RHI Exam Prep: Domain Two - Compliance

Welcome to the presentation on RHI Exam Prep Domain Two, focused on compliance, emphasizing the disclosure of Protected Health Information (PHI).

HIPAA Compliance

• HIPAA: Health Insurance Portability and Accountability Act.
  • Focuses on protecting the integrity of PHI.
  • Compliance involves adhering to administrative, physical, and technical safeguards.

Key Terms

Protected Health Information (PHI)

• PHI: Patient data meant to be safeguarded, e.g., names, email addresses, social security numbers.
• Privacy Rule: Sets standards for the privacy of PHI.
  • Patients can request access, amendments, and disclosures of their records.

Security Rule

• Focuses on electronically protected health information (ePHI).

Breach Notification Rule

• Covered entities/business associates must notify affected parties if PHI is compromised.

Covered Entities

• Healthcare providers, plans, data clearinghouses.
• They electronically transmit/receive PHI.

Business Associates

• Third-party organizations handling identifiable health data on behalf of covered entities.

Notice of Privacy Practices (NPP)

• Document detailing how healthcare providers protect patient privacy.

HIPAA Identifiers

• 18 Identifiers considered PII (e.g., names, geographic data, dates, phone numbers, etc.).
• Removing these identifiers de-identifies data.

Department of Health and Human Services (HHS)

• Enhances health and well-being, advancing medicine and public health.

Office of National Coordinator (ONC)

• Supports adoption and exchange of health information technology.

HITECH Act

• Encourages electronic health record adoption.
• Adds privacy/security protections, financial incentives, and penalties.

Differences: HIPAA and HITECH

• HITECH supports HIPAA but allows patients to request access reports on ePHI disclosures.

Unique Identifiers

• Include HPID, NPI, EIN for covered entities.

Core Sets

• Specific codes (ICD-10, CPT, etc.) required for transactions.

Major Amendments

1. Security Rule Amendment (2003): Protects ePHI via safeguards.
2. Privacy Rule Amendment (2003): Ensures patient PHI protection.
3. Breach Notification Rule (2009): Sets breach notification requirements.
4. Final Omnibus Rule (2013): Additional requirements for entities/business associates.

Technical Safeguards

• Network encryption, access control, activity audits.

Physical Safeguards

• Facility access control, workstation management.

Administrative Safeguards

• Risk assessments, staff training, risk management.

Privacy Rule Amendment (2013)

• Sets standards for PHI privacy, responds to patient requests.

Breach Notification Rule (2009)

• Notify patients and HHS if over 500 records are breached.

Final Omnibus Rule (2013)

• Update agreements, privacy policies, and training to reflect changes.

Summary

• Importance of HIPAA and HITECH in securing healthcare information.
• Encouraged to take HIPAA quizzes for better understanding.

These notes provide an overview of HIPAA compliance and pertinent legislation impacting healthcare information privacy and security.