常见问题解答

In general, the HIPAA Rules apply to 涉及实体 其中包括:

1. 卫生计划;
2. Healthcare clearinghouses; and
3. 医疗服务提供者.

HIPAA的 Rules also apply to 商业伙伴 受保实体.

A business associate is a person or entity who performs certain services to or on behalf of a covered entity that requires the business associate to access, create, maintain or transmit protected health information in order to perform the services. 

HIPAA allows entities, like 差, who perform activities that include functions that are covered by the HIPAA Rules and functions that are 不 covered by the HIPAA Rules to designate themselves as hybrid entities.  As a hybrid entity, 差 is required to identify those units of the University that do perform functions that would make them a covered entity or business associate as covered components.  覆盖组件 must comply with the HIPAA Rules and University HIPAA 政策 and 程序.

差 Personnel (including students, volunteers, trainees & 所有其他个人) within covered components of the University and within covered 差/MEAC clinics must follow the HIPAA Rules and University HIPAA 政策 and 程序.

Even if you are 不 directly involved in providing healthcare to 差/MEAC patients, you may still be subject to the HIPAA Rules because you otherwise access, create, receive, maintain or transmit protected health information in the course of job function. 

If you are unsure if HIPAA applies to you please do 不 hesitate to contact the HIPAA 合规办公室423.439.8533或电邮至 daniell@wayanadregency.com.

Protected health information includes all individually identifiable health information, 包括人口统计数据，这与:

• the individual’s past, present or future physical or mental health or condition;
• the provision of healthcare to the individual; or
• the past, present, or future payment for the provision of healthcare to the individual.

HIPAA的 rules and University HIPAA 政策 and 程序 regulate how 差 Personnel access, create, receive, maintain or transmit protected health information.  HIPAA的 Rules and University HIPAA 政策 and 程序 also establish safeguards that 差 Personnel must implement to ensure the protection of our patients’ health information.

You may send protected health information via 加密 只电子邮件. When feasible protected health information should be communicated via 安全 messaging within the confines of the electronic medical record system (EMR). However, when it is necessary to communicate protected health information outside the EMR system, 差 Personnel may communicate protected health information to authorized persons so long as encryption technology is used.

Internal 电子邮件 Communications (etsu.Edu to wayanadregency.com): 

1. Simply type the word encrypt anywhere 在主题行 to encrypt the contents of the message and the message attachments
2. Do 不 include protected health information 在主题行 as the subject line itself is 不 安全

Encrypted messages sent internally will show up in the 差 inbox and look completely normal—no actions have to be taken to decrypt/read the message

When the recipient takes subsequent action with an 加密 电子邮件 (e.g. 回复或 forwards it) the subsequent 电子邮件s will remain 加密 so long as the trigger word—encrypt—remains 在主题行.

External 电子邮件 Communications (etsu.Edu到外部地址)

1. Simply type the word encrypt anywhere 在主题行 to encrypt the contents of the message and the message attachments
2. Do 不 include protected health information 在主题行 as the subject line itself is 不 安全

Encrypted messages sent from an wayanadregency.com address to an external address will show up in the recipient’s mailbox and require extra steps—recipient will have to follow instructions to access contents of the 加密 message within a 安全 portal 会话

When the recipient takes subsequent action with an 加密 电子邮件 (e.g. 回复或 forwards it) the subsequent 电子邮件s will remain 加密 so long as all actions are taken within the 安全 portal 会话

例子:

一个差.edu user sends an 加密 电子邮件 to an external MSHA 电子邮件 address by typing the word encrypt 在主题行.  The MSHA recipient will receive an 电子邮件 that says:  “You’ve received an 加密 message from username@wayanadregency.com.”  To actually read the content of the message the MSHA recipient has to click a link and verify they are who they say they are by entering a code that Microsoft auto 为他们生成.  The actual message content then opens inside a 安全 portal 会话.  Actions taken by the MSHA recipient inside the 安全 portal will remain 加密. 

