Purpose

The purpose of this policy is to define how the Oregon Primary Care Association (“OPCA”) will meet the Health Insurance Portability and Accountability Act (HIPAA) requirements for the use and disclosure of Protected Health Information (PHI). OPCA is committed to protecting the privacy of our patient’s information, and OPCA provides protections to individually identifiable health information that OPCA is in possession of.

Scope

This policy applies to OPCA and its subsidiaries (including but not limited to the Oregon Network of Community Health Centers [“ONCHC” or “The Network”] and its subsidiaries) employees, the Boards of Director, temporary employees, contractors, students, interns, consultants, and others who may have access to OPCA members’ patient information of any kind, including information that is used for compliance activities, claims processing, member
services, and quality improvement.

Policy

It is the policy of OPCA to protect the confidentiality, integrity and availability of patient information belonging to our member’s patients. OPCA will protect that information in a manner that will comply with State and/or Federal privacy laws. OPCA will incorporate portions of this policy, consistent with State and Federal law, into any applicable Human Resources policies.

Definitions

  1. Covered Entity: A type of covered entity is a healthcare provider that conducts certain electronic transactions, including billing and eligibility information. Covered entities are also health plans, and healthcare clearing houses.
  2. Business Associate: A business associate is an individual or organization that is not part of a covered entity’s workforce, who provides a service or performs a function for a covered entity which requires the use of PHI. For example, claims processing, data analysis, and/or practice management.
  3. HIPAA: The Health Insurance Portability and Accountability Act, as defined in 45 CFR Parts 160, 162, and 164.
  4. Inappropriate Disclosure: Inappropriate disclosure of PHI is the release of information, transfer of information, provision of information, and access to or divulging patient information in any manner outside the entity holding the information that has not been authorized by the member or the member’s patient.
  5. Joint Venture: A legal arrangement between two or more entities to provide services, products or both.
  6. Organized Healthcare Arrangement (OCHA): An arrangement or relationship that allows two or more covered entities who participate in joint activities to share protected health information about individuals in order to manage and benefit their joint operations. This includes utilization review decisions which are reviewed by other participating covered entities; quality improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf. OHCAs also include multiple entities holding themselves out to the public as participating in a joint enterprise and participating in joint activities. IPAs (Independent Practice Associations) that engage in utilization reviews, credentialing and other health care operations are good examples.
  7. Privacy Rule: The part of the HIPAA regulations that is related to the privacy of PHI, and is outlined in 45 CFR Subpart E.
  8. Designated Privacy Official: OPCA has a Deputy Director, who is the designated Privacy Official under the HIPAA regulations.
  9. Protected Health Information (PHI): PHI is any information including demographic information that is created or received by a covered entity and which relates to:
    1. The past, present or future physical or mental health or condition of an individual
    2. The past, present, or future payment for the provision of healthcare to an individual, and that identifies the individual or there is a reasonable basis to
      believe that the information can be used to identify the individual.
    3. PHI includes information concerning a person that is living or deceased and may be in written, oral or electronic format. There are 18 identifiers that the Privacy regulation says can be used to identify a person including:
      1. Name
      2. All geographic subdivisions of a state, including street address, city, county, zip code, and zip code except for the first three digits in a zip code
      3. All dates directly related to the individual, including birth date, admission date, discharge date, date of death, (except for the year)
      4. Telephone number
      5. Fax number
      6. E-mail address
      7. Social Security Number
      8. Medical Record Number
      9. Health plan beneficiary number
      10. Account number
      11. Certificate/license number
      12. Vehicle identifiers and serial numbers
      13. Device identifiers and serial numbers
      14. URL addresses
      15. IP addresses
      16. Biometric identifiers, including fingerprints
      17. Full-face photographs and any comparable images
      18. Any unique identifying number, characteristic or code
    4. PHI excludes individually identifiable health information:
      1. In education records covered by the Family Educational Rights and
        Privacy Act, as amended, 20 U.S.C. 1232g
      2. In records described at 20 U.S.C. 1232g(a)(4)(B)(iv)
      3. In employment records held by a covered entity in its role as employer
      4. Regarding a person who has been deceased for more than 50 years

Requests for Individually Identifiable Information

Requests for access to a patient’s printed medical data or requests for electronic access to a patient’s medical data will be referred to the Deputy Director for processing. Requests will be responded to within 30 days.

