HCA 417 Electronic Health Record Health Care Only

vroins

chapter_10_part_1.pdf

Home >Information Systems homework help >HCA 417 Electronic Health Record Health Care Only

ELECTRONIC HEALTH RECORDS Understanding and Using Computerized Medical Records

CHAPTER LESSON

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Privacy and Security of Health Records

CHAPTER TEN ONE

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Understanding HIPAA

• HIPAA: acronym for Health Insurance

Portability and Accountability Act; passed by Congress in 1996. – Improve portability and continuity of health

insurance coverage. – Combat waste, fraud, and abuse in health

insurance and healthcare delivery.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Understanding HIPAA

• HIPAA (cont.) – Promote use of medical savings accounts. – Improve access to long-term care. – Simplify administration of health insurance.

• Administrative Simplification Subsection 1 of HIPAA: covers entities such as health plans, clearinghouses, healthcare providers (covered entities).

Understanding HIPAA

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Administrative Simplification Subsection

• Administrative Simplification Subsection components: – Transactions and code sets – Uniform identifiers – Privacy – Security

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Administrative Simplification Subsection

• HIPAA Transactions and Code Sets – Regulations that govern electronic transfer of

medical information for business purposes such as insurance claims, payments, and eligibility.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Eight HIPAA Transactions

• Claims or Equivalent Encounters and Coordination of Benefits (COB)

• Remittance and Payment Advice • Claims Status • Eligibility and Benefit Inquiry and

Response • Referral Certification and Authorization

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Eight HIPAA Transactions

• Premium Payments • Enrollment and De-enrollment in a Health

Plan • Retail Drug Claims, Coordination of Drug

Benefits and Eligibility Inquiry • Health Claims Attachments (Not Final) • First Report of Injury (Not Final)

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Standard Code Sets

• In an EDI transaction, certain portions of information are sent as codes to communicate demographic and billing information.

• HIPAA requires use of standard sets of codes. Two standards are: – Diagnoses (ICD-9-CM) codes – Procedure (CPT-4 and HCPCS) codes

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Standard Code Sets

• HIPAA Uniform Identifiers – National Provider Identifier: assigned to

doctors, nurses, other healthcare providers. – Employer Identifier: used to identify employer-

sponsored health insurance. – National Health Plan Identifier: not yet

implemented; identification number assigned to each insurance plan and to organizations that administer insurance plans.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Standard Code Sets

• HIPAA Privacy Rule – Privacy standards designed to protect

patient's identifiable health information from unauthorized disclosure or use in any form.

– PHI or Protected Health Information: patient's personally identifiable health information.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

• HIPAA Privacy Rule (cont.) – Gives individuals a fundamental right to be

informed of privacy practices of health plans and healthcare providers.

– To be informed of their privacy rights with respect to personal health information.

– Providers are required to develop and distribute a notice that provides a clear explanation of these rights and practices.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Consent

• Informed consent: patient's agreement to receive medical treatment having been provided information to make informed decision.

• Under the Privacy Rule, patient gives consent to use of their PHI for purposes of treatment, payment, operation of healthcare practice.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Consent

• Patient signs consent form or signs an acknowledgment that he or she has received copy of office's privacy policy. – Healthcare entity may use or disclose PHI for

its own treatment, payment, and healthcare operations activities.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Consent

• Consent (cont.) – Provider may disclose PHI about an individual

as part of claim for payment to health plan. – Provider may disclose PHI related to

treatment or payment activities of any healthcare provider.

– Health plan may use protected health information to provide customer service to enrollees.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Consent

• Others within office who can use PHI: – Doctors – Nurses – Administrative staff – Office administrators

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Modifying HIPAA Consent

• Individuals have the right to request restrictions on how covered entity will use and disclose protected health information.

• Covered entity not required to agree to individual's request for restriction.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Modifying HIPAA Consent

• Individuals may request to receive confidential communications from covered entity.

• Healthcare provider must accommodate request for such confidential communications.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Authorization

• Authorization differs from consent; it requires patient's permission to disclose PHI.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Authorization

• Privacy Rule requires that authorization form contain specific information. – Date signed – Expiration date – To whom information may be disclosed – What is permitted to be disclosed – For what purpose information may be used

• Authorizations are not global.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Authorization

• Privacy Rule: – Requires authorization for researchers to use

PHI. – Allows some exceptions that permit

researchers to access PHI without individual authorizations.

– Defines marketing and requires individual authorization for all uses or disclosures of PHI for marketing purposes (limited exceptions).

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Government Agencies

• Privacy Rule (cont.) – Permits disclosure of PHI without patient's

authorization or consent if requested by authorized government agency for legal or public health purposes.

– Permits disclosure of PHI, without authorization, to public health authorities for purpose of preventing or controlling disease or injury.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minimum Necessary

• Privacy Rule minimum necessary standard is intended to limit unnecessary or inappropriate access to and disclosure of PHI beyond what is necessary.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minimum Necessary

• Does not apply to the following: – Disclosures to or requests by healthcare

provider for treatment purposes. – Disclosures to individual who is subject of

information. – Uses or disclosures made pursuant to

individual's authorization. – Uses or disclosures required for compliance

with HIPAA Administrative Simplification Rules.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minimum Necessary

• Does not apply to the following (cont.): – Disclosures to Department of Health and

Human Services (HHS) when disclosure of information is required under Privacy Rule for enforcement purposes.

