Week 3 Ethics & Legal

NBHWC Code of Ethics

(Updated February 1, 2017) NBHWC is committed to maintaining and promoting excellence in coaching. Therefore, NBHWC expects all credentialed health and wellness coaches (coaches, coach faculty and mentors, and students) to adhere to the elements and principles of ethical conduct: to be competent and integrate NBHWC Health and Wellness Coach Competencies effectively in their work. The NBHWC Code of Ethics is designed to provide appropriate guidelines, accountability and enforceable standards of conduct for all NBHWC Credential- holders. In line with the NBHWC definition of coaching, all NBHWC Credential-holders commit to abiding by the following Code of Ethics. Part One: Definitions Health and Wellness Coaching: Health and Wellness Coaches partner with clients seeking self-directed, lasting changes, aligned with their values, which promote health and wellness and, thereby, enhance well- being. In the course of their work health and wellness coaches display unconditional positive regard for their clients and a belief in their capacity for change, and honoring that each client is an expert on his or her life, while ensuring that all interactions are respectful and non-judgmental. NBHWC Coach: A health and wellness coach certified by the NBHWC (after the National Certification Examination is available); and who thereby agrees to practice within the NBHWC Health and Wellness Coach Scope of Practice and Competencies and who pledges accountability to the NBHWC Code of Ethics. Professional Coaching Relationship: A professional coaching relationship exists when coaching includes an agreement (including contracts) that defines the rights, roles and responsibilities of each party. Roles within Coaching Relationships: In order to clarify roles in the coaching relationship it is often necessary to distinguish between the client and the sponsor. In most cases, the client and sponsor are the same person and are therefore jointly referred to as the client. For purposes of identification, however, the NBHWC defines these roles as follows:Client: The "client" is the person(s) being coached. (May also be referred to as "coachee," "patient," or "member" in some settings.)Sponsor: The "sponsor" is the entity (including its representatives) paying for and/or arranging for coaching services to be provided. In all cases, coaching agreements should clearly establish the rights, roles and responsibilities for both the client and sponsor if the client and sponsor are different people.Student: The "student" is someone enrolled in an NBHWC-approved coach training program or working with an NBHWC-approved faculty member or coach mentor, in order to learn the coaching process or to develop and enhance his /her coaching skills.Faculty: An individual who provides primary instruction/training to students enrolled in an NBHWC-approved coach training program.Mentor: An individual who conducts coaching skills performance audits and provides feedback to coaching students/coaches for the purpose of developing and enhancing health and wellness coaching skills.Conflict of Interest: A situation in which a coach has a private or personal interest sufficient to appear to influence the objective of his or her professional role or responsibilities as a coach, faculty, or mentor. Part Two: The NBHWC Standards of Ethical Conduct Section 1: Professional Conduct at Large - As a health and wellness coach, I:Conduct myself in accordance with the NBHWC Code of Ethics in all health and wellness coaching interactions, including coach training and coach mentoring activities.Commit to take the appropriate action with the coach, faculty member, or coach mentor and/or will contact NBHWC to address any ethics violation or possible breach as soon as I become aware of such situation, whether it involves me or others.Communicate and create awareness in others, including organizations, employees, sponsors, coaches, clients, potential clients, and others who might need to be informed of the responsibilities established by this Code.Refrain from unlawful discrimination in occupational activities, including age, race, gender orientation, ethnicity, sexual orientation, religion, national origin or disability; and consistently demonstrate dignity and respect in all professional relationships.Make verbal and written statements that are true and accurate about what I offer as a health and wellness coach, the coaching profession, and the NBHWC.Accurately identify my coaching qualifications, expertise, experience, training, certifications and NBHWC credentials.Recognize and honor the efforts and contributions of others and only claim ownership of my own material. I understand that violating this standard may leave me subject to legal remedy by a third party.Strive at all times to recognize any personal issues that may impair, conflict with or interfere with my coaching performance or my professional coaching relationships. I will promptly seek the relevant professional assistance and determine the action to be taken, including whether it is appropriate to suspend or terminate my coaching relationship(s) whenever the facts and circumstances necessitate.Recognize that the Code of Ethics applies to my relationship with coaching clients, students, mentees, sponsors, and other coaches.Conduct and report research with competence, honesty and within recognized scientific standards and applicable subject guidelines. Research I participate in will be carried out with the informed consent of those participating and the approval of all regulatory bodies as indicated. Such research efforts will be performed in a manner that complies with the applicable laws and regulations of the jurisdictions involved.Maintain, store and dispose of any records, including electronic files and communications, created during my coaching engagements in a manner that promotes confidentiality, security and privacy and complies with any applicable laws, regulations and agreements.Use NBHWC credentialed coach contact information, such as email addresses and telephone numbers, only in the manner and to the extent authorized by the NBHWC. Section 2: Conflicts of Interest - As a coach, I:Seek to be conscious of any conflict or potential conflict of interest, openly disclose any such conflict to all stakeholders involved, and offer to remove myself when a conflict arises.Clarify roles for health and wellness coaches, set boundaries and review with sponsors and stakeholders conflicts of interest that may emerge between coaching and other role functions. Disclose to all clients the exact nature of the coach's role within the company or organization, and the limitations and expectations thereof.Disclose to my client and the sponsor(s) all anticipated compensation from third parties that I may receive for referrals of clients or pay to receive clients. Compensation from the sale of products or non-coaching services to clients must be disclosed fully before coaching begins. The quality of coaching services and the quantity of coaching sessions as defined in the coaching agreement must not be dependent in any way upon the purchase of any additional products or services by the client.Honor an equitable coach/client relationship, regardless of the form of compensation. Section 3: Professional Conduct with Clients - As a coach, I:Ethically speak what I know to be true to clients, prospective clients or sponsors about the potential value of the coaching process or of me as a coach.Make clear to any employer/sponsor and to the client what activities fall within the scope of practice within an NBHWC-certified health and wellness coach, as well as the outcomes that can be reasonably be expected.Adhere to all ethical standards of practice for his/her respective health care licensures and credentials.Carefully explain and strive to ensure that, prior to or at the initial meeting, my coaching client and sponsor(s) understand the nature of health and wellness coaching, the nature and limits of confidentiality, financial arrangements, and any other terms of the coaching agreement.Have a clear coaching service agreement with my clients and sponsor(s) before beginning the coaching relationship and honor this agreement. The agreement shall include the roles, responsibilities and rights of all parties involved.Hold responsibility for being aware of and setting clear, appropriate and culturally sensitive boundaries that govern interactions, physical or otherwise, I may have with my clients or sponsor(s).Avoid any sexual or romantic relationship with current clients, sponsor(s), students, mentees or supervisees. Further, I will be alert to the possibility of any potential sexual intimacy among the parties including my support staff and/or assistants and will take the appropriate action to address the issue or cancel the engagement in order to provide a safe environment overall.Respect the client's right to terminate the coaching relationship at any point during the process, subject to the provisions of the agreement. I shall remain alert to indications that there is a shift in the value received from the coaching relationship.Strive to protect the health, safety, and welfare of the client. I will encourage the client or sponsor to make a change if I believe the client or sponsor would be better served by another coach or by another resource, and I will support my client seeking the services of other professionals when deemed necessary or appropriate. Section 4: Confidentiality/Privacy - As a coach, I:Maintain the strictest levels of confidentiality with all client and sponsor information unless release is required by law, specifically adhering to all applicable state and federal regulations.Have a clear agreement about how coaching information will be exchanged among coach, client and sponsor, including mobile health/electronic health data collected by the client.Have a clear agreement when acting as a coach, coach mentor, coaching supervisor or trainer, with both client and sponsor, student, mentee, or supervisee about the conditions under which confidentiality may not be maintained (e.g., illegal activity, pursuant to valid court order or subpoena; imminent or likely risk of danger to self or to others; etc.) and make sure both client and sponsor, student, mentee, or supervisee voluntarily and knowingly agree in writing to that limit of confidentiality. Where I reasonably believe that because one of the above circumstances is applicable, I may need to inform appropriate authorities.Require all those who work with me in support of my clients to adhere to the NBHWC Code of Ethics, Number 26, Section 4, Confidentiality and Privacy Standards, and any other sections of the Code of Ethics that might be applicable. Section 5: Continuing Development - As a coach, I:Commit to the need for continued and ongoing development of my professional skills. Part Three: The NBHWC Pledge of Ethics: As a Health and Wellness coach, I acknowledge and agree to honor my ethical and legal obligations to my coaching clients and sponsors, colleagues, and to the public at large. I pledge to comply with the NBHWC Code of Ethics and to practice these standards with those whom I coach, teach, mentor or supervise.

