1 of 21

HIPAA PRIVACY

2 of 21

Objectives

Identify HIPAA regulations

Recognize patients’ rights to protect health information

Demonstrate knowledge of methods to protect patient information

3 of 21

Agenda

Introduction

Identifying HIPAA Regulations

Recognizing Patients’ Rights

Methods to Protect Patient Information

Summary

4 of 21

Introduction

How would you rate your personal knowledge of

HIPAA regulations?

Follow this link provided in chat: https://www.menti.com/v89djxvtxa

OR scan this QR code to join:

Enter this code to vote: 1834 0583

Answer the question

Timing: 4 minutes (1 min. setup, 1 min. activity, 2 min. debrief)

DO:

AHEAD OF TIME- Login to Mentimeter and make sure it is set for accepting answers- reset for each session to get accurate results.

We will need the URL for the participants, the URL to display results, and the code. They may also use the QR code. NOTICE code will change every 7 days. You must get the updated code from your Mentimeter login.

SAY:

Welcome to Harvey’s Heart Hospital. We want to ensure that all hospital staff have a clear understanding of HIPAA regulations. Before we get started, I would like to see how you feel about your current knowledge of HIPAA regulations. Let’s complete this activity. Answer this question: How would you rate your personal knowledge of HIPAA regulations?

Follow the link provided in chat to answer the question shown on the screen. You may also scan the QR code with another device if you prefer.
Once you click the link, you will be asked for a code. Enter _______________.
Once everyone responds to the question, a graph will be created with the answers.
Make sure you submit at the bottom after entering your answer.
Once you hit submit, return back here and click on the thumbs up emoji in Zoom. This is the signal telling me you are ready to move on.
You will have 1 minute, starting now.

DO:

Put the link in the chat
Monitor ZOOM to see when all participants have returned and are ready to move on.
Once all participants have completed the Mentimeter activity, display results on the screen. Debrief and discuss where the majority are in their knowledge of HIPAA currently. This will help you know what type of audience you have.

SAY:�As you can see, there are many different levels of familiarity with HIPAA regulations. Let’s learn more! �

Producer Notes:

While Facilitator is introducing the activity, navigate to the Mentimeter website and login.
Click on the preset graphing activity for HIPAA Regulations Intro.and go into presentation mode.
Post a link in the chat to the “How would you rate your personal knowledge of HIPAA regulations?” Mentimeter page.
Switch the screen from the PowerPoint presentation to the Mentimeter page so the participants can see it in real time.
Keep track of time using the timing instructions provided.
Allow 30 seconds to a minute for participants to answer.
Grab a screenshot of the Mentimeter results so the ideas that are shared can be sent out after the conference.
Switch back to PowerPoint mode when Facilitator is ready to continue.

(ADVANCE SLIDE)

5 of 21

Identifying HIPAA Regulations

6 of 21

Health Insurance Portability �and Accountability Act (HIPAA)��

In 1996, it established national standards protecting the privacy and security of medical records and personal health information.

This includes, but not limited to:

Patient demographics (name, address, Social Security number, date of birth, etc.)

Billing statements

Beneficiary data

Claims data

Medical records

7 of 21

Three Rules of HIPAA

Follow the link provided in chat to read about the three rules of HIPAA.

You will need this information to complete the next activity:

https://wakelet.com/wake/RqsX70Ck2JTer45sNnhjC

OR

Scan the QR code:

Timing: 7 minutes (1 min. set up, 5 min. reading, 1 min. debrief)

DO:

AHEAD OF TIME- Login to Waklet and make sure the link to the article is working.

We will need the URL for the participants. They may also use the QR code to access the Wakelet.

SAY:

Since 1996, additional rules and regulations have been added to HIPAA. Today, we will be reading an article that focuses on the three main rules.

