This document discusses ensuring patient confidentiality through privacy laws like HIPAA and HITECH, common causes of data breaches in healthcare organizations, and the importance of training employees on maintaining confidentiality. It notes that the majority of breaches are caused by employees and partners and cost an average of $2.4 million. The document advocates for regular privacy and security training for employees to educate them on policies and prevent breaches, and emphasizes building a culture of compliance to minimize privacy incidents.

1. ENSURING PATIENT
CONFIDENTIALITY
MHA 690: HEALTH CARE CAPSTONE

2. Privacy Laws
 Health Insurance Portability and Accountability Act
(HIPAA)
 Enacted in 1996, this law establishes national
standards to protect the privacy and security of
individuals’ medical records and other personal health
information
 HIPAA sets civil and criminal penalties for violations of
patient privacy (U.S. Department of Health & Human Services, n.d.)
 Health Information Technology for Economic and
Clinical Health Act (HITECH)
 2009
 Expanded upon HIPAA requirements and increased
the associated penalties (FairWarning, Inc, n.d.)

3. Data Breaches
 94% of healthcare organizations experienced at least one
breach of data over the past two years
 45% of healthcare organizations dealt with more than five
breaches during the past two years
 Leading causes of breaches include
 Employee mistakes
 Third-party mix-ups
 Lost devices
 Criminal attacks (Reid, 2013)
 The majority of data breaches are perpetrated by active
employees and partners
 Average cost of a data breach to a healthcare organization is
$2.4 million (FairWarning, Inc, n.d.)

4. Employee Training on
Confidentiality
 HIPAA
 Employees must receive education on HIPAA
rules and regulations
 They should receive quarterly education to stay
current with changes
 State regulations involving privacy of patient
information should be given to employees
 Employees should be educated on the
implications of data breaches, such as fines and
personal consequences

5. Employee Training on
Confidentiality
 Raise employees’ security awareness
 A lack of security awareness can contribute to
data breaches
 Employees should be educated on IT security
 Employees should be engaged in building a
culture of security
 Frequent and engaging security awareness training
 Internal training
 Daily reminders
 Visual workplace cues (Manos, 2014)

6. Employee Training on
Confidentiality
 Situation training
 Social engineering tests should be ran (phishing, pre-text
phone calls)
 Success should be rewarded
 The good and the bad should be tracked in all testing
and real situations. This information should be used
in future training
 Other strategies include
 Telephone hotlines
 Posters on walls
 Screen-saver reminders
 Monthly tips (Manos, 2014)

7. Employee Training on
Confidentiality
 Healthcare organizations should establish clear
security/privacy policies
 Employees should be trained and aware of
organizational policies and procedures governing the
protection of PHI
 Training should be updated annually to cover any
policy changes
 Employees should be made aware of potential data
breaches that can happen while performing the duties
in their job description
 They need to be made aware of how they can prevent
privacy breaches

8. Effectiveness of Confidentiality
Training
 Ensures ongoing accountability for privacy and
security of protected health information
 Keeps privacy issues in the forefront of
employees minds
 Minimizes the amount of privacy breaches
 Training builds a culture of compliance
 “This culture isn’t built instantaneously, but over years
of repeated training. Training emphasizes that
protecting data security matters. Employees are more
likely to care if the organization cares. A large
component of training isn’t just educating, but
motivating. People don’t do what they’re supposed to
do because they fail to appreciate why it matters”
(Solove, 2014).

9. Conclusion
 Along with trust, patient confidentiality is
extremely important in healthcare. Healthcare
organizations must adhere to strict laws governing
privacy or incur stiff penalties. To protect
themselves, and most importantly their patients,
organizations must implement internal privacy
policies. They must train their staff on
organizational policies and public law. Training
helps to prevent privacy breaches. A breach in
privacy can not only be a legal problem it can
cause a breach of trust between the healthcare
organization and the patient that may prove
difficult to repair.

10. References
 Centers for Medicare & Medicaid Services website. (n.d.).
www.cms.gov
 FairWarning, Inc. (n.d.). Privacy breach detection in healthcare
[White paper]. Retrieved from
http://www.fairwarning.com/whitepapers/2012-02-WP-PRIVACY-BREACH-
DETECTION-FAIRWARNING.pdf
 Manos, D. (2014, February 19). 5 ways to avoid health data
breaches. Healthcare IT News. Retrieved from
http://www.healthcareitnews.com/news/5-ways-avoid-health-data-breaches?
page=1
 Reid, G. (2013, March). Data security and breach prevention.
Healthcare Finance News. Retrieved from
http://www.healthcarefinancenews.com/news/data-security-and-breach-
prevention
 Solove, D. J. (2014). Does training really work? can it reduce data
security breaches? Retrieved from
https://www.teachprivacy.com/training-really-work-can-reduce-data-security-
breaches/#more-10118
 U.S. Department of Health & Human Services. (n.d.). www.hhs.gov