Healthcare Privacy & Security: Hipaa, Hitech Act, & Meaningful Use

Front 1

Meaningful use

Back 1

-using certified EHR technology for: Improve quality, safety, efficiency, and reduce health disparities
-Engage patients and families in their health care
-Improve care coordination
-Improve population and public health
-All the while maintaining privacy and security

Front 2

The American Recovery and Reinvestment Act of 2009 (ARRA)

Back 2

Act specifies 3 main components of Meaningful Use

Front 3

3 main components of Meaningful Use part 1

Back 3

-The use of a certified EHR in a meaningful manner, such as e-prescribing.
-The use of certified EHR technology for electronic exchange of health information to improve quality of health care.

Front 4

3 main components of Meaningful Use part 2

Back 4

-The use of certified EHR technology to submit clinical quality and other measures.

Front 5

meaningful use

Back 5

providers need to show they're using certified EHR technology in ways that can be measured significantly in quality and in quantity

Front 6

CMS EHR Meaningful Use Criteria Summary

Back 6

staged in three steps over the course of the next five years.
Stage 1
Stage 2
Stage 3

Front 7

CMS EHR Meaningful Use Criteria Summary part 1

Back 7

Stage 1 (2011 and 2012) sets the baseline for electronic data capture and information sharing.
-Stage 2 expected to be implemented in 2013

Front 8

Stage 3

Back 8

(expected to be implemented in 2015) will continue to expand on this baseline and be developed through future rule making

Front 9

Meaningful Use
Stage 1

Back 9

(2011-2012) Data Capture and Sharing

Front 10

Meaningful Use
Stage 2

Back 10

(2014) Advance Clinical Processes

Front 11

Meaningful Use
Stage 3

Back 11

(2016) Improved Outcomes (EBM focus on best practices)

Front 12

Meeting Meaningful Use Requirements

Back 12

To qualify for incentive payments, meaningful use requirements must be met in the following ways:
Medicare EHR Incentive Program
Medicaid EHR Incentive Program

Front 13

Meeting Meaningful Use Requirements
Medicare EHR Incentive Program

Back 13

Eligible professionals, eligible hospitals, and critical access hospitals (CAHs) must successfully demonstrate meaningful use of certified electronic health record technology every year they participate in the program. (65 and older and disabled)

Front 14

Meeting Meaningful Use Requirements
Medicaid EHR Incentive Program

Back 14

EPs and eligible hospitals qualify for incentive payments if they adopt, implement, upgrade or demonstrate meaningful use in their 1st year of participation. They must successfully demonstrate MU for subsequent participation years.

Front 15

MEANINGFUL USE part 1

Back 15

-Adopted: Acquired and installed certified EHR technology. (show evidence of installation.)
-Implemented: Began using certified EHR technology. (provide staff training or data entry of patient demographic information into EHR.)

Front 16

MEANINGFUL USE part 2

Back 16

-Upgraded: Expanded existing technology to meet certification requirements. (For example, upgrade to certified EHR technology or add new functionality to meet the definition of certified EHR technology.)

Front 17

Requirements for Stage 1 of Meaningful Use part 1

Back 17

Meaningful use includes both a CORE SET and a MENU SET OF OBJECTIVES that are specific to EP or eligible hospitals and CAHs.

Front 18

Requirements for Stage 1 of Meaningful Use part 2

Back 18

For EPS, there are a total of 25 MU objectives. To qualify for an incentive payment, 20 of these 25 objectives must be met.
-There are 15 required core objectives.

Front 19

Requirements for Stage 1 of Meaningful Use part 3

Back 19

-The remaining 5 objectives may be chosen from the list of 10 menu set objectives.
-EPs must report on 6 total Clinical Quality Measures (3 required core measures; 3 out of 38 from additional set)

Front 20

Requirements for Stage 1 of Meaningful Use part 4

Back 20

-For ELIGIBLE HOSPITALS AND CAHS, there are a total of 24 meaningful use objectives. To qualify for an incentive payment, 19 of these 24 objectives must be met.
-There are 14 required core objectives.

