College Life Documented

MCCG100 - WEEK 4 HIPAA Law Report 1

Abstract

The Health Insurance Portability and Accountability Act of 1996, Public Law §§ 104-191 was national legislation passed to protect all "individually identifiable health information" held or transmitted by a covered entities (Health plans, Healthcare clearinghouses, and Healthcare Providers) or its business associates, in any form or media, whether electronic, paper or oral. This information is known as "protected health information” (PHI) and it includes demographic data, which relates to the individual’s past, present, or future physical health condition or mental health, provision for payment of healthcare for the individual, common identifiers (e.g., name, address, birth date, Social Security Number), and any health information that which is reasonably perceived as identifiable to the individual.

Keywords:

(Notice of Privacy Practices) (Inspection) (Complaints) (Amendments)

(Restricting Disclosure) (Communication) (Personal Representatives) (Security Rule)

(Safeguards) (Compliance and Enforcement) (Penalties for HIPAA Violations) (Criminal Penalties) (Breach Notification) (HIPAA’s impact over the last five years) (References)

(Table 1 HIPAA Statutes) (Table 2 Top 5 Issues Investigated of 2018-2021)

Notice of Privacy Practices

The Privacy Rule requires covered entities to supply a Notice of Privacy Practices form to their patients. Covered Entities must have a form for patients to sign to acknowledge they received the NPP, or documentation must be substituted in place of the form. The notice will inform the individual, (patient) of how the covered entity will use (internal) and disclose (external) their PHI. The form will also inform the patient they have the right to request the covered entity:

 to review and obtain a copy of their protected health information in their medical records.

 restrict use or disclosure of their PHI.

 amend their protected health information in the medical record when that information is inaccurate or incomplete.

 send communications using a specified contact method, e.g.: email instead of phone contact or in a closed envelope rather than a postcard.

 to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual’s protected health information. (“3000, Administrative Policy | Texas Health and Human Services”)

 to make a complaint with them or to make a complaint with HHS if they feel their privacy rights have been violated.

*With some exceptions or some requests may be denied at the covered entities discretion.

The Security Rule

Secures ePHI, but the standard also applies to physical PHI. ePHI may be stored on computers, mobile devices, networks, or the cloud. The Security Rule requires covered entities to employ safeguards to ensure confidentiality, integrity, and security of electronic protected health information in electronic use and disclosure. Safeguards are as follows:

• Administrative controls: – policies and procedures.

• Physical controls: – tangible or physical controls to protect data and prevent it from theft or unauthorized access or persons.

• Technical controls: – protected computer systems and protection sending electronic PHI over open networks to prevent ePHI from access by unauthorized or unintended recipient.

Compliance and Enforcement

HHS will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Rule. Complaints about potential HIPAA violations are investigated by the OCR, and while many prove to be unsubstantiated, oftentimes a HIPAA covered entity or an employee of that organization, is discovered to have violated patient privacy or HIPAA Breach, Penalties: (“How Does OCR Deal with HIPAA Complaints? - hipaajournal.com”)

• Category 1: $100 minimum fine per violation, $50,000 maximum fine.

the covered entity was not aware of and could not have reasonably known was a violation by exercising a reasonable amount of due diligence (“What are the Penalties for HIPAA Violations? - HIPAA Guide”)

• Category 2: $1,000 minimum fine per violation, $50,000 maximum fine.

the covered entity should have been aware of but could not have been prevented even with a reasonable amount of care (“HIPAA Enforcement Rule - Violations”)

• Category 3: $10,000 minimum fine per violation, $50,000 maximum fine.

willful neglect of HIPAA Rules, in cases where efforts have been made to address the violation within 30 days. (“What are the Penalties for HIPAA Violations? - HIPAA Guide”)

• Category 4: $50,000 minimum fine per violation.

willful neglect, where no efforts have been made to correct the violation in a reasonable period (“What are the Penalties for HIPAA Violations? - HIPAA Guide”)

Criminal Penalties

The Department of Justice will enforce criminal sanctions.

· up to one-year imprisonment and $50,000 fine - if a person knowingly obtains or discloses individually Identifiable health information in violation of HIPAA (“Eligibility Transaction System Inquiries Rules of Behavior”)

· up to five years imprisonment and $100,000 fine- if the wrongful conduct involves false pretenses, (“HIPAA Privacy Rules for the Protection of Health and Mental Health ...”)

