Why Did Regulators Add New Standards After Hipaa'S Initial Implementation

1. To improve the efficiency and effectiveness of the healthcare system 2. Improve portability and continuity of health insurance coverage 3. Prohibit discrimination in health coverage 4. Regulate the privacy and security of health information

. Transactions and code sets . National provider identities . Privacy . Security

. Healthcare plans . Healthcare clearinghouses . Healthcare providers

. Covered entities (they must protect information from unauthorized access, alteration, deletion, and transmission) . Business associates (must enter into a business associate contract before beginning work with the covered entity)

. Information covered under HIPAA that includes all health information that relates to past, present, or future physical or mental health; the provision of care, or payment of care . Information that identifies the patient or could reasonably be expected to identify the patient.

. Explains the patients' rights to privacy . How you're going to use/protect their information . Who you will/will not share their information with without further authorization . Who to contact with complaints

. Must make a good-faith effort to provided privacy notice and receive signed acknowledgment from each patient . Need only once . First transaction at the pharmacy . Written unless consent to electronic transmission . May not refuse treatment if they refuse . Must document effort

. Pharmacies are allowed to use and disclose PHI for TPO (treatment, payment, operations) . Can always provide complete disclosure to patient, their personal representative or their agent in a timely manner (30 days + 30 day extension)

. Health Information Technology for Economic and Clinical Health . If covered entities use an EMR they are required to account for ALL disclosures of PHI within 3 years of the request date . Requires a limited data set if possible in the EMR . Requires pharmacies to address breaches of PHI

To their healthcare plan in out of pocket situations.

. To the patient . Other providers regarding treatment . When authorized by patient . When required for compliance and enforcement purposes . Required by law

. All individual identifying factors of a PHI are removed . NOT considered PHI after removal of identifiable information

The acquisition, access, use, or disclosure of PHI in a way that compromises the security or privacy of the PHI and poses a significant risk of financial, reputation, or other harm to the individual

Within 60 days of the breach discovery . First class mail (or electronically if agreed upon) if more than 500 individuals are affected the pharmacy must notify the media

Preferable but not required to hire business associate to handle disposal Must use reasonable safeguards to protect disposal of PHI

. Must have individual written authorization to sell or market PHI . Exceptions: for treatment uses, face to face, for case management or care coordination, recommended alternatives, about health-related services offered by the pharmacy or health plan, refill and adherence reminders

. Must develop policies and procedures to implement HIPAA standards . Must outline penalties for violations for workers . Must identify a privacy officer to run compliance program

. Penalties for violating HIPAA can be severe and increased after the implementation of HITECH . Civil and criminal penalties can result for HIPAA violations . HIPAA does NOT create private cause action for individuals to use

. Unintentional violations: $100-$25,000 per person per violation in one calendar year . Reasonable cause violations: $1,000 per violation up to $50,000 total in one calendar year . Willful neglect corrected within 30 days: $10,000 with annual cap of $250,000 . Willful neglect NOT corrected with 30 days: $50,000 with annual cap of $1.5m . Intentional violations or involvement of fraud are subject to prison time

. Protect privacy of PHI . Reduce medical costs . Improve coordination of care . Improve delivery of public health services and emergency response system

1. Transaction and code sets 2. National Provider Identities 3. Privacy 4. Security