HIPAA Clinical Scenario ExamBy Karna, Healthcare PM & RCM

HIPAA Basics 22

Review QuestionHIPAA’s goal is to catch staff sharing patients’ health information with those who do not need the information.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 33

Answer

ANSWER: FALSE

The goal of HIPAA is to protect confidential patient information from improper use or disclosure.

If you see an apparent violation, you should report it to your instructor who will immediately assist you in contacting the Privacy Officer.

HIPAA Basics 44

Review Question

One of the privileges of working in health care is that we have access to our family and friends’ health information so we can find out when they have an illness.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 55

AnswerANSWER: FALSE

We do not have a right to access anyone’s health information including family members unless it is directly needed for the completion of our job responsibilities for a patient.

If you accidentally see patient information that is not directly needed for you to perform your job, you cannot share that information with anyone else.

HIPAA Basics 66

Case Scenario

Dr. Williams asks Sue, a nurse, to bring up his patient’s lab results on the computer screen. Dr. Williams looks around and does not see any other staff or visitors in the area. He asks Sue to turn the monitor so he can see the chart. There is no other person around the desk when the screen is turned towards him. When Dr. Williams is finished, Sue turns the screen back around facing away from public view.

Dr. Williams and Sue violated the patient’s privacy by turning the screen and viewing the lab results.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 77

Case Answer

ANSWER: False

They took the time to examine their surroundings and made certain that no unauthorized individuals were near. Turning the screen and then returning it to a secure position is an acceptable practice.

If visitors or others were present, the doctor would need to go behind the desk and view the screen.

HIPAA Basics 88

Case Question

Julie is a nurse entering notes into a patient chart at the nurse’s station where visitors come to ask questions. Jeff, another nurse, steps out of a patient’s room and asks Julie for help. Julie leaves the chart open on the desk, then goes to assist Jeff in the patient’s room.

Q: Leaving the chart open on the desk when the nurse leaves the area is OK because she will be right back and trying to find her place would take too much time.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 99

Case AnswerANSWER: False

The best way to maintain patient confidentiality is to never leave records unattended in public places. Closing the chart is a good first step. In a non-emergency situation, return the chart to its designated location before leaving the area. In an emergency situation, secure the chart using your professional judgment, then proceed to assist with the emergency.

HIPAA Basics 1010

Case Scenario

Jennifer, a nurse, and Tom, a physical therapist, are eating lunch together in the cafeteria. They begin discussing a patient that they are both treating. The cafeteria is crowded and others around them can hear them referring to the patient’s name and other confidential information.

Q: They are violating the patient’s privacy in this situation.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 1111

Case Answer

ANSWER: True

Never discuss a patient’s health information in areas where there are others that don’t need to know about it. If you need to discuss a patient’s care with a co-worker, speak softly in an area away from the public.

HIPAA Basics 1212

Case and Question

An adult daughter of an elderly patient is present in the room when his doctor enters to speak with the patient about test results. The patient introduces his daughter to the doctor, and then asks the doctor if the test results are back. The doctor begins to explain the results to the patient.

Q: The doctor violated the patient’s privacy by talking about the test results with the daughter present in the room.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 1313

Case Answer

ANSWER: False

Since the patient asked about the results with his daughter in the room, the doctor can assume that it is appropriate to share the results at that time.

HIPAA Basics 1414

Case Question

In a Radiology waiting room, an x-ray technologist calls the next patient by name saying “Jane Smith, we are ready for your to get your sonogram now.”

Q: The x-ray technologist violated the patient’s privacy by calling out her name and test to be performed.

True or False?

To see the correct answer, click on NEXT.

HIPAA Basics 1515

HIPAA Basics 1616

Non-Retaliation Policy

There should also be a policy in place to safeguard the rights of a person who, in good faith, reports a privacy violation.

Action should not be taken against anyone who, in good faith: Exercises her or his rights, including filing a complaint. Contacts or sends a complaint to the Department of Health

and Human Services. Testifies, assists, or participates in an investigation,

compliance review, proceeding, or hearing. Believes that an act or practice is against the law. The person reporting the violation must have a reason to

believe that there is a problem and may not use or disclose PHI to address her or his concern.

HIPAA Basics 1717

HIPAA Patient Rights

An Authorization is a form signed by the patient for the use and disclosure of specific PHI that are not related to treatment, payment, or health care operations.

There are some uses and disclosures where an authorization is not required.

