HIPAA & Confidentiality

Back to Course Catalog
Course Objectives
  1.  Explain the purpose of HIPAA, identify covered entities and business associates, and recognize protected health information in healthcare settings.
  2. Apply privacy and security practices when accessing, discussing, sharing, storing, and disposing of patient information.
  3. Recognize potential privacy or security incidents and follow the appropriate reporting and response process within their professional role.
Course Content
Course Creator: Nichelle Volker, RMA
Total CE Hours: 1 Credit Hour
Pace Course #: 586-2801-24
 
Key Terms: 
  • Covered Entity
  • Protected Health Information (PHI)
  • Patient Identifiers

Outline:
HIPAA foundations
  • Purpose and history of HIPAA
  • Meaning of HIPAA and protected health information
  • Covered entities and business associates
  • Responsibilities of healthcare personnel
The Privacy Rule
  • Protection of oral, paper, and electronic PHI
  • Identifying information and de-identification
  • Patient privacy rights
  • Permitted uses and disclosures
  • Authorization requirements
  • Minimum necessary practices and their exceptions
The Security Rule
  • Protection of electronic PHI
  • Administrative safeguards
  • Physical safeguards
  • Technical safeguards
  • Secure workstation and mobile device practices
HIPAA updates and enforcement
  • Enforcement Rule and the role of OCR
  • HITECH Act and breach notification
  • Final Omnibus Rule of 2013
  • Business associate responsibilities
Maintaining compliance
  • Privacy and security responsibilities
  • Policies and procedures
  • Workforce training
  • Risk analysis, evaluation, and corrective action
  • Business associate agreements
  • Retention of required HIPAA documentation
Permitted disclosures and confidentiality decisions
  • Treatment, payment, and healthcare operations
  • Public health activities
  • Disclosures required by law
  • Requests involving law enforcement or legal proceedings
  • Requests from family members
  • Verification and escalation before disclosure
Incidents and consequences
  • Recognizing suspected inappropriate access or disclosure
  • Reporting lost devices, misdirected information, and other incidents
  • Organizational investigation and breach assessment
  • Civil enforcement and potential criminal consequences
  • Lessons from enforcement cases
Knowledge applications
  • Improper disposal of patient information
  • Unauthorized access or discussion
  • Family member requesting patient information
  • Lost or stolen device containing patient information
Conclusion
  • Confidentiality during everyday patient care
  • Appropriate access and secure communication
  • Prompt incident reporting
  • Key takeaways and references
 
References:
 
  1. U.S. Department of Health and Human Services (HHS). Covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
  2. HHS. Summary of the HIPAA Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
  3. HIPAA Journal. HIPAA history. https://www.hipaajournal.com/hipaa-history/
  4. U.S. Congress. (1996). Health Insurance Portability and Accountability Act of 1996, Public Law 104–191. https://www.govinfo.gov/content/pkg/PLAW-104publ191/html/PLAW-104publ191.htm
  5. U.S. Congress. (1995). Health Insurance Reform Act of 1995, S. 1028. https://www.govinfo.gov/app/details/BILLS-104s1028is
  6. Fitzgerald, A. (2023, March 21). History of HIPAA: How the standard has evolved since 1996. Secureframe. https://secureframe.com/blog/history-of-hipaa
  7. HHS. Guidance regarding methods for de-identification of protected health information. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
  8. HHS. Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
  9. HHS. Enforcement process. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html
  10. HHS. Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
  11. HHS. HITECH Act Enforcement Interim Final Rule. https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html'HHS. Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
  12. HHS. Minimum necessary requirement. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html
  13. HHS. OCR’s HIPAA Audit Program. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html
  14. UConn Health. (2020, February 6). Elements of an effective compliance program. https://health.uconn.edu/healthcare-compliance-privacy/2020/02/06/elements-of-an-effective-compliance-program/
  15. HHS. (2013). Business associate contracts: Sample business associate agreement provisions. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
  16. HHS. (2013, January 25). Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act and GINA, and other modifications. Federal Register, 78, 5566–5702. https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the
  17. Arvisais-Anhalt, S., Lau, M., Lehmann, C. U., Holmgren, A. J., Medford, R. J., Ramirez, C. M., & Chen, C. N. (2022). The 21st Century Cures Act and multiuser electronic health record access: Potential pitfalls of information release. Journal of Medical Internet Research, 24(2), e34085. https://doi.org/10.2196/34085
  18. HHS. (2016). Business associate’s failure to safeguard nursing home residents’ PHI leads to $650,000 HIPAA settlement. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/catholic-health-care-services/index.html
  19. U.S. Department of Justice, Office of Legal Counsel. (2005). Scope of criminal enforcement under 42 U.S.C. § 1320d-6. https://www.justice.gov/sites/default/files/olc/opinions/attachments/2014/11/17/hipaa_final.htm
  20. 45 C.F.R. § 102.3: Penalty adjustment and table. Electronic Code of Federal Regulations. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3
  21. HHS. HIPAA enforcement highlights—October 2024. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html
  22. Intraprise Health. 5 most common HIPAA privacy violations. https://intraprisehealth.com/5-most-common-hipaa-privacy-violations/
  23. HHS. (2017). Overlooking risks leads to breach, $400,000 settlement. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/mcpn.html
  24. HHS. (2017, April 24). $2.5 million settlement shows that not understanding HIPAA requirements creates risk. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/cardionet/index.html
  25. HHS. (2018, October 15). Anthem pays OCR $16 million in record HIPAA settlement. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/anthem/index.html
  26. HHS. What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of protected health information? https://www.hhs.gov/hipaa/for-professionals/faq/what-does-hipaa-require-of-covered-entities-when-they-dispose-information/index.html
  27. HIPAA Journal. (2017, October 19). Termination for nurse HIPAA violation upheld by court. https://www.hipaajournal.com/nurse-hipaa-violation/
  28. P1: Patel, R. (2023, June 27). Everything you need to know about HIPAA-compliant language services. Translate By Humans. https://translatebyhumans.com/blog/hipaa-compliant-language-services/
  29. P2: MSPG Technology. (n.d.). Privacy and security of electronic health information. https://mspgtech.com/mspgtech-privacy-and-security-of-electronic-health-information/ 
  30. P3: U.S. Department of Health and Human Services, Office for Civil Rights. (2021, September 17). Enforcement process. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html 
  31. P4: Path Outline. (n.d.). The Health Information Technology for Economic and Clinical Health Act (HITECH). https://www.pathoutline.com/the-health-information-technology-for-economic-and-clinical-health-act/ 
  32. P5: Rosen, S. (2020, February 6). Elements of an effective compliance program. UConn Health, Office of Healthcare Compliance & Privacy. https://health.uconn.edu/healthcare-compliance-privacy/2020/02/06/elements-of-an-effective-compliance-program/
  33. P6: Shindell, R. (2023, November 27). HIPAA violations and fines: Everything you need to know. Carosh Compliance Solutions. https://www.carosh.com/hipaa-violations-and-fines-everything-you-need-to-know/


© All Rights Reserved
PhlebCE.com 2024

Company
Learn More
Legal
Connect with us