HIPAA Privacy Training & Certification Program

Privacy Rules

• Privacy Concerns
• Impact On State Law
• Legislative Background
• Legislative Background: Privacy Concerns
• The HIPAA Privacy Rules
• Legislative Background: Impact On State law
• Enforcement
• Compliance

Protected Health Information

• What Information Is Protected?
• Health Information (HI)
• Individually Identifiable Health Information (IIHI)
• Protected Health Information: Psychotherapy Notes
• Benefits Excepted From HIPAA Privacy Rules
• Protected Health Information (PHI)
• Protected Health Information (PHI)
• Excepted Benefits
• Exempted Health Information

Covered Entities

• Health Plan Defined
• Health Plans Specifically Identified By The Privacy Rules
• Exceptions To The Definition Of Health Plan
• Employers
• Impact On Employer/Plan Sponsors
• Affiliated Covered Entities
• Covered Entities
• Health Plans Specifically Identified By The Privacy Rules
• Health Care Clearing Houses
• Health Care Providers
• The Hybrid Entity
• Multiple Covered Functions
• Organized Health Care Arrangements
• Business Associates

Business Associates

• Business Associate Agreement: Additional Modifications
• Business Associate Agreement: Additional Contract Elements
• Business Associate Agreement: Other Arrangements
• Responsibilities Of The Covered Entity
• Disclosure Of PHI To Business Associates
• Business Associates
• Business Associates: Disclosure of PHI
• Business Associates: Business Associate Agreement
• Additional Contract Elements
• Additional Modifications

Use And Disclosure Of PHI

• Required Disclosure
• Examples Of Potential Disclosure Of PHI
• Requesting PHI And The Minimum Necessary Standard
• Rights Of The Individual
• Restrictions On Individual Rights
• Disclosure Of PHI
• Disclosure Of PHI
• Authorization
• Authorization
• Exceptions To The Authorization Requirements
• Minimum Necessary Standard
• Requesting PHI And The “Minimum Necessary” Standard
• Exceptions To The Minimum Necessary Standard
• Individual Rights
• Security Breach Notification Rules

Use And Disclosure For Treatment, Payment, And Health Care Operations (TPO)

• Repeal Of The Consent Requirement
• Use And Disclosure Requiring No Authorization
• Disclosure Of PHI To Parents Of Minor Children
• Use And Disclosure For TPO: Psychotherapy Notes
• Identifying Codes
• Treatment, Payment And Health Care Operations
• Repeal Of The Consent Requirement
• Use And Disclosure For Treatment, Payment, Or Health Care Operations (TPO)
• Use And Disclosure For Treatment, Payment, Or Health Care Operations (TPO)
• De-Identified Information
• De-Identified Information

Use And Disclosure For Other Activities

• Marketing
• Research
• Documentation Of Waiver Approval
• Fundraising
• Underwriting
• Law Enforcement
• Accounting Of Disclosures Of PHI

Privacy Notice Requirements

• Timing Of Issuance Of The Privacy Notice
• Electronic Notices
• Organized Health Care Arrangements
• Responsibilities
• Timing Of The Privacy Notice
• Content Of Privacy Notice
• Rights Of Individuals
• Content Of Privacy Notice
• ACA Non-Discrimination Notices

Administrative Requirements

• Privacy Official
• Designated Contact Person
• Refraining From Intimidating Or Retaliatory Acts
• Policies and Procedures
• Training
• Grievance Procedure
• Other Duties
• The Fully-Insured Group Health Plan
• Administrative Requirements: Covered Entities
• Covered Entities
• Exception

Privacy And The Plan Sponsor

• Plan Documents
• Restrictions
• Certification Of Compliance
• Summary Health Information
• Americans With Disabilities Act (ADA)
• Family And Medical Leave Act (FMLA)
• State Privacy Rules
• The Fully-Insured, Employer-Sponsored, Group Health Plan
• Self-Insured, Employer-Sponsored, Group Health Plans
• The Employer/Plan Sponsor
• The Employer/Plan Sponsor

Other HIPAA Administrative Simplification Standards

• Other Simplification Standards: Electronic Transactions
• Electronic Transactions: Security Requirements
• Covered Entities
• Electronic Transactions: Covered Entities
• Electronic Transaction Codes
• Security Standards
• Electronic Transactions: Enforcement
• Security Standards

Sample Notices

• Sample Business Associate Contract Provisions
• Sample Notice Of Privacy Practices
• Sample Authorization Form

HIPAA Privacy Rules Summary

• Action Items