WIXLIB

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOJane –HIPAA’s security standard mandates how healthinformation is protected. One way to think about thedifference between privacy and security is this – theprivacy standard allows a patient to control who hasaccess to his or her health information. The securitystandard makes sure that the information is keptsafe from unauthorized access, whether thatinformation is in paper or electronic form. Eachorganization or entity subject to HIPAA, like OMH, isrequired to translate HIPAA’s security standard intosecurity practices that their own organization andtheir own workforce will use to keep a patient’shealth information safe.Kevin –Like using locked cabinets, or offices.Jane –Right. HIPAA’s security standard establishesadministrative, physical and technical safeguards forpatient data and information.Kevin –I think I understand. What about EDI – that soundsvery technical.Jane –EDI really should not be a concern to most OMHemployees. At the facility level, the HIPAA EDIstandard doesn’t change the way patient data isentered into the OMH system. In fact, onlyemployees within the OMH Central Office will reallynotice anything different – on a regular basis, theywill roll-up patient and related payment dataprovided by OMH facilities and convert the data intothe format required by HIPAA. While it won’t affectthe work of most OMH employees, once eachorganization subject to HIPAA, like OMH, makes theEDI systems adjustments it needs to make, thisprocess is expected to save the healthcare system agreat deal of money.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 10 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOKevin –That’s reassuring.HIPAA sets National Standards for Privacy of confidential health information, or whatkind of information is protected. Security of health information, or how thatinformation is protected via physical security,technical security and administrative securitymeasures. Electronic exchange of health information.Jane –So, thus far:HIPAA is a federal law that sets national standards for theprivacy of health information or what kind of information isprotected, the security of health information, or how thatinformation is protected, and it sets national standards forthe electronic exchange of data.Kevin –Before we get into more specifics Jane, I’ve got one morequestion.Jane –Sure.HIPAA Violations Law provides for penalties ranging from 100 to 250,000 and up to 10 years in prison. Most severe penalties are for willful disclosure ofprivate health information. OMH actions to address violations of policies andprocedures related to HIPAA will be consistent withexisting practices and disciplinary processes.Kevin –If HIPAA is a law, then . . . there must be penalties for notfollowing it. Are OMH employees at risk for not followingHIPAA?Jane –Depending on the severity of the offense, penalties for notfollowing HIPAA regulations can be as much as 250,000and 10 years in prison.Kevin –Wow! This is serious!Jane –Protecting patient healthcare information is serious. Themost severe penalties are for those incidences when anindividual willfully discloses private health information.For example, if someone disclosed private healthinformation in return for payment or for commercialadvantage, he or she could face a 250,000 fine and tenyears in prison.Kevin –What if someone simply makes, you know, an “honestmistake?”OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 11 of 59

