Nursing Informatics Ch.8: Legislative Aspects of Nursing Informatics: HIPAA, HITECH, and Beyond
Tier 4 CMP
$50,000 to $1.5 million if the covered entity does not properly correct a violation
ONC current strategic goals:
-Advance person-centered and self-managed health -Transform health care delivery and community health -Foster research, scientific knowledge, and innovation -Enhance nation's health IT infrastructure (ONC, 2018)
HITECH ACT definitions
-Certified EHR technology -Enterprise integration -Healthcare provider -Health information technology -Qualified electronic health record
Privacy Rules (HIPAA)
-Define protected health information (PHI) -Propose that authorization by patients for release of information is not necessary when the release of information is directly related to treatment and payment for treatment. -Establish patient ownership of the healthcare record and allow for patient-initiated corrections and amendments. -Mandate administrative requirements for the protection of healthcare information. -Mandate that all outside entities that conduct business with healthcare organizations (e.g., attorneys, consultants, and auditors) must meet the same standards as those of the organization for information protection and security. -Allow PHI to be released without authorization for research studies. Patients may not access their information in blinded research studies because their access may affect the reliability of the study outcomes. -Propose that PHI may be de-identified before release in such a manner that the identity of the patient is protected. The healthcare organization may code the de-identification so that the information can be re-identified once it has been returned. -Applies only to health information maintained or transmitted by electronic means.
Protected Health Information:
-Demographics -Medical History; Lab or Tests Results -Insurance Information
HITECH Act has had a significant impact on HIPAA's Privacy and Security Rules in the following ways:
-HHS is to provide annual guidance about how to secure health information. -Notification requirements in the event of a breach in the security of health information were enhanced. -HIPAA requirements now also apply directly to any business associates of a covered entity. -The rules that pertain to providing an accounting to patients who want to know who accessed their health information were changed. -Enforcement of HIPAA was strengthened.
Outside Attacks
-Hackers -Worms, Viruses, Spam -Theft
Intentional Breaches
-Malicious Insiders -Social Media Use -Unauthorized Access
Privacy and Security rules rights
-Patients are entitled to a notice of privacy practices from their healthcare provider. -Inpatients are entitled to opt out of the facility's directory, thereby protecting disclosure of information that they are even a patient in the facility.
HIPPA factors
-The need and means to guarantee the security and privacy of health information was the focus of numerous debates. -Comprehensive standards for the implementation of this portion of the act eventually were finalized, but the process to adopt final standards took years.
Network Issues
-Unencrypted Transmissions -Firewall Failure
Unintentional breaches
-Unsecured Terminals -Loss of Devices -Unsecured Passwords
The ARRA 2 divisions
A and B
safeguards
Administrative Physical Technical
require a form for each release that specifies which information pertinent to the issue at hand is to be released. All releases of information must be formally documented and accessible to the patient on request.
All other releases of health information:
HITECH Act and Health disparities
All patients, regardless of race, ethnicity, or socioeconomic status, should receive care that is effective, safe, equitable, and timely. When the national health IT infrastructure contemplated by the HITECH Act is fully implemented, such disparities are bound to decrease. The ability to monitor for disparities and promote the delivery of appropriate care to all patients will be enhanced. Clinicians will be prompted to base their treatments on appropriate factors and avoid biased care.
it was estimated that less than 8% of U.S. hospitals used a basic EHR system in at least one of their clinical units and less than 2% of U.S. hospitals had an EHR system in all of their clinical settings
At the time the HITECH Act was enacted:
Health Insurance Portability and Accountability Act (HIPAA) Rules
Contain privacy, security, and breach notification requirements that apply to indiviudaly identifiable health information created, receievd, maintained, or transmitted by health care providers who engage in certain electronic transactions, health transactions, health plans, health care cleringhouses, and their business associates
The Office for Civil Rights (OCR)
Government agency that enforces the HIPAA Privacy Act.