Front 21

Requirements for Stage 1 of Meaningful Use part 5

Back 21

-The remaining 5 objectives may be chosen from the list of 10 menu set objectives.
-Eligible hospitals and CAHs must report on all 15 of their Clinical Quality Measures.

Front 22

MEANINGFUL USE
Clinical Quality Measures [CQM] part 1

Back 22

-CQMs can be measures of processes, experiences and/or outcomes of patient care, observations or treatment that relate to one or more quality aims for health care such as effective, safe, efficient, patient-centered, equitable, and timely care.

Front 23

MEANINGFUL USE
Clinical Quality Measures [CQM] part 2

Back 23

-CQMs help CMS ensure that quality health care is delivered to Medicare beneficiaries and Medicaid recipients.
-CQMs provide a standardized means of measuring and comparing delivery of care.

Front 24

MEANINGFUL USE
CQM Reporting Requirements part 1

Back 24

EPs must complete 3 of the following:
-Hypertension – Blood Pressure Measurement
-Preventive Care and Screening Measure Pair
-Tobacco Use Assessment
-Tobacco Cessation Intervention

Front 25

MEANINGFUL USE
CQM Reporting Requirements part 2

Back 25

-Adult Weight Screening and Follow up
-Weight Assessment and Counseling for Children and Adolescents
-Preventive Care and Screening
-Influenza Immunization for Patients > aged 50

Front 26

MEANINGFUL USE
CQM Reporting Requirements part 3

Back 26

-Childhood Immunization Status
-EPs must also complete 3 of the 38 listed in the additional set

Front 27

MEANINGFUL USE
-Reporting of CQM

Back 27

2011 – Eligible Professionals seeking to demonstrate meaningful use are required to submit aggregate CQM numerator, denominator, and exclusion data to CMS or the States by Attestation

Front 28

MEANINGFUL USE
-Reporting of CQM

Back 28

2012 – Eligible Professionals seeking to demonstrate meaningful use are required to electronically submit aggregate CQM numerator, denominator, and exclusion data to CMS or the States

Front 29

Eligible Professionals Must Complete ALL 15 Core Objectives

Back 29

1.Computerized Provider Order Entry (CPOE)
2.E-Prescribing (eRx)
3.Report
4.Implement one clinical decision support rule

Front 30

Eligible Professionals Must Complete ALL 15 Core Objectives

Back 30

5.Provide patients with an electronic copy of their health information, upon request
6.Provide clinical summaries for patients for each office visit
7.Drug-drug and drug-allergy interaction checks

Front 31

Eligible Professionals Must Complete ALL 15 Core Objectives

Back 31

8.Record demographics
9.Maintain an up-to-date problem list of current and active diagnoses
10.Maintain active medication list
11.Maintain active medication allergy list

Front 32

Eligible Professionals Must Complete ALL 15 Core Objectives

Back 32

12.Record and chart changes in vital signs
13.Record smoking status for patients 13 years or older
14.Capability to exchange key clinical information among providers of care
15.Protect electronic health information

Front 33

Eligible Professionals Must Complete 5 Out of 10 Set Objectives

Back 33

1.Drug formulary checks
2.Incorporate clinical lab test results as structured data
3.Generate lists of patients by specific conditions
4.Send reminders to patients per patient preference for preventive/follow up care

Front 34

Eligible Professionals Must Complete 5 Out of 10 Set Objectives

Back 34

5.Provide patients with timely electronic access to their health information
6.Use certified EHR technology to identify patient-specific education resources and provide to patient, if appropriate

Front 35

Eligible Professionals Must Complete 5 Out of 10 Set Objectives

Back 35

7.Medication reconciliation
8.Summary of care record for each transition of care/referrals
9.Capability to submit electronic data to immunization registries/systems*

Front 36

Eligible Professionals Must Complete 5 Out of 10 Set Objectives

Back 36

10. Capability to provide electronic syndromic surveillance data to public health agencies*

Front 37

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)

Back 37

Passed in 1996 – laid much of the groundwork for the privacy and security measures adopted within HIT today

Front 38

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)

Back 38

-Directions on how patient data was used and made available when patients switched physicians or insurers
Included two (2) major rules covering privacy and security

Front 39

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)
-COVERED ENTITIES:

Back 39

Health Plans – Health insurers, HMOs, Company health plans,Government programs such as Medicare & Medicaid

Front 40

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)
-COVERED ENTITIES:

Back 40

Health Care Providers – Most doctors, Clinics, Hospitals,Psychologists, Chiropractors, Nursing homes, Pharmacies,Dentists

Front 41

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)
-COVERED ENTITIES:

Back 41

-Health Plans – Health insurers, HMOs, Company health plans,Government programs such as Medicare & Medicaid
-Health Care Clearinghouses

Front 42

ORGANIZATIONS USING PHI BUT NOT A COVERED ENTITY

Back 42

-Life insurers, Employers, Workers compensation carriers, Schools and school districts, State Agencies like Child Protective Service Agencies, Law enforcement agencies, Municipal offices

Front 43

HIPAA

Back 43

-Patient data and personal information MUST be protected according to the SECURITY RULE
-Applies to ALL personal health information (PHI)
-

Front 44

Personal health information (PHI)

Back 44

-Hard copy records
-Electronic personal health information (ePHI) stored on computing systems
-Verbal discussion between medical professionals

Front 45

CONSUMER RIGHTS: part 1

Back 45

-Ask to see and get a copy of their health records
-Have corrections added to their health information
-Receive a notice that discusses how health information may beused and shared

Front 46

CONSUMER RIGHTS: part 2

Back 46

-Provide permission on whether health information can be used or shared for certain purposes, such as for marketing
•Get reports on when and why health information was shared for certain purposes

Front 47

CONSUMER RIGHTS: part 3

Back 47

-File a complaint with a provider, health insurer and/or the U.S.Government if patient rights are being denied or health information is not being protected

Front 48

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 1

Back 48

All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP Code,and their equivalent geographical codes

Front 49

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 2

Back 49

All elements of dates (except year) directly related to an individual, including DOB, admission date, discharge date, death; and all ages over 89 and all

Front 50

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 3

Back 50

elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older

Front 51

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 4

Back 51

-Telephone numbers
-Facsimile numbers
-Electronic mail addresses
-Social security numbers
-Medical Record number-

Front 52

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 5

Back 52

-Health plan beneficiary numbers
-Account numbers
-Certificate/license numbers
-Vehicle identifiers and serial numbers, include license plate numbers

Front 53

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 6

Back 53

-Device identifiers and serial numbers
-Web universal resource locaters
-Biometric identifiers, including fingerprints and voiceprints

Front 54

Privacy Rule permits de-identifying data by removing the following 18 identifiers
part 7

Back 54

-Full-face photographic images and any comparable images
-Any other unique identifying number, characteristic, or code, unless otherwise permitted by the PrivacyRule for re-identification

Front 55

Covered Entity Permitted Uses and Disclosure According to the Privacy Rule part 1

Back 55

•To the individual
•For treatment, payment or health care operations
•Uses and disclosures with opportunity to agree or object
•Facility directories; For notification and other purposes

Front 56

Covered Entity Permitted Uses and Disclosure According to the Privacy Rule part 2

Back 56

•Incidental use and disclosure
•Public interest and benefit activities
•Required by law; Public health activities; Victims of abuse, neglect or domestic violence; Health oversight activities; Judicial and administrative proceedings; Law enforcement purposes;

Front 57

Covered Entity Permitted Uses and Disclosure According to the Privacy Rule part 3

Back 57

Decedents; Cadaveric organ,eye, or tissue donation; Research; Serious threat to health or safety;Essential government function; Worker’s compensation
•Limited data set

Front 58

ADMINISTRATIVE REQUIREMENTS: part 1

Back 58

Administrative requirements were established by the Privacy Rule to ensure that all covered entities, regardless of size or organization, met a minimum standard for protecting patient privacy and permitting patients to exercise their rights.

