Integrity Standards Health Insurance Portability and Accountability Act (HIPAA)

August 2007

St. Claire Regional Medical Center

Integrity Standards

Health Insurance Portability and

Accountability Act (HIPAA)

August 2007

Dear St. Claire Regional Employee, Physician, and Volunteer, St. Claire Regional Medical Center has been part of the fabric of our community since 1963. We have lived our mission of proclaiming God’s goodness through a healing ministry to the people of Eastern Kentucky. We commit ourselves to continue to keep patients at the center of all we do, to provide quality care, and to operate according to high moral, ethical, and legal standards. Our Organizational Integrity Plan and our commitment to privacy will assist us to continue in this tradition and communicate it to patients, their families, the communities we serve, to our Board members, employees, physicians, volunteers, and to the vendors and contractors with whom we conduct business. The Plan is to ensure that St. Claire Regional Medical Center is in compliance with all of its policies and procedures and all applicable federal and state laws and regulations. The standards are designed:

1. to communicate St. Claire Regional’s continued commitment to a healing ministry to the people of the area; to compliance with laws, regulations, standards of care, and ethical business practices.

2. to give each employee a clear understanding of responsibilities under our Organizational Integrity Plan and the HIPAA regulations.

It is the responsibility of every St. Claire Regional employee and all with whom St. Claire Regional conducts business to act in a manner consistent with these Standards, the principles they express, and their supporting policies.

Our Organizational Integrity Plan and the HIPAA regulations apply to all employees and all who serve at St. Claire Regional, each of whom has a right and a duty to report a problem and to do so without the threat of retaliation. If you observe a violation of these

Standards, you have an obligation to report it. The methods for reporting violations are described on the last page of this document.

As a healthcare provider, St. Claire Regional is committed to ensuring that personal medical information is protected. All are expected to become familiar with the privacy and security policies and procedures for safeguarding protected health information (PHI) and the HIPAA regulations applicable to their area of service.

The continuation of our healing ministry is dependent upon our commitment to and living of our mission, our delivery of high quality healthcare services, and our compliance with all applicable rules, regulations, and standards. I wholeheartedly support our Organizational Integrity Plan and the policies and procedures that support the HIPAA regulations and ask for your support and cooperation.

__________________ Mark J. Neff President/CEO

1

BELIEFS AND BASIC COMMITMENTS FOR ST. CLAIRE REGIONAL MEDICAL CENTER

MISSION The mission of St. Claire Regional Medical Center is to proclaim God’s goodness through a healing ministry to the people of Eastern Kentucky. PHILOSOPHY The philosophy of St. Claire Regional Medical Center, which flows from the conviction that God is the giver of life, is expressed through the hearts and hands of those who minister at St. Claire Regional Medical Center. We believe that life is a sacred gift from God.

Every facet of human life—from conception to death—is to be valued. Quality service and loving care are provided in support of life and death.

We believe that the needs of the whole person, physical, spiritual and psychosocial, are to be responded to according to professional standards and justice.

Quality services are rendered in a professional, compassionate manner with respect for the dignity of all. Sensitivity and support for the total needs of the person are integral parts of the system of care. Support for the poor and disadvantaged is pursued in all aspects of the operation of the Medical Center.

We believe that the task entrusted to us brings responsibilities to share and develop.

Technological resources and knowledge are applied and shared to promote health. Opportunities for growth through education and research are promoted. Personal and technological resources are used in an efficient manner for the benefit of all.

2

VISION Dedicated to a Christian healing ministry, St. Claire Regional Medical Center, in partnership with our physicians, will be distinguished as a trusted healthcare organization and employer. We will be recognized for:

• Providing clinical and service excellence in a personalized manner;

• Building a leading integrated medical community that provides a seamless system of care and education; and

• Enhancing the quality of life of the individuals and communities we serve by promoting physical, spiritual, social, and emotional well-being.

CORE VALUES Dignity Because life is a sacred gift from God, we treat each person with courtesy and respect. Christian values influence our decisions and characterize our relationships. Compassion Our ministry touches the core of life; therefore, we provide service with heartfelt care and concern for patients and for one another. Excellence Because every facet of human life is valued, we provide quality service in a professional and sensitive manner with concern for the whole person. We take pride in our work as we use our talents and skills to improve our ministry. Commitment Because of our deep spiritual heritage, we are dedicated to improving the quality of health of communities, especially the poor and underserved. We use our resources responsibly and with integrity. Collaboration We provide services, address problems, and develop programs with a spirit of cooperation and teamwork with each other, our physicians, the community, and others involved in healthcare.

