Overview
This lecture covers the Health Insurance Portability and Accountability Act (HIPAA) and the essential responsibilities pharmacy technicians have in protecting patient information and maintaining privacy standards.
Introduction to HIPAA
- HIPAA was enacted in 1996 to safeguard personal health information (PHI) while enabling effective healthcare delivery.
- PHI includes any patient-identifiable data about physical or mental health, past, present, or future.
Pharmacy Technicians’ Responsibilities
- Pharmacy staff can only share PHI with those directly involved in a patient’s care: the patient, prescriber, or health insurance.
- Information sharing must follow the "minimum necessary" standard—only disclose what is needed for the other party’s role.
- Techs should only access the information required for their specific job duties.
Privacy Practices and Compliance Procedures
- New patients must sign a HIPAA privacy acknowledgement; pharmacies retain these records for six years after their last service date.
- Selling patient information is strictly forbidden without explicit patient consent.
- Staff receive annual HIPAA compliance training.
- Every healthcare facility has a designated HIPAA Privacy Officer.
- Access to PHI is regularly reviewed and revoked immediately for departing employees.
Best Practices for Pharmacy Technicians
- Avoid casual conversations about patients or their medications with colleagues.
- Protect computer screens displaying PHI from unauthorized viewing.
- Maintain low voices when discussing sensitive information with patients.
- Store files securely and lock them up when not in use.
- PHI must be destroyed by shredding or incineration; never discard in regular trash.
HIPAA Breaches and Penalties
- Breaches may result in fines up to $250,000 and up to 10 years in jail.
- HIPAA protects both patients and healthcare staff.
- When in doubt, consult a pharmacist or pharmacy manager regarding privacy concerns.
Key Terms & Definitions
- HIPAA — Health Insurance Portability and Accountability Act; ensures protection of health information.
- PHI (Protected Health Information) — Any personal health information that identifies a patient or their health status.
- Minimum Necessary Standard — Rule to limit PHI disclosures to only what is needed for a specific purpose.
- HIPAA Privacy Officer — Appointed individual responsible for HIPAA training and privacy issues.
Action Items / Next Steps
- Complete annual HIPAA training.
- Secure and store all PHI according to policy.
- Consult your HIPAA Privacy Officer or supervisor if you suspect a possible privacy breach.