Protecting Patient Information in Today's World

HIPAA and Spiritual Care Partners Karen Green HIPAA Privacy Analyst, BSR 1 1

YOUR ROLE IS CRITICAL TO THE SUCCESS OF THIS ORGANIZATION! 2 2

CODE OF CONDUCT The Bon Secours Code of Conduct applies to All employees Volunteers Medical Staff members Officers and Directors of Bon Secours 3 3

Maintaining Confidentiality Do not review or use patient s personal health information unless necessary as part of your job Do not discuss patient information in public areas e.g. cafeterias, elevators restrooms, including electronic forums that are open to the public 4 4

HIPAA Health Insurance Portability and Accountability Act of 1996 = HIPAA Not HIPPA US law designed to provide privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care 5 5

Protected Health Information This is applicable to all PHI: electronic, paper, or any other form. Data are "individually identifiable" if they include any of the 18 types of identifiers listed on the next page 6 6

Individual Identifiers Name Street Address, City, State Fax Number Date of Discharge Date of Death Email Address Social Security Number Account Number Photo Images Medical Record Number Health Plan Beneficiary Number Device ID or Serial Number Phone Number Certificate / License Number Web Address ("uniform resource locator" or URL) Date of Admission License Plate Number Internet Protocol (IP) Address Date of Birth Vehicle ID Number and any other unique identifiers that could be used by themselves or together with other information to identify a patient. 7 7

Our World Today Presents many challenges when protecting patient information One of the most challenging is our use of Social Media 8 8

Social Media When it comes to Social Media my best recommendation is don t . Posting information about patients, even with the best of intentions and taking what seems like reasonable precautions frequently ends poorly. 9 9

Example of Social Media Breaches A physician at Westerly Hospital in Rhode Island recounted her emergency room experiences on Facebook in April 2011. Although the doctor didn't include the patient's name, she included enough detail about the patient's injuries that a third party was able to identify the patient. The incident led to a guilty charge of unprofessional conduct and $500 fine by the state medical board. 10 10

Patient Information The patient information you are entrusted with in your position as a Spiritual Care Partner is for the purpose of carrying out your job duties only. The Bon Secours HIPAA Sanctions policy includes Volunteers in the definition of Workforce Members 11 11

Sanctions Negligent Error based Three step process Written Warning Final Written Warning Termination 12 12

Sanctions Intentional Accessing, Using or Disclosing patient information without a professional need. Intent is not a mitigating factor Immediate Termination 13 13

Conclusion YOUR ROLE IS CRITICAL TO THE SUCCESS OF OUR ORGANIZATION! THANK YOU FOR ALL YOU DO! 14 14