Follow the link provided in chat to READ about the three rules of HIPAA. You may also scan the QR code with another device if you prefer to access the article that way.
Once you click the link, you will need to read the article carefully. You will need this information to complete the next task.
Feel free to make notes about each rule as you read the article so you can refer back to them in our activity.
Once you have finished reading, return back here and click on the thumbs up emoji in Zoom. This is the signal telling me you are ready to move on. Please take your time reading to ensure you understand each rule.
You may now begin.

DO:

Click on the link to display the article on the screen so participants will know they are on the right article.
Monitor ZOOM to see when all participants have returned and are ready to move on.

Say:

I hope you were able to learn something new about the three rules of HIPAA. Each rule has an important role in keeping personal health information secure. Let’s use this information as we move on to our next activity.

Producer Notes:

While Facilitator is introducing the activity, navigate to the Wakelet website and login.
Ensure that the link is working to take participants to the article.
Post a link in chat to “Three Rules of HIPAA” article.
Switch the screen from the PowerPoint presentation to the Wakelet link so participants can ensure they are on the right page.
Keep track of time using the timing instructions provided.
Switch back to PowerPoint mode when Facilitator is ready to continue.

(ADVANCE SLIDE)

8 of 21

Padlet Activity

https://padlet.com/mandyharvey1217/7ujvy12zklo3v1lg

Let’s see what you know about the three rules of HIPAA.

Follow this link provided in chat :

Create a brief list of the three rules and at least ONE thing you know for each.

Timing: 8 minutes (1 min. set up, 5 min. activity, 2 min. debrief)

DO:

AHEAD OF TIME- Login to Padlet and make sure it is ready to accept answers- reset for each session.

We will need the URL for the participants, which will show results in LIVE time.

SAY:

Let’s see what you learned about the three rules of HIPAA. We will be completing an activity on Padlet.
Each person will create a brief list of the three rules, giving ONE thing you learned about each rule.
For example, you will type Privacy Rule, and give one thing you learned. Continue doing that for the other two rules as well.
As each person completes their response, you will be able to see their thoughts in Padlet.
Once you have finished creating your response, return back here and click on the thumbs up emoji in Zoom. This is the signal telling me are ready to move on.
You will have five minutes to complete this activity. You may now begin.

DO:

Click on the link to display the Padlet on the screen.
Monitor ZOOM to see when all participants have returned and you are ready to move on.

Say:

Let’s see what we learned.

EXAMPLES to know:

PRIVACY RULE: designates which organizations are responsible under HIPAA, what is protected health information, how organizations can share, and patient’s rights
SECURITY RULE: sets standards for what is protected in ELECTRONIC format; includes what you create, receive, store, or send; requires risk analysis for organization
BREACH NOTIFICATION RULE: requires organization to send alerts of a breach within 60 days. Must alert affected individuals, Health and Human Services (if more than 500 people), media if necessary

DO:

Go over each Padlet quickly to compare similar and different responses.
Cover any information from example above that was not given by participants.
Give positive feedback to all participants.

Producer Notes:

While Facilitator is introducing the activity, navigate to the Padlet website and login.
Ensure that the link is working to take participants to the article.
Post a link in chat to “Three Rules of HIPAA” Padlet.
Switch the screen from the PowerPoint presentation to the Padlet link so participants can see responses live.
Keep track of time using the timing instructions provided.
Switch back to PowerPoint mode when Facilitator has completed going over Padlet and is ready to continue.

(ADVANCE SLIDE)

9 of 21

Recognizing Patients’ Rights

10 of 21

Notice of Privacy Practices

Our Notice of Privacy Practices must be signed and kept on file for each patient.

It includes:

Hospital’s duties with respect to patient privacy

Ways we can use and disclose patient information

How patients can express concerns about our hospital or its team members in regards to patient privacy

We need patients to give permission before we can give information to others on their behalf.

Timing: 1 min.

SAY:

Now, let’s talk about the Notice of Privacy Practices.

