HIPAA Annual Training 2018-2019

Why is training important?There are many reasons why training is important. Training Training enables Employees to develop the knowledge and skills set necessaryto perform the essential functions of their job in compliance with the law. Advantage Effective training affords Corizon Health a competitive advantage in thecorrectional healthcare market.25 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Why is training important? Career Training advances an Employee’s career and sense of feeling valued by CorizonHealth. OJT “On the job training” is an investment in Corizon Health’s future as Employeeswill share this knowledge with other Employees (current and new hires) inperforming the essential functions of their job.26 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Training ComplianceTo begin, you will need to complete this course by completing all of theTopics. After you review the 5 topics, you may take the quiz. We’veestimated your total time to complete this course, including the Quiz, isabout 70 minutes.Topic TitleTopic #Time to CompleteOverview115 MinutesPrivacy Rule215 MinutesSecurity Rule310 MinutesReporting and Enforcement410 MinutesScenarios510 MinutesReview QuizQuiz10 MinutesTotal Time to Complete: 70 Minutes27 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Training ComplianceAt the end of this training, you will need to take a shortquiz and answer all ten (10) questions correctly. In theevent you do not answer all ten (10) questions correctly,you are required to retake the quiz. The Super User ateach site shall ensure that each Employee takes theQuiz until he/she attains a score of 100%.28 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Hot Buttons for Corizon Health Disposal of PHI Sensitive information and PHI should NEVER be placed in the regular trash! Hard copy materials that contain PHI, like sick call request forms, must be properlyshredded at your site or placed in a locked shred container for shredding later. DO NOT use an open box under your desk as your shred storage for PHI If you are using an unsecured container to hold PHI for destruction, there is a greaterlikelihood in inappropriate access or that it will accidentally be comingled with regulartrash. Keep in mind that the destruction of actual medical records is client dependent, soplease work with your site management before destroying any medical records.

Hot Buttons for Corizon Verification of Identity Before you provide records to an inmate or any other third party, you MUST verifythat the name of the person in the medical record matches the name beingrequested. Does the information within the medical record all belong to that inmate?If two different inmates with the same last name of Smith request their records, check,check again and check a third time to ensure that you are providing the correct recordto the correct inmate "Smith".

Hot Buttons for Corizon Health Unsecured PHIEVERY SINGLE TIME you send an email outside the Corizonhealthdomain that contains any PHI the email MUST BE ENCRYPTED, e.g., yousend medical record to attorney who does not have acorizonhealth.com email address.As a Corizon employee, you must use your Corizonhealth email.DO NOT send emails from your personal email accounts like Gmail orHotmail or your County or state email address that contain any PHI.Corizon, as the covered entity, is responsible for the security of the PHIand we cannot control the security of a third party email system.

What is HIPAA? The Health Insurance Portability and Accountability Act of1996, commonly referred to as “HIPAA”, is a federal lawwhich created a national standard for the privacy andsecurity of Protected Health Information (“PHI”).In learning about HIPAA, it is important to recognize thatthis legislation was enacted with two broad interests inmind: 32PrivacySecurity Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.Congress became concerned abouthow to protect the confidentiality ofhealth care data that was beingelectronically transmitted. Therefore,the purpose of HIPAA was to protectthe privacy and security of PHI.HIPAA legislation was passed in1996. However, it was not until 2003that the Privacy Rule was finallyenacted and later in 2005, the SecurityRule was enacted.

What is HIPAA?In this course, we will first learn about the privacycomponent of HIPAA more precisely referred to as the HIPAAPrivacy Rule.Generally speaking, the HIPAA Privacy Rule was enacted toencompass the following items: Individual rights; Instructions on how to exercise those individual rights;and Uses and/or disclosures of PHI which must beauthorized by the individual (patient) or are requiredby law.33 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

What is HIPAA?After we conclude our discussion of the Privacy Rule, we willredirect our attention to the Security Rule which mandatesthe administrative, physical, and technical safeguardsnecessary to protect the confidentiality, integrity, andavailability of electronic PHI (“ePHI”).The belief was that privacy is a "fundamental right" and that patients should have the abilityto control information pertaining to their care.Therefore, HIPAA gave patients a number of rights, including but not limited to access tomedical records, the right to amend records and the right to restrict certain uses anddisclosures of their PHI.34 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