A member joined Level2 as a member and has been assigned to your queue. When you pull up her information, you recognize her address. It appears that you are neighbors!

1. Is it okay to share that information? 2. If this violates an ethical standard, what principle would be violated?

Our Boundaries - Gavin et al (#4, pg. 87-88)

Another topic that coincides with the scope of practice conversation concerns our boundaries. We should first distinguish between boundary crossings and boundary violations. With a boundary crossing, there is the potential for an ethical violation, but it is more of a potential red flag than an immediate cause for concern. Let's say you run into a member at the grocery store, and she gives you a hug. Is this okay? Another example would be belonging to the same philanthropic organization as a member. While it may not pose any harm, it is important to be aware that a boundary crossing could turn into a violation. What is a boundary violation? Most likely there is an issue of misconduct; an ethical line has been crossed. One clear example would be a romantic relationship with a member during the time you are providing coaching services. The bottom line is that it is important to be aware of the boundaries we have within our coaching role as we have already discussed when it comes to our scope of practice. An additional element is that our resources, namely our time, need to be protected as well.

Ethical - Bark, (#2, pp. 62-63) - INTEGRITY

As coaches, we are committing to acting with integrity in every interaction we have, whether with a member, a colleague, or ourselves

Our Boundaries - Gavin et al (#4, pg. 87-88)

Boundary Crossing •Potentially could create to ethical violation •Example: giving a member a hug or belonging to the same philanthropic organization • Boundary violation •Most likely an issue of misconduct •Example: romantic relationship with a member

NBHWC HIPAA Position Statement

Client/Patient Privacy & Data Confidentiality in the Practice of Health and Wellness Coaching The National Board for Health and Wellness Coaching (NBHWC) recognizes the critical importance of following best-practice with regards to client/patient privacy and data confidentiality when handling client/patient information and records. The NBHWC recognizes that local, state, and federal regulations, as well as policies pertinent to individual employment settings, may dictate additional guidance and/or policies and procedures. As a general rule, the NBHWC holds the position that health and wellness coaches should manage client/patient personal health information and records according to the policies and procedures as established by the Health Insurance Portability and Accountability Act (HIPAA). More specifically, health and wellness coaches should familiarize themselves and comply with, "Title II: HIPAA Administrative Simplification." Given the relative complexities and broad utilization of this legislation, it is recommended that coaches first familiarize themselves with "HIPAA for Individuals" and then "HIPAA for Professionals." This information is provided by the Department of Health and Human Services (HHS). It is further recommended that health and wellness coaches pursue training and education germane to HIPAA compliance. The Department of Health and Human Services (HHS) also provides access to a number of free training and education resources, and this information can be found on their website. The NBHWC further recognizes that the setting within which health and wellness coaches provide services may dictate additional compliance-based rules and regulations. For example, coaches providing services within an educational environment may be required to comply with the Family Educational Rights and Privacy Act (FERPA). The U.S. Department of Education provides specific information and additional links here. They also provide free sector-specific training videos. Regardless of the domain within which one practices health and wellness coaching (including those that are self-employed, practicing outside of health care, and/or in educational settings), it is the position of the NBHWC that all health and wellness coaches should educate themselves and comply with applicable best practices. National Board for Health & Wellness Coaching PO Box 16307San Diego, CA 92176 866-535-7929 [email protected] Find A Board Certified Coach About NBHWC Media Become An Approved Training Program Program Approval Resources Become A Board Certified Coach Exam Prep Resources Applicant Log-In NBC-HWC Log-In Contributions to section 501(c)(6) organizations are not deductible as charitable contributions on the donor's federal income tax return. They may be deductible as trade or business expenses if ordinary and necessary in the conduct of the taxpayer's business. Please contact your account for additional details. Donate to NBHWC.

Ethical Bark, (#2, pp. 62-63- RESPECT

First, we need to show respect for each individual regardless of their age, race religion, sexual orientation, disability, and socioeconomic standing. The conversations are race and injustice rebeal that there is much work to be done on this topic on a systemic level. However, it starts with each of us. Are we aware of our own biases and subconscious judgments that we make? As we talked about last week, as coaches, it is our role to keep growing in our awareness and peeling back the layers that may reveal information we were previously unaware of.

Scope of Practice

Health and wellness coaches work with individuals and groups in a client-centered process to facilitate and empower the client to develop and achieve self-determined goals related to health and wellness. Coaches support clients in mobilizing internal strengths and external resources, and in developing self-management strategies for making sustainable, healthy lifestyle, behavior changes. While health and wellness coaches per se do not diagnose conditions, prescribe treatments, or provide psychological therapeutic interventions, they may provide expert guidance in areas in which they hold active, nationally recognized credentials, and may offer resources from nationally recognized authorities such as those referenced in NBHWC's Content Outline with Resources. As partners and facilitators, health and wellness coaches support their clients in achieving health goals and behavioral change based on their clients' own goals and consistent with treatment plans as prescribed by individual clients' professional health care providers. Coaches assist clients to use their insight, personal strengths and resources, goal setting, action steps and accountability toward healthy lifestyle change.

Ethical - Bark, (#2, pp. 62-63) - CLEAR MONETARY ARRANGEMENTS

If payment for services is involved, the member needs to know how this will happen. Do they need to pay before coaching occurs? Do they pay for multiple sessions at a time? Does coaching stop if they don't pay? Answering these questions at the beginning in the coaching agreement, saves lots of uncomfortable questions later.

Ethical - Bark, (#2, pp. 62-63) - REFER AS APPROPRIATE

If we are not the best suited to support the member, it is our role to refer to the appropriate individual. At Level2, this could look like referring to an RD, endocrinologist, or nurse if the member has blood glucose spikes, lows or other challenges that are concerning and not easily explained by member choices.

