PowerPoint

April 2017Volume 25 Issue No. 4

CNA Training Advisor

Program time

Approximately 30 minutes

Learning objectives

Participants in this activity will be able to:

• Explain the purpose of the Health

Insurance Portability and Accountability

Act of 1996 (HIPAA)

• Identify the HIPAA compliance rule of

thumb

• Describe the privacy and confidentiality

policies and procedures required by law

• Obey agency procedures aimed at

protecting resident information

• Recognize and alleviate the information

security risks posed by new technologies

Preparation

• Review the material on pp. 1–4

• Duplicate the CNA Professor insert for

participants

• Gather equipment for participants

(e.g., an attendance sheet, pencils, etc.)

Method

1. Place a copy of CNA Professor and a pencil at each participant’s seat

2. Conduct the questionnaire as a pretest or, if participants’ reading skills are limited, as an oral posttest

3. Present the program material

4. Review the questionnaire

5. Discuss the answers

Program Prep Social Media: Your Role in Resident Confidentiality, Privacy, and HIPAA

Social media

Social media, or websites and applications that enable users to create and share content or to participate in social networking, is all around us, and we’ve all caught the bug. Smartphones, tablets, accessible internet and Wi-Fi, and more and more jobs requiring connectivity have thrust social media upon us. We share and react on Facebook, Twitter, Instagram, LinkedIn, Google+, Disqus, Snapchat, Tumblr, YouTube, Vine, WhatsApp, Meetup, Pinterest, and even plain text messages. Social media gives everyone the ability to share words or images with one person—or thousands of people—with a swipe or a tap of a button.

Social media gives everyone a microphone, which can be incredibly important. Social media has helped organize protests and fundraisers, connect people affected by natural disasters, locate lost pets, and more. Unfortunately, if misused, it can also be dangerous.

Social media gives the average person the freedom to share with an audience, and this is a greater responsibility than it might first appear to be—especially for healthcare workers. Think about what you might share in your personal life among friends. Maybe you post whatever is on your mind, something you think others will be interested in, or even something for a laugh. Sharing has become so easy, it’s nearly mindless. However, when you work in healthcare, you can never share mindlessly about your professional duties.

As a CNA, it’s natural to feel the desire to connect after leaving your facility or on your way to work. You might experience things during your workday that astound you, anger you, sadden you, or make you laugh, and your first thought may be to share those stories with others. However, it’s critical to avoid reaching for your phone—the risk of such casual sharing is too great, both for the resident involved and for you. You never truly know who will see what you put online, and whatever you share can be re-shared by anyone, over and over again. Even if

Answer Key

1. c.

2. a.

3. b.

4. d.

5. c.

6. b.

7. d.

8. a.

9. c.

10. a.

HCPRO.COM © 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

2 |CNA Training Advisor April 2017

CNA Training Advisor (ISSN: 1545-7028 [print]; 1937-7487 [online]) is published monthly by HCPro, a division of BLR®. • CNA Training Advisor, 100 Winners Circle, Suite 300, Brentwood, TN 37027. • Copyright © 2017 HCPro, a division of BLR. All rights reserved. Printed in the USA. Except where specifically encouraged, no part of this publication may be reproduced, in any form or by any means, without prior written consent of HCPro, a division or BLR, or the Copyright Clearance Center at 978-750-8400. Please notify us immediately if you have received an unauthorized copy. • For editorial comments or questions, call 781- 639-1872 or fax 781-639-7857. For renewal or subscription information, call customer service at 800-650-6787, fax 800-785-9212, or email [email protected]. • Visit our website at www.hcpro.com. • Occa- sionally, we make our subscriber list available to selected companies/vendors. If you do not wish to be included on this mailing list, please write to the marketing department at the address above. • Opinions expressed are not necessarily those of CTA. Mention of products and serv ices does not constitute en dorse ment. Advice given is general, and readers should consult professional counsel for specific legal, ethical, or clinical questions.

CTA STAFF MEMBERS STAY CONNECTED

This document contains privileged, copyrighted information. If you have not purchased it or are not otherwise entitled to it by agreement with HCPro, a division of BLR, any use, disclosure, forwarding, copying, or other communication of the contents is prohibited without permission.

ers is friends with your resident and knows the facility you work for? It’s too easy to leave too much identify- ing information on the table and violate HIPAA. To be very clear, HIPAA can be violated through any form of social media. It’s also important to keep in mind that you can’t take back anything you post online.

