This document outlines the goals and policies of a confidentiality training program. It aims to educate employees on HIPAA privacy rules, limiting disclosure of protected health information without patient authorization to treatment, payment and healthcare operations. The training reviews expectations that employees maintain strict patient confidentiality, sign confidentiality agreements, and report any privacy violations. Technical safeguards like automatic log offs, password changes and encrypted transmission are also implemented to protect electronic protected health information.

1. Confidentiality Training
Sherry Davis
MHA690: Health Care Capstone
Dr. Sherrie Lu
February 20, 2014

2. Training Goals
• Understand HIPAA
• Understand Company policy on releasing
HPI
• Understand company policy on privacy
practice notices
• Know how to report protected health
information to compliance officer
• Review employee expectations and policy

3. HIPAA
• HIPAA Privacy Rule defines and limits the circumstances
in which an individual’s protected health information
(PHI) may be used or disclosed by “covered entities”.
• HIPAA helps to ensure privacy of PHI
• Gives patients more control of PHI
• Establishes safeguards that the organization must
achieve to protect PHI
•
Hold violators accountable, with civil and criminal
penalties that can be imposed if they violate patients’
privacy rights

4. Policy on PHI Disclosures without
Patient Authorization
• Treatment, Payment, Health Care Operations.
• Emergencies and Informal Disclosures
• Public health activities
• Law enforcement
• Authorization must be written in plain language with
specific terms and that allow the disclosure of PHI
by the entity seeking authorization. The
authorization will have an explanation and the right
to revoke.

5. Policy on PHI Disclosures with Patients
Authorization
• PHI will be disclosed to only those that
the patient consents to.
− Written consent must be on file prior to
release of PHI.
− If a request for PHI is made from someone
other than consent was contained for will
be documented and patient notified.
− All release of information will be
documented in medical record.

6. Policy on Privacy Practices Notice
• Patients will receive a notice of privacy practices
that contains:
• The way PHI may be used and disclosed
• The provider’s duties to protect PHI
• The patient’s rights to complain to HHS of a
violation
• A point of contact for further information and
complaints
• Specific distribution requirements for
providers and plans

7. PHI Safeguards
•
Every employee is responsible for maintaining strict
patient confidentiality at all times.
•
All employees will sign a confidentiality agreement.
− Any breach of patient confidentiality at anytime will
result in immediate dismissal.
•
Any knowledge of any breach of PHI is to be reported to
immediate supervisor, as well as the compliance officer.
− Complaints can be in person, written, or anonymous.

8. Technical Safeguards
• The following safeguards are in place to
protect electronic PHI and control access
to it.
• Automatic log off after inactivity of all
computer systems.
• Monthly password changes for all users.
• User authentication.
• T-9 transmission of all HPI.

9. Employee Expectations
• Employees are to conduct themselves in
an ethical manner and:
− Comply to all federal and state laws
− Comply with all company policy and
procedures
− Immediately report any alleged
compliance violations.
• Failure to comply to the employee
expectations may result in termination of
position.