Ethical - Bark, (#2, pp. 62-63) - AVOID CONFLICTS OF INTERESTS

It is our job to avoid potential conflicts of interest. At Level2, we probably wouldn't run into this to any great extend. An example outside of the company might sound like this. A practitioner coaches and also sells a certain brand of supplements, from which she gets a sizable kickback. If she doesn't disclose the financial arrangement with the client ahead of time, this would lead to an ethics violation.

Ethical - Bark, (#2, pp. 62-63) - CLARITY

It is our job to bring clarity to the expectation in the coaching relationship. This will be explained in more detail when we talk ab out the coaching agreement in Module 2 on coaching structure. Having these clear toles outline helps us protect ourselves and improves the experience for the member. For example, if we share up-front that the initial coaching session will be 20-25 minutes and follow-up session will be 12-15 minutes, we are protecting our time and giving the member clarity on what to expect. If a member start to go off on a tangent, we have the freedom to refer back to our initial agreement and use that to gently remind the member of our session boundaries.

Ethical - Bark, (#2, pp. 62-63) - RESPONSIBILITY

It is our responsibility to share honestly about our training our qualifications, as well as the benefits of the coaching relationship. Even if the member never finds out our qualifications aren't what we say they are, this comes back to the principle of integrity and being true to that no matter what. Also, regarding the benefits of coaching we need to be careful to not promise more than we can deliver. Let's say a member expects that her diabetes will be in remission in a month. If the month passes without major improvement, she may be frustrated with herself, with the coach, with the Level2 Program, or all of the above.

Ethical - Bark, (#2, pp. 62-63) - CONFIDENTIALITY

It is our role to respect the confidentiality of all member information. Throughout the coaching partnership, members share a lot of personal information with us. If they question how that information will be handled, it may interfere with the amount of information they are willing to share and thus, the extent to which we can help them.

Basics of HIPAA

Let's go over a few of the basics of HIPAA, starting with the name. The acronym stands for the Health Insurance Portability and Accountability Act of 1996. Congress passed this law with the purpose of keeping individuals health information safe and also keeping it available to the right sources (like healthcare providers and health plans) for continued medical care. While there are many components to HIPAA, we will highlight a couple key provisions. First, the privacy rule helps to protect protected health information (PHI) within health plans, healthcare clearing houses, and health care providers. There are a couple key features to note. A covered entity is required to provide PHI to an individual within 30 days if requested to do so by that individual. Care must be taken to share the minimum necessary information when PHI is disclosed. In certain situations, covered entities must disclose PHI, for example a court order or subpoena. Second, the security rule was established to complement the privacy rule. Their scope is slightly different. While the Privacy Rule dictates how all PHI is handled, the Security Rule pertains only to electronic PHI. Three types of safeguards were put in place by this rule: administrative, physical and technical. I'll give one quick example from each category. On the administrative side, covered entities are required to have training in place to help their employees understand how to handle PHI. Within the physical safeguards, one example is that workstations should be monitored so that the PHI potentially displayed on them is not in public view. Finally, a technical safeguard is computer system's data cannot be changed or erased without adhering to proper protocols.

Reasons to Refer - Moore et al, (#8, pg 20)

Member is/has •Less pleasure in life and more hopeless •Difficulty focusing •Struggling with sleep •Experiencing a change in appetite •Feeling guilty because of the suffering of others Impulsive or shows risk-taking behavior

What does PHI stand for?

Protected Health Information

How do you convey dignity and respect for those you work with?

See next few cards

Basics of HIPPA

Source references: HIPAA for professionals https://ww.hhs.gov/hipaa/for-professionals/index.html (Accessed July 17, 2020) Edemekong PF, Annamaraju P, Haydel MJ. Health Insurance Portability and Accountability Act (HIPAA) (Updated 2020 Mar 29). In: StatPearls (Internet). Treasure Island (FL): Stat Pearls Publishing; 2020 Jan-Available from: https://www.ncbi.nlm.nih.gov/books/NBK500019/ (Accessed July 17, 2020)