Sensitive Information

Certain information contained within medical records is particularly sensitive. For example drug and alcohol treatment information, mental health records, Human Immunodeficiency Virus (HIV), and genetic testing information. The electronic medical record (EMR) may contain sensitive information as well as other treatment information that may require a special authorization before it can be released. It is not a breach of PHI for this information to be contained within the EMR. The Deputy Director will determine who needs access to any PHI, including any sensitive information, and each user’s security for access within the electronic medical record and practice management system will need to be set accordingly.

Confidentiality

Confidentiality means keeping private information private. OPCA employees, contractors, and students must not discuss PHI with anyone, unless it is directly required in order to perform their job duties. Conversations about confidential information should be conducted in a manner that preserves the confidentiality of the information. Employees, students, interns, vendors and contractors must not access or review individual’s health information contained in any of the OPCA databases or on paper for any reason other than to perform their job duties.

Confidentiality Agreements

Employees, contractors, consultants, students and others are required to sign a confidentiality agreement as part of the conditions of their employment or their relationship with OPCA. Confidentiality agreements should be signed by individuals if the individual may have the occasion to see or hear information about a patient, however, seeing or hearing that information is not part of their duties at OPCA. For example, OPCA may hire a temporary agency person to help OPCA with yearend accounting, but their primary duties will not involve seeing or using PHI.

Employees, contractors, consultants, interns and students who violate the OPCA confidentiality agreement are subject to disciplinary action, up to and including termination of employment, or termination of contract. The individual may also be held personally responsible for violation of the confidentiality agreement.

Business Associate Agreements

Business Associate Agreements (BAA) are required to be agreed to between organizations when one organization is using PHI belonging to OPCA in order to or  as part of providing a service to OPCA.

BAAs will specify that the business associate agrees to comply with OPCA’s privacy and security policies, including reporting security incidents and breaches of unsecured PHI to OPCA as required under Breach Notification Rule, and ensure subcontractors agree in writing to the same restrictions and conditions that apply to business associates and that they will limit their access to any PHI to the minimum necessary in order to fulfill their obligations to OPCA. The
agreement also will state that the business associate will limit access to PHI by other companies performing work for the business associate, such as software vendors.

BAAs are not required unless PHI is being used by a business associate on a routine basis in order to provide services to OPCA. Incidental viewing of PHI does not require that a BAA be signed. For example, the US Postal Service does not need to sign a BAA, even though they may pick up and deliver mail that contains PHI.

Breach of Confidentiality

A breach of confidentiality occurs when an OPCA employee, consultant, intern, student, vendor, subcontractor, or business partner accesses, releases, reviews or discusses a patient’s PHI for any reason that is not directly related to the performance of their job duties, and without permission of the clinic, provider or the patient. Breaches of confidentiality must be reported to the Deputy Director and the Senior Data Strategy Director, immediately. Individuals who report breaches will be protected from any retaliation from the employee who was reported for breaching patient confidentiality, or from OPCA’s management.

Privacy Training

All OPCA employees, consultants, contractors, interns and students who access PHI or PHIcontaining systems must complete OPCA confidentiality training. Confidentiality training will be completed as part of new employee orientation during the first week of employment, and at a minimum, annually thereafter. Periodic privacy reminders may be sent via e-mail, newsletter, website, US mail.

Documentation of employee privacy training will be kept in the employee’s file.

Printing PHI

Printing PHI is discouraged unless it is needed for document decisions that were made regarding a member or a member’s patient. Any printed PHI must be shredded or put in the locked shredder bin after it has been used for its intended purpose. It is not acceptable to put the un-shredded PHI in a recycle box, or the garbage can.

Printed confidential information that needs to be routed to another individual at OPCA should be enclosed in a protective envelope. If printed confidential information must be kept for a period of time, it must be placed in a locked location that only has limited access to others.

Privacy Official

OPCA has designated the Deputy Director as the Privacy Official under the HIPAA Privacy regulation. Questions regarding privacy of member or patient information should be directed to the Deputy Director for clarification.

Reference

45 CFR 160.103 Definitions
45 CFR 164.314
45 CFR 164.410
45 CFR 164.502-164.514
45 CFR 164.532