OMH HIPAA Training ProgramVIDEOvideo script with graphics - FinalAUDIOJane –That’s one of the main reasons we are here today, Kevin.Every OMH employee has a role in protecting patientprivacy. Protecting that privacy means that all staff need tofollow OMH policies and procedures. In the event anemployee does not follow procedure or policy, theresponse will be consistent with existing practices. Forexample, the response could include verbal or writtencounseling or disciplinary action, including penalties basedon the severity of the violation. And, penalties couldrange from reprimands, through fines or suspensionswithout pay, to termination of employment. Actions takenby OMH in any such cases will be consistent with existingpractice and disciplinary processes contained in applicablecollective bargaining agreements.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 12 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOKevin –Thanks, Jane – it’s good to know that. Now let meask about who and what organizations HIPAAapplies to. Does HIPAA apply to everybody? Imean, do these new privacy and securityregulations affect everyone?Jane –HIPAA policies and procedures affect virtuallyeveryone and every organization working inhealthcare. Certainly, some individuals andbusinesses will be affected more than others.Kevin –Like who?Jane –Generally, individuals or organizations involvedwith the provision and/or administration ofhealthcare must comply with HIPAA. You mayhave heard the term “Covered Entity.” CoveredEntity is the term used by HIPAA to define whomust comply with HIPAA requirements.Covered Entities must Comply with HIPAA andfall into Three Groups:Health plans - Insurance companies or similar agenciesthat pay for health care.Healthcare providers - Physicians, hospitals, or anyother provider who has direct or indirect patient contact.Healthcare clearinghouses - Companies that facilitatethe processing of health information for billing purposes.Kevin –I have heard that term. What is a “Covered Entity?”Jane –Simply put, Covered Entities are thoseorganizations that must comply with HIPAA. Theyfall into three groups:Covered Entities include health plans such asinsurance companies or similar agencies that payfor health care.Covered Entities include most healthcare providerslike hospitals, physicians or outpatient healthprograms who have direct or indirect patientcontact that use electronic transactions to engagein the business of health care, such as to do theirbilling.The last group of Covered Entities is healthcareclearinghouses. These are companies thatfacilitate the processing of health information forbilling purposes.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 13 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOKevin –So the Office of Mental Health would be a CoveredEntity because OMH operates a number ofpsychiatric centers.Jane –That’s right. Throughout this training and whilediscussing HIPAA, you will hear the term “CoveredEntity” quite often.Kevin –Another term that I have heard being used is“Business Associate.” What are they?Business Associates – Contractors, agencies or otherorganizations that provide services to Covered Entities;and, in order to provide their services, need access topatient information.Jane –Business associates are contractors or organizationsthat provide services for or on behalf of a CoveredEntity like OMH and in order to provide their servicesthey need access to patient information. Forexample, some OMH contractors, depending on theirneed to access patient information, may be classifiedas Business Associates.Kevin –Like an IT consultant who needs access to OMHpatient information on our computers in order to testthe system might be a Business Associate?Jane –Right. Since they need access to patient informationto do their job, they would, under thosecircumstances, be Business Associates.Kevin –What about physicians who some of our OMHpatients are referred to for things like emergency ordental care?Jane –Generally, doctors who provide patient care areHealth Care Providers, so under thosecircumstances, the doctors would be CoveredEntities – not Business Associates – and therefore asCovered Entities, HIPAA directly applies to them.Kevin –How about the guy who fills the water coolers on apatient ward?OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 14 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOJane –Well, since that contractor does not need patientinformation to do his job, he is NOT a BusinessAssociate. Business Associates are those contractorsor organizations that must have access to patientinformation in order to do their job.Kevin –In our facility, we have many people like students,interns or volunteers that work alongside us. Are peoplelike this, you know, people who work with us, but aren’tOMH employees, are these individuals Covered Entitiesor Business Associates?Jane –For the purpose of HIPAA, students, interns or othersthat function under the direction of OMH are consideredpart of the OMH workforce. So, these individuals arepart of a covered entity and must abide by all HIPAAregulations just as if they were OMH employees.Kevin –What’s the big deal about being a “Business Associate?”Jane –A Business Associate, even though it may not be aCovered Entity, still must agree in writing to safeguardpatient information. OMH, as the Covered Entity, mustensure that written agreements are in place with itsBusiness Associates. These agreements are called“Business Associate Agreements” – we will discussthem some more later on.Kevin –OK, I guess it does make sense that OMH has to ensurethat everyone who needs patient information to do theirjob must properly safeguard it.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 15 of 59

OMH HIPAA Training ProgramVIDEOvideo script with graphics - FinalAUDIOJane –Right. Kevin, let me ask you another question. Does theterm “Trading Partner” mean anything to you?Kevin –No. What’s that?Trading Partners – Organizations that receive patientinformation via electronic transfer.Examples of OMH's Trading Partners: NYS DOH Office of Medicaid Management. Empire Medicare.Jane –A “Trading Partner” is another term that you may hearrelated to HIPAA. It is used in relation to the EDI, or theelectronic exchange of data portion of HIPAA, and“Trading Partner” simply refers to an organization thatreceives EDI transactions. OMH, and anyone OMHsends EDI transactions to, or receives EDI transactionsfrom, could be called a “Trading Partner.” Most “TradingPartners” are covered entities, under HIPAA, in theirown right. In New York State, the main TradingPartners of the public mental health care system are theDepartment of Health’s Office of Medicaid Managementfor Medicaid and Empire Medicare for Medicaretransactions. In Trading Partner agreements, theparties agree to use only the standard electronictransactions, in effect, a standard “vocabulary,” whenthey engage in electronic transactions with one another.Kevin –So there are at least three types of organizations thatare either directly or indirectly covered by HIPAA.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 16 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOHIPAA APPLIES TO:Kevin –Covered Entities: Healthcare Providers, Health Plans,and Healthcare Clearinghouses.The first group is referred to as Covered Entities. Theseare healthcare providers, like physicians, and hospitals,health plans, or healthcare clearinghouses.Business Associates: Organizations or individualsworking with a Covered Entity who must access patienthealth information in order to do their work.Trading Partners: Organizations that exchange patientinformation via electronic transfer.Jane –Right. Covered Entities are directly responsible forcomplying with all of the HIPAA requirements. TheOffice of Mental Health, including all of its inpatient andoutpatient facilities, is a Covered Entity.Kevin –Next are Business Associates. These are organizationsor individuals who work with a Covered Entity andduring the course of the contract, these BusinessAssociates come into contact with patient information inorder to do their work.Jane –Right again. They are indirectly covered by HIPAApursuant to a Business Associate Agreement with aCovered Entity.Kevin –The third group is Trading Partners. Trading Partnersare organizations that exchange patient information inorder to conduct an electronic transaction for certainbusiness purposes.Jane –And the New York State Department of Health isresponsible for managing Medicaid in New York and,therefore, is a good example of a Trading Partner.Similar to Business Associates, they are, as TradingPartners, indirectly covered by HIPAA pursuant to aTrading Partner Agreement. Although, many are in factCovered Entities in their own right, in which case HIPAAwould apply to them directly.PLEASE STOP THE PROGRAM AND BEGINLEARNING ACTIVITY THREEOMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Kevin –Thanks, Jane. It’s starting to make more sense.Page 17 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOJane –Hello again. So far, we’ve covered just the basics ofHIPAA including Privacy, Security, EDI and thosegroups or individuals covered or affected by HIPAA likeCovered Entities, Business Associates and TradingPartners.Kevin –I’m still not sure how HIPAA will change my job, or whatI’m supposed to be doing differently.Jane –That’s okay. It’s important to have a good overview ofand appreciation for HIPAA in general. Now, we’re goingto explore HIPAA’s privacy standard.Kevin –I’m ready.Jane –Let’s get started.LEARNING OBJECTIVES FOR PRIVACY Identify and understand terms associated withHIPAA Privacy Requirements: Protected Health Information (PHI) Treatment, Payment or HealthcareOperations Discuss OMH policies behind “authorization” and“Notice of Privacy Practices.” Recognize who is a Business Associate. Understand that HIPAA provides patients certainrights with respect to their PHI.When we’re finished with this section, you will be ableto: Identify and understand terms associated withHIPAA’s privacy requirements such as ProtectedHealth Information or PHI and the phrase“treatment, payment or healthcare operations”. Discuss the policy behind “authorization” and“Notice of Privacy Practices.” Recognize who is a Business Associate. Understand that HIPAA provides patients certainrights with respect to their Protected HealthInformationKevin –Before we start, I have a question.Jane –Sure.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 18 of 59

