1601 - Confidentiality And Disclosure Of PHI

Question 1

Who shall be responsible for:

1. Establishing and enforcing policies and procedures to ensure all TFD personnel with access to patient information maintain PHI confidentiality
2. Evaluating the extent and severity of all reports of unauthorized PHI disclosures in accordance with federal and state HIPAA related regulations and the guidelines set forth in this document
3. Ensuring that all disclosures are documented in accordance with the guidelines set forth in this document
4. Maintaining this document

Answer 1

The TFD Privacy Officer or his/her designee

Question 2

Who shall be responsible for:

1. Knowing, following and being able to execute established policies and procedures for maintaining PHI confidentiality
2. Documenting all PHI disclosures in accordance with the guidelines set forth in this document
3. Documenting all unauthorized disclosures of PHI in accordance with the guidelines set forth in this document
4. Complying with TFD confidentiality policies and procedures during his/her entire employment or association with TFD

Answer 2

All TFD personnel who have access to patient information

Question 3

, Who shall be responsible handling PHI requests in accordance with the guidelines set forth in this document.

Answer 3

TFD Headquarters Personnel, including the Financial Assistant and the Account Technician for EMS billing

Question 4

HIPAA.

Answer 4

Health Insurance Portability and Accountability Act.

Question 5

PHI.

Answer 5

Protected Health Information includes any health-related information that is: • Individually identifiable or demographic in nature OR • Regarding past, present or future physical or mental health OR • Regarding provision of or payment for care to an individual OR • Created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health clearinghouse OR • Maintained or transmitted in any form or medium

Question 6

SOAPED.

Answer 6

Format for documenting the narrative elements of patient care: 
S = Subjective findings 
O = Objective findings 
A = Overall assessment 
P = Plan for care 
E = Evaluation of change 
D = Dissemination of PHI

Question 7

General Guidelines
1. The privacy laws were not intended to impede common health care practices that are essential in providing treatment to the individual, therefore ____________ shall remain the first priority of the Tacoma Fire Department.
2. _________ shall exercise due diligence in maintaining the confidentiality and security of all material created or used by TFD that contains patient care information.
3. ____________[[[ shall function as the TFD Privacy Officer.
confidential and protected by federal and state laws.
5. Except for _____________, discussions of PHI within the TFD organization shall be limited to the minimum necessary to perform a work related task or function.
6. TFD personnel shall not disclose, at any time or under any circumstances, any PHI in any form, no matter how minimal, to any unauthorized source or forum, including but not limited to social media networks such as Facebook, MySpace, Twitter and/or Photobucket.
True or false?
7. All individuals who request access, amendment and/or restriction of a patient’s PHI shall be referred to __________
8. All TFD employees with access to patient information must agree to abide by all confidentiality policies or be __________
9. Failure to abide by patient confidentiality regulations or policies may result in ________________
10. Upon termination of employment or association with TFD for any reason, any and all patient information in the terminated employee’s possession must be __________

Answer 7

1. the effective, immediate treatment of patients
2. All TFD personnel
3. The Medical Services Officer for Operations
4. the purpose of patient care
5. True
6. TFD Headquarters.
   a. Hours of operation for handling PHI requests are Monday through Friday, 8 a.m. to 5 p.m.
7. subject to disciplinary action.
8. disciplinary action, up to and including termination of employment or association with TFD.
9. returned to TFD.

Question 8

Use and Disclosure of PHI

1. Acceptable uses of PHI within the TFD organization include, but are not limited to:
   a. ________
   b. ________
   c. ________
2. Unless for the purposes of patient care or internal healthcare operations, or as required by law, TFD employees shall not disclose any PHI without the approval of __________
3. TFD personnel may provide a copy of the patient’s EMIR to law enforcement personnel only _________
4. TFD personnel may verbally share the following PHI with incident related law enforcement personnel only when the patient suffers from traumatic injuries believed to be the result of a criminal act:
   a. ________
   b. ________
   c. ________
   d. ________
5. TFD personnel on scene shall provide a copy of a deceased patient’s EMIR to________

Answer 8

1. a. Exchange of patient information needed for patient care
   b. Billing
   c. Other essential internal health care operations, including supervision, peer review, internal audits and quality assurance activities
2. the Privacy Officer or his/her designee.
3. when the patient is and will remain in law enforcement custody.
   a. Otherwise, all law enforcement requests for a patient EMIR must be made through TFD Headquarters during normal business hours
4. a. Patient name, age, sex, residence and/or condition
   b. Extent and location of patient’s injuries
   c. Patient’s level of consciousness
   d. Patient’s destination
5. the Medical Examiner as required by RCW 70.02.050.

