Source: http://www.getceusnow.com/ceus-HIPAA-continuing-education-course-ceus
Timestamp: 2018-01-19 19:45:19
Document Index: 436041701

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 552', '§ 164', '§ 164']

HIPAA CEUs, Continuing Education
The patient’s insurance company, managed-care, or Medicare may need information similar to the first example to document that the patient is making progress in treatment and why. They do not need the private information which occurs in the consulting room. HIPAA protects this information if the therapist is willing to make separate folders for their patients. The patient is able to talk about shameful thoughts, acts, and memories while the therapist can take private Psychotherapy Notes on these which remain private but would cause damage or harm to the patient if revealed. Additionally, the patient must authorize the therapist to share the Psychotherapy Notes with other clinicians. If several therapists or others such as physicians are involved in a case, the general notes or medical records can be shared. Only the patient, the subject of the notes, can authorize sharing of the Psychotherapy Notes.
The privacy and security of health information is an important concern for all those delivering healthcare and is especially crucial for those who care for HIV/AIDS patients. You should be aware that any inappropriate disclosure of their condition may have serious consequences for your patients. AIDS-related stigma and discrimination persist and people with HIV/AIDS continue to be discriminated against in health care, housing, and the workplace. Fear of stigma and discrimination also affects their decision to obtain care, as it may discourage them from seeking HIV testing and treatment. Thus, it is crucial that you adhere to the privacy and security rules that protect your patients’ rights.
All healthcare providers are required to comply with Federal and State laws that protect patients’ health information. The first and most extensive Federal legislation on health privacy and security is the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This legislation defines what health information must be protected and stipulates what must be done to protect patients’ privacy and security. While HIPAA does not specifically address HIV/AIDS, its regulations have been important for protecting HIV/AIDS patients from discrimination related to their condition.
Recent growth in the use of health IT presents new benefits and potential risks for the privacy and security of patients’ health information. Since the enactment of HIPAA in 1996, the use of electronic health information technology (IT) has grown. Vendors’ health IT systems have become increasingly sophisticated and providers have become more accepting of their use. In addition, the Federal government funded programs to encourage providers to purchase, adopt, implement, and demonstrate meaningful use of electronic health record (EHR) systems and will eventually penalize Medicare providers do not meaningfully use EHR technologies.
While health IT offers you and your patients the opportunity for better quality and more efficient care, widespread use of health IT also presents challenges to privacy and security. To address these challenges, the Federal government’s Health Information Technology for Economic and Clinical Health Act (HITECH) of the American Recovery and Reinvestment Act of 2009 (ARRA) strengthened some HIPAA requirements for privacy and security. An interim rule expands individuals’ rights to access their health information and restricts certain types of disclosures of protected health information to health plans; requires business associates of HIPAA-covered entities to be under most of the same rules as the covered entities; sets new limitations on the use and disclosure of protected health information for marketing and fundraising; and prohibits the sale of protected health information without patient authorization. These and other changes to HIPAA’s rules were proposed on July 14, 2010 and are already in effect. All covered providers must comply with these Federal rules and all other applicable state and local regulations.
Privacy refers to an individual’s right to control both access to and use of his or her health information.
Confidentiality relates to the right of an individual to the protection of their health information during storage, transfer, and use, in order to prevent unauthorized disclosure of that information to third parties.
Security consists of the protections or safeguards put in place to secure protected health information (PHI). It requires that administrative, technical, and physical safeguards are developed and used.
Discussing, diagnosing, and treating HIV/AIDS is a sensitive, private issue between a patient and his or her provider. This privacy is especially important, because as mentioned in the introduction, any breach of privacy may result in stigmatization or discrimination against HIV/AIDS patients. Patients who are concerned that their health information will not be held private or secure may be discouraged from being tested for HIV and may be dissuaded from pursuing or adhering to recommended treatment regimens.
The need for privacy and security must be carefully balanced with the appropriate sharing of patient information. Health IT poses risks for maintaining patient privacy and security, but also offers you and your HIV/AIDS patients potential benefits. There are instances in which you must reveal patient information to someone other than the patient. You are required to report the names of persons who have a positive HIV test to public health authorities for infectious disease surveillance. In some States you are also required to report the names of partners of those who test positive for HIV.
You may also share a patient’s medical information with the patient’s other medical providers to coordinate care and to manage HIV/AIDS as a chronic condition. The policies and regulations that have been put in place will allow you to share patient health information when necessary and appropriate, while maintaining the confidentiality, privacy, and security of this information.
In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments.The final modifications were published in final form on August 14, 2002.
The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”). Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities.4 Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations (“HMOs”), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of government-funded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center,5 or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance. If an insurance entity has separable lines of business, one of which is a health plan, the HIPAA regulations apply to the entity with respect to the health plan line of business.
Business Associate Contract. When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates.10 Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first.
(4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule.27 (5)
Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes.28 These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information.
Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.31
Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity’s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity’s receipt of direct or indirect remuneration from a third party must reveal that fact. See additional guidance on
Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices.51 The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. Notice
Distribution. A covered health care provider with a direct treatment relationship with individuals must have delivered a privacy practices notice to patients starting April 14, 2003 as follows:
Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.70 For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See additional guidance on Complaints. A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule.71 The covered entity must explain those procedures in its privacy practices notice.72Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS.
Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual’s protected health information, as well as the individual’s rights under the Rule.84 A personal representative is a person legally authorized to make health care decisions on an individual’s behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when a covered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual.
Special Case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children. If State and other law is silent concerning parental access to the minor’s protected health information, a covered entity has discretion to provide or deny a parent access to the minor’s health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See additional guidance on
15 The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the “safe harbor” method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet
Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and ® any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R. § 164.514(b).
37 The Privacy Rule defines research as, “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” 45 C.F.R. § 164.501.43 45 C.F.R. § 164.514(e). A limited data set is protected health information that excludes thefollowing direct identifiers of the individual or of relatives, employers, or household members ofthe individual: (i) Names; (ii) Postal address information, other than town or city, State and zipcode; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses: (vi) Socialsecurity numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix)Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers,including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifiers, including finger and voice prints; (xvi) Full face photographic images and any comparable images. 45 C.F.R. § 164.514(e)(2).
46 45 CFR § 164.532. 47 “Psychotherapy notes” means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. 51 45 C.F.R. §§ 164.520(a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity’s own fundraising.
A covered entity may deny access to individuals, without providing the individual an opportunity for review, in the following protected situations: (a) the protected health information falls under an exception to the right of access; (b) an inmate request for protected health information under certain circumstances; (c) information that a provider creates or obtains in the course of research that includes treatment for which the individual has agreed not to have access as part of consenting to participate in the research (as long as access to the information is restored upon completion of the research); (d) for records subject to the Privacy Act, information to which access may be denied under the Privacy Act, 5 U.S.C. § 552a; and (e) information obtained under a promise of confidentiality from a source other than a health care provider, if granting access would likely reveal the source. 45 C.F.R. § 164.524.58 45 C.F.R. § 164.526.