– Uses or disclosures that are required by other law.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Incidental Disclosures

• HIPAA Privacy Rule is not intended to impede customary and essential communications and practices and does not require that all risk of incidental use or disclosure be eliminated to satisfy its standards.

• Incidental disclosure is one of the exceptions to the Breach Notification Requirements.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Critical Thinking Exercise 60: What Is Required?

• You are employed at a medical facility. • One of your patients is being treated as a

result of an accident. • The doctor asks you to take the patient's

x-rays to a colleague for an opinion on the best treatment. – What HIPAA form does the patient need to

sign to permit you to do this?

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Critical Thinking Exercise 60: What Is Required?

• The same patient is suing the company responsible for the accident.

• His attorney has asked for copies of the x- rays to prepare his case. – What HIPAA form does the patient need to

sign to permit you to do this?

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

A Patient's Right to Know about Disclosures

• Privacy Rule gives individuals the right to receive a report of all disclosures made for purposes other than treatment, payment, or operation of the healthcare facility.

• Report must include date of disclosure, to whom information was provided, description of information, stated purpose for disclosure.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Patient Access to Medical Records

• Law allows patients to be able to see and obtain copies of their medical records and request corrections if they identify errors and mistakes.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Personal Representatives

• Personal representative: person authorized to act on behalf of individual in making healthcare related decisions.

• Personal representative is treated as the individual for all purposes under Privacy Rule.

• Examples include parent with respect to minor child or legal guardian of mentally incompetent adult.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Personal Representatives

• Where representative's authority limited to particular healthcare decisions, his or her authority concerning PHI limited to same area.

• When patient is deceased, a person who has authority to act on behalf of deceased or deceased's estate is personal representative for all purposes under Privacy Rule.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Personal Representatives

Figure 10-3: Personal representatives for patients.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minor Children

• Parent, guardian, or other person acting as parent is personal representative and acts on behalf of minor child with respect to PHI.

• Privacy Rule prohibits providing access to or disclosing child's PHI to parent, when it is expressly prohibited under state or other laws.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minor Children

• Three exceptional circumstances when parent is not minor's personal representative: – When State or other law does not require

consent of parent or other person before minor can obtain particular healthcare service, and minor consents to healthcare service.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Minor Children

• Three exceptional circumstances when parent is not minor's personal representative (cont.): – When a court determines or other law

authorizes someone other than parent to make treatment decisions for minor.

– When parent agrees to confidential relationship between minor and physician.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Critical Thinking 61: Comparison of Privacy Policy

• Visit a medical office, other healthcare facility, or web site and ask for a copy or print a copy of their HIPAA Privacy Policy.

• Figure 10-4 in the textbook provides a summary of patient rights under the Privacy Rule.

• Compare contents of privacy policy you obtained with points in sample CMS brochure shown in Figure 10-4.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Critical Thinking 61: Comparison of Privacy Policy

• Write a brief paper comparing the points of the government document with copy of privacy policy you obtained.

• Give your instructor a copy of privacy policy you obtained along with your paper.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Business Associates

• Privacy Rule allows covered providers and health plans to disclose protected health information to business associates.

• Covered entity's contract or other written arrangement with business associate must contain elements specified in privacy rule.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Civil and Criminal Penalties

• Congress provided civil and criminal penalties for covered entities that misuse personal health information.

• For civil violations of standards, OCR may impose monetary penalties.

• Criminal penalties can be monetary and one year in prison for certain offenses.

Electronic Health Records: Understanding and Using Computerized Medical Records, Second Edition Richard Gartee

Civil and Criminal Penalties

• HITECH Act strengthens civil and criminal enforcement of HIPAA rules by establishing: – Four categories of violations that reflect

increasing levels of culpability. – Four corresponding tiers of penalty amounts

that significantly increase minimum penalty amount for each violation

– Maximum penalty amount of $1.5 million for all violations of an identical provision.

Slide Number 1
�Understanding HIPAA�
Understanding HIPAA
Administrative Simplification Subsection
Administrative Simplification Subsection
Eight HIPAA Transactions
Eight HIPAA Transactions
Standard Code Sets
Standard Code Sets
Standard Code Sets
Privacy Policy
Consent
Consent
Consent
Consent
Modifying HIPAA Consent
Modifying HIPAA Consent
Authorization
Authorization
Authorization
Government Agencies
Minimum Necessary
Minimum Necessary
Minimum Necessary
Incidental Disclosures
Critical Thinking Exercise 60: �What Is Required?
Critical Thinking Exercise 60: �What Is Required?
A Patient's Right to Know about Disclosures
Patient Access to Medical Records
Personal Representatives
Personal Representatives
Personal Representatives
Minor Children
Minor Children
Minor Children
Critical Thinking 61: �Comparison of Privacy Policy
Critical Thinking 61: �Comparison of Privacy Policy
Business Associates
Civil and Criminal Penalties
Civil and Criminal Penalties