Bill Clinton
HIPAA was signed into law by:
1. Improve healthcare quality by enhancing coordination of services between and among the various healthcare providers a patient may have, fostering more appropriate healthcare decisions at the time and place of delivery of services, and preventing medical errors and advancing the delivery of patient-centered care 2. Reduce the cost of health care by addressing inefficiencies, such as duplication of services within the healthcare delivery system, and reducing the number of medical errors 3. Improve people's health by promoting prevention, early detection, and management of chronic diseases 4. Protect public health by fostering early detection and rapid response to infectious diseases, bioterrorism, and other situations that could have a widespread impact on the health status of many individuals 5. Facilitate clinical research 6. Reduce health disparities 7. Better secure patient health information
HITECH (ONC) Purposes:
Title XIII of Division A of the ARRA is the:
HITECH ACT
PHI
PHI, defined as any physical or mental health information created, received, or stored by a "covered entity" that can be used to identify an individual patient, regardless of the form of the health information
need to be in place to control access whether the data and information are at rest; residing on a machine or storage medium; being processed; or in transmission, such as being backed up to storage or disseminated across a network
Safeguards:
-Research -Medical or Police Emergencies -Legal Proceedings -Collection of Data for Public Health Concerns.
Specific patient authorization is not required for:
healthcare-associated infections (HAIs)
The evolving U.S. health IT infrastructure has enabled us to track this issue for all surgical patients and thus develop evidence-based care plans to ensure that all patients within the infrastructure receive the same quality of care
-Curtail Healthcare Fraud and Abuse -Enforce Standards for Health Information -Guarantee the Security and Privacy of Health Information -Ensure Health Insurance Portability for Employed Persons
The intent of HIPPA legislation is to:
-Health Insurance Portability and Accountability ACT (HIPAA) of 1996 - Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009
Two key pieces of legislation were instrumental in shaping the health information technology and nursing informatics (NI) landscape:
PHI Vulnurabilities
Unintentional Breaches Outside Attacks Intentional Breaches Network Issues
Title IV of Division B of the ARRA
addressed Medicare and Medicaid health IT and provided significant financial incentives to healthcare professionals and hospitals that adopted and engaged in the "meaningful use" of electronic health record (EHR) technology
HITECH Act of 2009
addresses the development, adoption, and implementation of health IT policies and standards and provides enhanced privacy and security protections for patient information—an area of the law that is of paramount concern in NI
Agency for Healthcare Research and Quality (AHRQ)
an agency within HHS, has been releasing a National Healthcare Quality and Disparities Report every year since 2003.
HIPPA Requirements
consequences were put into place for institutions and individuals who violate the requirements of this act
breach
considered discovered as soon as an employee other than the individual who committed the breach knows or should have known of the breach, such as unauthorized access or even an unsuccessful attempt to access information
Title IV of Division B of the ARRA:
considered part of the HITECH Act
Whenever a breach involves unsecured PHI
covered entities are responsible for alerting each affected individual by mail or email, based on the individual's preference.
CMPs
divided into four tiers
meaningful use
electronically capturing health information in a coded format, using that information to track key clinical conditions, communicating that information to help coordinate care, and initiating the reporting of clinical quality measures and public health information
civil monetary penalties (CMPs)
for violations of HIPAA became effective as soon as the HITECH Act became law in February 2009.
According to the Office of the National Coordinator for Health Information Technology (ONC):
four out of five hospitals now have at least a basic EHR with clinician notes, and, for larger acute care hospitals, nearly 96% have EHR technology certified by HHS.
Covered entities
include hospitals and other healthcare providers that transmit any health information electronically as well as health insurance companies and healthcare clearinghouses
Healthcare provider
includes hospitals, skilled nursing facilities, nursing homes, long-term care facilities, home health agencies, hemodialysis centers, clinics, community mental health centers, ambulatory surgery centers, group practices, pharmacies and pharmacists, laboratories, physicians, and therapists
protected health information (PHI)
information relating to one's physical or mental health, the provision of one's health care, or the payment for that health care, that has been maintained or transmitted electronically and that can be reasonably identified with the individual it applies to
The Federal Register has indicated that the national coordinator of the ONC does the following
interoperability of health information, as central and foundational to the core mission of HHS to enhance and protect the health and well-being of all Americans;
Compliance with the Privacy and Security Rules
is mandatory for all covered entities, and the HITECH Act extends compliance with these requirements directly to other entities that are business associates of a covered entity. Requirements include designation of privacy and information security officials to protect health information and appropriate handling of any complaints. Sanctions must be imposed if a violation of HIPAA occurs.
