Health Insurance Portability and Accountability Act HIPAA Training... · What is HIPAA? •Health...

Health Insurance Portability and Accountability Act

In-Service Training

Tri-Community Ambulance Service

Welcome!

1/27/2017 Property of Tri-Community Ambulance

Service, Inc. 2

Purpose

• To ensure understanding and compliance with the Health Insurance Portability and Accountability Act of 1996

– Impacts on EMS

– Patient privacy requirements

– Provider Requirements


Service, Inc. 3

Training Plan

• Tri-Community New Member Orientation

– Self-Paced, Online Format

• Review all slides in the HIPAA powerpoint presentation

• Take the post-test

• Submit documentation to your new member orientation representative!

• If you need further assistance, visit our website http://www.tricommunityambulance.org/orientation-guidance


Service, Inc. 4

http://www.tricommunityambulance.org/orientation-guidance




What is HIPAA?

• Health Insurance Portability and Accountability Act

– Passed by Congress in 1996

– Law intended to facilitate the exchange of electronic health information and bring forth a national standard as it pertains to health insurance billing and health information sharing


Service, Inc. 5

Privacy Advocates Argued to incorporate protections

• Privacy advocates argued the law should also have consumer and patient protections

• Congress agreed and directed the Department of Health and Human Services to issue a national standard:

– HIPAA Privacy Rule

– HIPAA Security Rule


Service, Inc. 6

What is a HIPAA Covered Entity?

• A covered entity is:

– “healthcare provider who transmits any health information in electronic form in connection with a transaction covered by HIPAA”

• Includes: – ALL providers of medical or health services

– Examples: Physicians, Ambulance Services

– You must also engage in electronic “covered transactions”


Service, Inc. 7

“Covered transactions”

• Covered transactions include: – Healthcare claims or equivalent encounter

information

– Healthcare payment and remittance advice

– Coordination of benefits

– Healthcare claim status

– Enrollment and disenrollment in a health plan

– Eligibility for a health plan

– Referral certification and authorization


Service, Inc. 8

“Covered transactions”

• Health claims attachments

• Healthcare electronic funds transfers (EFT)


Service, Inc. 9

Is Tri-Community a “covered entity”

• To help apply and understand this rule, we must first understand company history


Service, Inc. 10

Who do we serve?

• Fire districts:

– Bergholz

– Pekin

– Sanborn

– St. Johnsburg

• We will provide mutual aid services when called upon


Service, Inc. 11

Who do we serve?

• Towns:

– Wheatfield

– Cambria

– Lewiston

– Tuscarora Indian Reservation


Service, Inc. 12

Who funds us?

• Tri-Community is an “unaffiliated agency” in terms of funding

– ZERO taxpayer dollars support our operations

– ZERO annual subscription fee’s for the fire companies to utilize us


Service, Inc. 13

Who funds us?

• Tri-Community is an “unaffiliated agency” in terms of funding

– ZERO taxpayer dollars support our operations

– ZERO annual subscription fee’s for the fire companies to utilize us

• So….who funds us?


Service, Inc. 14

Who funds us?

• Tri-Community will charge a nominal fee to help cover our expenses

– Fuel

– Supplies

– Building

– Vehicles

• Patient is billed • Patient’s health insurance will review to cover the bill


Service, Inc. 15

Historical Bill Submission

• Prior to our electronic patient care reports:

– Paper PCR’s

– Paper billing sheets

– Paper hospital admission and face sheets

• Tri-Community would scan these documents and transmit via secure fax and/or email services.


Service, Inc. 16

Current Bill Submission

• Tri-Community currently uses AmbuPro electronic charts for our patient care reporting

• Integrated functions: – Electronic patient signature pad

– Patient demographics stored • Address

• Health History

• Health Insurance Information for claims processing


Service, Inc. 17

Current bill submission

• Patient care report is submitted after each call by the in-charge technician – Patient information

– Nature of call

– Mileage

– Destination (landing zone, hospital)

– Medications, procedures and care notes

– Health Insurance Information

– Patient signature


Service, Inc. 18

Current bill submission

• Once the technician submits the chart, it will route into “work flow queues”

– Review

– QA/QI

– Billing


Service, Inc. 19

Claims Processing

• Tri-Community does NOT involve itself with direct claims processing

– Outsourced to a third-party billing company who will submit and follow up on claims on our behalf and coordinate payment to Tri-Community for services rendered

• MEDEX Billing is our billing company


Service, Inc. 20

Let’s test the law


Service, Inc. 21

Are we a covered entity?