HIPAA Compliance - Summary of the HIPAA Security Rule

Summary of the HIPAA Security Rule This is a summary of key elements of the Security Rule including who is covered, what information is protected, and what safeguards must be in place to ensure appropriate protection of electronic protected health information. Because it is an overview of the Security Rule, it does not address every detail of each provision. Introduction The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.1 To fulfill this requirement, HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called "covered entities" must put in place to secure individuals' "electronic protected health information" (e-PHI). Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties. Prior to HIPAA, no generally accepted set of security standards or general requirements for protecting health information existed in the health care industry. At the same time, new technologies were evolving, and the health care industry began to move away from paper processes and rely more heavily on the use of electronic information systems to pay claims, answer eligibility questions, provide health information and conduct a host of other administrative and clinically based functions. Today, providers are using clinical applications such as computerized physician order entry (CPOE) systems, electronic health records (EHR), and radiology, pharmacy, and laboratory systems. Health plans are providing access to claims and care management, as well as member self-service applications. While this means that the medical workforce can be more mobile and efficient (i.e., physicians can check patient records and test results from wherever they are), the rise in the adoption rate of these technologies increases the potential security risks. A major goal of the Security Rule is to protect the privacy of individuals' health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity's particular size, organizational structure, and risks to consumers' e-PHI. This is a summary of key elements of the Security Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Privacy and Security Rules are obligated to comply with all of their applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier to review the complete requirements of the Security Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit our Security Rule section to view the entire Rule, and for additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs. Statutory and Regulatory Background The Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II) required the Secretary of HHS to publish national standards for the security of electronic protected health information (e-PHI), electronic exchange, and the privacy and security of health information. HIPAA called on the Secretary to issue security regulations regarding measures for protecting the integrity, confidentiality, and availability of e-PHI that is held or transmitted by covered entities. HHS developed a proposed rule and released it for public comment on August 12, 1998. The Department received approximately 2,350 public comments. The final regulation, the Security Rule, was published February 20, 2003.2 The Rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality, integrity, and availability of e-PHI. The text of the final regulation can be found at 45 CFR Part 160 and Part 164, Subparts A and C. Who is Covered by the Security Rule The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities") and to their business associates. For help in determining whether you are covered, use CMS's decision tool. Read more about covered entities in the Summary of the HIPAA Privacy Rule - PDF - PDF. Business Associates The HITECH Act of 2009 expanded the responsibilities of business associates under the HIPAA Security Rule. HHS developed regulations to implement and clarify these changes. See additional guidance on business associates. What Information is Protected Electronic Protected Health Information. The HIPAA Privacy Rule protects the privacy of individually identifiable health information, called protected health information (PHI), as explained in the Privacy Rule and here - PDF - PDF. The Security Rule protects a subset of information covered by the Privacy Rule, which is all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form. The Security Rule calls this information "electronic protected health information" (e-PHI).3 The Security Rule does not apply to PHI transmitted orally or in writing. General Rules The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI. Specifically, covered entities must: Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit; Identify and protect against reasonably anticipated threats to the security or integrity of the information; Protect against reasonably anticipated, impermissible uses or disclosures; and Ensure compliance by their workforce.4 The Security Rule defines "confidentiality" to mean that e-PHI is not available or disclosed to unauthorized persons. The Security Rule's confidentiality requirements support the Privacy Rule's prohibitions against improper uses and disclosures of PHI. The Security rule also promotes the two additional goals of maintaining the integrity and availability of e-PHI. Under the Security Rule, "integrity" means that e-PHI is not altered or destroyed in an unauthorized manner. "Availability" means that e-PHI is accessible and usable on demand by an authorized person.5 HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the Security Rule is flexible and scalable to allow covered entities to analyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources. Therefore, when a covered entity is deciding which security measures to use, the Rule does not dictate those measures but requires the covered entity to consider: Its size, complexity, and capabilities, Its technical, hardware, and software infrastructure, The costs of security measures, and The likelihood and possible impact of potential risks to e-PHI.6 Covered entities must review and modify their security measures to continue protecting e-PHI in a changing environment.7 Risk Analysis and Management The Administrative Safeguards provisions in the Security Rule require covered entities to perform risk analysis as part of their security management processes. The risk analysis and management provisions of the Security Rule are addressed separately here because, by helping to determine which security measures are reasonable and appropriate for a particular covered entity, risk analysis affects the implementation of all of the safeguards contained in the Security Rule. A risk analysis process includes, but is not limited to, the following activities:Evaluate the likelihood and impact of potential risks to e-PHI;8Implement appropriate security measures to address the risks identified in the risk analysis;9Document the chosen security measures and, where required, the rationale for adopting those measures;10 andMaintain continuous, reasonable, and appropriate security protections.11 Risk analysis should be an ongoing process, in which a covered entity regularly reviews its records to track access to e-PHI and detect security incidents,12 periodically evaluates the effectiveness of security measures put in place,13 and regularly reevaluates potential risks to e-PHI.14 Administrative Safeguards Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level. Security Personnel. A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.15 Information Access Management. Consistent with the Privacy Rule standard limiting uses and disclosures of PHI to the "minimum necessary," the Security Rule requires a covered entity to implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient's role (role-based access).16 Workforce Training and Management. A covered entity must provide for appropriate authorization and supervision of workforce members who work with e-PHI.17 A covered entity must train all workforce members regarding its security policies and procedures,18 and must have and apply appropriate sanctions against workforce members who violate its policies and procedures.19 Evaluation. A covered entity must perform a periodic assessment of how well its security policies and procedures meet the requirements of the Security Rule.20 Physical Safeguards Facility Access and Control. A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.21 Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.22 A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).23 Technical Safeguards Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).24 Audit Controls. A covered entity must implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use e-PHI.25 Integrity Controls. A covered entity must implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed. Electronic measures must be put in place to confirm that e-PHI has not been improperly altered or destroyed.26 Transmission Security. A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.27 Required and Addressable Implementation Specifications Covered entities are required to comply with every Security Rule "Standard." However, the Security Rule categorizes certain implementation specifications within those standards as "addressable," while others are "required." The "required" implementation specifications must be implemented. The "addressable" designation does not mean that an implementation specification is optional. However, it permits covered entities to determine whether the addressable implementation specification is reasonable and appropriate for that covered entity. If it is not, the Security Rule allows the covered entity to adopt an alternative measure that achieves the purpose of the standard, if the alternative measure is reasonable and appropriate.28 Organizational Requirements Covered Entity Responsibilities. If a covered entity knows of an activity or practice of the business associate that constitutes a material breach or violation of the business associate's obligation, the covered entity must take reasonable steps to cure the breach or end the violation.29 Violations include the failure to implement safeguards that reasonably and appropriately protect e-PHI. Business Associate Contracts. HHS developed regulations relating to business associate obligations and business associate contracts under the HITECH Act of 2009. Policies and Procedures and Documentation Requirements A covered entity must adopt reasonable and appropriate policies and procedures to comply with the provisions of the Security Rule. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, written security policies and procedures and written records of required actions, activities or assessments.30 Updates. A covered entity must periodically review and update its documentation in response to environmental or organizational changes that affect the security of electronic protected health information (e-PHI).31 State Law Preemption. In general, State laws that are contrary to the HIPAA regulations are preempted by the federal requirements, which means that the federal requirements will apply.32 "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.33 Enforcement and Penalties for Noncompliance Compliance. The Security Rule establishes a set of national standards for confidentiality, integrity and availability of e-PHI. The Department of Health and Human Services (HHS), Office for Civil Rights (OCR) is responsible for administering and enforcing these standards, in concert with its enforcement of the Privacy Rule, and may conduct complaint investigations and compliance reviews. Learn more about enforcement and penalties in the Privacy Rule Summary - PDF - PDF and on OCR's Enforcement Rule page. Compliance Dates Compliance Schedule. All covered entities, except "small health plans," must have been compliant with the Security Rule by April 20, 2005. Small health plans had until April 20, 2006 to comply. Copies of the Rule and Related Materials See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and HIPAA for Professionals for additional guidance material.

Client/Patient Privacy & Data Confidentiality in the Practice of Health and Wellness Coaching

The National Board for Health and Wellness Coaching (NBHWC) recognizes the critical importance of following best-practice with regards to client/patient privacy and data confidentiality when handling client/patient information and records. The NBHWC holds the position that health and wellness coaches should manage client/patient personal health information and records according to the policies and procedures as established by the Health Insurance Portability and Accountability Act (HIPAA). More specifically, health and wellness coaches should familiarize themselves and comply with, "Title II: HIPAA Administrative Simplification." Given the relative complexities and broad utilization of this legislation, it is recommended that coaches first familiarize themselves with "HIPAA for individuals" and then "HIPAA for Professionals." This information is provided by the Department of Health and Human Services (HHS). It is further recommended that health and wellness coaches pursue training and education germane to HIPAA compliance. The Department of Health and Human Services (HHS) also provides access to a number of free training and education resources, and this information can be found on their website. The NBHWC further recognizes that the setting within which health and wellness coaches provide services may dictate additional compliance-based rules and regulations. For example, coaches providing services within an educational environment may be required to comply with the Family Educational Rights and Privacy Act (FERPA). The U.S. Department of Education provides specific information and additional links https://www2.ed.gov/ferpa. They also Provide free sector specific training videos: https://studentprivacy.ed.gov/content/online-training-modules Regardless of the domain within which one practices health and wellness coaching (including those that are self-employed, practicing outside of healthcare, and/or in educational settings), it is the position of the NBHWC that all health and wellness coaches should educate themselves and comply with applicable best practices.