What is Protected Health Information?HIPAA’s Privacy and Security Rules only apply to PHI, which iscommonly referred to as “PHI”. Therefore, in order forEmployees to understand the important aspects of HIPAA, itis critical to know what PHI is.PHI is defined as individually identified health informationthat is transmitted or maintained in electronic, written, oral,and/or any other recorded form or medium.The Department of Health and HumanServices generally considers any healthrelated information that identifies anindividual, or reasonably could be used toidentify an individual, which is created orreceived by a covered entity to be PHI.35 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

What is Protected Health Information? Individually identifiable health information is: Information that identifies an individual; Information created or received by Corizon Health; and Information that relates to the past, present or future physical or mental healthcondition of the individual. 36Remember: PHI does not just refer to medicalrecords, but any document or form thatcontains individually identifying informationabout the patient. Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

What is PHI?Some common examples of PHI include: Patient medical recordsPrescriptionsBilling informationPatient insurance formsPatient chartsPHI does NOT include: Employment records held by a Covered Entity in its role as an employer Educational recordsIt is important to remember that PHI includes less obvious items in comparison tothose common examples provided. If you are unsure as to whether or not aparticular item constitutes PHI, please consult the Privacy Officer for furtherclarification.37 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

How does HIPAA apply to Corizon?HIPAA only applies to “Covered Entities”, which include healthplans, health care clearinghouses and health care providers whouse PHI in connection with certain electronic transactions (such aspayments or claims attachments).38 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

How does HIPAA apply to Corizon?Under HIPAA, a health care provider is defined as an entity that furnishesmedical services.Because Corizon Health provides medical services to inmates of correctionalfacilities across the United States, Corizon Health is considered a health careprovider.As a health care provider, Corizon Health transmits electronic PHI for purposesof certain transactions which results in Corizon Health being classified as a“Covered Entity” for purposes of HIPAA.Corizon, as it currently functions, does not meet the definition of either ahealth care clearinghouse or a health plan.However, Corizon does engage in certain standard transactions, making us aCovered Entity subject to the rules and regulations of HIPAA.39 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Topic 1 – Overview – ConclusionGreat job, Topic 1 is complete.Topic TitleTopic #Time to CompleteOverview115 MinutesPrivacy Rule215 MinutesSecurity Rule310 MinutesReporting and Enforcement410 MinutesScenarios510 MinutesReview QuizQuiz10 MinutesTotal Time to Complete: 70 Minutes40 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Topic 2Time to complete Topic 2Privacy RuleApproximately 15 minutes

ObjectivesAt the end of this Topic, the learner will have a goodunderstanding of: The general rules for the use and disclosure of PHI; An individual’s right to access his or her own PHI; How to adequately protect an individual’s PHI from inappropriate use ordisclosure; Documenting “non-routine” disclosures of PHI; and The reporting of any improper uses or disclosures of PHI to the appropriatepersonnel so that any harmful effects can be mitigated.Note: Use means the PHI is being shared, applied, utilized, examined oranalyzed within Corizon and Disclosure means the releasing, transferring, orproviding access to the PHI outside of Corizon.42 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

General Rules for the Use and Disclosure of PHIThe HIPAA Privacy Rule generally requires Corizon Health to takereasonable steps to limit the use and disclosure of PHI to theminimum amount necessary to accomplish this purpose.43 The Employee shall make a reasonable effort to use and ordisclose only the amount of PHI which is required to performthe essential job functions. It is important to remember that the “Minimum NecessaryStandard” does not apply to all uses and disclosures of PHI. Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Exceptions to the “Minimum Necessary Standard”The Minimum Necessary Standard DOES NOT apply to thefollowing uses and disclosures of PHI:44 Uses and disclosures of PHI for treatment purposes(e.g. from one health care provider to another) Uses and disclosures of PHI to the individual who is thesubject of the PHI Uses and disclosures of PHI pursuant to a valid HIPAA compliantwritten authorization Uses and disclosures of PHI that are required by law Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

“Minimum Necessary Standard” – Example 1A patient at the Jail has requested that a copy of his entiremedical record be provided to his attorney. He has a presented asigned, validly executed authorization for release of his records.Does the “Minimum Necessary Standard” apply here?YESNOCorrect Answer: No, the patient has signed an Authorizationallowing his entire record to be sent to his Attorney.The Minimum Necessary Rule does not apply.The entire record must be provided to the patient’s attorney.45 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

“Minimum Necessary Standard” – Example 2Patient is being sent off-site to the hospital for a surgicalprocedure. The surgeon at the hospital calls to speak to thetreating physician at the correctional facility about the Patient’scare and upcoming procedure.Does the “Minimum Necessary Standard” apply here?YESNOCorrect Answer:No, the “Minimum Necessary Standard”does NOT apply to uses and disclosures ofPHI for the purpose of treatment.46 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