A study of medical blogs written by healthcare profes- sionals found that individual residents were described in 42% of the 271 samples studied. Of these samples, 17% included enough information for residents to identify themselves or their providers, and three samples included recognizable photographs of the residents (Chretien, K. C., & Kind, T. [2013]. Social media and clinical care: Ethical, professional, and social implications. Circulation, 127[13]:1413–1421). If you accidentally reveal a resident’s identity via social media, you and your facility could be in violation of HIPAA and suffer severe consequences.

HIPAA compliance is critical and must be a promi- nent component of a facility’s policies and procedures. All staff members who interact frequently with resi- dents, especially CNAs, need to familiarize themselves with the types of data considered to be protected health information (PHI) and what information requires authorization before it can be shared.

The rule of thumb for HIPAA compliance is the right information to the right person for the right reasons, even on social media (assuming the information is even

you’ve set your social media accounts to be private, even if you share with only a single other person, you’ve still given that person information, and he or she could share it with others. That single act of sharing is all it takes to violate HIPAA.

The basics of HIPAA

HIPAA is one of the most important pieces of federal healthcare legislation. Passed in 1996 and mandating compliance by April 2003, HIPAA requires that all healthcare workers uphold the privacy, confidentiality, and security of their residents’ healthcare information. Once someone sees or hears something, there’s no way to get that person to unsee or unhear it. HIPAA was created in part because of this principle—it’s critical to protect someone’s privacy because once it’s violated, it’s ruined, and there is no way to get it back.

Many providers think they know HIPAA well. And while you might understand the importance of resident privacy and the main tenets of the policy, are you willing to risk your career for it?

You also might not know social media as well as you think. Is your place of employment listed on your Facebook page? Are you Facebook friends with a resident at your facility? When you took that picture, did you really get rid of identifying factors? When you post about your rough day with a resident in his 80s who can’t hear well, what if one of your Twitter follow-

Adrienne Trivers Product Director [email protected]

Brianna Shipley Associate Editor [email protected]

Interact with us and the rest of the HCPro community at HCPro.com

Become a fan at facebook.com/HCProInc

Follow us at twitter.com/HCPro_Inc

Email us at [email protected]

Questions? Comments? Ideas? Contact Associate Editor Brianna Shipley at [email protected] or 781-639-1872, Ext. 3180.

Don’t miss your next issue If it’s been more than six months since you purchased or renewed your subscription to CNA Training Advisor, be sure to call customer service at 800-650-6787. Renew your subscription early to lock in the current price.

Relocating? Taking a new job? If you’re relocating or taking a new job and would like to continue receiving CNA Training Advisor, you are eligible for a free trial subscription. Contact customer serv ice with your moving information at 800-650- 6787. At the time of your call, please share with us the name of your replacement.

HCPRO.COM© 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

CNA Training Advisor | 3April 2017

appropriate to be shared there). CNAs who are cogni- zant of this rule and who vigilantly adhere to it should sidestep any HIPAA problems.

HIPAA and you

HIPAA has many rules your facility must follow. Some of those rules apply to you in your role as a CNA, and breaking them could result in penalties or even fines. HIPAA regulations cover many areas, but privacy of information is one of the most important. Privacy of information means that anything you say or write about a resident must not be overheard or read by anyone unless that person has a right and a need to hear or see the information. The person can have that right only if the resident has agreed that the person may have the information.

In a nutshell, HIPAA compliance is all about the privacy, confidentiality, and security of PHI:

• Privacy refers to who should and should not have access to health information. Residents have the right to privacy, meaning that information about them should be available only to people who need it to provide care.

• Confidentiality refers to preventing someone from hearing or seeing a person’s private health records and information unless they have the proper authorization. All health information is confidential. Anyone who possesses PHI is re- sponsible for protecting it.

• Security is the means used to provide privacy and confidentiality. The purpose of security is to en- sure only those people with authorization can access personal health information.

