any Improper Use or Disclosure of the Information Not Provided For by Its Data Use Agreement of Which It Becomes Aware
- Ensure That Any Agents, Including Subcontractors, to Whom It Provides the Limited Data Set Agrees to the Same Restrictions & Conditions that Apply to the Limited Data Set Recipient with Respect to Such Information
- Not Identify the Information or Contact the Patients

**Research**

**Notes:**
[NARRATOR] No Narration.

## P&P for Creating a Limited Data Set

- If Data Use Agreement Is Violated, IHS Must Take Reasonable Steps to End the Violation & if Unsuccessful, Must
- Discontinue Disclosure of PHI to the Recipient
- Report the Problem to the Secretary of DHHS

**Research**

**Notes:**
[NARRATOR] If a data use agreement is violated, IHS must take the responsibility for ending the violation, discontinuing the disclosure, and must report the problem to the Secretary of DHHS. 

## P&P for Creating a Limited Data Set

- IHS & It’s Employees Must Also
- Comply with the Terms of Any Limited Data Set Agreement Under Which it Receives Information
- Address Specific Questions Regarding the Implementation of this Policy to the SUD/CEO

**Research**

**Notes:**
[NARRATOR] IHS and its employees are required to comply with the terms of any data use agreement under which it receives information. If you have questions regarding the implementation of this policy, bring them to the attention of the SUD or CEO at your facility.

## Research

- Video – See Transcript in Notes Below

**Notes:**
CHIARCHIARO:   A full data set would include all of the patient’s information, including date of birth, social security number, name. A limited data set might have those identifiers removed but have some of the other data, their blood pressure or their fasting blood sugar or their hemoglobin A-1-C, still there. In other words, you couldn’t tell by looking at the data set who the patient was. 

## P&P for De-Identification & Re-Identification of PHI

- De-identification Is Making PHI Individually Un-Identifiable Through
- The Removal of Identifiers
- Determination Based Upon Statistical & Scientific Methods

**Research**

**Notes:**
[NARRATOR] It is important to understand the policies and procedures associated with de-identifying and re-identifying PHI. De-identification ensures that PHI cannot be traced back to a specific individual by removing key identifiers, or through statistical and scientific methods. 

## P&P for De-Identification & Re-Identification of PHI

- Re-identification Is Assigning a Code or Other Means of Record Identification to Allow De-Identified PHI to Be Retrieved & Identified While Maintaining the Anonymity of the Individual

**Research**

**Notes:**
[NARRATOR] Once PHI is de-identified, it must be re-identified in order to retrieve the information while, at the same time, maintaining the anonymity of the individual patient to whom it pertains. Often, this is accomplished by using assigning a code to the de-identified PHI.

## P&P for De-Identification of PHI

- The Determination of Whether Health Information Is Individually Identifiable or Whether PHI May Be De-identified Will Occur
- When There is no "Need to Know" the Identity of the Patient
- On a Case-by-Case Basis Depending on the Nature of the Request

**Research**

**Notes:**
[NARRATOR] IHS has defined a procedure for determining whether health information is identifiable, or whether it must be de-identified based upon whether it’s necessary to know who the identify of the patient is, and on a case-by-case basis, depending upon the request.

## P&P for De-Identification of PHI

- Removal of Identifiers, Including
- Names
- All Elements of a Street Address, City, County, Precinct, Zip Code & Equivalent Geocodes, Except for the Initial Three Digits of Zip Code
- All Elements of Dates, Except Year, for Dates Directly Related to the Patient (Except for Age 90 or Older)
- Telephone Numbers, Fax Numbers, E-mail Addresses
- Social Security Numbers, Medical Record Numbers
- Health Plan Beneficiary Numbers, Account Numbers

**Research**

**Notes:**
[NARRATOR] If a Health Information Management or Health Records professional, or other health care professional de-identifies patient records that contain PHI by removing the identifiers displayed on screen, IHS must NOT have actual knowledge that the remaining information could be used alone or in conjunction with other information to identify the patient. This also applies to electronic records. 