• Do we conduct transactions related to:


Service, Inc. 22



– Healthcare claims or equivalent encounter information?


Service, Inc. 23



– Healthcare claims or equivalent encounter information?

– YES!

• Tri-Community must collect patient information and transmit this to our billing company, who will then transmit this data to the insurance company for remittance of payment for services.


Service, Inc. 24





Service, Inc. 25




– YES! Tri-Community will transmit our patient care reports and patient information for billing, and we will receive monthly statements showing a listing of our patient accounts and their current status.


Service, Inc. 26



– Healthcare Claim Status


Service, Inc. 27



– Healthcare Claim Status

– YES! MEDEX Billing will supply Tri-Community status reports such as reports with/without patient signatures, paid versus unpaid accounts, etc. for business and financial purposes.


Service, Inc. 28



– Health claims attachments


Service, Inc. 29



– Health claims attachments

– YES! Tri-Community e-PCR system will allow for scanned documentation to be added to the report. These documents may include physical patient signature sheets, hospital face sheets, medical history forms or other pertinent call or incident data.


Service, Inc. 30



– Healthcare electronic funds transfers (EFT)


Service, Inc. 31



– Healthcare electronic funds transfers (EFT)

– YES! Tri-Community will receive periodic patient payments in the form of a bulk-EFT payment to our account. These bulked payments are coordinated by our billing company and avoid receiving an overwhelming and unmanageable amount of paper checks.


Service, Inc. 32


• As you can see, Tri-Community IS a HIPAA covered entity by the basic tests we just performed.

• This presentation will help you, our provider, in knowing what HIPAA is, and how it is applied.


Service, Inc. 33

Simply put…

Healthcare Provider Engage in covered electronic transactions


Service, Inc. 34

Third party billing

• Remember, Tri-Community IS a covered entity even though we contract with a third party billing company

• Claims are submitted:

– In Tri-Community’s name

– Using Tri-Community’s provider ID number


Service, Inc. 35

Protected Health Information

• Protected Health Information

– Also known as “PHI”

– Defined as: “individually identifiable health information”

• What makes information “PHI”

– Information, including demographic information collected from an individual, that:

• Is created and received by a healthcare provider

• Relates to the past, present or future health condition

1/27/2017

Property of Tri-Community Ambulance Service, Inc.

36

Past, Present and Future…

• PHI:

– Relates to the past, present and future physical or mental health or condition of an individual

– PHI that identifies the individual; or

– With respect to which there is a reasonable basis to believe the information can be used to identify the individual


Service, Inc. 37

Sources of PHI related to EMS

• Patient care reports

– Paper or electronic

– Note: our fire companies will provide us a carbon copy of their paper PCR

• Dispatch information received

• Medical Information

– Tri-Community has nursing homes, assisted living facilities, and specialty care centers in our area that will provide copies of medical records for EMS

1/27/2017


38

Sources of PHI related to EMS

• Insurance information

– Hospital face sheets

– Copies or actual insurance cards

• Verbal discussions about patients

• Photographs

– Scenes

– Vehicles

– Anything that can ID a patient or incident

1/27/2017


39

Protecting the PHI

• As we have discussed, the general rule of thumb is we do not discuss or share information pertaining to a patient or incident.

• There are a few exceptions, however…


Service, Inc. 40

3 areas we can disclose PHI

• There are 3 main areas that EMS can disclose PHI without patient prior authorization

– Treatment

– Payment

– Healthcare Operations


Service, Inc. 41

Disclosure of PHI for Treatment

• Treatment is defined as “the provision, coordination, or management of healthcare and related services. It includes coordination with other healthcare providers and any other third party relating to treatment of the patient”.


