Training on Training on confidentiality confidentiality

Audrey WalkerAudrey WalkerMHA 690MHA 690Instructor: ColeInstructor: ColeJuly 24, 2014July 24, 2014

HIPPA Privacy RuleHIPPA Privacy Rule

• The Hippa privacy rule provides protection of The Hippa privacy rule provides protection of personal health information held by covered personal health information held by covered entities and gives patients an array of rights entities and gives patients an array of rights with respect to that information (DHS, 2012)with respect to that information (DHS, 2012)

• Health information cannot be used or Health information cannot be used or disclosed without proper authorization by the disclosed without proper authorization by the patient or legal guardian for minorspatient or legal guardian for minors

• There is need to have the necessary training for There is need to have the necessary training for the issue to do with the confidentiality in the the issue to do with the confidentiality in the workplace. This training will help to avoid the workplace. This training will help to avoid the occurrence of unauthorized access to occurrence of unauthorized access to confidential information that relates to clients confidential information that relates to clients and other important data.and other important data.

• For these case where workers at Los Angeles For these case where workers at Los Angeles have reportedly been accessing celebrities have reportedly been accessing celebrities medical records without permission, the medical records without permission, the necessary training would be on health care necessary training would be on health care policy and laws that govern confidentialitypolicy and laws that govern confidentiality

Laws and policiesLaws and policies

• There are some state laws that bar the There are some state laws that bar the medical and health workers to access the medical and health workers to access the information about patient record unless information about patient record unless authorized. The ones authorized to manage authorized. The ones authorized to manage the records should have the knowledge on the records should have the knowledge on this laws since they need to live to the this laws since they need to live to the standard of ethics. standard of ethics.

• This will equip them with the ethical This will equip them with the ethical responsibility and knowledge to be able to responsibility and knowledge to be able to put up with the laws, which then will help put up with the laws, which then will help them to protect the usage as well as the them to protect the usage as well as the access of the information access of the information

Technology, Health ActTechnology, Health Act• Since the technology is so dynamic, it is also necessary to Since the technology is so dynamic, it is also necessary to

train the data handlers on how to put up with the challenges train the data handlers on how to put up with the challenges on the access of the data, control and authentication. on the access of the data, control and authentication.

• Thus, this training is simply the emphasis on the health Thus, this training is simply the emphasis on the health insurance portability and accountability Act that regulates insurance portability and accountability Act that regulates the access and sharing of the patientthe access and sharing of the patient’’s health records. With s health records. With the understanding on the Act, the health organizations will the understanding on the Act, the health organizations will equip the employees with the necessary knowledge on equip the employees with the necessary knowledge on privacy and confidentiality. privacy and confidentiality.

Training managers could put Training managers could put into place to avoid this into place to avoid this

situationsituation Educate healthcare personnel on Educate healthcare personnel on

confidentiality and data security requirements. confidentiality and data security requirements. Confirm that confidentiality and security Confirm that confidentiality and security policies and guidelines are coherent to HIPAA policies and guidelines are coherent to HIPAA laws and regulations. Implement periodic data laws and regulations. Implement periodic data security audits and risk assessmentssecurity audits and risk assessments

Review and modify privacy and security Review and modify privacy and security policies. Updating employee training programs policies. Updating employee training programs Establish breach notification protocols Assure Establish breach notification protocols Assure authorized access of patient information authorized access of patient information Monitor the access and disclosure of PHI Monitor the access and disclosure of PHI Develop an information protection strategy Develop an information protection strategy and framework and framework

Training managers could put Training managers could put into place to avoid this into place to avoid this

situation(cont)situation(cont)

These are steps every manager must take to These are steps every manager must take to ensure compliance and adherence to privacy, ensure compliance and adherence to privacy, security, and confidentiality protocol. security, and confidentiality protocol. Managers must also implement disciplinary Managers must also implement disciplinary measures for staff members who violate measures for staff members who violate these guidelines. The protection of patient these guidelines. The protection of patient information is a requirement in health care; information is a requirement in health care; ethically and legally ethically and legally

Reference Reference

Wu, S. S., & American Bar Association. Wu, S. S., & American Bar Association. (2007). (2007). Guide to HIPAA security and the lawGuide to HIPAA security and the law. . Chicago: ABA Section of Science & Chicago: ABA Section of Science & Technology Law. Technology Law.