Summary of the HIPAA Privacy Rule

This is a summary of key elements of the Privacy Rule including who is covered, what information is protected, and how protected health information can be used and disclosed. Because it is an overview of the Privacy Rule, it does not address every detail of each provision.Summary of the Privacy Rule PDF - PDF Introduction The Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services ("HHS") issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").1 The Privacy Rule standards address the use and disclosure of individuals' health information—called "protected health information" by organizations subject to the Privacy Rule — called "covered entities," as well as standards for individuals' privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights ("OCR") has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.A major goal of the Privacy Rule is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier for entities to review the complete requirements of the Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit our Privacy Rule section to view the entire Rule, and for other additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs. Statutory and Regulatory Background The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions.HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, 2000.2 In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments.The final modifications were published in final form on August 14, 2002.3 A text combining the final regulation and the modifications can be found at 45 CFR Part 160 and Part 164, Subparts A and E. Who is Covered by the Privacy Rule The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities"). For help in determining whether you are covered, use CMS's decision tool. Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities.4 Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations ("HMOs"), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of government-funded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center,5 or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers' compensation, automobile insurance, and property and casualty insurance. If an insurance entity has separable lines of business, one of which is a health plan, the HIPAA regulations apply to the entity with respect to the health plan line of business. Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.6 Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all "providers of services" (e.g., institutional providers such as hospitals) and "providers of medical or health services" (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care. Health Care Clearinghouses.Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.7 In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse's uses and disclosures of protected health information.8 Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions. Business Associates Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.9 Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity. Business Associate Contract. When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates.10 Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first.11 See additional guidance on Business Associates and sample business associate contract language. What Information is Protected Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)."12 "Individually identifiable health information" is information, including demographic data, that relates to: the individual's past, present or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.13 Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g. De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information.14 De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual's relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.15 General Principle for Uses and Disclosures Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual's protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual's personal representative) authorizes in writing.16 Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action.17 See additional guidance on Government Access. Permitted Uses and DisclosuresPermitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual's authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make. (1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information. (2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities.19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship. See additional guidance on Treatment, Payment, & Health Care Operations. Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another.20 Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual21 and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual. Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity.22 Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below.23 Obtaining "consent" (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities.24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent. (3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. Facility Directories. It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual's informal permission to list in its facility directory the individual's name, general condition, religious affiliation, and location in the provider's facility.25 The provider may then disclose the individual's condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation. For Notification and Other Purposes. A covered entity also may rely on an individual's informal permission to disclose to the individual's family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person's involvement in the individual's care or payment for care. 26 This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual's informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual's care of the individual's location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts. (4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as "incident to," an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the "minimum necessary," as required by the Privacy Rule.27 See additional guidance on Incidental Uses and Disclosures. (5) Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual's authorization or permission, for 12 national priority purposes.28 These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information. Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29 Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law.30 See additional guidance on Public Health Activities and CDC's web pages on Public Health and HIPAA Guidance. Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.31 Health Oversight Activities. Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule) for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.32 Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33 Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34 Decedents. Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.35 Cadaveric Organ, Eye, or Tissue Donation. Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.36 Research. "Research" is any systematic investigation designed to develop or contribute to generalizable knowledge.37 The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual's authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals' authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought.38 A covered entity also may use or disclose, without an individuals' authorization, a limited data set of protected health information for research purposes (see discussion below).39 See additional guidance on Research and NIH's publication of "Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule." - PDF Serious Threat to Health or Safety. Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat). Covered entities may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.40 Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41 Workers' Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers' compensation laws and other similar programs providing benefits for work-related injuries or illnesses.42 See additional guidance on Workers' Compensation. (6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed.43 A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set. Authorized Uses and Disclosures Authorization. A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.44 A covered entity may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances.45 An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual's authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes. All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data. The Privacy Rule contains transition provisions applicable to authorizations and other express legal permissions obtained prior to April 14, 2003.46 Psychotherapy Notes47. A covered entity must obtain an individual's authorization to use or disclose psychotherapy notes with the following exceptions48: The covered entity who originated the notes may use them for treatment. A covered entity may use or disclose, without an individual's authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity's compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law. Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service.49 The Privacy Rule carves out the following health-related activities from this definition of marketing: Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication; Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan's enrollees that add value to, but are not part of, the benefits plan; Communications for treatment of the individual; and Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual. Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity's provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity's receipt of direct or indirect remuneration from a third party must reveal that fact. See additional guidance on Marketing. Limiting Uses and Disclosures to the Minimum Necessary Minimum Necessary. A central aspect of the Privacy Rule is the principle of "minimum necessary" use and disclosure. A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.50 A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary. When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose. See additional guidance on Minimum Necessary. The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual's personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules. Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of protected health information to which access is needed, and any conditions under which they need the information to do their jobs. Disclosures and Requests for Disclosures. Covered entities must establish and implement policies and procedures (which may be standard protocols) for routine, recurring disclosures, or requests for disclosures, that limits the protected health information disclosed to that which is the minimum amount reasonably necessary to achieve the purpose of the disclosure. Individual review of each disclosure is not required. For non-routine, non-recurring disclosures, or requests for disclosures that it makes, covered entities must develop criteria designed to limit disclosures to the information reasonably necessary to accomplish the purpose of the disclosure and review each of these requests individually in accordance with the established criteria. Reasonable Reliance. If another covered entity makes a request for protected health information, a covered entity may rely, if reasonable under the circumstances, on the request as complying with this minimum necessary standard. Similarly, a covered entity may rely upon requests as being the minimum necessary protected health information from: (a) a public official, (b) a professional (such as an attorney or accountant) who is the covered entity's business associate, seeking the information to provide services to or for the covered entity; or (c) a researcher who provides thedocumentation or representation required by the Privacy Rule for research. Notice and Other Individual Rights Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices.51 The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity's duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals' rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. See additional guidance on Notice. Notice Distribution. A covered health care provider with a direct treatment relationship with individuals must have delivered a privacy practices notice to patients starting April 14, 2003 as follows:Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (fortelephonic service delivery);By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; andIn emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates. Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request.52 A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information. The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement.53 Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement. A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the "named insured," that is, the subscriber for coverage that also applies to spouses and dependents. Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice.54 The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient's written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation. Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity's designated record set.55 The "designated record set" is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider's medical and billing records about individuals or a health plan's enrollment, payment, claims adjudication, and case or medical management record systems.56 The Rule excepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion.57 Covered entities may impose reasonable, cost-based fees for the cost of copying and postage. Amendment. The Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is inaccurate or incomplete. 58 If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the information to the individual's detriment.59 If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. The Rule specifies processes for requesting and responding to a request for amendment. A covered entity must amend protected health information in its designated record set upon receipt of notice to amend from another covered entity. Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity's business associates.60 The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date. The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual's personal representative; (c) for notification of or to persons involved in an individual's health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities. Restriction Request. Individuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual's health care or payment for health care, or disclosure to notify family members or others about the individual's general condition, location, or death.61 A covered entity is under no obligation to agree to requests for restrictions. A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical emergency.62 Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs.63 For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card. Health plans must accommodate reasonable requests if the individual indicates that the disclosure of all or part of the protected health information could endanger the individual. The health plan may not question the individual's statement ofendangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled. Administrative Requirements HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the flexibility and scalability of the Rule are intended to allow covered entities to analyze their own needs and implement solutions appropriate for their own environment. What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources. Privacy Policies and Procedures. A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule.64 Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity's privacy practices.65 Workforce Training and Management. Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity).66 A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions.67 A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule.68 Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule.69 Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.70 For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See additional guidance on Incidental Uses and Disclosures. Complaints. A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule.71 The covered entity must explain those procedures in its privacy practices notice.72 Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS. Retaliation and Waiver. A covered entity may not retaliate against a person for exercising rights provided by the Privacy Rule, for assisting in an investigation by HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates the Privacy Rule.73 A covered entity may not require an individual to waive any right under the Privacy Rule as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.74 Documentation and Record Retention. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented.75 Fully-Insured Group Health Plan Exception. The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan.76 Organizational Options The Rule contains provisions that address a variety of organizational issues that may affect the operation of the privacy protections. Hybrid Entity. The Privacy Rule permits a covered entity that is a single legal entity and that conducts both covered and non-covered functions to elect to be a "hybrid entity."77 (The activities that make a person or organization a covered entity are its "covered functions."78) To be a hybrid entity, the covered entity must designate in writing its operations that perform covered functions as one or more "health care components." After making this designation, most of the requirements of the Privacy Rule will apply only to the health care components. A covered entity that does not make this designation is subject in its entirety to the Privacy Rule. Affiliated Covered Entity. Legally separate covered entities that are affiliated by common ownership or control may designate themselves (including their health care components) as a single covered entity for Privacy Rule compliance.79 The designation must be in writing. An affiliated covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions. Organized Health Care Arrangement. The Privacy Rule identifies relationships in which participating covered entities share protected health information to manage and benefit their common enterprise as "organized health care arrangements."80 Covered entities in an organized health care arrangement can share protected health information with each other for the arrangement's joint health care operations.81 Covered Entities With Multiple Covered Functions. A covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions.82 The covered entity may not use or disclose the protected health information of an individual who receives services from one covered function (e.g., health care provider) for another covered function (e.g., health plan) if the individual is not involved with the other function. Group Health Plan disclosures to Plan Sponsors. A group health plan and the health insurer or HMO offered by the plan may disclose the following protected health information to the "plan sponsor"—the employer, union, or other employee organization that sponsors and maintains the group health plan83: Enrollment or disenrollment information with respect to the group health plan or a health insurer or HMO offered by the plan. If requested by the plan sponsor, summary health information for the plan sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan. "Summary health information" is information that summarizes claims history, claims expenses, or types of claims experience of the individuals for whom the plan sponsor has provided health benefits through the group health plan, and that is stripped of all individual identifiers other than five digit zip code (though it need not qualify as de-identified protected health information). Protected health information of the group health plan's enrollees for the plan sponsor to perform plan administration functions. The plan must receive certification from the plan sponsor that the group health plan document has been amended to impose restrictions on the plan sponsor's use and disclosure of the protected health information. These restrictions must include the representation that the plan sponsor will not use or disclose the protected health information for any employment-related action or decision or in connection with any other benefit plan. Other Provisions: Personal Representatives and Minors Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual's protected health information, as well as the individual's rights under the Rule.84 A personal representative is a person legally authorized to make health care decisions on an individual's behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when acovered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual. Special Case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children. If State and other law is silent concerning parental access to the minor's protectedhealth information, a covered entity has discretion to provide or deny a parent access to the minor's health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See additional guidance on Personal Representatives. State Law Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.85 "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.86 The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits. Exception Determination. In addition, preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law: Is necessary to prevent fraud and abuse related to the provision of or payment for health care, Is necessary to ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation, Is necessary for State reporting on health care delivery or costs, Is necessary for purposes of serving a compelling public health, safety, or welfare need, and, if a Privacy Rule provision is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law. Enforcement and Penalties for Noncompliance Compliance. The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) establishes a set of national standards for the use and disclosure of an individual's health information - called protected health information - by covered entities, as well as standards for providing individuals with privacy rights to understand and control how their health information is used. The Department of Health and Human Services, Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews. Consistent with the principles for achieving compliance provided in the Privacy Rule, OCR will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Privacy Rule. Covered entities that fail to comply voluntarily with the standards may be subject to civil money penalties. In addition, certain violations of the Privacy Rule may be subject to criminal prosecution. These penalty provisions are explained below. Civil Money Penalties. OCR may impose a penalty on a covered entity for a failure to comply with a requirement of the Privacy Rule. Penalties will vary significantly depending on factors such as the date of the violation, whether the covered entity knew or should have known of the failure to comply, or whether the covered entity's failure to comply was due to willful neglect. Penalties may not exceed a calendar year cap for multiple violations of the same requirement. Category For violations occurring prior to 2/18/2009 For violations occurring on or after 2/18/2009 Penalty Amount Up to $100 per violation $100 to $50,000 or more per violation Calendar Year Cap $25,000 $1,500,000 A penalty will not be imposed for violations in certain circumstances, such as if: the failure to comply was not due to willful neglect, and was corrected during a 30-day period after the entity knew or should have known the failure to comply had occurred (unless the period is extended at the discretion of OCR); or the Department of Justice has imposed a criminal penalty for the failure to comply (see below). In addition, OCR may choose to reduce a penalty if the failure to comply was due to reasonable cause and the penalty would be excessive given the nature and extent of the noncompliance. Before OCR imposes a penalty, it will notify the covered entity and provide the covered entity with an opportunity to provide written evidence of those circumstances that would reduce or bar a penalty. This evidence must be submitted to OCR within 30 days of receipt of the notice. In addition, if OCR states that it intends to impose a penalty, a covered entity has the right to request an administrative hearing to appeal the proposed penalty. Criminal Penalties. A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm. The Department of Justice is responsible for criminal prosecutions under the Priv Compliance Dates Compliance Schedule. All covered entities, except "small health plans," must have been compliant with the Privacy Rule by April 14, 2003.90 Small health plans, however, had until April 14, 2004 to comply. Small Health Plans. A health plan with annual receipts of not more than $5 million is a small health plan.91 Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) 121.104 to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts.92See What constitutes a small health plan? Copies of the Rule & Related Materials See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and Understanding HIPAA for additional guidance material.

