Healthcare providers are accustomed to the privacy and security rules contained within the Health Insurance Portability and Accountability Act (“HIPAA” or the “Act”) – particularly as they apply to the careful management of patient information. On April 24, 2015, the Health and Human Services Office for Civil Rights (OCR) issued important guidance regarding HIPAA’s application to employee health and wellness programs. OCR is responsible for enforcing the Act’s privacy and security rules.
The HIPAA privacy and security rules generally apply to “covered entities” – defined as (1) A health plan; (2) A health care clearinghouse; or (3) A health care provider who transmits any health information in electronic. The rules also apply to “business associates.” The Act is most often associated with medical records generated by a health care provider. An employer – solely by hiring and paying an employee – is not impacted by the obligations of the Act. In general, the Act does not apply to an employee’s employment records.
OCR’s recent guidance addresses two important issues: 1) when does the Act extend to an employer’s health and wellness program; and 2) when may a health plan provide a sponsor employer with access to a participant’s protected health information (PHI).
The recent guidance makes clear that the application of the Act depends upon the structure of the employer’s health and wellness plan. Note that a health plan is a “covered entity” and is subject to the Act. OCR noted that a health and wellness program that is offered to employees as part of the employer’s health plan benefit is covered by the Act and its rules. A health and wellness program that is not part of a health plan is not covered by the Act and its rules – though other federal and state laws may apply to protect the confidential nature of such information.
In many instances, an employer (as the health plan’s sponsor) may administer the health and wellness program (among other elements of the plan). A health plan (a “covered entity” and subject to the Act) may provide an employer-sponsor access to an employee’s health information under limited circumstances where the employer-sponsor is involved in administering the program. In particular, the employer-sponsor may provide access to the employee’s PHI only to permit the employer-sponsor to perform its administrative functions and agree to modify its plan documents and certify that it will:
Establish adequate separation between employees who perform plan administration functions and those who do not;Not use or disclose PHI for employment-related actions or other purposes not permitted by the Privacy Rule;Where electronic PHI is involved, implement reasonable and appropriate administrative, technical, and physical safeguards to protect the information, including by ensuring that there are firewalls or other security measures in place to support the required separation between plan administration and employment functions; and report to the group health plan any unauthorized use or disclosure, or other security incident, of which it becomes aware.
Health plans and employers (particularly those within the health care industry where HIPAA awareness is already high) should be prepared to proactively address the protection of and access afforded to an employee-participants’ PHI. In addition, since the health plan (as a “covered entity”) has specific obligations related to any PHI breach, health plan and employer-sponsor should carefully and thoroughly review the privacy and security protection provided to all employee-participant PHI.
If an employee-sponsor does not perform administrative functions on behalf of the health plan, access to an employee-participant’s PHI is further limited. In particular, in such instances, the health plan may only disclose: 1) information on which individuals are participating in the plan or enrolled in the health insurance issuer or HMO offered by the plan; and 2) summary health information to the extent requested for purposes of modifying the plan or obtaining premium bids for coverage under the plan.
Mind mapping is a great way to brainstorm, make a plan, or turn ideas into the steps needed to make it real. Thankfully, there are great tools out there to help you build mind maps, organize them, and save them for later.
On October 10, 2014, hundreds of people tuned in for a panel discussion on innovative approaches to the dissertation. Hosted by CUNY Graduate Center and sponsored jointly by the Futures Initiative and Duke's PhD Lab, the panel featured five scholars in various disciplines who had either recently defended or would soon defend their dissertations.
The Office of the National Coordinator (ONC) released the revised “Guide to Privacy and Security of Electronic Health Information”April 13 to help organizations integrate federal health information privacy and security requirements.
The guide is geared toward HIPAA covered entities and Medicare eligible professionals from smaller organizations. The updated version features information about compliance with the privacy and security requirements of CMS’ Electronic Health Record (EHR) Incentive Programs as well as compliance with HIPAA Privacy, Security, and Breach Notification Rules.
The guide covers such topics as:
Increasing patient trust through privacy and securityProvider responsibilities under HIPAAHealth information rights of patientsSecurity patient information in EHRsMeaningful Use core objectives that address privacy and securityA seven-step approach for implementing a security management processBreach notification and HIPAA enforcement
In a landmark 2005 Harvard Business Review article, USC business professors Warren Bennis and James O’Toole argued that the skills imparted by most business schools were not relevant to students and their eventual employers.
Sharing your scoops to your social media accounts is a must to distribute your curated content. Not only will it drive traffic and leads through your content, but it will help show your expertise with your followers.
How to integrate my topics' content to my website?
Integrating your curated content to your website or blog will allow you to increase your website visitors’ engagement, boost SEO and acquire new visitors. By redirecting your social media traffic to your website, Scoop.it will also help you generate more qualified traffic and leads from your curation work.
Distributing your curated content through a newsletter is a great way to nurture and engage your email subscribers will developing your traffic and visibility.
Creating engaging newsletters with your curated content is really easy.