1602 Limiting Access, Disclosure and Use of PHI

Question 1

Associated with this document is the following forms:

Answer 1

1. PHI Fax Cover Sheet with disclaimer

2. Record Request Log (electronic form: \fstfd\fire- adm\admin\docs\hipaa\disclosure-breach docs)

Question 2

The _______________ or his/her designee shall be responsible for: 1. Establishing and enforcing policies and procedures to ensure all TFD personnel with access to patient information limit unauthorized access, disclosure and use of PHI

2. Establishing procedures to ensure PHI is appropriately de-identified for any training and/or quality assurance use
3. Maintaining this document

Answer 2

TFD Privacy Officer

Question 3

Who maintains 1602?

Answer 3

TFD Privacy Officer

Question 4

What does (PHI) stand for?

Answer 4

protected health information (PHI)

Question 5

___________________ shall be responsible for appropriately and adequately de-identifying and maintaining the security of PHI for use in conjunction with training and/or quality assurance activities in accordance with the guidelines set forth in this document.

Answer 5

TFD Peer Review Chairs and Training Staff

Question 6

_____________________ shall be responsible for ensuring:

1. All PHI within each station or facility is kept secure at all times 2. All PHI is properly routed to TFD Headquarters in a timely manner in accordance with the guidelines set forth in this document
2. A locked PHI deposit box is available for the secure, temporary storage of completed EMIRs and other PHI in accordance with the guidelines set forth in this document
3. A cross-cut shredder is maintained in each station and facility for the timely destruction of documents containing PHI in accordance with the guidelines set forth in this document
4. The current month’s controlled substance log is maintained in a secure manner and kept out of sight of those not authorized to view it

Answer 6

Company Captains, Paramedic Supervisors and Facility Managers

Question 7

The _______________ shall be responsible for ensuring the security of PHI associated with TFD personnel records in accordance with the guidelines set forth in this document.

Answer 7

Administrative Assistant for EMS

Question 8

The ___________________ shall be responsible for:

1. Ensuring the security of the EMIRs and billing related PHI contained within the file cabinets at TFD Headquarters in accordance with the guidelines set forth in this document
2. PHI requested by TFD field personnel is secured electronically prior to being released in accordance with the guidelines set forth in this document

Answer 8

Account Technician for EMS billing or his/her designee

Question 9

The __________ shall be responsible for ensuring the secure transport of PHI from TFD stations and facilities to TFD Headquarters in accordance with the guidelines set forth in this document.

Answer 9

TFD Messenger

Question 10

What is DRS.

Answer 10

Designated Record Set.

Question 11

What does HIPAA stand for?

Answer 11

Health Insurance Portability and Accountability Act.

Question 12

A secondary use or disclosure that cannot reasonably be prevented, is limited in nature and occurs as a result of or in connection with another permitted use or disclosure even though reasonable safeguards were in place and the “minimum necessary” standard was applied.

Answer 12

Incidental Use or Disclosure

Question 13

_______________includes any health-related information that is: • Individually identifiable or demographic in nature OR • Regarding past, present or future physical or mental health OR • Regarding provision of or payment for care to an individual OR • Created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health clearinghouse OR • Maintained or transmitted in any form or medium

Answer 13

PHI. Protected Health Information

Question 14

_________________ is either electronically stored and encrypted or when maintained in hard copy is kept in a: • Locked file cabinet that is not easily moveable and has limited access to the associated keys AND • Locked or monitored room AND • Locked or monitored building

Answer 14

Secure PHI

Question 15

Access to a patient’s entire file will not be allowed except:

Answer 15

a. When provided for in this and other policies and procedures; or b. When the justification for use of the entire medical record is specifically identified and documented; or
c. When authorized by the Privacy Officer

Question 16

All PHI managed by TFD shall be:

Answer 16

a. Maintained as encrypted electronic data whenever practical
b. Transmitted to internal network destinations only, unless otherwise authorized by the Privacy Officer

Question 17

All audio recordings containing PHI shall be kept in ______________________.

Answer 17

encrypted electronic format, unless otherwise authorized by the Privacy Officer.

Question 18

Any electronic copies of PHI sent via e-mail shall be ____________________________.

Answer 18

encrypted, password protected/individually receivable, viewable only and deleted once its use is complete, unless otherwise authorized by the Privacy Officer.

Question 19

TFD personnel shall shred the following documents before disposal:

Answer 19

a. All pink copies of EMIRs not transferred to another caregiver or authorized receiver of PHI
b. Yellow copies of EMIRs that are more than one month old
c. CAD/Zetron printout pages that contain PHI
d. Voided EMIRs that contain PHI
e. Copies of controlled substances logs
f. Any document or piece of paper containing PHI, including hand written notes on “scratch paper”

Question 20

TFD personnel shall deposit the following forms of PHI into the station’s locked deposit box designated for temporary PHI storage:

Answer 20

a. All white copies of EMIRs
b. Yellow copies of EMIRS that are one month old or less
c. Controlled substance logs
d. Signed reports of PHI Disclosure
e. All other documents containing PHI that need to be transported to TFD Headquarters

Question 21

The ___________________ shall:

a. Ensure the TFD Headquarters filing cabinets containing PHI associated with patient care and billing remain locked or monitored at all times
b. Limit access to keys for the TFD Headquarters filing cabinets that contain PHI associated with patient care and billing

Answer 21

Account Technician for EMS billing or his/her designee

Question 22

The ____________shall:

a. Ensure the TFD Headquarters filing cabinets that contain PHI associated with TFD personnel records remain locked or monitored at all times
b. Limit access to keys for the TFD Headquarters filing cabinets that contain PHI associated with TFD personnel records

Answer 22

Administrative Assistant for EMS

Question 23

Hours of operation for handling PHI requests are ________________

Answer 23

Monday through Friday, 8 a.m. to 5 p.m.

Question 24

Patient authorizations received directly from third party payors, such as Medicare or other insurance companies, which direct TFD to release PHI to those entities are not subject to the “______________________” standards.

Answer 24

minimum information necessary

Question 25

The Privacy Officer, Peer Review Chairs and Training Staff shall remove all of the following identifiers when de-identifying information for use and disclosure:

Answer 25

a. Name
b. Address
c. City
d. County
e. Zip code
f. Names of relatives and employers
g. Birthdates
h. Telephone and fax numbers
i. E-mail addresses
j. Social security number
k. Medical record number
l. Health plan beneficiary number
m. Account number
n. Certificate/license number
o. Vehicle or other device serial number
p. Web URL
q. Internet Protocol (IP) address
r. Finger or voice prints s. Photographic images
t. Any other unique identifying number, characteristic or code

Question 26

True or False?
* Other demographic information, such as gender, race, ethnicity and marital status are not included in the list of identifiers that must be removed

Answer 26

True

Question 27

The ________________shall de- identify all documents containing PHI that are to be used for quality assurance and/or training purposes in accordance with the guidelines set forth in this document.

Answer 27

Peer Review Chair and/or appropriate Training staff member

Question 28

True or False?

TFD Peer Review personnel shall not print out electronic documents containing PHI for any reason without the prior written approval of the Privacy Officer.

Answer 28

True