· up to ten years imprisonment and $250,000 fine- if the wrongful conduct involves the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm. (“HIPAA Flashcards | Quizlet”)

Breach Notification

An impermissible use or disclosure of protected health information is presumed to be a breach. Following a breach of unsecured protected health information, covered entities must send notice of the breach to: (“Breach Notification Rule | Guidance Portal - HHS.gov”) affected individuals, the Secretary, and, (In certain circumstances,) to the media. "In addition, business associates must notify covered entities if a breach occurs or at by the business associate." (“Breach Notification Rule | Guidance Portal - HHS.gov”) And covered entities handle sending notification of a breach that occurred by a business associate

HIPAA’s Impact on Healthcare Professionals in the Past Five Years

HIPAA Privacy over the last five-year period. The 2016/2017 Audit findings highlighted covered entities failures to comply were felt across the board. The findings were significant to drill down into the specifics of the non-compliance and insufficiency. As a result, the plain language in the Notice of Privacy Practices and Electronic Notice of Privacy Practices was reconsidered and enhanced by compliance protocols focused efforts. Another major initiative to come from this audit was the Individual Access to PHI, which was found to be inadequate or incorrect policies and procedures for providing access resulted in the need to be reconsidered and policies and procedures had to strengthened. Breach Notification Response, Breach Notification Response Time Frame, Notification of Breach by Business Associate to Covered Entity, Content of Breach Notification were all found to be insufficient, not followed through, no process, no reasonable time set lead to improvements to the Plain language, new response time frames, and clarification of impermissible uses.

HIPAA is having a profound impact on fraud and abuse detection and prevention, electronic communication standards, and health information security. The impacts on Healthcare Providers have proven to be costly in efforts to maintain compliance with the technical and physical standards and even more so for some providers who have settled cases for non-compliance. Impermissible Uses and Disclosures remain the top issue of the top five Issues in Investigated Cases Closed between 2018-2021. See Table 2.

Table 2 - Top Five Issues in Investigated Cases Closed with Corrective Action, by Calendar Year

Issue 1 Issue 2 Issue 3 Issue 4 Issue 5

2021 Impermissible Uses & Disclosures Access Safeguards Administrative Safeguards Breach – Notice to the individual

2020 Impermissible Uses & Disclosures Safeguards Access Administrative Safeguards Technical Safeguards

2019 Impermissible Uses & Disclosures Safeguards Access Administrative Safeguards Technical Safeguards

2018 Impermissible Uses & Disclosures Safeguards Administrative Safeguards Access Technical Safeguards

(Top Five Issues in Investigated Cases Closed | HHS.gov)

References

3000, Administrative Policy | Texas Health and Human Services, https://www.hhs.texas.gov/handbooks/primary-health-care-services-program-policy-manual/3000-administrative-policy.

How Does OCR Deal with HIPAA Complaints? - hipaajournal.com, https://www.hipaajournal.com/how-does-ocr-deal-with-hipaa-complaints-3514/.

What are the Penalties for HIPAA Violations? - HIPAA Guide, https://www.hipaaguide.net/hipaa-violation-penalties/.

Eligibility Transaction System Inquiries Rules of Behavior, https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/HETSHelp/Downloads/Eligibility-Transaction-System-Inquiries-Rules-of-Behavior.pdf.

HIPAA Privacy Rules for the Protection of Health and Mental Health ..., https://omh.ny.gov/omhweb/hipaa/phi_protection.html.

HIPAA Flashcards | Quizlet, https://quizlet.com/147370189/hipaa-flash-cards/.

Breach Notification Rule | Guidance Portal - HHS.gov, https://www.hhs.gov/guidance/document/breach-notification-rule.

The 2016-2017 HIPAA Audits Industry Report may be found at: https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf - PDF

Top Five Issues in Investigated Cases Closed with Corrective Action, by ..., https://www.hhs.gov/guidance/document/top-five-issues-investigated-cases-closed-corrective-action-calendar-year-0.

MCCG100 WEEK 1 Reflection - What I find most intriguing about Medical Coding and Reimbursement

What I find most intriguing about Medical Coding and Reimbursement is the endless versatility, in a demanding job market. I would like to follow my passion for working with medical records, and specifically train in coding and reimbursement roles to see my vision come to fruition. I have high aspirations, and set short-term goals that will build up to my long-term goal, to start my own medical billing and coding company, one day. I can see it all possible beginning with learning about medical coding and reimbursement!

The topics I am most interested in learning more about, are the different coding sets; ICD-10, CPT, HCPCS, what they are made up of, and how they are used in coding. I have used the HCPCS and CPT codes to bill for outpatient behavioral health providers, but this was mostly self-taught and with one day of instruction from Medicaid. It was extremely basic practice nonetheless, it was great exposure for me. Because I really enjoyed getting my providers paid and took the initiative to help create other sources of revenue for them as well. And I was hooked. ‘I finally knew what I wanted to be when I grew up’. Overall, I am excited to start learning about all aspects of medical coding and reimbursement. It has been a ‘long-time coming’ for me. It is important to me that I learn everything I can while I achieve my formal education at college. I look forward to the next 7 weeks in your class.

COMM104 – WEEK 7 Act Workplace Documents Assessment

Reading for information skills is different from leisurely reading skills because it makes you think differently about what you are reading. You might use scanning for keywords and or summarize the subject of the text, reading that may be needed in the workplace. Whereas when you are leisurely reading, you may read for pleasure, and you do not have an ulterior purpose for understanding the text.