Service, Inc. 42

Disclosure of PHI for Payment

• Payment is defined as “any activities related to obtaining payment for your services. This includes such activities: a) filing claims; b) coordinating benefits; c) making insurance eligibility inquiries; d) remittance advice; e) contacting financially responsible parties; f) appealing payment decisions; and g) collections activities”


Service, Inc. 43

Disclosure of PHI for Healthcare Ops

• Disclosures for Healthcare Operations may include: – QA/QI

– Care/Case Management and Coordination

– Competency Assurance Evaluations

– Accreditation

– Medical Reviews

– Audits

– Legal Services


Service, Inc. 44

Application Quiz!

• Scenario: Tri-Community MEDIC 5 is dispatched with Shawnee as automatic ALS backup. Shawnee 22R9 is enroute BLS. Shawnee ambulance transports, MEDIC 5 provides ALS onboard Shawnee’s ambulance. In the course of the transport, the ALS technician from TCAS receives all of the patient information while Shawnee works on BLS care activities and interventions.


Service, Inc. 45

Application Quiz!

• In this scenario, once at the hospital, Shawnee’s EMT asks our ALS personnel for patient information for their PCR. Can we honor this request?


Service, Inc. 46

Application Quiz!


• YES!


Service, Inc. 47

Application Quiz!


• YES! In this situation we can share the information as Shawnee was the transporting agency and has responsibility for a medical record as well. The situation works in reverse as well as TCAS needs this information for our chart and for billing also!


Service, Inc. 48

Shawnee/TCAS example….elaborated

• Lets add more critical thinking to this shall we. In the same scenario, if you were the ALS technician from TCAS given this request by Shawnee, and you know you can share the information, what would you give out?


Service, Inc. 49

The “minimum necessary standard”

Before we can answer this question, we must first know what the “minimum necessary standard” is and how it applies to EMS Operations.


Service, Inc. 50

The “minimum necessary standard”

You need to ask yourself:

“Am I using or disclosing only the amount of PHI necessary for what I am doing or being asked”

Essentially, apply the “less is more” theory.


Service, Inc. 51

Scenario decision point

So, in this case as we discussed, we would NOT want to simply copy our entire patient care report or come back to the station and print the entire chart which may be in excess of 30 pages, but instead give the basic information that will get the job done.


Service, Inc. 52

Exceptions to the Minimum-Necessary Requirement

1) Providing a full copy of the patient care report to the hospital. This will aid in the treatment of the patient by knowing what interventions we completed, what medications we pushed and how we found the patient. A full chart copy will provide all of this data and is NOT a breach of HIPAA.


Service, Inc. 53


2) Disclosures and releases to the patient or their authorized representative. There are times that a patient or their attorney will request a copy of the patient care report. This will be handled by the officers of the company who will validate the proper releases are on hand prior to giving a copy of the report.


Service, Inc. 54


3) Disclosures and releases to the HHS in relation to an investigation or enforcement activities.


Service, Inc. 55


4) Subpoena. At times, Tri-Community will receive a subpoena for a patient care report. This disclosure will be handled by the officers of Tri-Community. However, for the purposes of this training, this disclosure is permitted as it is required by law.


Service, Inc. 56

Incidental Uses and Disclosures

For EMS, Incidental Uses and Disclosures of PHI most commonly will be done via our “MERS” or pre-hospital to hospital radio report that we transmit inbound to the hospital. This radio report is NOT a violation of HIPAA as it is needed for proper and quality patient care.


Service, Inc. 57

PHI Disclosure and the caretaker

At times, we will receive a call for a person who cannot make medical decisions for themselves. This may be due to a health, physical or mental reason. You MAY disclose PHI if you in your professional opinion determine it is in the patients best interest.


Service, Inc. 58


If you encounter this scenario, you will want to apply the basic tests:

Who is this person?

Are they involved with the patients care?

Does the person have a legitimate interest in the patients care?

Would the patient want this person to know or would the patient benefit from this?


Service, Inc. 59


One of the biggest areas this will come up are with close friends and family members tasked with the care of the patient.

Normally, this would be the spouse or children of the patient.