Question 9

Documentation of PHI Disclosures

1. TFD personnel shall document all PHI disclosures, except those that are:
   a. _______
   b. _______
   c. _______
2. All use or disclosure of PHI that is not related to patient care or other essential internal health operations shall be documented and reported to the Privacy Officer or his/her designee, including:
   a. _______
   b. _______
   c. _______
   d. _______
3. The Privacy Officer shall:
   a. Evaluate ______________
   b. Determine ______________
   c. Take _____________

Answer 9

1. a. Made to carry out patient care or internal health care operations
   b. Merely incidental and secondary to a permitted or required disclosure
   c. Made for national security purposes
2. a. Unintended sharing of PHI with someone who does not have a need to know that information
   b. When PHI in written or electronic form is inadvertently left out in the open for others to access or see
   c. When PHI is electronically transmitted to the wrong destination
   d. When inappropriate or unauthorized use or disclosure of PHI is discovered (e.g.; patient-related information or pictures posted on Facebook)
3. a. the extent and severity of all reports of unauthorized disclosures of PHI
   b. whether the unauthorized disclosures meet the requirements of a breach Record all breach incidents in the electronic PHI Breach Log
   c. the necessary actions for resolution and/or reporting as required by federal and state law

Question 10

4. TFD personnel shall document on-scene PHI disclosures to law enforcement in the “Dissemination (D)” section of the SOAPED narrative on the incident EMIR and shall include:
   a. ______
   b. ______
   c. ______
5. TFD personnel shall document on-scene disclosures to the Medical Examiner in the “Dissemination (D)” section of the SOAPED narrative on the incident EMIR by writing _________
6. TFD personnel shall document an unauthorized disclosure of PHI _______________ whenever s/he knowingly or inadvertently discloses PHI in an unauthorized manner or becomes aware of an unauthorized disclosure of PHI.
7. The documentation for a report of unauthorized disclosure of PHI shall be in the form of a completed electronic “Report of PHI Disclosure” form submitted to the Privacy Officer and that includes at least the following:
   a. _____
   b. _____
   c. _____
   d. _____
   e. _____
   f. _____
8. TFD personnel are not required to document the following PHI disclosures:
   a. _______
   b. _______
   c. _______
   d. _______

Answer 10

4. a. Name of law enforcement officer
   b. Name of law enforcement agency
   c. Nature of the PHI disclosed
5. “Copy of EMIR provided to Medical Examiner”.
6. immediately or as soon as is practical,
7. a. Date and time of disclosure or discovery of disclosure
   b. Patient name or identifying information
   c. Name of individual to whom the PHI was provided, with address if known
   d. Brief description of the PHI disclosed e. Purpose of the disclosure
   f. Name(s) of TFD personnel who made the disclosure
8. a. Disclosures made in order to carry out patient care or health care operations
   b. Disclosures for national security or intelligence reasons
   c. Disclosures that are incidental to a use or disclosure otherwise permitted or required

Question 11

PROCEDURE FOR HANDLING PHI REQUESTS

All TFD Personnel
1.
2.

Answer 11

1. Inform the requesting individual that PHI issues are handled at TFD Headquarters during normal business hours.
2. Provide the individual with the address and/or directions to TFD Headquarters as necessary and appropriate.

Question 12

PROCEDURE FOR HANDLING PHI REQUESTS

TFD Headquarters Personnel
1.
2.
3.

Answer 12

1. Refer individuals with PHI requests to the Financial Assistant.
2. If the Financial Assistant is not available, refer the requesting individual to the Account Technician for EMS billing.
3. If both the Financial Assistant and the Account Technician for EMS billing are not available, refer the requesting individual to the Privacy Officer or his/her designee.

Question 13

PROCEDURE FOR HANDLING PHI REQUESTS

TFD Financial Assistant or Account Technician for EMS billing
1. Ask the requesting individual for one of the following acceptable forms of photo identification:
a.
b.
c.
d.
e.
2. If the requester is not the patient, ask for one of the following acceptable forms of proof of his/her status as legal representative:
a.
b.
c.
d.
3. Print and ask the requesting individual to complete the appropriate TFD form
a.
b.
c.
4. Forward the completed form to ________

Answer 13

1. a. Driver’s license
   b. State-issued I.D. card
   c. Passport
   d. Photo I.D. credit card or bank card
   e. Other forms of government-issued identification
2. a. Power of attorney
   b. Release form
   c. Birth certificate (for minors)
   d. Death certificate (for deceased patients) along with legal proof of personal representative status (e.g.; court order, will)
3. a. Request for PHI Access
   b. Request for PHI Amendment
   c. Request for Restriction on PHI Use and Disclosure
4. the TFD Privacy Officer or his/her designee for action.

Question 14

PROCEDURE FOR REPORTING AN UNAUTHORIZED DISCLOSURE OF PHI

All TFD Personnel

Answer 14

1. Complete the electronic “Report of PHI Disclosure” form.
2. Submit the completed electronic form via e-mail to the Privacy Officer.
   a. No signature is required if the completed form is sent from the author’s departmental e-mail account