HIPAA for medical students Dan Chen, MD – Internal
Description: HIPAA for medical students Dan Chen, MD Internal Medicine and Student Affairs Diane M. Lindquist - Director of Health Privacy and Compliance and BU HIPAA Privacy Officer Karen Symes, PhD Biochemistry and Student Affairs What does HIPAA
Related Topics
Download Presentation
"HIPAA for medical students Dan Chen, MD – Internal" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. HIPAA for medical studentsDan Chen, MD – Internal Medicine and Student AffairsDiane M. Lindquist - Director of Health Privacy and Compliance and BU HIPAA Privacy OfficerKaren Symes, PhD – Biochemistry and Student Affairs<br>
slide2. What does HIPAA stand for? Horrible, Intrusive Privacy Access Account
Health Insurance Portability and Accountability Act
Harmful Illness Probability and Anti-Acquisition
Healthy Intermediary Person and Associate Aide<br>
slide3. What is HIPAA A US law to protect patients' health information, including:
Privacy Rules, that every access, use or disclosure of patient information must be for an approved purpose
Security Rule, that requires we keep patient electronic data safe and encrypted
Breach Notification rule, requiring any breach of the Privacy and Security Rules be reported to the affected patients and to the government.<br>
slide4. Is this access a HIPAA violation?<br>
slide5. Is it OK for me to use EPIC to look at the entire medical record of my patient? Yes
No<br>
slide6. Is it OK for me to use EPIC to look at the entire medical record of my patient? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide7. Is it OK for me to use EPIC to look at the entire medical record of my team’s patient? Yes
No<br>
slide8. Is it OK for me to use EPIC to look at the entire medical record of my team’s patient? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide9. Is it OK to review the records of patients I will be seeing when my rotation starts next week? Yes
No<br>
slide10. Is it OK to review the record of patients I will be seeing when my rotation starts next week? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide11. Is it OK for me to use EPIC to check in on a patient I was following in my previous rotation? Yes
No<br>
slide12. Is it OK for me to use EPIC to check in on a patient I was following in my previous rotation? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide13. Is it OK for me to use a random patient record in EPIC to learn about a specific condition or treatment? Yes
No<br>
slide14. Is it OK for me to use a random patient record in EPIC to learn about a specific condition or treatment? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide15. Is it OK if my friend asks me to check his medical record in EPIC to see what is written about him? Yes
No<br>
slide16. Is it OK if my friend asks me to check his medical record in EPIC to see what is written about him? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide17. Is it OK if my Aunt asks me to check her medical record in EPIC to see what is written about her? Yes
No<br>
slide18. Is it OK if my Aunt asks me to check her medical record in EPIC to see what is written about her? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide19. Is it OK for me to access my own medical record through EPIC? Yes
No<br>
slide20. Is it OK for me to access my own medical record through EPIC? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide21. Is it OK for me speak about a patient in the hallway as long as it is with other members of the medical team? Yes
No<br>
slide22. Is it OK for me speak about a patient in the hallway as long as it is with other members of the medical team? Yes, as long reasonable efforts are made to safeguard against accidental disclosure to other people within earshot
No, the risk of accidental disclosure to other people within earshot is too high<br>
slide23. Is it OK for me to post a comment on social media about a patient as long as it is deidentified? Yes
No<br>
slide24. What is social media?<br>
slide25. BMC definitions of social media<br>
slide26. Is it OK for me to post a comment on social media about a patient as long as it is deidentified? Yes, as long as I am respectful
No, never under any circumstances<br>
slide27. Is it OK for me to snapchat an image of a patient’s interesting mole as long as it is deidentified and they give me permission? Yes
No<br>
slide28. Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation Is it OK for me to snapchat an image of a patient’s interesting mole as long as it is deidentified and they give me permission?<br>
slide29. How are HIPAA violations detected? Every click in the EMR is registered and recorded
The BMC compliance office frequently carries out audits to determine who is accessing the EMR. Flags include access by individuals not in particular departments or rotations, same last name accesses, excessive access to particular patient’s record AS WELL AS RANDOM AUDITS
Patients overhear or witness things in person and on-line
Colleagues report violations<br>
slide30. Consequences Investigation by Boston University and Boston Medical Center
Suspension from using EPIC – temporary pending investigation
Suspension from using EPIC permanently
Patients informed of violation
Appear before Disciplinary Committee
Dismissal
Inability to obtain a medical license
Fined
Institution and personally sued
Financial, reputational, and discriminatory harms to patients<br>