HIPAA for Professionals

To improve the efficiency and effectiveness of the health care system, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, included Administrative Simplification provisions that required HHS to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security. At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information. Consequently, Congress incorporated into HIPAA provisions that mandated the adoption of Federal privacy protections for individually identifiable health information. HHS published a final Privacy Rule in December 2000, which was later modified in August 2002. This Rule set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically. Compliance with the Privacy Rule was required as of April 14, 2003 (April 14, 2004, for small health plans). HHS published a final Security Rule in February 2003. This Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information. Compliance with the Security Rule was required as of April 20, 2005 (April 20, 2006 for small health plans). The Enforcement Rule provides standards for the enforcement of all the Administrative Simplification Rules. HHS enacted a final Omnibus rule that implements a number of provisions of the HITECH Act to strengthen the privacy and security protections for health information established under HIPAA, finalizing the Breach Notification Rule. View the Combined Regulation Text - PDF (as of March 2013). This is an unofficial version that presents all the HIPAA regulatory standards in one document. The official version of all federal regulations is published in the Code of Federal Regulations (CFR). View the official versions at 45 C.F.R. Part 160 - PDF, Part 162 - PDF, and Part 164 - PDF. Other HIPAA Administrative Simplification Rules are administered and enforced by the Centers for Medicare & Medicaid Services, and include:Transactions and Code Sets StandardsEmployer Identifier StandardNational Provider Identifier Standard Want to learn more about the HIPAA Privacy & Security Rules? Sign Up for the OCR Privacy & Security Listservs OCR has established two listservs to inform the public about health information privacy and security FAQs, guidance, and technical assistance materials. We encourage you to sign up and stay informed!

Ethical: Potential Conflicts of Interest

We do not push products that we get a monetary reward for.