3

QUALITY OF CARE

At St. Claire Regional Medical Center, our creed is "Patients Are The Center Of Everything We Do.” We recognize and respect the social, emotional, and spiritual needs of our patients while providing quality healthcare. Initiatives to improve quality of care, patient safety, and enhance the scope of service are continuous, cost effective, innovative, and collaborative. Our commitment is to improve the health status of the communities we serve.

PATIENT ENVIRONMENT We provide quality services in a professional, compassionate manner with respect for the dignity of all in support of human life from conception to death. We respond to and respect the physical, spiritual, and psychosocial needs of the whole person. We do not discriminate based on a patient's race, age, religion, ability to pay, gender, disability, or any other legal standard. We inform patients of their rights and maintain a healthcare environment that respects their rights. We involve patients and their families in treatment decisions and inform them about their condition, treatment plan, treatment alternatives, and risk factors. We protect patients’ health, safety, security, well-being, comfort, confidentiality, and privacy. We protect patients’ right to privacy regarding their person, their medical condition, records, and protected health information (PHI).

4

CUSTOMER SERVICE We strive to meet and exceed the expectations of patients, families, and all customers. We provide quality care and service in a caring, responsive, and responsible manner. We systematically review processes and systems to simplify access to care and to provide patient-focused care and service. We measure clinical outcomes and patient satisfaction to continually improve quality, safety, and the continuum of care. We evaluate variance from standard practice. Any identified deficiency or variance is reported through the appropriate channels. STAFF COMPETENCY We employ appropriately trained and qualified staff for the position they hold. Staff members provide care only within the scope of their qualifications and licensure. MEDICAL NECESSITY We provide only those services that are medically necessary and/or appropriate. We ensure that all patients are evaluated by a qualified healthcare practitioner before a treatment plan is initiated. We provide emergency medical treatment to all patients regardless of ability to pay.

5

HUMAN RESOURCES

In carrying out its mission, St. Claire Regional Medical Center creates and provides a positive, supportive work environment for our employees, physicians, and volunteers. We recognize each employee as an individual deserving of respect, dignity, and fair treatment.

ENVIRONMENT We value our staff and we are committed to treat them with fairness, dignity, and respect. We maintain an environment in which employees are free to offer ideas and suggestions and report problems without fear of retaliation. We carry out our mission of caring and quality care in accord with legal and professional standards. We promote and take means to safeguard the health and safety of our employees. We seek to resolve problems and conflicts through collaborative problem-solving. Our managers provide appropriate support, coaching, and counseling. We tolerate no form of harassment. We maintain a workplace free of substance abuse. We expect candor and honesty from persons associated with the Medical Center.

6

CONFIDENTIALITY We secure and maintain the confidentiality of employee personnel records. EDUCATION We share our philosophy and vision by providing a general orientation and departmental orientation for every employee. We provide opportunities to all employees to enhance and maintain skills and knowledge appropriate for the position they hold. EMPLOYMENT Employment, advancement, and compensation are based on qualifications and performance without regard for race, age, religion, disability, or any other legal standard. We evaluate employees’ performance based upon the behavioral and technical competencies outlined in job descriptions as well as adherence to our various policies and procedures. We employ only those who are not currently under sanction or exclusion by any duly authorized enforcement agency or licensing agency and disciplining authority.

7

HEALTHY ENVIRONMENT

St. Claire Regional Medical Center is committed to providing an environment that is safe and healthy for all whom we serve including patients, employees, physicians, volunteers, visitors, and vendors.

SAFE AND HEALTHY ENVIRONMENT We maintain facilities that are functionally safe and sanitary for employees, patients, visitors, volunteers, and physicians. We are familiar with safety procedures and health policies and attend mandated safety in-service programs. We utilize personal safety equipment as outlined in policies and procedures. We comply with applicable laws and regulations regarding the prevention, surveillance, and reporting of infectious disease. We manage and operate in a manner which respects our environment and conserves natural resources. We maintain an environment that is free of substance abuse. We maintain an environment that is smoke-free except in designated areas. We follow applicable laws, regulations, and recommendations and collaborate with the community to address Emergency Preparedness. HEALTH PROMOTION We provide information to promote health among employees, patients, volunteers, physicians, and the community.