HIPAA rules must be obeyed by the following public and private organizations, which are referred to as covered entities:

• Health plans and health insurance companies (e.g., health maintenance organizations and pre- ferred provider organizations)

• Healthcare clearinghouses (e.g., billing services)

• Healthcare providers (e.g., doctors, dentists, chiropractors, therapists, hospitals, nursing facili-

ties, clinics, pharmacies, hospices, and home health agencies)

Protecting resident privacy

The privacy protections of HIPAA apply to all PHI, which includes:

• Information created or received by a covered en- tity or an employer that relates to a resident’s past, present, or future health condition, health treatment, or payment for healthcare services

• Information that can identify an individual (e.g., name, address, telephone number, email address, date of birth, Social Security number, diagnosis, medical record number, employer, position, or other identifying data)

• The resident record

PHI can be in any format (e.g., paper, electronic, or oral). If a provider needs to disclose a resident’s PHI for purposes of providing healthcare, the provider needs to obtain that resident’s consent. Reasons for disclosing PHI include routine healthcare-related uses of the information, such as when a doctor consults with another doctor to provide better care for an individual. If a covered entity wants to disclose a person’s PHI for purposes other than providing care, the covered entity needs that person’s specific authorization.

The difference between consent and specific authori- zation is that to give consent, a resident must sign a form. He or she needs to sign the consent only once for each provider. The consent will apply whenever that provider discloses the resident’s PHI for purposes of providing healthcare. In comparison, specific authorization is required when a covered entity wants to use or disclose a resident’s PHI for purposes not related to providing healthcare. The resident must sign an authorization form for each specific instance in that case.

The HIPAA Privacy Rule generally permits covered entities to disclose PHI without a resident’s specific authorization in the following situations, depending on state or local law:

• Emergencies

HCPRO.COM © 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

4 |CNA Training Advisor April 2017

• Public health needs (e.g., infectious disease registries)

• Mandatory reporting of child or elder abuse and neglect

• Judicial and administrative proceedings

• Substantial communication barriers

If there is no state or local law specifically requiring disclosure of information in the instances listed, covered entities are required to use professional judgment in deciding whether to disclose information and exactly how much to disclose.

A covered entity must allow a person to view and photo- copy his or her own PHI if that person submits a request. An organization may charge the person for copies of records. In a few special circumstances, such as when a covered entity has compiled information for use in a civil, criminal, or administrative proceeding, that entity does not have to give a person access to his or her PHI.

A covered entity may deny a resident access to the PHI if it has reason to believe that access would endanger the resident’s health. If a resident believes that his or her PHI contains information that is incorrect, he or she may ask the covered entity to make changes. The covered entity may deny the request if it believes that the current information is accurate and complete or if it did not create the information.

Covered entities are also required to do the following:

• Notify residents about their privacy rights. This can be done by producing a clear, written expla- nation of how the provider may use and disclose the resident’s health information.

• Adopt written privacy procedures that clearly de- fine who has access to protected information, how the entity will use the information, and when the entity might disclose the information to others.

• Train employees so that they are fully aware of the privacy procedures.

• Implement safeguards to prevent intentional or accidental misuse of PHI.

• Appoint an individual to make sure that employ- ees follow the privacy procedures.

• Give an account of instances in which the entity has disclosed PHI for purposes other than treat- ment, payment, or healthcare operations.

CNA confidentiality

Some residents may fear that exposure of their PHI could result in job discrimination, personal embarrass- ment, or the loss or denial of health insurance. Confi- dentiality of information, whether in written, elec- tronic, or verbal form, is a priority. Confidentiality should extend to all health information, and you should handle all resident records as though they are confidential at all times. Do not leave them open where unauthorized people can see them.

All CNAs should learn the safeguards that their facility requires for the use, disclosure, and storage of PHI. Know your facility’s privacy policies and proce- dures. Keep in mind that individuals have the right to know and decide who may have access to their health information and under what circumstances they may have it. Most agencies provide annual training on HIPAA rules and facility policies with mandatory attendance. In addition, CNAs should remember the following:

• Discuss resident information only in private loca- tions where others cannot overhear the conversation.

• A cover sheet marked “confidential” should ac- company all faxed information.

• If emailing information about a resident is per- mitted within your facility, remove any detailed identifying information (e.g., do not refer to the resident by his or her full name; consider using the resident’s initials or internal resident number).

• Only authorized personnel should enter confi- dential medical information into a computer- based resident record.

• Use only objective, precise language when documenting in the resident record and avoid casual remarks and abbreviations that might be misunderstood. Do not express opinions. Stick to factual information.

HCPRO.COM© 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

CNA Training Advisor | 5April 2017

• Always take the utmost care to protect the priva- cy and confidentiality of all health information by being aware of who is around you and not al- lowing unauthorized people to hear or see any PHI (e.g., while at the facility of resident X, do not leave resident Y’s file out in the open where resident X or his or her family can see resident Y’s information). In fact, never take any part of a resident record into the room or facility of anoth- er resident. Keep records in a folder or envelope when leaving them on your desk or inbox. While in a resident’s room, do not discuss your next res- ident. The first resident may be able to figure out who you are talking to, which then could provoke him or her to ask how the second resident is do- ing—and you cannot disclose that information.

