HIPAA Privacy Procedures Manual & E-Alerts Agenda

Agenda

Privacy Rules

• Legislative Background
• Privacy Concerns
• The HIPAA Privacy Rules
• Impact On State Law
• Compliance Dates
• Enforcement

Protected Health Information

• What Information Is Protected?
• Health Information (HI)
• Individually Identifiable Health Information (IIHI)
• Protected Health Information (PHI)
• Protected Health Information: Psychotherapy Notes
• HIPAA Portability Requirements
• Benefits Excepted From HIPAA Portability Requirements And HIPAA Privacy Rules
• Summary Of Excepted Benefits
• Exempted Health Information

Covered Entities

• Covered Entities
• Health Plan Defined
• Health Plans Specifically Identified By The Privacy Rules
• Exceptions To The Definition Of Health Plan
• Employers
• Impact On Employer/Plan Sponsors
• Health Care Clearinghouses
• Health Care Providers
• The Hybrid Entity
• Affiliated Covered Entities
• Multiple Covered Functions
• Organized Health Care Arrangements

Business Associates

• Business Associates
• Disclosure Of PHI To Business Associates
• Business Associate Agreement
• Sample Business Associate Agreement
• Business Associate Agreement: Additional Modifications
• Business Associate Agreement: Additional Contract Elements
• Business Associate Agreement: Other Arrangements
• Responsibilities Of The Covered Entity

Use And Disclosure Of PHI

• Disclosure Of PHI
• Required Disclosure
• Examples Of Potential Disclosure Of PHI
• Authorization
• Exceptions To The Authorization Requirements
• Minimum Necessary Standard
• Requesting PHI And The Minimum Necessary Standard
• Exceptions To The Minimum Necessary Standard
• Rights Of The Individual
• Restrictions On Individual Rights

Use And Disclosure For Treatment, Payment, And Health Care Operations (TPO)

• TPO
• Repeal Of The Consent Requirement
• Use And Disclosure Requiring No Authorization
• Disclosure Of PHI To Parents Of Minor Children
• Use And Disclosure For TPO: Psychotherapy Notes
• De-Identified Information
• Identifying Codes

Use And Disclosure For Other Activities

• Marketing
• Research
• Documentation Of Waiver Approval
• Fundraising
• Underwriting
• Law Enforcement

Privacy Notice Requirements

• Responsibilities
• Timing Of Issuance Of The Privacy Notice
• Electronic Notices
• Content Of Privacy Notice
• Organized Health Care Arrangements

Administrative Requirements

• Administrative Requirements: Covered Entities
• Privacy Official
• Designated Contact Person
• Refraining From Intimidating Or Retaliatory Acts
• Policies and Procedures
• Training
• Grievance Procedure
• Other Duties
• The Fully-Insured Group Health Plan

Privacy And The Plan Sponsor

• Plan Documents
• Restrictions
• Certification Of Compliance
• Summary Health Information
• The Employer/Plan Sponsor
• Americans With Disabilities Act (ADA)
• Family And Medical Leave Act (FMLA)
• State Privacy Rules
• The Fully-Insured, Employer-Sponsored, Group Health Plan
• Self-Insured, Employer-Sponsored, Group Health Plans

Security Standards

• Introduction
• Security Standards: Covered Entities
• Security Standards: Compliance Dates
• EPHI
• Excluded Transmissions
• Format Of The Standards
• Implementation Specifications
• General Rules
• Administrative Safeguards
• Security Official
• Information Access Management
• Security Incident Procedures
• Contingency Plan
• Evaluation
• Workforce Security Standards
• Termination Procedures
• Security Awareness And Training
• Physical Safeguards
• Physical Safeguards: Facility Access Controls
• Physical Safegaurds: Workstation Use
• Physical Safeguards: Workstation Security
• Physical Safeguards: Device And Media Controls
• Technical Safeguards
• Technical Safeguards: Access Control
• Technical Safeguards: Audit Controls
• Technical Safeguards: Integrity
• Technical Safeguards: Person or Entity Authentication
• Technical Safeguards: Transmission Security
• Organizational Requirements
• Organizational Requirements: Group Health Plans
• Policies And Procedures
• Administrative Checklist

Other HIPAA Administrative Simplification Standards

• Other Simplification Standards: Electronic Transactions
• Electronic Transactions: Requirements
• Electronic Transactions: Enforcement
• Other Standards: Unique Identifiers

Sample Notices

• Sample Business Associate Contract Provisions
• Sample Notice Of Privacy Practices
• Sample Authorization Form

HIPAA Privacy Rules Summary

• Action Items