Front 59

ADMINISTRATIVE REQUIREMENTS: part 2

Back 59

•Develop and implement written privacy policies and procedures
•Designate a privacy official
•Workforce training and management
•Mitigation strategy for privacy breaches

Front 60

ADMINISTRATIVE REQUIREMENTS: part 3

Back 60

•Data safeguards - administrative, technical, and physical
•Designate a complaint official and procedure to file complaints

Front 61

ADMINISTRATIVE REQUIREMENTS: part 4

Back 61

•Establish retaliation and waiver policies and restrictions
•Documentation and record retention - six years
•Fully-insured group health plan exception

Front 62

ADMINISTRATIVE REQUIREMENTS: part 5

Back 62

Focuses on policy and procedures

Front 63

HIPAA SECURITY FOR COVERED ENTITIES

Back 63

ADMINISTRATIVE SAFEGUARDS
PHYSICAL SAFEGUARDS
TECHNICAL SAFEGUARDS

Front 64

HIPAA SECURITY FOR COVERED ENTITIES
ADMINISTRATIVE SAFEGUARDS

Back 64

-Security management processes to reduce risks and vulnerabilities
-Security personnel responsible for developing and implementing security policies

Front 65

HIPAA SECURITY FOR COVERED ENTITIES
ADMINISTRATIVE SAFEGUARDS

Back 65

-Information access management - minimum access necessary to perform duty
-Workforce training and management
-Evaluation of security policies and procedures

Front 66

HIPAA SECURITY FOR COVERED ENTITIES
PHYSICAL SAFEGUARDS

Back 66

-Facility access and control limiting physical access to facilities
-Workstation and device security policies and procedures covering transfer, removal, disposal, and re-use of electronic media

Front 67

HIPAA SECURITY FOR COVERED ENTITIES

Back 67

Access control that restrict access to authorized personnel
Audit controls for hardware, software, and transactions
-Integrity controls to ensure data is not altered or destroyed
-Transmission security to protect against unauthorized access to data transmitted on networks and via email

Front 68

10 BIGGEST HIPAA SECURITY BREACHES IN THE U.S.10

Back 68

Since the 2009 Breach Notification Rule included in HITECH Act, 489 HIPAA-covered entities have reported breaches involving 500 individuals or more….

Front 69

10.EISENHOWER MEDICAL CENTER
Individuals Affected: 514,330 When: March 11, 2011

Back 69

10.EISENHOWER MEDICAL CENTER-Rancho Mirage, Calif.-stolen an unencrypted computer containing patient names, ages, DOB, partial Social Security numbers and the hospital’s medical record number. Not discovered missing stolen until March 14, 2011.

Front 70

9.UTAH DEPARTMENT OF HEALTH
Individuals Affected: 780,000 When: March 10, 2012

Back 70

Unlike the other top breaches, Utah Department of Health confirmed that a server containing personal health information had been actively hacked into. Officials reported that thieves had begun removinginformation from the server.

Front 71

9.UTAH DEPARTMENT OF HEALTH
Individuals Affected: 780,000 When: March 10, 2012

Back 71

Addresses, dates of birth, SSN diagnoses codes, NPI numbers, billing codes and taxpayer identification numbers were all included on the server. The Utah Department of Technology Services shut down the server when the breach was discovered on April 2,

Front 72

9.UTAH DEPARTMENT OF HEALTH
Individuals Affected: 780,000 When: March 10, 2012

Back 72

2012. The breach had occurred more than one month earlier. One year of free credit monitoring and identity theft insurance was extended to those affected.

Front 73

8.SOUTH SHORE HOSPITAL
Individuals Affected: 800,000 When: Feb. 26, 2010 Settlement: $750,000 to the state of MassachusettsThe 318-bed, Weymouth, Mass.-

Back 73

hospital shipped 3 boxes containing 500 unencrypted back-up computer tapes with protected health information (PHI) to be erased by Archive Data Solutions. The boxes then went missing, and only one has since been recovered.

Front 74

7.SUTTER MEDICAL FOUNDATION
Individuals Affected: 943, 434 When: Oct. 15, 2011 Settlement: 11 total lawsuits could amount to between $944 million and $4.25 billion The Sutter Health Sacramento, Calif.-

Back 74

based affiliate reported the theft of a company desktop computer containing clinical data and medical diagnoses information of patients. Moreover, the computer also contained limited demographic data of more than 3.3 million additional individuals.