When in doubt about what information is required to have a signed authorization for release, ask!

HIPAA Basics 1818

HIPAA Patient Rights

What do you need to know? Patients have the right to register complaints

with Federal agencies and with the facility if they feel their rights have been violated.

Every facility has a Privacy Officer who is responsible for overseeing HIPAA implementation.

If you are uncertain about what information may be given out, talk to your instructor or one of the nurses on the unit where you are assigned, or contact the Privacy Officer.

HIPAA Basics 1919

Unauthorized DisclosuresSome of the biggest threats to patient privacy is unintentional disclosure of information:

Discussing a case where other patients or visitors may overhear, such as in elevators, hallways or the cafeteria.

Leaving sensitive information out where patients or visitors can see it.

Another threat to patient privacy is when a workforce member intentionally uses or discloses information in an unauthorized way:

Copying information and taking it home.

Removing medical records from the health facility and giving them to others who have no legal right to them.

Deliberately sharing information with unauthorized persons (family members, friends, or news reporters).

Using confidential information in gossiping about patients.

Leaving a computer unattended after logging in to an application.

Sharing passwords with others or leaving passwords around a computer.

HIPAA Basics 2020

Unauthorized Disclosures

It is essential that everyone who provides care and services to patients be aware of what is going on in their surroundings to ensure that confidential information is only shared with those who need to know, and at the minimum level necessary to enable them to carry out duties and responsibilities safely, effectively, and efficiently.

Always be aware of where you are, who is around you, and what information can be seen or heard. It may not be possible to ensure absolute privacy, but reasonable measures need to be taken to “minimize the chance of incidental disclosure to others.”

Don’t browse through a patient’s chart or other files out of curiosity. Access only the portions of medical record you need to perform your specific role as a student nurse.

HIPAA Basics 2121

Verify Identity

Before you can release information about a patient, you must first confirm the identity of the person requesting information about the patient, whether in person, by phone, or in writing.

What methods can be used to verify identity?

A photo ID

Information that only the patient would know, and which you can confirm, such as the patient’s middle name

HIPAA Basics 2222

Security RulesPrivacy rules identify what information is protected and define

when and how that information may be used or disclosed.

Security rules apply to PHI that is sent electronically from one location to another. Security rules identify steps to take to secure PHI that is in electronic format. They also apply to PHI that may be used or stored by the facility.

There are four key parts which work together to protect PHI. These are:

1. Physical Security: hands-on access to computer hardware, systems, areas, and buildings.

2. Technical Security: the process to identify the access and type of information individuals may access and view on a computer.

3. Technical Security Mechanisms: processes that automatically monitor systems activity and report suspicious activity.

4. Administrative Procedures: policies and procedures that define steps the facility will take to address the above.

These define the basic level of security that must be in place to comply with HIPAA

HIPAA Basics 2323

Electronic CommunicationPart of ensuring the privacy rules is to understand how information is stored, transmitted, and accessed by staff.

Faxes, e-mails, and computer printouts may contain patient information. Take precautions to ensure that these types of communications get to their intended destination.

As students, you will likely not be in a position to fax or email patient information to others. If you are placed in a situation where this becomes necessary, talk with your instructor about the proper procedure.

HIPAA Basics 2424

Paper Communication

You will find during your clinical experiences that there is a lot of paper that contains confidential patient information. Make sure you keep this paper out of the public view.

Do not leave documents where the public can easily access them, even accidentally. Many of you may use visitors’ lounges for conferences. Do not leave your papers or any medical record information where it can be seen by others.

When documents containing patient information are no longer needed, shred them or dispose in designated containers.

HIPAA Basics 2525

Verbal Communication

Nursing is never practiced in isolation. It is a collaborative team operation. As a result, there are many times when you will need to discuss patient information with colleagues.

In doing so, remember you must:

Only discuss information relevant to the patient’s care.

Only include those involved in the patient’s care.

Select an area that is as private as possible, and check the surroundings to ensure no one will overhear confidential information who shouldn’t.

HIPAA Basics 2626

Summary All health information that specifically

identifies an individual is considered confidential.

Protecting the privacy of patient information is everyone’s responsibility.

Even though you are a student nurse, you are an active part of this program. Use patient information only to perform your responsibilities as assigned.

Be aware! Don’t intentionally or unintentionally disclose patient information. Help others to do the same.

If you suspect any privacy violations or concerns, notify your instructor who will immediately assist you in contacting the Privacy Office.