• Think about how you would want your PHI treat- ed, and give your residents that much protection and more.

• Although it can be tempting, avoid posting text, pictures, or videos that have anything to do with your residents or work on any social media app. Never take photos or videos of your resident ex- cept to specifically document a finding, such as a wound or bruising. When documenting such find- ings, identify the photo with only the resident’s internal ID number and the date. The photo should not include the resident’s face or other identifying features. It is best to use only facility- owned equipment when taking resident photo- graphs. Equipment should be password-protected and encrypted in accordance with HIPAA’s tech- nical standards. Always check your facility’s poli- cy regarding taking resident photos before you use your own phone or equipment to do so.

The ramifications of HIPAA violations

The Office for Civil Rights (OCR), a facility within the Department of Health and Human Services (HHS), is responsible for enforcing the HIPAA Privacy Rule and Security Rule. One of the ways that OCR carries out this responsibility is to investigate complaints filed with the office. OCR may also conduct compliance reviews to determine whether covered entities are in compliance.

OCR may only act on complaints that meet the follow- ing conditions:

• The alleged action occurred after the dates the Privacy and Security rules took effect

• The complaint is filed against an entity that is re- quired by law to comply with the Privacy and Se- curity rules (i.e., a covered entity)

• The complaint alleges an activity that, if proven true, would violate the HIPAA Privacy or Secu- rity rules

• The complaint is filed within 180 days of when the person submitting the complaint knew or should have known about the alleged violation

If OCR accepts a complaint for investigation, OCR will notify the person who filed the complaint and the covered entity named in it. Then the complainant and the covered entity are asked to present information about the incident or problem described in the com- plaint. OCR may request specific information from each to get an understanding of the facts. Covered entities are required by law to cooperate with com- plaint investigations. If a complaint describes an action that could be a violation of the criminal provision of HIPAA, OCR may refer the complaint to the Depart- ment of Justice for investigation.

OCR reviews the information, or evidence, that it gathers in each case. In some cases, it may determine that the covered entity did not violate the requirements of the Privacy or Security rules. If the evidence indi- cates that the covered entity was not in compliance, OCR will attempt to resolve the case with the covered entity by obtaining voluntary compliance, corrective action, and/or a resolution agreement. Most investiga- tions are concluded to the satisfaction of OCR through these types of resolutions. OCR notifies the person who filed the complaint and the covered entity in writing of the resolution result.

If the covered entity does not take satisfactory action to resolve the matter, OCR may decide to impose a civil monetary penalty (CMP) on the covered entity. If a CMP is imposed, the covered entity may request a hearing in which an HHS Administrative Law Judge decides whether the penalties are supported by the

HCPRO.COM © 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

6 |CNA Training Advisor April 2017

evidence in the case. Complainants do not receive a portion of CMPs collected from covered entities; the penalties are deposited in the U.S. Treasury.

Outside of HIPAA

Posting about your personal life might not be as personal as you think. Complaining about residents and coworkers can hurt your work life (and worse) if someone sees what you’ve posted and knows it’s about them. Disparaging comments aimed at a coworker online can be considered cyberbullying, and inappro- priate pictures taken of you using work equipment might come back to you.

Of course, it’s not safe to type or take pictures while you drive. If you do, not only could you harm yourself or someone else, but you could also be violating your facility’s workplace safety policy. In most states, use of any keyboard while driving is a citable violation subject to a fine.

The CNA’s role

To say CNAs play an important role in maintaining the privacy, confidentiality, and security of their residents’ PHI would be an understatement. CNAs work very closely with resident records, information that can easily identify a resident, and residents’ past and present health conditions, treatments, and payments for services rendered. CNAs must be extremely attentive when handling such sensitive information, both for the resident’s benefit as well as the facility’s. HIPAA compliance is taken very seriously, and violations can quickly land providers in hot water. Remember the rule of thumb: the right information to the right person for the right reasons. CNAs should abide by this rule, be mindful of their environment and whether residents’ PHI is at risk of unauthorized disclosure, and treat documentation, electronic sources, and mobile devices containing PHI like they would treat their own sensitive personal information. By doing this, HIPAA problems should be avoided—and residents will receive the vigilance they deserve when it comes to their information.