More on Confidentiality

We know that it's important to keep a member's information confidential. But what are some of the guidelines around this? To start, it is important to clearly define confidentiality standards both verbally and in writing. In this way, we can create a safe space for members to share. While some members don't have any problem telling us about their journey, other members may be more likely to share if they know confidentiality is being upheld Another pieces of the puzzle are the requirements of the HIPPA law. We will be covering this in more detail later today, but for the sake of this conversation, it's important to note that the law does play a role. It's not just an ethical code; there are actual legal implications as well. Finally, there are times when it's okay to break our confidentiality agreement with members. If it's a life and death emergency, we need to speak up and tell someone. Also, if members share any plans to harm themselves or others, it is our duty to report. Any cases of abuse are another reason to break our silence. It may be awkward, but ultimately, we have the best interest of the members in mind and those whose lives they touch. •Here are a couple of examples of what could violate the NBHWC Code of Ethics. Any product that we sell on the side and might recommend to members I something that should be disclosed. Also if we are referring a member to another practitioner and receive compensation, we need to share this up-front. •There are two key takeaways. One: disclosure is our responsibility. Two: no coaching relationship should be based on the premise that members need to buy certain products or use certain services in order to maintain the coaching partnership. We need to ensure that there is clear separation.

Ethical - Bark, (#2, pp. 62-63) - ACT ON AWARENESS OF PERSONAL ISSUES THAT MAY INTERFERE WITH COACHING

We need to stay aware of how our personal issues may interfere with the coaching partnership. For example, let's say my grandma recently passed away, and I am still dealing with the grief of losing her. If the member shares that the recent loss of her family member is impacting her mindset, this may touch a raw nerve within me. As a result, it may be best for me to refer this member to another coach or perhaps another healthcare professional, like a counselor or psychologist.

Best Practices for Wearing Multiple Hats _ Kimsey-House etal, (#6, pg 163)

While we may need to refer, how do we handle a member interaction when we have expert knowledge we can provide? We do have coaches at Level2 with multiple "hats" that they can wear when it comes to working with our members. For example, several of our staff are health coaches and registered dieticians. These guidelines from the Co-Active Coaching book provide a step-by-step process. Let's use this scenario, a Level2 member is practicing a vegetarian diet and is interested in trying a ketogenic diet as well. She needs guidance on how to get enough protein in her meal plan, though many common sources of vegetarian protein may not be keto-friendly. The health coach working with this member is also a train dietician. First, the coach determines what information she could provide and how important that would be to the member. In this case, getting enough protein is very important and the member seems open to hearing more details. Second, the coach should make it clear to the member that she is switching roles. A sample dialogue could be, "hypothetical person, as I shared in our initial coaching session, in addition to my role as a health coach, I am also a registered dietician. In this role, I have some information that I could share about getting adequate protein while following both a vegetarian diet and the keto diet." In the third step, the coach asks for permission to share what she knows. Going back to our previous example, the coach could say something like this, "is it okay with you if i share this information with you?" If the member says yes, you can then share whatever information seems most relevant to what the member needs. The final piece of guidance is that we offer advice without being attached to the outcome, or the member response. IN our example with hypothetical person, she may decide that she wants to follow the recommendations, or she may choose to not take the advice. It is our role to support the member's autonomy and give her the freedom to make her own decisions as long as those decisions are not posing a health risk.

Types of Referrals - Gavin et al, (#4, pg. 87)

•1. Completely ends relationship •2.Refers and continue working with member So let's say the member needs a specific meal plan or has a mental health concern that we can't ethically treat. We have two options, either completely refer the member to another practitioner's care or work alongside the other practitioner, so to speak. Many times, the member may benefit by working with multiple practitioners on his or her care team. For example, at Level2, members are working with the coach, with their primary care physician or endocrinologist, and often another practitioner like a nutritionist, dietician, or physical therapist. Having this team allows the member to get great quality support, and each practitioner can stay with in their scope of practice. Having good communication is key so that important pieces of information don't fall through the cracks. What information is it important to have from a member's healthcare team at Level2?

Self-Management of Triggers - Kimsey-House et al, (#6, pg. 103)

•1. Notice it: we notice that we are feeling triggered. We pause, we take a deep breath and bring awareness to our emotional state. 2.•Name it: we name the feeling or trigger. Maybe the member started talking about a certain political party, and my views differ. I can name the feeling as "disunity" or "judgment" or whatever best fits situation. •3. Reconnect: after we have noticed the feeling and named it, we can make the choice to set it aside and reconnect with our member. We may need to go back later and address these feelings with ourselves or with a mentor, but for the moment, we are able to regain focus and be fully present.

Breaking Down the HIPPA Statement NBHWC HIPPA Statement

•1. We need to abide by HIPPA. Thankfully, her at Level2, we have a legal team that does much of the investigative work so that we don't have to ready through lots of complicated jargon •2. The statement highlights Title II: HIPPA Administrative Simplification. Basically, Title II out of five titles, covers these topics: preventing health care fraud and abuse. •Medical liability reform Simplifying administrative methods that lead to the establishing of national standards for electronic healthcare transactions and identifiers for providers, employers •3. The NBHWC calls out two specific links, one that goes over what HIPPA means for individuals and one for professionals. While the information can still be pretty dense, there are some videos with in the HIPAA for individuals link that can help to clarify what HIPPA means more specifically. •4. It is important for us to continue learning more about HIPAA. As an employee of UHG, this is part of the reason why we are required to go through regular training on this topic. •5. Especially if a health coach has a private practice without the luxury of the UHG Legal Team, it is important to educate oneself on the local, state and federal regulations governing our work.

Relevance to Day-to-Day Operations

•Confirming Identifiers (first and last name, date of birth, address or phone number) Is an example of how we can adhere to HIPAA and keep members' information safe. •Also it is our role to keep information that members share within the coaching portal/Salesforce/etc. and not talk about this with our coworkers (unless necessary for their role), family or friends. •Additionally, we need to use care when getting advice from another person about how to handle a certain member challenge. We should share only the minimum of information necessary. •As telecommuters here at Level2 it is our responsibility to create a HIPAA-compliant home office. What does it take? Here are a few keys to creating a more compliant space: •Keep your laptop locked when not in use, just like you would at the office. Even if only family members are at home with you, it would still violate HIPAA -guidelines to allow them any kind of access to PHI •If possible, set up your screen so that it can't be easily seen by others. This may require repositioning your desk if it's in a common room or simply closing the door if with a designated room. •It's important that printouts or any notes written with member information that may contain PHI be stores or discarded safely, to minimize the risk of the information being misused.

NOT within Scope of Practice -Muth etal (#9, pg 7)

•Counseling, therapy, consulting •Nutrition prescription and meal planning •Exercise prescription •Laboratory evaluation and assessment •Diagnosis of medical or mental health conditions •Recommendation, promotion, or sale of nutritional supplements •This list comes from the Coaching Behavior Change manual. Unless we have a degree, which allows us to practice as a counselor or therapist, we need to stay out of this area of expertise. Additionally, nutrition prescription and meal planning fall under the jurisdiction of a registered dietician. The NBHWC Scope of Practice does make the distinction that we can utilize resources from its healthy lifestyle curriculum. This includes all the links that are in the health and wellness section of the exam content outline, links form website like the Centers for Disease Control, The National Institutes of Health, or Harvard Medical School. •It's also important for us to not prescribe a specific exercise plan for a member, unless we have the specific training, such as being a certified personal trainer or a physical trainer or a physical therapist. •While it might seem obvious, we shouldn't evaluate lab tests or assessments or diagnose medical or mental health conditions. •Finally, recommending, promoting or selling nutritional supplements technically falls outside of the scope of practice of a health coach.