Service, Inc. 60

PHI Disclosure and Law Enforcement

Tri-Community maintains a very close working relationship with local law enforcement officials. We run many calls together each year, and have several members who are employed by NCSO. We are normally inclined to help law enforcement do their job and normally do not have a second thought in releasing requested information to them.


Service, Inc. 61


The primary HIPAA law enforcement exceptions are:

Disclosure is required by a state reporting law.

This may be our mandated Child or Elder abuse reporting hotlines.


Service, Inc. 62



Law Enforcement needs to locate or ID a suspect, material witness, fugitive, witness to a crime or missing person(s).


Service, Inc. 63



Law Enforcement needs information about a victim of a crime


Service, Inc. 64



Your patient appears to have passed away as a result of criminal conduct


Service, Inc. 65



You need to report a crime in an emergency


Service, Inc. 66



You need to report a crime that occurred at the station or in the ambulance


Service, Inc. 67



Reporting the incident would avert a serious threat to the health and safety of the patient or someone else.


Service, Inc. 68


If you do not feel the request being made falls within any of these, simply ask your patient if it is okay that the police officer receives the requested information. If the patient declines, and the police officer is still asking for this information, contact a line officer to consult with their opinion!

Note: normally these scenarios do not present themselves


Service, Inc. 69

The patient refused, are they covered under HIPAA privacy rules?

The simple answer, YES!

Tri-Community maintains the position that ANY patient contact we make or ANY incident information we obtain IS private and protected information. No matter what the call disposition is (ie: transport, DOA, sign-off).


Service, Inc. 70

Incident Data and CISD

At times we will run a serious call that may be hard for some responders to cope with on their own. To ensure our responders are taken care of, we may employ a CISD team to discuss the call post-incident.


Service, Inc. 71


The CISD (Critical Incident Stress Debriefing) teams are trained personnel with industry experience that will come out at the conclusion of the incident, usually within 24-48 hours after the incident. We will talk about the call. This is an ok and permissible venue to talk about the call to help our fellow responders.


Service, Inc. 72


During any CISD activity, we will want to protect the personal and protected information of our patient as much as we can. Personal information such as name, address and other characteristics should be avoided.

Additionally, what is discussed in CISD, stays in CISD. This is NOT an open topic to discuss at the conclusion of the meeting.


Service, Inc. 73

PHI and the Order to Appear

With being a witness to the incident and one of the first to arrive, we are subject to receiving a subpoena and order to appear before the court or at a deposition. If you receive one of these requests, CONTACT THE CHIEF IMMEDIATELY and request that the company attorney be notified as well to either attend with you or assist, if needed, in preparation for your appearance.


Service, Inc. 74

PHI and Event Standby’s

Tri-Community will provide event standby services to our local organizations, schools and colleges. PHI and patient privacy do NOT erode under this scenario, even if it is only an evaluation and sign off. Patient privacy must be protected at these events as well. Unless a patient has signed a proper release to give their information and patient chart to the host organization, we will NOT release patient information.


Service, Inc. 75

PHI and NEMSIS Requirements

Our electronic patient care reporting system automatically collects statistical data for the National EMS Information System (NEMSIS). This is permissible data sharing and NOT a breach to HIPAA.

This statistical information is built into your chart and is required data points to allow your chart to be locked and submitted!


Service, Inc. 76

HIPAA and the Public Observer

EMS training programs routinely require a combination of Emergency Room and ambulance “ride along” time as a graduation requirement from the program. Tri-Community provides support to our local colleges and universities with the “ride-along” program.


Service, Inc. 77

HIPAA and the Public Observer

The public observer, or “ride along”, is required to sign a HIPAA disclosure form prior to starting their shift that highlights the expectations of our company.

HIPAA does not erode with the public rider. The public rider is expected to uphold HIPAA requirements and protect PHI.


Service, Inc. 78

HIPAA, PHI and End of Life

HIPAA, PHI and Patient Rights do NOT terminate at the end of life! This means, we follow the law and respect our patients privacy regardless of patient outcome!


Service, Inc. 79

HIPAA Fact versus fiction


Service, Inc. 80


HIPAA prohibits the use of my patients name over the radio.