External Provider having issues reading your 加密 电子邮件? 给他们发以下邮件 产品说明: External Encrypted 电子邮件 Explained

密码应符合 大学的标准 的复杂性.

Instructions to password encrypt files:

在Microsoft Word 2010中:

1. 点击“文件”
2. 点击“信息”
3. 按“保护文件”
4. Select “Encrypt with Password”
5. Type a complex password into the Password Box and Click “OK”
6. 点击保存. *You must save the document to apply the password encryption.

在Microsoft Excel 2010中:

1. 点击“文件”
2. 点击“信息”
3. 点击“保护工作簿”
4. Select “Encrypt with Password”
5. Type a complex password into the Password Box and Click “OK”
6. 点击保存. *You must save the document to apply the password encryption.

PDF档案:

1. Right Click within the document
2. 点击“文档属性”
3. Select “Password Security” from the Security Method Dropdown
4. Click “Require password to open document”
5. Type a complex password into the Document Open Password Box and Click “OK”
6. 点击保存. *You must save the document to apply the password encryption.

授权 persons are allowed to access protected health information.  差工作人员 in a covered department or covered clinic are authorized to access protected health information (in electronic and paper form) when doing so is necessary to perform their 工作职责.

差 Personnel are prohibited from accessing protected health information about themselves 或者他们的家庭成员.  If you need to access protected health information about yourself or your child you should contact your supervisor who will instruct you on the appropriate process for doing so. 

Unauthorized access of protected health information is a HIPAA violation.

If you are unsure if you are authorized to access protected health information please do 不 hesitate to contact the HIPAA 合规办公室423.439.8533或电邮 at daniell@wayanadregency.com.

Summary of Consent to Healthcare Laws for 未成年人 (under the age of 18)

In general, to provide healthcare to minors the healthcare provider must obtain consent from the minor’s parent or legal guardian.  However, the State of 田纳西州 allows for minors to consent to certain healthcare testing and treatment 没有 parental 知识或认可.  A minor may consent to the following 没有 父母的同意:

1. Testing or treatment for sexually transmitted diseases including HIV
2. Contraceptive supplies and information 
3. Examination, diagnosis and treatment for the purpose of providing prenatal care
4. 药物滥用治疗*

*The law allows the physician to use the physician’s “own discretion” in determining whether to 不ify the minor’s parents of treatment for drug abuse

HIPAA的影响

HIPAA的 Rules require that a minor be afforded the same rights as an adult with respect to his/her health information in situations where state law allows the minor to consent to treatment 没有 parental consent. Therefore, when a minor receives treatment in relation to any of the above, the minor may restrict disclosure of the medical records created in relation to such services from those who would otherwise have the right to view such records, i.e., the minor’s parents or legal guardian. 

差 供应商 and Staff should exercise all reasonable efforts to ensure the minor’s rights to privacy and confidentiality of the records created in relation to the services 上面列出的.  供应商 and Staff should document the minor patient’s preferences 在同一方面.  供应商 and Staff should “flag” such records as instructed below, to alert the medical records clerk that the electronic health record contains information that should 不 be released.  供应商 and Staff should inform minor patients who are on their parents’ insurance that the minor’s parent may receive a statement from the insurance company that may contain health information.  小病人 who wish to pay for the services out-of-pocket in full the day services are rendered can restrict the disclosure to the insurance company for those services.  供应商 and Staff should also inform minor patients that billing statements for the services are sent to whomever is listed in their file as responsible for payment. 

1. T.C.A. § 68-10-104(c). Officers to examine suspected persons and require treatment -- Sources of infection to be investigated. 
2. T.C.A. § 68-34-107. 未成年人避孕用品. 
3. T.C.A. § 63-6-223.  未成年人产前护理. 
4. T.C.A § 63-6-220.  Treatment of juvenile drug abusers 没有 parental consent.
5. 45 C.F.R. 164.502(g)(3)(i). Uses and disclosures of protected health information: 一般规则.

 

Read more about what qualifies as protected health information and the 18个HIPAA标识符.