I found some of the questions to be exceedingly difficult in the ACT Assessment because of the way a question was worded in a completely different context as to how the passage example was written. An example of that would be the question you have to answer is what step comes next? And, the way the passage is worded is in such a way that the direction stated actually precedes the item being discussed.

Three tips I would use to advise future COMM104 students who are preparing to take the ACT test:

Make sure you are well rested, eat a healthy snack, and your mind is clear to start the test.
It consists of a short reading passage and then you will answer 2-3 questions and that is it, you will be done with it and move on to a new reading.
If you are stuck on a question, move on, and come back to it later and remember you are not being timed.

Based on my results, I want to keep my reading comprehension skills sharp by continuing to read and reread directions always and double check my answers to make sure they are correctly answering the question being asked.

MCCG100 - Week 7.5 Reflection

What I found most interesting to learn came with the research and completion of the Case Scenarios assignment from week six because it provided insight into what a medical coder's actual job duties look like. Every week supplied a new set of challenges, but the topic that I thought was most challenging was learning about the four main coding classification systems. Each set is unique to the other and it was helpful to organize the sets into the Code Set Report and Table assignment from week five. I’m not sure of anything I could have done differently to achieve a better outcome. I’m very passionate about learning and making a career in Medical Coding. I’m proud of my efforts, I applied myself and really enjoyed this course. My advice to future students is to always reach out to the instructor if they need any clarification. Thank you, to my Instructor: for the wisdom and encouragement you’ve impressed upon me. And for always letting me know that you were there if I needed any help with the course content. Someday I will reflect on this experience and the lessons I learned in this course as the start of my journey, but for now, I look forward to advancing the next step.

ENGL102 - Week 7.5 Reflection

Academic integrity is about respecting the process and oneself to faithfully apply information that comes from within thyself. Making a commitment to allow the full potential of the learning experience to be achieved. It is knowing what practices do not align with academic integrity, and if in doubt, seek clarification. For me, it is a standard of practice to remain in line with academic expectations because I value my learning experience, and nothing is worth jeopardizing my enrollment or potential learning opportunities. I will continue to build on my innate ability to maintain my academic integrity. If a fellow student was having trouble understanding the importance of academic integrity, my message is: just don’t cheat! Nothing can be said of someone with bad morals, though. As we advance education levels the standards for achieving academic integrity become more complex involving stricter guidelines. Every student is responsible for their education, and I am only focused on mine.

ENGL102 - WEEK 7 Article Summary and Reflection for the Workplace

The new workplace is evolving, and so is the formula for effective leaders, high emotional intelligence is now understood to be the key ingredient needed which promotes five basic strengths: self-awareness, self-regulation, empathy, motivation, and social skills. People who have high self-awareness are in-tune with their feelings and their values. Such self-knowledge is usually self-evident in performance reviews as the individual is comfortable addressing their limits, and craves constructive feedback with a can-did sense of self-humor that never wavers. In contrast to someone who has low self-awareness will interpret feedback as hostile or a threat. Self-regulation supports the strengths needed to thrive in an ever-changing world of business, to be able to use restraint and balance emotions is a personal virtue and expresses high organizational skills. High self-control is rare today, businesses function right into the ground fueled by low-impulse control and negative emotions. Potential leaders are deeply invested for the sake of succeeding at their goal and exude an almost limitless drive-in pursuit of developing something further or trying new things. Empathy is important for decision-making that is made with knowledge, thoughtfully. Social skills are the glue that binds the qualities which manifest in behaviors of emotional intelligence. This is the formula for making effective leaders that are needed to steer constantly changing workplace environments into the future (Pathak, 2013, 54-55).

References

Pathak. M. (2013, February). Emotional intelligence at the workplace. Human Capital, 54-55.

Reflection

Most invaluable to my learning experience was the SQ3R method. Outlining bullet points became the blueprint to access higher understanding and critical thinking connections to guide my writing process. In the past, I struggled often with inadequate study habits. To articulate professionally, solve problems, and make decisions will be dependent on one’s ability to employ critical reading, thinking, and summarization skills. Citing skills are needed to credit sources, which gives you credibility with research in the workplace.

ENGL102 - Week 7 Article Summary and Reflection for the Workplace

References

Pathak, M. Dr. (2013, February). Emotional intelligence at the workplace.

Psychology at Work HC, p. 54-55.

Reflection

Outlining topics was the road map to my higher understanding and my critical thinking was activated. I was able to recall considerably more information and built on connections to guide my writing process. In the past, I struggled often with inadequate study habits. To articulate professionally, solve problems, and make decisions will be dependent on one’s ability to employ critical reading, thinking, and summarization skills. Citing skills are needed to credit sources, which gives you credibility with research in the workplace.