Privacy Rule
What information should you gather before disclosing any Protected Health Information (PHI) on the phone?
Birthdate, address, or last 4 of social on the phone
When you walk away from your computer, you should do this to prevent others from seeing the screen.
Lock your computer/log out
What does HIPAA stand for?
Health Insurance Portability and Accountability Act
Employees with access to patient information may use or disclose it only on a “___ to ___” basis
Need to know
You accidentally send a patient's information to the wrong email address. What do you do?
Immediately report it to your HIPAA Security Officer
____ of Privacy Practices describes how the practice may use and disclose PHI, the individuals rights, and who to contact
Notice of Privacy Practices
Why should each employee use their own username and password?
So the practice can control and track who accesses information
Sam is an 18-year old patient and has been a patient since he was 5. The day after his appointment, his mother calls asking for details of his treatment. What do you do?
If you did not have Sam sign an authorization form, you cannot disclose information to the mother even IF she pays for his treatments and is on her insurance
A patient asks you to discuss their treatment in the waiting room. What should you be mindful of?
Protecting their privacy or protected health information for others in the waiting room
What is a breach in patient information?
The acquisition, access, use, or disclosure of PHI which may compromise their security
How long do you have to provide an individual with their records after they have requested them?
30 days
What does ePHI stand for?
Electronic Protected Health Information
If a patient is incapable to make health decisions themselves as an adult, what is required from their guardian to disclose treatment with them?
Legal guardianship document
Your cousin is a patient at your practice. You're curious about her treatment and want to look at her X-rays, is this ok and why?
No, you are not involved in her treatment
Give me an example of an unintentional use or view of protected health information
An assistant accidentally views a chart that isn’t theirs, a patient overhears treatment
What information should you gather before disclosing any Protected Health Information (PHI) in person?
Driver’s license, state ID, or military ID
How often are you and your office’s IT professional required to perform a written risk analysis?
Annually
How long do you have to keep training records?
5 years
You are leaving a voicemail for a patient to discuss treatment, what information should you disclose?
Patient’s name, who is calling, and a request to call back. NO specific information
If a breach involves more than ___ records, the media MUST be informed.
500
Where are the 3 places the Notice of Privacy Practices should be accessible to patients?
Posted for view in the office, offered to patient, and posted on website
What is a risk analysis?
Identify potential threats to PHI and implement safeguards to mitigate those risks
HIPAA investigations are usually triggered by ____ complaints.
Patient
Two employees are discussing a patient's treatment at the front desk in a voice loud enough for patients in the waiting room to hear. What’s the problem?
Other patients might hear PHI
Your IT professional calls you saying they need access to your computer password to fix a bug in your software. What do you do?
Confirm his contact with your HIPAA officer, doctor, etc before providing ANY confidential information