Front 75

6.BLUE CROSS BLUE SHIELD OF TENNESSEE
Individuals Affected: 1,023,209 When: Oct. 2, 2009 Settlement: $1.5 million to U.S. Department of Health and Human Services
Chattanooga, Tenn.-

Back 75

health insurer reported stolen 57 unencrypted computer hard drives from one of the company’s leased facilities. The hard drives contained member demographic information in addition to

Front 76

6.BLUE CROSS BLUE SHIELD OF TENNESSEE
Individuals Affected: 1,023,209 When: Oct. 2, 2009 Settlement: $1.5 million to U.S. Department of Health and Human Services
Chattanooga, Tenn.-

Back 76

SSN, diagnosis codes and health plan identification numbers. BCBST paid over $6 mill for additional data encryption, and spent nearly $17 mill for protection, investigation and member notification.

Front 77

6.BLUE CROSS BLUE SHIELD OF TENNESSEE
Individuals Affected: 1,023,209 When: Oct. 2, 2009 Settlement: $1.5 million to U.S. Department of Health and Human Services
Chattanooga, Tenn.-

Back 77

The settlement paid to the HHS was the first enforcement action resulting from HITECH Breach Notification Rule.

Front 78

5. THE NEMOURS FOUNDATION
Individuals Affected: 1,055,489 When: August 10, 2011

Back 78

The foundation reported that three unencrypted backup tapes in a locked storage cabinet went missing from its Wilmington, Del. facility. The tapes contained patient names, addresses, dates of birth, Social Security numbers and personal health information.

Front 79

5. THE NEMOURS FOUNDATION
Individuals Affected: 1,055,489 When: August 10, 2011

Back 79

Employee, vendor and patient guarantor financial and demographic information were also included on the tape. The foundation offered individuals affected one year of free credit monitoring and credit protection.

Front 80

4.AVMED, INC.
Individuals Affected: 1,220,000 When: December 10, 2009
The Miami, Fla.

Back 80

based health insurer reported stolen 2 unencrypted laptops containing member names, DOB, addresses, SSN and PHI. both laptops were reported missing from a locked conference room.

Front 81

4.AVMED, INC.
Individuals Affected: 1,220,000 When: December 10, 2009
The Miami, Fla.

Back 81

Despite the breach occurring in 12/2009, the company waited until 2/2010 to notify members affected. The number of patients affected by the breach was initially pegged at 208,000; however, that number shot up to 1.22 million by June 2010.

Front 82

3.NY CITY HEALTH & HOSPITALS CORP’S NORTH BRONX HEALTHCARE NETWORK
Individuals Affected: 1,700,000 When: Dec. 23, 2010

Back 82

based health network reported 2 back-up tapes for 2 computer systems stolen from a vendor truck parked on a Manhattan street. The tapes contained 20 years of PHI of both employees, vendors and patients.

Front 83

3.NY CITY HEALTH & HOSPITALS CORP’S NORTH BRONX HEALTHCARE NETWORK
Individuals Affected: 1,700,000 When: Dec. 23, 2010

Back 83

The Bronx Healthcare Network includes Jacobi Medical Center, North Central Bronx Hospital, the Health Center at Gun Hill and the Health Center at Tremont. One year of free credit monitoring was provided to individuals affected.

Front 84

2.HEALTH NET, INC.; Individual Affected: 1,900,000 When: January 21, 2011; reported Mar. 14, 2011
The Woodland Hills, Calif
The company offered two years of free identity and fraud protection and identity theft insurance.

Back 84

HI Company lost nine 9 server drives on 1/2011 and waited two 2 months to report breach. The servers contained the SSNs, names, addresses, and health information of Health Net employees, members and providers.

Front 85

1.TRICARE MANAGEMENT ACTIVITY
Individuals Affected: 4,901,432 When: Sep. 14, 2011 Settlement: $4.9 billion sought in filed class-action lawsuit

Back 85

biggest HIPAA data breaches, lost back-up tapes containing personally identifiable and PHI from military beneficiaries’ EHR. According to officials, back-up tapes may have contained patient addresses, phone numbers, SSN, clinical data

Front 86

3 PILLARS OF INFORMATION SECURITY

Back 86

Confidentiality
Integrity
Availability