HIPAA FAQ

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996 and requires us to implement processes with respect to protected health information as well as inform individuals about how we protect their information.

HIPAA may not change your job significantly, but we will all be trained on what we need to know so we can ensure we protect health information from unauthorized use.

Since April 14, 2003, all health care providers and payers nationwide have had to train their staff and implement policies and procedures to provide uniform privacy rights.

Each one of us.

Confidential information is any health information or billing information that can be linked to an individual. If you know that John Jones was a patient and received treatment for a broken leg, this is confidential information. If you know that John Jones has Blue Cross insurance and was billed $5,000 for treatment for his broken leg, this is confidential information. If you know that during 2001, 185 patients were treated in the emergency department for ear infections, that is not confidential information because it does not identify the specific patients or list any identifiers such as birth date, medical record number, etc.

A good HIPAA privacy exercise is to put yourself in your person's shoes. As an individual, how would you like your caregivers to protect your personal health information? By limiting who sees or hears health information, you'll take the first steps to ensure our commitment to protecting health information.

If you have a question or concern about HIPAA privacy, contact Human Resources at 386-822-8710.

Most health plans and health care providers covered by the new Rule have been required to comply with the new requirements since April 14, 2003.

For the first time, the HIPAA Privacy Rule creates national standards to protect individuals' medical records and other personal health information.

• It gives patients more control over their health information.
• It limits how health records can be used and disclosed.
• It establishes appropriate safeguards that health care providers and others must achieve to protect the privacy of health information.
• It holds violators accountable through civil and criminal penalties for violating patients' privacy rights.
• It also balances public responsibility by allowing disclosure of some data, for example, to protect public health.

For patients:

• It means patients can make informed choices when seeking care and reimbursement based on how their personal health information may be used.
• It lets patients learn how their information may be used and about certain disclosures that have been made.
• It generally limits release of information to the minimum reasonably needed for the purpose of the disclosure.
• It generally gives patients the right to review and obtain copies of their health records and request corrections.
• It empowers individuals to control certain uses and disclosures of their health information.

The Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs.

By contrast, an "authorization" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. When the Privacy Rule requires patient authorization, voluntary consent is not enough to permit a use or disclosure of protected health information unless it also meets the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.

The Privacy Rule requires that an Authorization contain either an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. For example, an Authorization may expire "one year from the date the Authorization is signed," "upon the minor's age of majority," or "upon termination of enrollment in the health plan." An Authorization remains valid until its expiration date or event, unless effectively revoked in writing by the individual before that date or event. The fact that the expiration date on an Authorization may exceed a time period established by State law does not invalidate the Authorization under the Privacy Rule, but a more restrictive State law would control how long the Authorization is effective.

Individuals do not have a right under the Privacy Rule at 45 CFR 164.522(a) to request that a covered entity restrict a disclosure of protected health information about them for workers' compensation purposes when that disclosure is required by law or authorized by, and necessary to comply with, a workers' compensation or similar law. See 45 CFR 164.522(a) and 164.512(a) and (l).

No. The Privacy Rule is not intended to impede the flow of health information to those who need it to process or adjudicate claims, or coordinate care, for injured or ill workers under workers' compensation systems. The minimum necessary standard generally requires covered entities to make reasonable efforts to limit uses and disclosures of, as well as requests for, protected health information to the minimum necessary to accomplish the intended purpose. For disclosures of protected health information made for workers' compensation purposes under 45 CFR 164.512(l), the minimum necessary standard permits covered entities to disclose information to the full extent authorized by State or other law. In addition, where protected health information is requested by a State workers' compensation or other public official for such purposes, covered entities are permitted reasonably to rely on the official's representations that the information requested is the minimum necessary for the intended purpose. See 45 CFR 164.514(d)(3)(iii)(A).

For disclosures of protected health information for payment purposes, covered entities may disclose the type and amount of information necessary to receive payment for any health care provided to an injured or ill worker.

The minimum necessary standard does not apply to disclosures that are required by State or other law or made pursuant to the individual's authorization.

Yes. A covered entity is permitted to disclose an individual's protected health information as necessary to comply with, and to the full extent authorized by, workers' compensation law. See 45 CFR 164.512(l).

Covered entities are permitted to disclose protected health information for such purposes as authorized by, and to the extent necessary to comply with, workers' compensation law. See 45 CFR 164.512(l). In addition, the Privacy Rule generally permits covered entities to disclose protected health information in the course of any judicial or administrative proceeding in response to a court order, subpoena, or other lawful process. See 45 CFR 164.512(e)

Stetson University is a hybrid entity, and certain health plans fall under HIPAA regulation; the Student Health Clinic is covered by the new HIPAA rules and regulations. The HIPAA rules protect the privacy and security of "protected health information," or PHI. Practices that explain the new regulations. Students and employees who visit the Student Health Clinic here on campus will receive a slightly different notice.

The "P" in PHI means that Stetson University must protect and maintain certain privacy standards related to individually identifiable health information. The "H" for health generally refers to medical or dental records, but it can also refer to the type of health insurance coverage an employee chooses. For example, Susie Smith's employment at Stetson, family coverage, and the BCBS Premium Plan would be considered "PHI." HIPAA covers any health-related information that identifies an individual and is obtained at our clinic or through our insurance programs for medical, dental, vision, and prescription drugs, as well as the health care Flexible Spending Account and Employee Assistance Program. Information under the Workers' Compensation laws or the Family and Medical Leave Act is not covered under HIPAA.

HIPAA laws require the Office of Human Resources not to discuss your personal health information with anyone else unless you approve it. Generally, this means that if you tell us in person to speak with your spouse about your claims issue, we will be happy to do so. If you call or email us, we may ask you to fill out and give us an Authorization to Release Information that tells us what information you want discussed and to whom we can discuss it with. All of the HIPAA-related forms are on the Office of Human Resources website at www.stetson.edu/hr or can be picked up from our office.

That is correct. A parent or legal guardian of a minor child (under age 13 for health information) is automatically considered to be that child's Personal Representative and the Office of Human Resources will be happy to assist you with any claims issue.

Yes, HIPAA regulations require that the Office of Human Resources needs your permission to speak with anyone about each claims issue or question. We know this can be bothersome, but the regulations were designed to protect each individual from having their information released without permission. In an emergency, public health risk, or at the request of law enforcement, the HR office will disclose information without your written approval.

In general, the Office of Human Resources retains the benefit enrollment forms you complete as a new employee or during annual open enrollment. Most health-related information is kept in summary form for billing. The Office of Human Resources can use your PHI for 3 purposes: treatment, payment, or operations. The Student Health Clinic keeps personal and confidential medical files that no one on campus can see.

HIPAA officials won't fine you for a prayer request, but many employees don't want their personal health condition discussed. We encourage everyone to be especially careful about what information you include in an email.

Of course. HIPAA regulations do not impede free speech.

Yes, you can. HIPAA rules specifically do not cover the employment relationship. The handbook's sick leave and FMLA policies still apply. Do not share specifics with the rest of your department about why the employee is absent.

Example: Don't say, "Jen won't be in her office today because she says the dust from the new carpet aggravates her allergies."

Example: Do say, "Jen has a medical condition, so we are letting her work the phones today instead of having her work in her office."

We have identified all employees with access to PHI, and they will receive special training to ensure they understand and comply with regulations. We want to make sure that your private health information is kept confidential in every way possible.

The Office of Human Resources website at www.stetson.edu/hr includes HIPAA policies and forms, as well as several related links for review.