8

We provide infectious disease education to patients, their families, employees, visitors, and the community in order to prevent disease transmission and promote healthy living. HAZARDOUS MATERIALS We adhere to work practices that protect employees, patients, and the environment from exposure to infectious and hazardous waste. We comply with applicable laws and regulations in the generation, storage, transport, and disposal of hazardous and infectious waste. Any improper release of potentially toxic or hazardous material, unsafe storage, unsafe transportation, or disposal of such material is reported to the St. Claire Regional Safety Officer. REPORTING UNSAFE PRACTICES OR CONDITIONS We report to management or the Safety Officer any observed practice(s) or condition(s) that may violate safety practices, laws, rules, or regulations.

9

BILLING AND CODING

St. Claire Regional Medical Center is committed in its efforts to ensure that all coding and billing transactions and activities are performed according to national uniform coding rules, billing standards, and all applicable state and federal regulations. We are committed to efforts to ensure that these transactions are accurate and supported by appropriate documentation in medical and financial records.

BILLING We follow billing procedures which are in compliance with all applicable federal and state laws, as well as other regulations and guidelines. We maintain accurate and complete documentation and records of all billing. We bill only for documented services provided to patients. We bill only for services appropriately ordered and which are medically necessary. We submit billing claims which are true, nonfraudulent, accurate, and complete. We correct billing errors, giving notice and making refunds as appropriate. We do not waive co-insurance or deductible amounts for patients except in accordance with laws, regulations, and policies.

10

CODING We properly assign diagnoses and procedure codes which are supported by appropriate documentation in the medical record. We use only accurate billing codes which describe the services provided. SKILL AND KNOWLEDGE We provide ongoing education so our staff has the knowledge and skills needed for correct billing and coding. ACCOUNTABILITY We submit accurate and complete cost reports that document the costs incurred for healthcare services provided. We identify and provide consultation to patients who qualify for financial assistance or who can benefit from other financial or social resources.

11

LAWS AND REGULATIONS

St. Claire Regional Medical Center strives to operate with high moral, ethical, and legal standards in carrying out our stated mission.

COMPLIANCE We conform to all known applicable laws, regulations, and standards. We comply with the “Ethical and Religious Directives for Catholic Healthcare Services” and the Directives of the Sisters of Notre Dame. We maintain all business data, records, and reports completely, accurately, and truthfully. We deal with all accrediting bodies in a direct, open, and honest manner. We engage in business only with those organizations that are not currently under sanction or exclusion by any duly authorized enforcement agency or licensing agency and disciplining authority. All accounting books and records shall be maintained according to generally accepted accounting principles, established accounting policies, and internal control procedures. We do not pursue any business opportunity that requires engagement in unethical or illegal activity. We do not knowingly take any action that is in violation of any statute, rule, or regulation. We comply with the law and cooperate with any reasonable demand made in a government audit or investigation. We present truthful and accurate information in our advertising and marketing.

12

COPYRIGHT We comply with all copyright regulations regarding print, computer programs, and information. CONFIDENTIALITY We comply with the HIPAA regulations for privacy and security. We maintain as confidential all minutes, correspondence, and records of committees related to patient care. We maintain records and reports in accordance with policy. DEFICIT REDUCTION ACT/FALSE CLAIMS ACT SCR takes appropriate steps to comply with the requirements and provisions of the Deficit Reduction Act (“DRA”) by informing its employees, contractors and agents about certain Federal and State laws related to preventing and detecting fraud, waste and abuse in Federal and State health care programs. The False Claims Act (“FCA”) is a Federal statute that covers fraud involving any federally funded contract or program, including the Medicare and Medicaid programs. The FCA makes it a crime for any person or organization to knowingly make a false record or file a false claim with the government for payment. Examples of FCA violations include: • billing for services not rendered; • filing false cost reports or failing to provide correct data on cost

reports; • double billing; • billing for unnecessary (“too much”) care such as certifying

unneeded services as medically necessary or otherwise misrepresenting the nature of a resident’s illness; or

• billing for substandard care.

13

FCA Whistleblower Protections The FCA includes a “qui tam” or whistle blower provision that allows any person with actual knowledge of allegedly false claims to the government to file a lawsuit on behalf of the U.S. government. Staff who engage in lawful acts in furtherance of a false claims action, such as the investigation for, initiation of, testimony for, or assistance in an action filed or to be filed, are protected from being discharged, demoted, suspended, threatened, harassed, or in any other manner discriminated against in the terms of their employment.