Qualified electronic health record
means "an electronic record of health-related information on an individual." A "qualified" EHR contains a patient's demographic and clinical health information, including the medical history and a list of health problems, and is capable of providing support for clinical decisions and entry of physician orders. It must also have the capacity "to capture and query information relevant to health care quality" and "exchange electronic health information with, and integrate such information from other sources
Health information technology
means "hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by healthcare entities or patients for the electronic creation, maintenance, access, or exchange of health information
Certified EHR technology
means that an EHR meets specific governmental standards for the type of record involved, whether it be an ambulatory EHR used by office-based healthcare practitioners or an inpatient EHR used by hospitals. The specific standards that are to be met for any such EHRs are set forth in federal regulations.
Enterprise integration
means the electronic linkage of healthcare providers, health plans, the government, and other interested parties to enable the electronic exchange and use of health information among all the components in the healthcare infrastructure
Federal HITEECH ACT
part of the American Recovery and Reinvestment Act (ARRA). The ARRA, also known as the "Stimulus" law, was enacted to stimulate various sectors of the U.S. economy during the most severe recession this country had experienced since the Great Depression
Under the Privacy Rule
patients have a right to expect privacy protections that limit the use and disclosure of their health information
breaches involving unsecured PHI of more than 500 individuals
prominent media outlet must also be notified.
insufficient contact information for 10 or more patients
provider is required to place conspicuous postings on the home page of its website or in major print or broadcast media (without identifying patients) toll-free number must be provided so that affected individuals can call for information about the breach.
Under the Security Rule
providers are obligated to safeguard their patients' health information from improper use or disclosure and maintain the integrity of the information and ensure its availability
administrative safeguards
refer to the documented formal policies and procedures that are used to manage and execute the security measures. They govern the protection of healthcare data and information and the conduct of the personnel.
physical safeguards
refer to the policies and procedures that must be in place to limit physical access to electronic information systems
To Err is Human: Building a Safer Health System
report concluded that approximately 44,000-98,000 people in the United States die each year as a result of healthcare errors. Many thousands more who do not die are seriously injured from such errors. In addition to the human pain and suffering associated with healthcare errors, the monetary costs of these errors are substantial.
Centers for Medicare and Medicaid Services (CMS)
responsible for enforcing the electronic transactions and code sets provisions of the law
HITECH Act
sought to change that situation by providing each person in the United States with an EHR. In addition, a nationwide health IT infrastructure would be developed so that access to a person's EHR would be readily available to every healthcare provider who treats the patient, no matter where the patient may be located at the time treatment is rendered
Once the HITECH Act became law
state attorneys general were authorized to pursue civil claims for HIPAA violations and collect up to $25,000 plus attorneys' fees. As of 2012, individuals who are damaged by such violations became eligible to share in any monetary awards obtained by these state officials.
Tier 3 CMP
the covered entity engaged in willful neglect that resulted in a breach, is $10,000 per incident, up to a cap of $250,000 per year
Tier 1 CMP
the covered entity had no reason to know of a violation, $100 per incident, up to a cap of $25,000 per year
Tier 2 CMP
the covered entity had reasonable cause to know of a violation, is $1,000 per incident, up to a cap of $100,000 per year
Technical safeguards
the policies and procedures used to control access to healthcare data and information
Cost of an EHR system
was a major barrier to widespread adoption of this technology in most healthcare facilities
Reducing health disparities
was another purpose of the HITECH Act. Disparities are differences in access to care and quality of care in subpopulations.
Health IT industry
was one area where lawmakers saw an opportunity to stimulate the economy and improve the delivery of health care at the same time. This explains why the title of the HITECH Act contains the phrase "for Economic and Clinical Health."
Security Requirements
went into effect on April 21, 2005, and required the covered entities to put safeguards into place that protect the confidentiality, integrity, and availability of PHI when stored and transmitted electronically.
Privacy Requirements of HIPAA
which went into effect on April 14, 2003, limited the release of PHI without the patient's knowledge and consent.
Notice of a breach must be given to HHS
within 60 calendar days of the discovery
