HIPAA – What is it?
Health Insurance Portability and Accountability Act of 1996
Standardizes how electronic claims are processed
Secures systems/processes that contain Protected Health Information (PHI)
Promotes privacy/security of individually identifiable health information (IIHI)
HIPAA Benefits
Decrease administrative costs
Increase efficiency via standard formats
Protect health information
Enhance security for e-health transactions
Comply with federal laws
HIPAA Penalties for noncompliance
Severe civil and criminal penalties:
Fines up to $25,000 for multiple violations of the same standard per year
Fines up to $250,000 and/or imprisonment up to 10 years
Employee Sanctions:
Violations by UAMS workforce may result in discipline up to and including termination from
employment or association with UAMS.
Key HIPAA Standards and Timelines
Compliance is required 24 months + 60 days after final rule is published in the Federal Register.
1. Electronic Transactions & Code Sets – Compliance Date has been delayed to 10/16/03.
Standard electronic formats for claims and billing
Uniform codes that all insurance plans must use
Rule covers defined electronic transactions. Examples include claims, enrollment, eligibility, payment
and remittance advice.
2. Security (Proposed Rule) – has not been finalized
Designed to ensure the security and integrity of electronically stored health information
3. Privacy Rule – Compliance Date is April 14, 2003.
Imposes restrictions on the use and disclosure of protected health information (PHI) by
UAMS and its employees.
Protects individually identifiably health information that is used/disclosed in any formelectronic, paper, or oral
PHI is to be used/disclosed for health purposes only, with a few exceptions.
Use/disclosure of PHI is limited to minimum necessary
Protected Health Information
PHI is health information, whether oral, written, or electronic, that is individually identifiable
and created or received by UAMS.
PHI includes identifiable health information that relates to the past, present or future
physical or mental condition, treatment plan or payment for care delivered.
Examples of written information include: patient status boards, eligibility printouts,
financial records, fax sheets, test results, data stored on internet/intranet or data used for
research purposes.
Other PHI may be a sign-in sheet that includes a patient’s name and reason for visit, a
patient’s identification bracelet, an insurance card or a detailed appointment reminder left
on an answering machine.
IDENTIFIERS OF PHI
There are eighteen PHI identifiers and they apply to patients, relatives, employers or household
members of the patients.
-Name
Address (street address, city, county,
zip code (more than 3 digits) or other
geographic codes
-Dates directly related to patient -Telephone Number
-Fax Number -e-mail addresses
-Social Security Number -Medical Record Number
-Health Plan Beneficiary Number -Account Number
Certificate/License Number -Any vehicle or device serial number
-Web URL -Internet Protocol (IP) Address
-Finger or voice prints -Photographic images
-Any other unique identifying number,
characteristic, or code (whether generally
available in the public realm or not)
-Age greater than 89 (due to the 90 year
old and over population is relatively ‘
small)
Privacy Rule Requires 3 key documents
1. WRITTEN NOTICE OF PRIVACY PRACTICES: UAMS must provide patients a written
Notice of Privacy Practices (NPP) no later than the date of the first delivery of service after
April 14, 2003, that describes:
How we use and disclose PHI
The patient’s rights
UAMS’ legal duty with respect to PHI
2. ACKNOWLEDGEMENT: Except in emergency situations, UAMS must make a “good faith”
effort to obtain written acknowledgment from the patient that they received the Notice of
Privacy Practices. If we are unable to obtain this acknowledgement, we must document our
efforts, and why it was not obtained.
3. AUTHORIZATION: Written permission from patient to use/disclose PHI for non-routine
purposes. Examples are to attorneys, and for certain marketing, fund raising and research
(unless waived by IRB) activities. The authorization form will replace our current release of
information forms and has several required elements.
Authorizations must specify data to be used/disclosed, the recipients providing and
receiving the data, and the purpose.
Authorizations must include expiration date or event and be signed and dated.
In addition to the “core” elements above, several statements must be included regarding
revocation, conditional treatment and redisclosures.
Anyone processing or obtaining release of information/authorizations must ensure all of these
elements are included.
Patient Rights
View, copy, request amendments and accounting of disclosures
The patient has a right to inspect and obtain a copy of their records, to request an
accounting of disclosures and to request an amendment to their records. Our Health
Information Management Department (HIM) or Medical Records will handle these
requests.
Request restrictions
a. Patients can request restrictions on the use and disclosure of their information.
b. Patients can request to not be included in the patient directory. We sometimes refer to
these patients informally as “no info” patients. The directory can only include the
patient’s name, location in the facility, a one word statement of condition and religious
affiliation (available only to the clergy). Unless the patient asks not to be included in the
directory, this information can be provided to the clergy and others who ask for the
patient by name. Examples of how the directory might be used include assisting patient
visitors, floral deliveries, etc.
c. Patients can also request that we communicate with them at alternate locations or by
alternate means.
d. Patients can also specify what family members and close friends their information can be
shared with.
When you encounter a request related to a patient right under HIPAA you should refer to the
specific policy/procedure in your area that addresses it. If you still have questions, ask your
supervisor.
UAMS Responsibilities
1. Use and Disclosure Guidelines – UAMS policies and procedures will outline how protected
health information can be used and disclosed.
Use – The utilization, examination or analysis of protected health information within
UAMS.
Disclosure – The release, transfer, provision of access or sharing in any manner of
information outside of UAMS.
A. UAMS can use and disclose PHI for treatment, payment and health care operations
(TPO) as described in our Notice of Privacy Practices.
1) Treatment – the provision of healthcare-by-healthcare providers including coordination of
care and referrals to other providers.
2) Payment – activities related to reimbursement and premiums. Examples are billing,
utilization review, and eligibility determination.
3) Operations – Examples are:
Conducting training programs of health care providers
Accreditation, certification, licensing, or credentialing
Quality assessment and improvement activities including outcomes evaluation
and development of clinical guidelines
Case management and care coordination
Business planning and general administrative activities
B. UAMS can also use and disclose PHI when required by law. Examples include reporting
communicable diseases such as TB and suspected cases of abuse and neglect.
C. All other uses and disclosures require patient’s written authorization.
2. Research and Clinical Trials – Research is not considered a part of “operations” and requires
a Human Subject Consent Form and HIPAA Authorization or waiver of both from the IRB.
HIPAA permits use of de-identified data (defined as removal of 18 specific
identifiers listed above) for research purposes without authorization.
HIPAA permits use and disclosure of a limited data set (includes some of the items
removed above) provided a data use agreement is obtained.
HIPAA permits use/disclosure of PHI for research with patient authorization and IRB
approval or waiver from the IRB.
As required by FDA and OHRP, individuals must sign in
Use the order calculator below and get started! Contact our live support team for any assistance or inquiry.
[order_calculator]