14

CONFLICTS OF INTEREST

We shall refrain from and avoid conflicts of interest or the appearance of conflicts between personal interests and one’s official responsibilities and performance of duties on behalf of St. Claire Regional Medical Center.

CONFLICT OF INTEREST We avoid engaging in any activity, practice, or act which conflicts with the interests of the Medical Center. We refrain from actual conflict of interest or the appearance of conflicts between personal interests and interests of the Medical Center. We avoid any outside employment with a consulting or other business firm that is a competitor, customer, or supplier of the Medical Center without advance written permission from the Integrity Officer. We avoid placement of family members into positions that would indicate a potential for or actual conflict of interest unless deemed to be in the best interest of St. Claire Regional. Members of the Medical Center’s Board of Directors, Board Committees, and Leadership annually complete a Conflict of Interest Statement. DISCLOSURE We disclose to the Integrity Officer possible conflicts of interests involving ourselves or our immediate family. We disclose involvement, directly or indirectly, in outside commercial interests doing business with the Medical Center if we have any influence over the Medical Center’s decisions involving the outside interest.

15

GIFTS AND CONTRIBUTIONS We make no direct or indirect corporate contribution, gift, or donation to any political party or candidate for office. We make no cash or significant non-cash gifts to clinicians or referral sources. Medical Center staff shall not seek to gain improper advantage by offering business courtesies to customers, referral sources, or purchasers of care. We discourage personal gifts or gratuities from patients, visitors, or vendors. However, staff may accept gifts of less than $50.00. To accept a gift of over $50.00, prior approval should be obtained from the Integrity Officer. Cash or gift certificates in any amount may not be accepted. We ensure that charitable contributions from vendors or others directly benefit St. Claire Regional’s Mission.

16

PROTECTING ASSETS

St. Claire Regional Medical Center is committed to the protection of its assets as well as those of others entrusted to St. Claire Regional. This commitment includes, without limitations, the protection of physical property and proprietary information against loss, destruction, theft, breach of confidentiality, misappropriation, and misuse.

PRESERVATION OF ASSETS We act with responsibility and accountability for the proper expenditure of St. Claire Regional funds. We exercise responsibility for preserving assets, property, facilities, equipment, and supplies. We appropriately utilize the time that is paid for by St. Claire Regional. We follow procedures for the proper disposal of surplus or obsolete materials. We follow regulations and established procedures for the safe storage, security, disposal, and proper inventories of pharmaceuticals. We observe the procedures for the authorized use of Medical Center materials, e.g., computer systems, networks, software, and information. CONFIDENTIALITY Contractual terms and the nature of business transactions are kept confidential.

17

We follow established procedures to safeguard access to and the confidentiality of personnel records, as well as all patient information, business records, and other information collected, transmitted, and compiled by St. Claire Regional. We follow established procedures in the use and disclosure of patient information as required by HIPAA and other state, federal, and regulatory guidelines. OTHER PROPERTY We do not tolerate theft or other misconduct involving St. Claire Regional’s property or the property of patients, employees, or visitors.

18

Health Insurance Portability and Accountability Act (HIPAA): Privacy /Security

The HIPAA Privacy and Security Rules ensure that personal medical information that is shared with physicians, hospitals, and others who provide and pay for healthcare is protected. THE PRIVACY AND SECURITY RULES:

• Impose restrictions on the use and disclosure of protected health information

• Give patients greater access to their medical records • Give patients greater protection of their medical records

PROTECTED HEALTH INFORMATION (PHI) includes:

• Personal health information • Individual’s name or address • Social security number or other identification number • Physician’s personal notes • Billing information

PHI IS USED (within the organization) when it is:

• Shared • Examined • Applied • Analyzed

PHI IS DISCLOSED (outside the organization) when it is:

• Released or transferred • Accessed by anyone outside

CAN USE OR DISCLOSE PHI:

• For treatment • For payment • For healthcare operations • When authorized by the patient • When authorized by law

19

THE AUTHORIZATION FORM: • Only covers the use/disclosure outlined in that form • Patient has the right to revoke the authorization • Requires the signature of the patient and the date • Contains an expiration date

THE MINIMUM NECESSARY: In general, the use/disclosure of PHI is limited to the minimum amount of health information necessary to get the job done. It does not apply to the use/disclosure of medical records for treatment. PRIVACY NOTICE is:

• Made available in print to patients • Written acknowledgement of receipt of Notice • Displayed at the site of service

THE PRIVACY RULE GRANTS PATIENTS NEW RIGHTS OVER THEIR PHI to:

• Receive privacy notice • Restrict use and disclosure • Inspect and amend PHI • Obtain copies, with some exceptions • Contact Privacy Officer about concerns of breach of privacy

THE SECURITY RULE REQUIRES THAT ST. CLAIRE SECURE ELECTRONIC PROTECTED HEALTH INFORMATION (EPHI) by:

• Implementing rules on who can access data • Installing systems to detect, correct, and prevent security

breaches • Implementing policies to handle security violations • Limiting access to ePHI • Authenticating users and enforcing individualized logins and

passwords • Restricting access to areas and computers with ePHI • Implementing controls over electronic media containing ePHI • Implementing controls, such as virus protection, to protect

equipment from malicious software • Monitoring successful and unsuccessful login attempts

20

COMMUNICATION St. Claire Regional Medical Center is dedicated to protecting our patients’ privacy and confidentiality. To do this, we follow the American Hospital Association’s guidelines and the Federal HIPAA mandates for the release of patient information. Therefore, our staff is permitted to release a one-word condition report when asked about a patient. These conditions are: undetermined, good, fair, serious, or critical.

21

REPORTING CONCERNS

St. Claire Regional Medical Center’s Organizational Integrity Plan and commitment to privacy and security continues the tradition of providing quality healthcare in a caring environment. The Plan reflects our commitment to high moral, ethical, and legal standards and is based on our Christian tradition and our philosophy and mission statement. An important factor in the living of our commitment to integrity is maintaining open channels of communication. Every manager has the responsibility that the employees they supervise are made aware of the St. Claire Regional Organizational Integrity Plan and the HIPAA regulations and are given the necessary training. Employees must be willing to report instances of alleged unethical or illegal conduct or violations of privacy and security, or concerns about safety or quality of care. Managers are expected to maintain an open door policy and be receptive to all concerns brought by any employee. Any employee reporting problems will not be retaliated against by any St. Claire Regional manager or employee. If an employee is not satisfied with the response or has additional concerns, the employee should continue to raise the issue through the chain of command. Other resources such as Human Resources, the Integrity Officer, the Privacy Officer, and the Security Officer may be contacted. The process for reporting instances of alleged unethical or illegal conduct or violation of privacy is:

1. Follow the applicable policies or procedures that exist within St. Claire Regional Medical Center or the specific department, including contacting the immediate supervisor.

2. If an employee is not comfortable asking the supervisor or is not satisfied with the advice received, he or she should contact the next higher-level manager.

3. Other possible sources of assistance are Human Resources, the Integrity Officer (Linda Fultz, 6596),

22

the Privacy Officer (6572), the Security Officer (6560), the Director of Mission Integration (6516).

4. The Integrity Hot Line is available at National

Hotline Services, Inc. in Alexandria, Virginia at 1-877-780-9373 (toll-free).

The Integrity Hot Line should be used to report serious concerns about suspected or known instances of fraud or violations of any laws, regulations, the Integrity Standards, or HIPAA Privacy/Security Rules. It should be used after an employee has considered or tried the other reporting processes available. The Hot Line is not a substitute for St. Claire Regional’s established grievance or dispute-resolution policies and procedures. Employees need not identify themselves when calling. Within legal and practicable limits, all who call the Hot Line will be assured anonymity or confidentiality within the limits of the law. The Integrity Officer or a designee will investigate all allegations and concerns raised through the Hot Line. Integrity Hot Line calls will be acted upon in a timely fashion. Staff is encouraged to report safety or quality of care concerns to their supervisor, manager, Risk Manager, VP Quality Resource Management, VP Inpatient Services, VP Medical Affairs, or CEO/Administrator on-call. Staff may report safety or quality of care concerns to the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) at 1-630-792-5000. The Integrity Officer for St. Claire Regional Medical Center is Linda Fultz. Linda’s office is located in Room 224; telephone number is 6596. The Security Officer for St. Claire is Randy McCleese. Randy’s office is located on the seventh floor; telephone number is 6560 The Privacy Officer for St. Claire Regional is Theresa Garvin. Theresa’s office is located in the Health Information Department on the second floor; telephone number is 6572. February 1999 February 2002 June 2006 September 1999 May 2003 August 2000 June 2005 May 2001 February 2006

23