Basics of HIPAA - what does it stand for?

•HIPAA - Health Insurance Portability & Accountability Act of 1996 •Primary provisions: •Privacy Rule •Protects PHI (Protected Health Information) •Security Rule •Protects PHI as it is transmitted/stored/access electronically

Politics/Religion •How to stay in the coaching mindset when the topic gets personal and/or conflicts with your own beliefs and values

•Have a plan upfront when someone brings up hot political and religious subjects that go against your own political and religious beliefs. •If it goes on for too long then you can gently gently gently set boundaries. •Acknowledge the persons passion only don't get involved or contribute to the conversation

Scope of Practice - NBHWC Health & Wellness coach scope of practice

•Health and wellness coaches work with individuals and groups in a client-centered process to facilitate and empower the client to develop and achieve self-determined goals related to health and wellness. Coaches support clients in mobilizing internal strengths and external resources, and in developing self-management strategies for making sustainable, healthy lifestyle, behavior changes. While health and wellness coaches per se do not diagnose conditions, prescribe treatments, or provide psychological therapeutic interventions, they may provide expert guidance in areas in which they hold active, nationally recognized credentials, and may offer resources from nationally recognized authorities such as those referenced in NBHWC's Content Outline with Resources. As partners and facilitators, health and wellness coaches support their clients in achieving health goals and behavioral change based on their clients' own goals and consistent with treatment plans as prescribed by individual clients' professional health care providers. Coaches assist clients to use their insight, personal strengths and resources, goal setting, action steps and accountability toward healthy lifestyle change.

Medicaton & Supplement Advice

•I'm here to assist you within safe boundaries, so I would suggest that you speak to your doctor but we can have a conversation of what train of thoughts. As for supplements: refer them to Registered Dietician

Reasons to Refer - Moore et al, (#8, pg 20) cont.

•In addition to referring members if their needs fall outside our scope of practice, this list from the Coaching Psychology Manual outlines additional reasons when it is important to refer. This specifically details signs to look for with members who might need a mental health provider. •If members are noticeably more hopeless, or if activities they used to enjoy no longer elicit pleasure, there may be something deeper going on than coaching can address. In addition, we may notice that members have a hard time focusing and seem easily distracted or perhaps forger their goals consistently. Another sign to refer is when members routinely struggle with sleep, either getting too much or struggling to fall asleep or stay asleep. A change in appetite is also a potential red flag. The member may forger to eat or may overeat. Either throughout the day or by binge eating. •If members talk about feeling immense guilty because of the suffering of others, they may need a mental health referral, and impulsive or extreme risk-taking behavior are other signs to be aware of. While we all may have days where we feel sad or have a change in appetite, etc. it's important to look for patterns with our members and if these patterns affect their ability to move forward and make changes.

Convey Dignity & Respect for All - Jordan (#5, pg. 84-87)

•In her book How to be a Health Coach, Meg Jordan shares this quote to summarize her discussion of how to respond to those who are culturally, ethnically, socioeconomically, etc. Different from us. It starts with our heart intent, with our desire to connect and truly understand others. While it can be helpful to gain more knowledge around culturally sensitive language, etc. showing unconditional positive regard can take us a long way. Here are additional tips to help us convey dignity and respect for all individuals that cross our paths. • "Othering" is the mentality of "it's me against them". This also reinforces biases and prejudices, that certain groups of people always behave in certain ways and thus should be treated in a certain way. Maybe we have judge others by what they are wearing and put everyone in one group because of something very much on the surface. The human race is just that, one race. The more we see the things that wse all have in common, the stronger our connections will be. •As these stories surface, it is important to acknowledge the discomfort and be willing to give space to it. It's okay to be unsure of how to interact with a member of a different ethnicity or cultural background, but we need to own that. When we enter a coaching relationship with someone different than us, genuine curiosity will support the growth of the partnership. As we utilize open-ended questions and reflect emotions, we build trust and let the member know we want to learn how we can best support them. •Finally, it is important to steer away from cultural generalizations. While every cultural sub-group does have certain traits in common, it can be insulting to presume that we know all the likes and dislikes a person has before starting a coaching relationship.

Confidentiality

•Make it clear verbally and in writing •Create the safe space for members •Be aware of HIPAA's impact •Know the exceptions •Life and death emergencies •Information about plans to harm oneself or another person •Evidence of abuse against the elderly, disabled or minors

National Board of Health and Wellness Coaching Code of Ethics

•NBHWC Coach •Sponsor is the entity paying for and/or arranging for coaching services to be provided

Other Ethics -Gavin et al (#4, pg. 87)

•Other Ethical Codes that you can read to broaden your understanding: •American Counseling Association •American Psychological Association •National Board for Certified Counselors •Worldwide Association of Business Coaches •BUT FOCUS ON THE NBHWC CODE OF ETHICS!!!

Ethical Considerations

•Respect for everyone •Act with integrity •Establish clear roles and boundaries •Accurately represent our training, qualifications, etc. •Have clear monetary arrangements •Act on awareness of personal issues that may interfere w/ coaching •Refer as appropriate •Avoid conflicts of interest Respect confidentiality

Ethics & Legal Cohort#3 Week 3 NBC-HWC Training

•Summarize the NBHWC Code of Ethics and how it applies to health coaching, including the following areas: •Confidentiality •Conflicts of interest •Demonstrating respect for all •Scope of practice •Explain how HIPPA applies to health coaching

Action Model by duffy & Passmore (2010) Gavin et al (#4 pg 86)

•This is one model of how to respond to ethical decisions as outlined in the lifestyle wellness Coaching Book. Based on the research of Duffy and Passmore, they identified this model that can assist coaches.

Action Model by duffy & Passmore (2010) Gavin et al (#4 pg 86) What does A C T I O N stand for?

•What does A stand for? Stands for awareness. We need to have awareness of the code of ethics that governs our practice, namely the NBHWC Code of Ethics. We also need awareness of our own values and beliefs. •What does C stand for? Stands for classify. We must determine what are the issues at stake. What is relevant to this discussion? This helps to bring clarity so that we focus on what is truly important to the discussion. •What does T stand for: Stands for time. We shouldn't hurry to make a decision when an ethical issue is concerned. WE should do our research and talk to the experts in our field. •What does I stand for? Stands for initiate. We can come up with a few different ways we could move forward. •What does O stand for? Stands for options. Each idea we come up with in the previous step should be evaluated for its benefits and drawbacks. •What does N stand for? Stands for novate. Let's pause for a moment. What does novate mean? According to the Merriam-Webster dictionary, it is "to replace (an old obligation) by a new obligation". Relating that to our discussion, once we decide on an option to try, we can incorporate that into best practices and policies moving forward.

Ethical Situations; Professional Conduct - Personally know the individual scheduled for coaching

•When you personally know •You can re-assign the person to another coach •Or if you feel comfortable you can ask the other person if they feel comfortable to move forward and if not that I can assign another coach