Outcomes and the CNA

When CNAs understand HIPAA, retain the privacy, confidentiality, and security of their residents’ PHI, and work with their facility to maintain HIPAA compli- ance, outcomes are much more likely to be positive. A thorough understanding of the purpose of HIPAA, in conjunction with a complete grasp of the facility’s HIPAA policies and procedures, will guide CNAs in virtually all situations where the wrong decision could put a resident’s information at risk. Likewise, CNAs will preserve residents’ confidence in the care they receive and in the quality of services provided by the facility when it is clear that HIPAA compliance is a top priority and that PHI is handled carefully.

Your facility’s policies • Learn and follow your facility’s policies on secu-

rity and confidentiality of resident information.

• Provide information only when you are certain that the resident does not object.

• If the resident is present, ask if it is all right to discuss the information and give the resident an opportunity to say no. If the resident is not pres- ent, you will likely need to ask your supervisor whether you should discuss the information. The information you would disclose should be direct- ly related to the inquirer’s need to know, and the person requesting the information should be someone involved in the resident’s healthcare. H

HCPRO.COM© 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

CNA Training Advisor | 7April 2017

Social Media: Your Role in Resident Confidentiality, Privacy, and HIPAA

Directions: Read each question carefully, then determine the best answer. Check the corresponding box on your answer sheet. Do not write on this posttest.

1. HIPAA requires that all healthcare workers uphold the privacy, __________, and security of their residents’ healthcare information.

a. safety b. accountability

c. confidentiality d. publicity

2. Which of the following is the correct rule of thumb for HIPAA compliance?

a. The right information to the right person for the right reasons

b. The right person’s reception of the right information

c. The right information reasonably related to the right person

d. The right information for the right reasons to the left person

3. Residents have the right to __________, which refers to who should and should not have access to PHI.

a. security b. privacy

c. protection d. safety

4. While in resident X’s room, you discuss your next resident, Y, with a fellow CNA. Which state- ment below is true?

a. You should never discuss resident Y from resident X’s room

b. Resident X may overhear your conversation, even if you speak quietly

c. Resident X may determine who your next resident is just by hearing your side of the conversation, prompting him or her to inquire about resident Y’s health—which you must protect and keep private

d. All of the above

5. Which of the following is not a violation of HIPAA?

a. Taking a photo of your resident and posting it online for just a few minutes

b. Posting on a blog about your rough day working at XYZ facility, with a difficult old man on the third floor of Harmony Assisted Living

c. Taking a photo using facility or facility-approved equipment, with resident consent, of the resident’s wound (and only the wound), identified with the resident’s ID number

d. Casually chatting with friends in a public place about your day and your resident, Mr. Jones

Quiz

HCPRO.COM © 2017 HCPro, a division of BLR. For permission to reproduce part or all of this newsletter for external distribution or use in educational packets, contact the Copyright Clearance Center at copyright.com or 978-750-8400.

8 |CNA Training Advisor April 2017

6. As long as a CNA’s social media profile is set to private and he or she is not knowingly friends with anyone associated with the facility, it’s okay to post information about a resident experience without breaking HIPAA compliance.

a. True

b. False

7. Jane, a CNA, is in the facility documenting her resident’s care into the facility’s electronic medi- cal record. Her colleague Sue, who is on a different team and does not provide care to this resident, comes by and reads the record. Sue is intrigued by the photos contained in the record, so she pulls out her cell phone and takes a photo of the record to text to her husband, who is an EMT. In this situation, how is Sue breaching HIPAA?

a. Viewing a medical record that she has no need to see

b. Taking a photo of a page in the medical record

c. Texting the photo to her husband

d. All of the above

8. In an effort to maintain the confidentiality of PHI, CNAs should never __________.

a. text any resident information to a coworker

b. remove detailed identifying information about a resident when corresponding through email

c. use objective, precise language when documenting in the resident record

d. allow authorized individuals to hear about a resident’s health treatment

9. To avoid compromising residents’ PHI via mobile devices and other technologies, CNAs should __________.

a. avoid the use of usernames and passwords on their devices

b. set their devices to automatically log off after one to two hours

c. employ encryption on their devices

d. not use zip drives

10. CNAs should not make social media posts or replies containing any:

a. resident-specific comments, photographs, or links

b. facts from peer-reviewed journals

c. information (not resident specific) learned in facility training

d. objective findings from the internet

Quiz

Copyright of CNA Training Advisor: Lesson Plans for Busy Staff Trainers is the property of HCPro and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.