OMH HIPAA Training ProgramVIDEOvideo script with graphics - FinalAUDIOKevin –Privacy of patient information is not new. Everyoneworking in healthcare from support personnel toclinicians already protects patient information. Duringorientation, employees receive training on theimportance of privacy. How is what we’re about to coverany different?Jane –Good question. You’re right Kevin. The concept ofpatient confidentiality is nothing new under existing NewYork State law, particularly with respect to mentalhealth. Revealing that an individual is receiving mentalhealth services risks more than simply breakingconfidentiality. Effective and lasting therapy can oftenonly occur in an environment of confidentiality and trust.Kevin –Right. So how does HIPAA change this?Preemption Analysis Details the difference between New York State Lawand Federal Law. Available through OMH Counsel's Office and theOMH Internet site.Jane –It really doesn’t – the privacy and security afforded tocertain types of health information has always been atthe cornerstone of OMH’s mission – HIPAA does notchange this commitment in any way. However, for thefirst time, HIPAA establishes at the federal level a set ofrights that individuals have regarding the disposition orsharing of their health information. Some of HIPAA’srights and protections were not covered under existingNew York State Law and some are more or lessstringent than what New York State law alreadyprovided. As we discussed earlier, the differencesbetween HIPAA and New York law are spelled out in the“Preemption Analysis” which is available through OMHCounsel’s Office and on OMH’s Internet site.Kevin –So, under HIPAA, do people have the right to know whogets their patient information?.OMH HIPAA Training Program NYS Office of Mental Health 2003. All rights reserved.Page 19 of 59

OMH HIPAA Training Programvideo script with graphics - FinalVIDEOAUDIOA Covered Entity can only use or disclose ProtectedHealth Information or PHI: For treatment, payment or health care operations;OR, As specifically authorized by the patient in writing;OR, If HIPAA provides another exception.Jane –Yes. As a general rule, unless the patient gives expresspermission, a Covered Entity can only use or discloseprotected health information for treatment, payment orhealthcare operations purposes. Otherwise, with a fewspecific exceptions, any use or disclosure must bespecifically authorized by the patient in writing. In otherwords, individuals generally have the right to controltheir personal health information and covered entities Kevin –Covered entities like OMH .Jane –Right, covered entities like OMH have the duty to guardprotected health information. And HIPAA extends thatduty to each member of a Covered Entity’s workforce –that’s why it is so important that all employees know andunderstand what HIPAA is all about.Kevin –There’s that term again. What exactly is “protectedhealth information?”Protected Health Information (PHI) Health Information Individually Identifying Information.Jane –Protected health information, or its abbreviation “PHI,” isany type of health information that contains somethingthat could identify the individual.Kevin –What are some examples of PHI?Jane –Patient notes and records, pharmacy information, billinginformation, background and histories would all beexamples of PHI.Kevin –And, under HIPAA, what sorts of things should OMHemployees know about using or disclosing a patient’sPHI?Jane –“Use PHI,” you mean as in within OMH?OMH HIPAA Training Program NYS Office of Mental H

OMH HIPAA Training Program video script with graphics - Final OMH HIPAA Training Program Page 6 of 59 NYS Office of Mental Health 2003. All rights reserved. VIDEO .