Our hospital issues a Notice of Privacy Practices form to each patient upon beginning of care. It is updated annually, or more frequently if changes have been made to the policies.
This form MUST be signed by the patient, or guardian in the case of a minor, and kept in the patient’s file.
The Notice of Privacy Practices includes:

Our hospital’s duties regarding patient privacy – what we are responsible for.
Identifies ways we are allowed to use and disclose patient information – We want to make sure they are aware of their rights, but also understand what we are allowed to share and why.
Informs patients how they can express any concerns about our hospital or staff regarding patient privacy issues – This gives a sense of transparency and helps to establish trust in our service.

We MUST have permission from the patient before we can give information to others on their behalf. No exceptions can be made!!!

�

(ADVANCE SLIDE)

11 of 21

Patients’ Rights

Due to HIPAA laws, all patients have the right to:

Request access to health information

Request to amend their health information

Request restrictions to information sharing

Request accountability of disclosures

YOU can’t talk about patients to anyone outside of hospital employees taking care of them.

Timing: 2 min.

SAY:

Now, let’s think about the rights for each patient. Our patients are important to us, and we must treat them with kindness and respect.
At Harvey’s Heart Hospital, we want to provide the highest level of care, while honoring and respecting the patients’ privacy.
HIPAA laws help to protect patients’ and give them specific rights.

Patients may request ACCESS to health information. They may request to see or receive copies of any health documentation or information on file.
Patients can request to AMEND their health information and medical records, but it is up to the provider to decide whether or not to do it. We have no more than 60 days to act on the request.
Patients can request RESTRICTIONS to sharing their information. Please note, we are required to agree to the request to restrict disclosure to the health plan if the individual or person on individual’s behalf pays for the item or service out of pocket in full.

DO:�Give time for any questions for clarification.

(ADVANCE SLIDE)

12 of 21

Methods to Protect �Patient Information

Timing: 2 min.

SAY:

Now that we know what rights each patient has, let’s think about ways we can help protect confidential health information. Each employee must do their part to ensure confidentiality is maintained.

Think for just a moment about all the locations in the hospital. (Pause a few seconds to allow participants to think of areas.)
This could include areas like hallways, exam rooms, reception desk, restrooms, etc.
Now, think about locations that normally contain personal health information. (Pause again for a few seconds.)
This information could include written records and files, computer records, billing, or even verbal conversations.
Now, I want you to think about which areas of the hospital are actually SECURE. (Pause for a few seconds to allow participants to think.)

We should only have discussions regarding health information in a secure location.
We must be aware of where we are, and who is there.

(ADVANCE SLIDE)

13 of 21

Protecting Patient Information: Conversations

Discussions regarding health information should only take place in secure locations.

THINK TWICE before sharing in locations like the ones shown below. These are NOT secure locations.

elevator

waiting room

cafeteria

Timing: 2 min.

SAY:

One way we can work to protect patient information is in our conversations.
In our jobs, conversations regarding patient care and health information occur regularly.
We need to train ourselves to THINK TWICE before speaking about confidential information.
We MUST make sure we are in a secure location, being aware of WHERE we are and WHO is there.
For example, discussions in an elevator with anyone other than the patient, or someone they have given permission to discuss health information with, would be a violation of HIPAA.
This would also apply in other areas of the hospital, such as waiting rooms and cafeterias.
You must be aware of people around you that may overhear the conversation. If they are able to hear personal health information, this would be a breach of confidentiality.

ALSO, remember HIPAA applies to conversations about personal health information no matter WHERE you are.
You could be at the grocery store, your child’s soccer game, walking in your neighborhood, the nail salon, etc.
You must ALWAYS keep patient health information confidential. No exceptions!

�

(ADVANCE SLIDE)

14 of 21

Protecting Patient Information: �Ask Permission

ALWAYS ask permission from the patient before speaking about health information in front of visitors or family members.

Timing: 1 min.

SAY:

Another way we can work to protect patient information is asking the patient’s permission.
We must ALWAYS ask permission from the patient before speaking about health information in front of visitors or family members.
Let’s say you go into a hospital room to discuss an update for your patient’s care.
They may have other family members or visitors in their room.
BEFORE you speak about medical information, you must ASK the patient if it is ok to do so.
If the patient is not comfortable or does not give you permission to speak in front of others, you may ask the others to step out of the room or come back if you are able to wait.