slide31. Case – discuss 2 minutes with the person sitting next to you and report back A medical student uses marijuana for medical reasons. As part of the onboarding at an away site, they were required to take a drug test, which was positive for delta-9-tetrahydrocannabinol (THC) and its derivatives. What are possible implications?<br>
slide32. Questions<br>
slide2. What does HIPAA stand for? Horrible, Intrusive Privacy Access Account
Health Insurance Portability and Accountability Act
Harmful Illness Probability and Anti-Acquisition
Healthy Intermediary Person and Associate Aide<br>
slide3. What is HIPAA A US law to protect patients' health information, including:
Privacy Rules, that every access, use or disclosure of patient information must be for an approved purpose
Security Rule, that requires we keep patient electronic data safe and encrypted
Breach Notification rule, requiring any breach of the Privacy and Security Rules be reported to the affected patients and to the government.<br>
slide4. Is this access a HIPAA violation?<br>
slide5. Is it OK for me to use EPIC to look at the entire medical record of my patient? Yes
No<br>
slide6. Is it OK for me to use EPIC to look at the entire medical record of my patient? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide7. Is it OK for me to use EPIC to look at the entire medical record of my team’s patient? Yes
No<br>
slide8. Is it OK for me to use EPIC to look at the entire medical record of my team’s patient? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide9. Is it OK to review the records of patients I will be seeing when my rotation starts next week? Yes
No<br>
slide10. Is it OK to review the record of patients I will be seeing when my rotation starts next week? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide11. Is it OK for me to use EPIC to check in on a patient I was following in my previous rotation? Yes
No<br>
slide12. Is it OK for me to use EPIC to check in on a patient I was following in my previous rotation? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide13. Is it OK for me to use a random patient record in EPIC to learn about a specific condition or treatment? Yes
No<br>
slide14. Is it OK for me to use a random patient record in EPIC to learn about a specific condition or treatment? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide15. Is it OK if my friend asks me to check his medical record in EPIC to see what is written about him? Yes
No<br>
slide16. Is it OK if my friend asks me to check his medical record in EPIC to see what is written about him? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide17. Is it OK if my Aunt asks me to check her medical record in EPIC to see what is written about her? Yes
No<br>
slide18. Is it OK if my Aunt asks me to check her medical record in EPIC to see what is written about her? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide19. Is it OK for me to access my own medical record through EPIC? Yes
No<br>
slide20. Is it OK for me to access my own medical record through EPIC? Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation<br>
slide21. Is it OK for me speak about a patient in the hallway as long as it is with other members of the medical team? Yes
No<br>
slide22. Is it OK for me speak about a patient in the hallway as long as it is with other members of the medical team? Yes, as long reasonable efforts are made to safeguard against accidental disclosure to other people within earshot
No, the risk of accidental disclosure to other people within earshot is too high<br>
slide23. Is it OK for me to post a comment on social media about a patient as long as it is deidentified? Yes
No<br>
slide24. What is social media?<br>
slide25. BMC definitions of social media<br>
slide26. Is it OK for me to post a comment on social media about a patient as long as it is deidentified? Yes, as long as I am respectful
No, never under any circumstances<br>
slide27. Is it OK for me to snapchat an image of a patient’s interesting mole as long as it is deidentified and they give me permission? Yes
No<br>
slide28. Yes, because it is part of my formal clinical rotation
No, because it is not part of my formal clinical rotation Is it OK for me to snapchat an image of a patient’s interesting mole as long as it is deidentified and they give me permission?<br>
slide29. How are HIPAA violations detected? Every click in the EMR is registered and recorded
The BMC compliance office frequently carries out audits to determine who is accessing the EMR. Flags include access by individuals not in particular departments or rotations, same last name accesses, excessive access to particular patient’s record AS WELL AS RANDOM AUDITS
Patients overhear or witness things in person and on-line
Colleagues report violations<br>
slide30. Consequences Investigation by Boston University and Boston Medical Center
Suspension from using EPIC – temporary pending investigation
Suspension from using EPIC permanently
Patients informed of violation
Appear before Disciplinary Committee
Dismissal
Inability to obtain a medical license
Fined
Institution and personally sued
Financial, reputational, and discriminatory harms to patients<br>
slide31. Case – discuss 2 minutes with the person sitting next to you and report back A medical student uses marijuana for medical reasons. As part of the onboarding at an away site, they were required to take a drug test, which was positive for delta-9-tetrahydrocannabinol (THC) and its derivatives. What are possible implications?<br>
slide32. Questions<br>