FALSE! To be able to treat the patient, you must first find the patient. There are parts of our district where fire dept. personnel, or even our members, may be able to locate a patient via patient last name versus address markers that are near-impossible to see at night!


Service, Inc. 81


HIPAA prohibits me from transporting more than one patient at a time.

FALSE! There may be times that transporting more than one patient is the only option. This may be due to low resources in the area or due to a large scale event or MCI. You can transport more than one patient in the rig, if needed.


Service, Inc. 82


On-scene photos, videos or images do NOT fall under HIPAA because they do not constitute PHI.

FALSE! Any media that can identify, or could reasonably identify a patient DO constitute PHI. Common oversights are: patient’s vehicle with license plate in the picture. Responders should avoid posting “action photos” of ANY response they or their agency responds to.


Service, Inc. 83


HIPAA prohibits us from faxing our e-PCR to the hospital at the conclusion of the call.

FALSE! It is the hospital and company expectation that the e-PCR is completed and faxed to the receiving facility as soon as possible after the call. This is NOT a breach of HIPAA.


Service, Inc. 84

HIPAA in the digital age


Service, Inc. 85

Digital records management

EMS is ever-changing and continues to evolve. In the very primitive years, EMS agencies and fire departments may have kept a yearly journal of calls in their station, if any documentation even occurred! EMS is now slowly phasing out the detailed paper patient care reports in favor of the electronic patient care reports.


Service, Inc. 86

Digital records management

Electronic patient care reports have many advantages over the archaic paper charts:

• Less storage space required

• Added security

• Limitations on access

• Clean, simple easy to manage workflow for all EMS operations from data entry to billing.


Service, Inc. 87

E-PCR and Tri-Community

Tri-Community is currently on our 2nd electronic PCR system. Currently we use AmbuPro EMS for our patient care report needs.

Tri-Community provides 4 Toughbook laptops and 1 desktop that are licensed with this program to complete patient care reporting.


Service, Inc. 88

Data storage

Tri-Community will maintain all patient care records on our secured computers. It is the position of Tri-Community Ambulance that no member shall maintain patient care or incident records on their personal devices. All information obtained in the course of EMS operations is property of Tri-Community and will be maintained on company owned computers.


Service, Inc. 89

HIPAA and Social Media


Service, Inc. 90

Social Media and EMS reputation

"It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett


Service, Inc. 91

Social Media

Social Media remains one of the hot topics of any business, and remains one of the biggest threats to both companies and employees. Social media violations of all sizes are continuing to occur at a record pace across all industries. EMS is no exception.

However, EMS can suffer greater consequences


Service, Inc. 92

Social Media: Example 1


Service, Inc. 93



Service, Inc. 94


As you can see, Miller Hose and Olcott were dispatched to a house fire. You can see the information that is heard over the radio by anyone who has a scanner; but you now have anyone that is John Q. Public placing comments for anyone to see. And they may NOT be factual!

More importantly, these release of information may not be for public knowledge and pending family notifications. Do NOT be the cause of a breach!


Service, Inc. 95

Social Media Example #2


Service, Inc. 96

Social Media Example #2

While this post did not give an incident location, it sure did give enough detail to allow people on Facebook to know more about the MVA our agency was dispatched to!

Remember folks! We are a small town agency. The accident we respond to may involve someone you know, and definitely someone on social media will know this person.


Service, Inc. 97

Social Media and EMS

As an EMS provider, we are called to help those in need. We are not called to judge their decisions, especially when we may not have all of the facts. Posting a comment, when people know you are a member here, may erode peoples opinion of our company, or of you as a provider.

Do NOT post anything on social media about a call!


Service, Inc. 98

Local Example!


Service, Inc. 99

Local Example!

Tri-Community was dispatched for EMS standby with St. Johnsburg to cover a police incident for a male held up in his house with a gun. EMS Crews from both companies were aware of the incident conclusion via SOCIAL MEDIA prior to being notified on the incident tactical channel!

We were staged right across the street from the command zone and found out first from social media sources.


Service, Inc. 100

Improper Release of Information via Social Media implications

We need to think about the larger picture when we are sharing information to our friends, family, online blog’s and social media accounts.