## P&P for De-Identification of PHI

- Certificate/License Numbers
- License Plate Numbers, Vehicle Identifiers & Serial Numbers
- Device Identifiers & Serial Numbers
- URL Addresses & Internet Protocol (IP) Address Numbers
- Biometric Identifiers, Including Finger & Voice Prints
- Full Face Photographic Images & Comparable Images
- Any Other Unique Identifying Number

**Research**

**Notes:**
[NARRATOR] No Narration

## P&P for De-Identification of PHI

- Knowledgeable Experienced Person
- Applies Appropriate Methods & Determines Risk is Very Small that the Information Could Be Used Alone, or in Combination with Other Available Information, by an Anticipated Recipient of Such Information, to Identify the Patient
- Documents the Methods & Results of the Analysis that Justify the Determination

**Research**

**Notes:**
[NARRATOR] IHS may also determine that health information is not individually identifiable if a person with knowledge & experience of statistical & scientific methods, designated by the SUD/CEO,  determines the risk of identifying the patient is very small.   This designated person must document the methods & results of the analysis that justify the determination.

## P&P for De-Identification of PHI

- De-identification Will Be Performed at the Origin of the Data, or, in the Case of the Determination Made by a Designated Person,Where Such Person Is Located, As Appropriate
- Hardcopy PHI Will Be De-Identified by Obliterating (Making Unreadable & Unrecognizable) the Individual Identifier(s)

**Research**

**Notes:**
[NARRATOR] De-identification must be performed at the origin of the data, or, if made by the SUD/CEO-designated individual, where that person is located, as appropriate. Hardcopy PHI will be de-identified by obliterating—that is making unreadable & unrecognizable--the individual identifier(s).

## P&P for Re-Identification of PHI

- IHS May Assign a Code or Other Means of Record Identification to Allow Information to Be Re-Identified by IHS Provided that:
- The Code Is Not Derived From or Related To the Information About the Patient
- The Code Is Not Capable of Being Used to Identify the Patient
- IHS Does Not Use or Disclose the Code for Any Other Purpose
- IHS Does Not Disclose the Mechanism for Re-Identification that Could Be Used to Link the Code with the Patient

**Research**

**Notes:**
[NARRATOR] Once information has been de-identified, it is re-identified using a code or other means, so that the information can be retrieved in a way that does not require use of the individual patient’s name or other key identifiers. The code cannot be related to patient information, must ensure that it can’t be used to identify a patient, and cannot be disclosed for any other purpose. The mechanism for creating the code also cannot be disclosed.

## Q&A 

**Research**

## Slide 174

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Delegation of Authority
FAX Machine Usage 
Transmittal of Confidential Communication by Alternate Means
Instructions on Administrative Requirements

- FAX Machine Usage
- Transmittal of Confidential Communication by Alternate Means
- Instructions on Administrative Requirements

**Administrative**

**Notes:**
[NARRATOR] Administrative training includes understanding the delegation of authority, new requirements for the use of fax machines and the transmittal of confidential information by other alternative means, as well as other instruction on administrative requirements.

## Delegation of Authority

- Not Substantially Different Than Previous Policy
- SUD/CEO May Delegate to a Medical Records/Business Office Staff or Other Management Staff Member
- Only the Person Listed in the Document Can Accept or Deny a Change to Records
- Nothing Can Be Agreed to Verbally

**Administrative**

**Notes:**
[NARRATOR] The procedure for delegating authority is not substantially different than before implementing HIPAA requirements. The SUD/CEO may delegate authority to  a medical records, business office, or other management employee to review, accept, deny, issue written notifications, coordinate action on patient records, sign appropriate correspondence, and/or file requests for issues associated with restrictions and corrections or amendments. Only the person to whom the authority is delegated may accept or deny changes to records, and nothing can be agreed to verbally.

## Delegation of Authority

**Administrative**

- Video – See Transcript in Notes Below

**Notes:**
ODIA: Under the privacy rule, IHS has designated the SUD, CEO as the System of Record Manager for their facility.

KIHEGA:  A delegation of authority could be used if a CEO is going to be gone for an extended period of time, or if the CEO or SUD decides that they don’t want to deal with this on a regular basis. Maybe they don’t want to handle patients coming in asking for  restrictions or the correction or amendment of records. 

ODIA:  The delegation of authority memo is what we will use to accomplish this.