AGAIN, we need to train ourselves to THINK TWICE before speaking about confidential information.
We MUST make sure we are in a secure location, being aware of WHERE we are and WHO is there.�

(ADVANCE SLIDE)

15 of 21

Protecting Patient Information: �Written Documents

Do NOT leave client records, files and other written documents on your desk or in the open where they can be seen by others.

Timing: 2 min.

SAY:

We can also work to protect patient information by maintaining confidentiality of written documents.
Medical records may be on paper, in a file, or kept on a computer.
BOTH are protected under HIPAA and must be kept confidential.

Use extra caution NOT to leave client records or files out where someone else might see them.
They should not be left on your desk or anywhere that allows access from others to open them and read the information.
This information is to always be kept confidential and protected.

Also, your computer records must NOT be left open and accessible.
Let’s say you are working on a patient’s file on the computer and need to take a restroom break.
You must “lock” your computer so it is not accessible to be seen or tampered with while you are away.

AGAIN, we need to train ourselves to THINK TWICE before walking away from an area when we are dealing with confidential information.
We MUST make sure we keep all personal health information in a secure location.�

(ADVANCE SLIDE)

16 of 21

Activity:

Protecting Patient Information

Steps for Breakout Activity:

Choose a location, either INSIDE or AWAY from the hospital, where conversation occurs.
Distinguish WHO is present during the conversation
State what the patient is asking
Determine HOW you will handle the situation
Explain WHY you handled it this way.

You will complete each task on a “sticky note” on the

ZOOM Whiteboard.

Timing: 17 min (2 min. prep, 10 min. activity, 5 min. share- approx. 1 minute for each group)

DO:

AHEAD OF TIME:

Prepare to split participants into four breakout room groups on ZOOM.
Prepare Whiteboard activity on ZOOM using 2 X 2 Grid template. Each section will be designated for a group.

(ACTIVITY EXAMPLE):

Location – daughter’s dance recital
Conversation between self (doctor) and the patient (other child’s parent)
Patient asks for an update on their bloodwork or status of a claim
Give information on HOW to handle the situation and WHY

SAY:

We will now do a small group activity using breakout rooms.
I will divide you into four groups where you will work together to complete this activity.
Once you are in the breakout room, you will need to determine a few things. Each of these tasks will be “logged” onto a sticky note in the whiteboard activity.

1) Choose a location either INSIDE or AWAY from the hospital where a patient conversation will occur.
If you choose a location away from the hospital, it could be something like in a grocery store, at soccer practice, on a walk in the neighborhood, etc.
2) Distinguish WHO the conversation will include. For example, billing clerk (you) and patient or maybe a nurse (you), the patient, and their friend.
3) State what the patient is asking, such as an update on their blood work, billing situation, test results, etc.
4) Determine HOW you will handle the situation
5) Explain WHY you handled it this way

As soon as you are placed into the breakout room, I will let you know which color of sticky notes of the whiteboard you will be completing.
You will have 10 minutes to complete this task. Then, I will bring everyone back to ZOOM where we can share.
Are there any questions?
Great! You may begin working as soon as you get into the breakout room.

DO:

Divide into four breakout rooms.
“Enter” each room and assign a color to be used for their section of the whiteboard: 1)yellow, 2)green, 3)orange, 4)blue
Check with each group to make sure they understand directions
Set timer for 10 minutes, then bring everyone back to main ZOOM screen.
Allow share time for each group.

SAY:

Welcome back! Let’s see what each group came up with.

DO:

Go through each group, allowing them to share their scenario and why they chose to handle it that way. Give feedback as needed.

SAY:

Great job, everyone! Now, let’s continue to finish up this course.

