Speaks on HIPAA, PHI and violations.

1. Qwatevyia Edwards
MHA690: Health Care Capstone
Instructor: Hwang-Ji Lu
September 21, 2016

2.  Associated Press UCLA article
 HIPAA
 Breach Rule
 PHI
 Confidentiality
 Violation
 Training
 References

3. LOS ANGELES – More than 120 workers at a Los Angeles hospital looked
at celebrities' medical records and other personal information without
permission between January 2004 and June 2006 — nearly double the
number initially reported earlier this year, according to a state report (Fox
News, 2008).

4. Privacy Rule establishes national standards to protect individuals’ medical
records and other personal health information and applies to health
plans, health care clearinghouses, and those health care providers that
conduct certain health care transactions electronically.

5. An impermissible use or disclosure under the Privacy Rule that compromises
the security or privacy of the protected health information, demonstrates that
there is a low probability that the protected health information has been
compromised based on a risk assessment of at least the following factors:
 The nature and extent of the protected health information involved,
including the types of identifiers and the likelihood of re-identification;
 The unauthorized person who used the protected health information or to
whom the disclosure was made;
 Whether the protected health information was actually acquired or viewed;
and
 The extent to which the risk to the protected health information has been
mitigated.

6. Individually identifiable health information that is transmitted or
maintained in any form or medium (electronic, oral, or paper) by a
covered entity or its business associates, excluding certain educational
and employment records.

7. Confidentiality is one of the core duties of medical practice. It requires
health care providers to keep a patient's personal health information
private unless consent to release the information is provided by the
patient. Patients routinely share personal information with health care
providers.

8. Failure to comply with HIPAA can result in civil and criminal penalties (42
USC § 1320d-5).
 Individual did not know (and by exercising reasonable diligence would
not have known), $100 per violation, with an annual maximum of
$25,000 for repeat violations.
 Violation due to reasonable cause and not due to willful neglect
$1,000 per violation, with an annual maximum of $100,000 for repeat
violations $50,000 per violation, with an annual maximum of $1.5
million .

9.  HIPAA violation due to willful neglect but violation is corrected within
the required time period $10,000 per violation, with an annual
maximum of $250,000 for repeat violations $50,000 per violation, with
an annual maximum of $1.5 million
 HIPAA violation is due to willful neglect and is not corrected $50,000
per violation, with an annual maximum of $1.5 million $50,000 per
violation, with an annual maximum of $1.5 million
Offenses committed with the intent to sell, transfer, or use individually
identifiable health information for commercial advantage, personal gain
or malicious harm permit fines of $250,000, and imprisonment for up to
ten years.

10.  Cybersecure Contingency Plan
 Privacy and Security Challenge
 Understanding HIPAA / PHI
 Tools to safeguard the workstation
 Changing password every 90 days
 Implementation of security drills
 Conducting random spot checks
 Initial / Quarterly training

11.  American Medical Association (2016). HIPAA Violations and Enforcement.
Retrieved from http://www.ama-assn.org/ama/pub/physician-
resources/solutions-managing-your-practice/coding-billing-
insurance/hipaahealth-insurance-portability-accountability-act/hipaa-
violations-enforcement.page?
 Associated Press (2008). Over 120 UCLA Hospital Staff Saw Celebrity Health
Records. Retrieved from
http://www.foxnews.com/story/2008/08/06/report-over-120-ucla-hospital-
staff-saw-celebrity-health-records.html
 National Institute of Health (2007). HIPAA Privacy Rule. Retrieved from
https://privacyruleandresearch.nih.gov/pr_07.asp
 U.S. Department of Health and Human Services (2016). Health Information
Privacy. Retrieved from https://www.hhs.gov/