## FAX Machine Usage 

- Location:
- Not in a Public Area
- Use Can Be Monitored Only by the Person(s) Designated to Conduct Monitoring
- Only Authorized Staff Can Have Direct Access to FAX Machine
- Medical Records Fax Cover Page Must Include:
- Facility's Identification
- Date of Transmission
- Number of Pages Being Transmitted (Including Cover Page)
- To: Authorized Receiver's Name, Telephone Number, & FAX Number
- From: Sender's Name, Provider's Name (If Applicable), Sender's Telephone Number & FAX Number
- Remarks or Special Instructions (If Appropriate)
- Confidentiality Statement

**Administrative**

**Notes:**
[NARRATION] Taking extra care to protect PHI is especially important when using a fax machine to transmit information.  The fax machine should not be located in a public area, should be monitored by the appropriate person, and only be accessible to authorized staff.  Fax cover sheets must include the information appearing on your screen. 

## Sending Information Via FAX

- Call Receiving Facility to Inform that Records Are Being Sent
- Confirm Fax Number
- Confirm That  Fax Machine Is in a Secure Area or Request that Recipient Stand by Machine to Receive
- Reconfirm After Dialing that the Number Displayed on Fax Machine Is Correct Before Hitting “Send”

**Administrative**

**Notes:**
[NARRATOR] Prior to sending a fax, follow the procedure displayed on-screen to ensure that confidential information is not faxed to the wrong number, received by the wrong person, or, if is sent in error, that it is destroyed.  Place a copy of the cover sheet and the confirmation of fax in the patient record. 

## Sending Information Via FAX

- Confirm Receipt by Calling Recipient or CheckingTransmission Report
- If Fax Is Sent to Wrong Machine Contact Recipient & Request Fax Be Destroyed
- Place Copy of Cover Page & Confirmation of Fax Receipt in Patient’s Medical Record

**Administrative**

**Notes:**
[NARRATOR]No Narration

## Receiving Information Via Fax (cont.)

- Remove Medical Information from Machine ASAP
- Count Number of Pages
- If Missing Pages Contact Sender & Request Re-transmittal
- Read Fax Cover Page & Follow Instructions
- If Facility Has ARJ, Document Receipt of Fax
- If Fax is Printed on Thermal Paper, Photocopy & Destroy Original Thermal

**Administrative**

**Notes:**
[NARRATOR] It is just as important to follow procedure for receiving information via fax. Remove faxed  information from the  machine as soon as possible, confirm that the page count is correct and if anything is missing, call the sender and request the information be re-transmitted. Follow any instructions on the fax cover sheet, and execute additional procedures as described on-screen. 

## Receiving Information Via Fax (cont.)

- Notify Intended Recipient that Fax Was Received
- Faxed Medical Information that Is Not in a Secure Area Must Be
- Hand Delivered or
- Placed in a Sealed Envelope & Delivered ASAP
- If Fax Is Erroneously Received at Facility
- Inform Sender of Error
- Destroy Fax
- Note in ARJ if Applicable

**Administrative**

**Notes:**
[NARRATOR] No Narration

## P&P for the Transmittal of Confidential Communication by Alternate Means

- Individual Has the Right to Request Transmittal of PHI by Alternate Means or to an Alternate Location
- Request Must Be Submitted in Writing, Contain the Requested Form of Alternate Means/Location & Be Addressed to the Patient Registration Office or Other Appropriate Department
- Basis for the Request Is Not Required

**Administrative**

**Notes:**
[NARRATOR] HIPAA grants individuals the right to request transmittal of PHI by alternate means or to an alternate location. The request must be submitted in writing, contain complete information about how and where the information will be sent, and/or addressed, and should be forwarded to Patient Registration or other appropriate department for execution. The patient does not have to give a reason for the request. Follow other procedures as described on-screen.