“Minimum Necessary Standard” – Example 3Nurse Nancy makes a serious documentation error in aPatient’s chart. Her supervisor works with the HR Department todetermine whether corrective action is warranted. The HR Departmentrequests a copy of the medical record as part of its investigation.Does the “Minimum Necessary Standard” apply here?YES 47NOCorrect Answer:Yes, the Supervisor should only provide the relevant pages of themedical record to the HR department with the patient’s nameredacted. The HR Department does not need to know the patient’sname or see the entire record in order to complete its investigation. Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

“Minimum Necessary Standard” – Example 4Several inmates at the correctional facility have been diagnosed withand are being treated for a communicable disease. The local healthdepartment is on-site at the correctional facility to investigate and helpmitigate a possible outbreak.Should the Medical Staff apply the “Minimum Necessary Standard”when speaking with the Health Department?YES 48NOCorrect Answer:No, this disclosure is required by law so the “Minimum NecessaryStandard” would NOT apply. The Health Department will need allinformation related to the patients with the communicable disease inorder to adequately and effectively treat and prevent the spread ofthe disease. Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

When is a Written Authorization Required?The HIPAA Privacy Rule requires Employees to obtain a HIPAAcompliant written patient authorization prior to using and/ordisclosing PHI for certain purposes.Some examples of uses and/or disclosures of PHI that require aHIPAA compliant patient authorization are: Disclosure of PHI to the patient’s family or friends in cases where the friend or familymember is NOT the patient’s personal representative Disclosure of PHI to the media Disclosure of PHI to the patient’s attorney.Employees can obtain Corizon’s standard HIPAA compliant patient authorization online athttp://hipaa.corizonhealth.com or from the Super User at your respective site.To be consistent and ensure that the Authorization is HIPAA compliant, it is best to always use theCorizon approved form. If a patient or third party presents an Authorization on a non-Corizonform, you may request that they complete a new authorization on the Corizon form.49

When a Written Authorization is NOT RequiredEmployees are NOT required to obtain a HIPAA compliant writtenauthorization prior to using and/or disclosing PHI in the followingcircumstances:50 Uses or disclosures of PHI for treatment purposes(providing healthcare services or items) Uses or disclosures of PHI for payment purposes(submitting and receiving claims, making and receivingpayment for services) Uses or disclosures of PHI for health care operational purposes(quality improvement activities, credentialing, utilizationreview, training programs, accreditation activities, insurancerating) Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

When a Written Authorization is NOT Required(Continued)51 Uses or disclosures of PHI to a correctional facility or officer toassist the facility in providing the patient with health care,protecting the health or safety of the patient or others, or forthe safety or security of the correctional facility Uses or disclosures of PHI to avert serious threat to health orsafety (threat to the patient, public, or other individuals) Uses or disclosures of PHI for law enforcement purposes(information related to the commission of a crime on thepremises or against health care personnel) Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

When a Written Authorization is NOT Required(Continued) Uses or disclosures of PHI to a Corizon Health BusinessAssociate that has signed a Business Associate Agreement Uses or disclosures of PHI for public health activities asrequired by law for the purpose of preventing or controllingdisease, injury or disability Uses or disclosures of PHI for judicial, legal, or administrativeproceedings (e.g. Court orders and subpoenas)KEY ELEMENT OF INSTRUCTION:It is important that Employees understand that Corizon Health is the custodian of thePHI in its possession and the Client is the owner. For this reason, Employees must notimpede the Client’s ability to access its own PHI so long as such use and disclosurecomplies with the correctional facilities/officer exception listed above.52 Corizon Health, Inc. All information and photos are confidential and proprietary. All rights reserved.

Custodial Exemption As previously mentioned, in the correctional environment,HIPAA gives broad authority to the providers to allow for therelease of information to a correctional facility or officer if thepurpose is to provide care to the patient or to protect thehealth and safety of the officers and/or the facility. However, be cautious with this authority. Any release ofinformation to an officer or a warden should be done so for thepurpose of protecting the institution, it's officers and the otherinmates. This does not give an officer the right to inspect apatient's records out of mere curiosity. You still have anobligation to protect the patient's privacy.

Safeguarding the Confidentiality of PHI YOU are responsible for securing PHI fro

Test Out Option for HIPAA Annual Training Corizon Health is offering a test out option on Annual HIPAA Training. Here is how it works: 1. You may take a 10 question pre-test regarding HIPAA. If you pass with a score of 100%, you may skip the full training course and receive a “ompleted” status for this annual requirement. 2.File Size: 2MB