We are looked to as a critical source of information as we have a front row seat to emergencies and incidents in our towns.


Service, Inc. 101


While the list is extensive of potential implications of improper release of information to social media, we will talk about a few of them for the purpose of this training.


Service, Inc. 102


Breach of HIPAA.

By posting updates or photos, we may breach HIPAA and patient privacy rights. Refrain from posting ANYTHING you see or know about from a call our agency responds to. This includes any data received via ERRS incident messaging.


Service, Inc. 103


If you were on scene of a police emergency and you were posting an update to Firewire or other online forum that an incident was clear, you are being trusted as a responder who is on scene. As a result, people may start to utilize this road or area again, potentially coming into a HOT incident or potentially placing responders in harms way of what was perceived to be a closed off area.


Service, Inc. 104


Additionally, your release of information may impact law enforcement activities. You will have a front row seat to serious incidents in our towns we serve, and may have critical incident knowledge that is NOT for public knowledge. You MUST refrain from posting anything online.


Service, Inc. 105


One other potential implication from improper release of incident knowledge is the premature incident outcome notification to family members. If we run a fatal motor vehicle accident and we post an update that it was a fatal accident, out of town family members may be notified via social media of their loved one’s passing before their family can call them. All it takes is one photo and one comment to piece things together.


Service, Inc. 106

Don’t become a national headline


Service, Inc. 107



Service, Inc. 108


As you can see by any article on the topic, the names of the offenders are routinely posted for the world to see. Your name and Tri-Community’s name can be included in the article highlighting your breach and pending legal action against both the provider and the company.


Service, Inc. 109

Field Quick Tip: ID PHI Fast!

Want a simple rule on how to determine if something may be PHI and protected information? Apply this simple test.

Could a family member or friend viewing your post determine who or what this is pertaining to simply by what you posted online? If so, it is most likely PHI!


Service, Inc. 110

Breach Notifications

If one of our members were to post something online and it is indeed considered a breach, we are bound by law to notify the patient AND the Federal Government of the breach.

This could immediately open the legal troubles for both the company AND the individual responder.

You can be sued personally for a breach!


Service, Inc. 111

Bringing it all together

We have covered a lot of ground. The topic HIPAA and Patient Privacy Rights is an exhaustive and ever-changing topic. This in-service was aimed at providing you job-specific knowledge as it pertains to your position at Tri-Community!


Service, Inc. 112

HIPAA and PHI

The easiest way to ensure compliance? Don’t talk about a patient, call, scenario or dispatch information you are given.

We are trusted members of society, and we are invited into peoples lives and homes at their worst. Let’s not ruin this trust.


Service, Inc. 113

Preventable Unintended Disclosures


Service, Inc. 114


• Examples include:

– Unattended vehicles with patient charts on the screen

– Unattended vehicles with paperwork on the dashboard

– Patient charting in public (ie: Tim Hortons)

– Unattended paperwork and computers at the hospital


Service, Inc. 115


• The easiest way to prevent this:

– Ensure all paperwork is in your custody at all times

– Do not leave computers open or paperwork out

– Do not chart patient records in public. Come back to the station to do this


Service, Inc. 116

Patient Privacy Notice

Patients have the right to a copy of our patient privacy notice. We maintain copies of the privacy notice in our vehicles in the clipboards, or you may direct our patients to our company website to obtain a copy.

http://www.tricommunityambulance.org/privacy-notice


Service, Inc. 117





Online copy of our Privacy Notice


Service, Inc. 118

Online copy of our Privacy Notice


Service, Inc. 119

HIPAA Continuing Education

As with any topic, HIPAA is an ongoing and ever-changing law that as society and technology changes, the law may need to change. As a provider, you should keep current with changes by doing independent review and research on top of company provided updates.

https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/


Service, Inc. 120










Thank you

Thank you for your completion in our HIPAA in-service. Please kindly navigate to the New Member Homepage on our website to complete a short post-test!


Service, Inc. 121

Health Insurance Portability and Accountability Act HIPAA Training... · What is HIPAA? •Health...

Documents

Transcript of Health Insurance Portability and Accountability Act HIPAA Training... · What is HIPAA? •Health...