## P&P for the Transmittal of Confidential Communication by Alternate Means (cont.)

- CEO/SUD Will Approve or Disapprove All Requests
- Whenever Possible, Decision Will Be Given Prior to the Patient Leaving the Facility
- When Alternate Means Would Affect Third-Party Payment the Individual Must Specify How Payment Will Be Handled
- Requests Must Be Filed in Health Record

**Administrative**

**Notes:**
[NARRATOR] No Narration

## Instructions on Administrative Requirements

- Designate Official HIPAA Contact Person
- Training:
- To All Employees, Volunteers & Contactors
- New Employees – Within 30 Days
- To Designated Staff As Policies Are Revised
- Shall Be Documented & Documentation Maintained for 6 Years
- Safeguards:
- Enact Policies & Procedures to Safeguard PHI in Compliance with Privacy Act & HIPAA Regulations for Both Paper & Electronic Records

**Administrative**

**Notes:**
[NARRATOR] HIPAA requires each Service Unit to designate an official contact person and to provide training to all employees, as described on-screen. The policies & procedures covered in this training are a response to the HIPAA safeguards requirement that is designed to ensure compliance for both paper and electronic records. 

## Instructions on Administrative Requirements

- Complaints Shall Be Addressed to SUD/CEO or Designee & Must Be Documented, Maintained & Filed with Explanation of Resolution
- IHS & Its Facilities Shall Not Invoke Sanctions Against Its Employees Under the Following Conditions:
- Whistleblower
- Health Oversight or Public Health Authority Authorized by Law to Investigate
- Attorney Retained by Employee for Purpose of Determining Legal Options
- Disclosure of Employees Who Are Victims of Crime to a Law Enforcement Official, with Limitations

**Administrative**

**Notes:**
[NARRATOR] All complaints should be directed to the SUD/CEO or designee, and must be documented, maintained, and filed, along with a brief explanation of the resolution of the complaint, if there is one. IHS must also ensure that employees are not penalized for reporting HIPAA violations or suspected violations, for retaining an attorney to determine legal options if they need it, or for other actions as described on screen. 

## Instructions on Administrative Requirements

**Administrative**

- Video – See Transcript in Notes Below

**Notes:**
TRENT: In the instance where an individual becomes aware of a violation of HIPAA and reports it, that individual would be protected under the Whistle Blowers Act from criminal or civil prosecution. 

REBECCA LOVING, RN, MS – Oklahoma Area Acting Director, Division of Health Care Systems
HIPAA offers protection for employees who report violations of HIPAA against retaliation from their co-workers, their employers, their supervisors. 

TRENT:  Or any sort of negative impact on themselves or their workplace environment or their position as a federal employee because they engaged in disclosing what they believed at the time was a violation of the act.

## Instructions on Administrative Requirements

- IHS Shall Take Reasonable Steps to Ensure Mitigation of a Disclosure or Violation
- IHS Shall Refrain From Intimidating Acts Against Patients & Employees for Exercising Rights Under HIPAA Privacy Rule
- IHS Shall Not Require Individuals to Waive Right toFile Complaints
- IHS Shall Develop Policies & Procedures for HIPAA & a Process Shall Be Established for Revisions to ReflectFuture Changes

**Administrative**

**Notes:**
[NARRATOR] HIPAA regulations also require IHS to take steps to minimize the impact of any disclosure violations, and to make sure that individuals who exercise their rights under HIPAA are not victimized by intimidating acts. IHS cannot force individuals to waive their rights to file complaints, and must develop a process to accommodate future changes in policy and procedure. 

## Q&A 

**Administrative**

## Slide 190

**Notes:**
[NARRATOR]Welcome to Train Learn & Protect—a program designed to ensure the successful implementation of the Healthcare Insurance Portability & Accountability Act, commonly known as HIPAA. Successful completion of this program will enable you to understand & use the forms, policies, & procedures to protect yourself, your organization, & your patients.

## Summary

- Learn Train & Protect

- Know IHS HIPAA Forms, Policies & Procedures
- Avoid Incidental Disclosures
- Refer Questions or Concerns to HIPAA Coordinator, Area Health Records Management or Regional Counsel

**Notes:**
[NARRATOR] While it puts in place many new forms, policies, and procedures, it is very important to remember that HIPAA is not designed to prevent or get in the way of providing patients with the high quality healthcare they deserve. It is designed to protect privacy and engender trust. Questions and/or concerns should be addressed to HIPAA Coordinators, Area Health Records Management or Regional Counsel. 

## Training Materials, Forms, Policies, Procedures, Updates, FAQs, Quick Reference Cards, and More are Available at www.ihs.gov

**Summary**

## Q&A 

**Summary**