Producer Notes:

While Facilitator is introducing the activity, prepare the ZOOM Whiteboard activity using the 2 X 2 Grid template.
Prepare to split participants into four breakout room groups.
Once the Facilitator gives instructions, send participants into breakout rooms to complete activity.
Set timer for 10 minutes.
Monitor the chat for any issues or questions.
At end of 10 minutes, bring all participants back to ZOOM screen to share.
Switch to whiteboard screen for all to see group feedback and discuss.
Switch back to PowerPoint mode when Facilitator is ready to continue.�

(ADVANCE SLIDE)

17 of 21

Emergency Situations

In an emergency situation, it may be necessary to share Protected Health Information (PHI) quickly and possibly in a way in which others cannot be prevented from seeing or hearing it.

These situations are referred to as Incidental Disclosures.

18 of 21

Violations

Sharing patient information for any reason other than the allowed work-related purposes is a violation of HIPAA’s Privacy Rule.

Our hospital will enforce corrective action for staff found in violation of organizational privacy policies.

Remember, violations may result in loss of license, fines, jail time, and civil lawsuits.

Timing: 2 min.

SAY:

HIPAA regulations are federal law and must be followed and will be enforced.
Sharing any patient information for ANY reason other than what is allowed for your specific work-related purposes is a violation of HIPAA’s Privacy Rule.
For example, if you are in billing, you may only access patient information that is required to fulfill your job duties. You are not allowed to look further into the patient’s records for more details.

At Harvey’s Heart Hospital, we take these violations very seriously.
Our hospital will enforce any necessary corrective action for staff who violate these privacy policies.

REMEMBER: Violations of any type may result in a loss of your license to practice, fines, jail time, and even cause civil lawsuits.
It is critical that every staff member understand their responsibilities and do their part in maintaining confidentiality.
We are counting on you.�

(ADVANCE SLIDE)

19 of 21

Follow this link provided in chat for the Kahoot! Quiz:

https://kahoot.it/challenge/0384290?challenge-id=76b459ee-c7e6-4f30-925d-49c42dbfa1cb_1661896240085

Enter Game PIN: 0384290

Answer the quiz questions carefully.

Timing: 22 min. (1 min. prep, 20 min. Quiz, 1 min. debrief)

AHEAD OF TIME- Login to Kahoot! and make sure the quiz is set for accepting answers- adjust dates to allow for submissions.

We will need the URL for the participants and the Game PIN.

SAY:

Now, let’s see what you have learned about HIPAA regulations.

You will be taking a quiz on Kahoot!

Follow the link provided in chat to access the quiz.
Once you click the link, you will be asked for a code. Enter _______________.
Complete all 10 questions, reading carefully and doing the best that you can.
Make sure you click submit at the bottom after completing your quiz.
Once you hit submit, return back here and click on the thumbs up emoji in Zoom. This is the signal telling me you are ready to move on.

You will have 20 minutes to complete the quiz. If you finish early, please take a restroom break and return to ZOOM as soon as you can.
When time is up, we will move on with the course.

DO:

Put the link in the chat
Monitor ZOOM to see when all participants have returned and are ready to move on.
Once all participants have completed the Kahoot! quiz.

SAY:�Now that you have all finished the quiz, let’s move on to wrap up the course. �

Producer Notes:

While Facilitator is introducing the activity, navigate to the Kahoot! website and login.
Check the quiz dates to ensure it will allow submissions.
Post a link in the chat to the Kahoot! quiz.
Keep track of time using the timing instructions provided.

(ADVANCE SLIDE)

DO:

AHEAD OF TIME:

SAY:

DO:�

(ADVANCE SLIDE)

20 of 21

Summary��

Now you are able to:

Identify HIPAA regulations

Recognize patients’ rights to protect

health information

Practice methods to protect patient information

1 of 21

2 of 21

3 of 21

4 of 21

5 of 21

6 of 21

7 of 21

8 of 21

9 of 21

10 of 21

11 of 21

12 of 21

13 of 21

14 of 21

15 of 21

16 of 21

17 of 21

18 of 21

19 of 21

20 of 21

21 of 21