These restrictions apply to:

Transcription

1

2 These restrictions apply to: - LSUHSC-NO Institutionally-related foundations that are being used to raise funds on behalf of the LSU ( e.g. The LSUHSC-NO Foundation, alumni associations) - Any third-party business associate hired on behalf of LSUHSC- NO to provide marketing and fundraising services

3 The marketing definition is divided into two parts: - Part One: A communication about a product or service that encourages recipients of the communication to purchase or use the product or service - Part Two: Disclosing information in exchange for direct or indirect remuneration so that another entity or is affiliate [may] make a communication about its own product or service than encourages recipients of the communication to purchase or use that product or service. This definition does not limit the type or means of communication considered marketing.

4 Part One: A communication about a product or service that encourages recipients of the communication to purchase or use the product or service - This Part has four exemptions of activities that are not considered marketing under HIPAA.

5 Treatment information Conveying information about benefits General information Small gifts and face-to-face exchanges Refill reminders Case management

6 Treatment information - Any information that is provided for the purpose of furthering or managing the treatment of an individual. An example: An LSUHSC-NO healthcare provider directing or recommending to the individual alternative treatments, therapies, health care providers, or settings of care is NOT marketing.

7 Conveying information about Benefits. This includes: - Entities participating in a provider network or health plan, including the services offered by those providers - The benefits covered by the health plan, including replacements to and enhancements for coverage under the plan. o These must be available to the general public on the same terms as to the individual given the information. Example: A LSUHSC-NO physician may be asked questions about whether an alternative treatment is covered under the patient s health plan or for a recommendation of to another provider. This is not considered marketing under HIPAA.

8 General information - Population-oriented communications that promote health in a general manner, provided there is no endorsement of a specific product or service. Some Examples: Newsletters and other general circulation material with information about health-promoting activities Screenings for certain diseases

9 Small gifts and face-to-face exchanges - Gifts of nominal value Examples: Dentists may give toothbrushes, floss and toothpaste samples. Mugs, pens and the like are also acceptable. - Face-to-Face exchanges Communications while meeting with the patient are unrestricted, even if they are promoting a particular product or service.

10 Receiving money for making such gifts or communications does not change the exemption. However, anti-kickback, fraud and self-referral statutes may still apply.

11 Part Two: Disclosing information in exchange for direct or indirect remuneration so that another entity or is affiliate [may] make a communication about its own product or service than encourages recipients of the communication to purchase or use that product or service. All disclosures for marketing under Part Two require the patients authorization. Click here to view the related authorization form. - There are no exemptions under Part Two.

12 Even a list of names and addresses compiled from the LSUHSC-NO patient database, stripped of all medical data would still be protected. Having a name on the list indicates that the person got health services of some kind.

13 LSUHSC-NO must obtain an individual s authorization for the disclosure of PHI for all MARKETING purposes, unless the communication is: - A face-to-face communication made by LSUHSC-NO to the individual - A promotional gift of nominal value provided by LSUHSC-NO Additionally, if the arrangement involved direct or indirect remuneration (money or benefit) to LSUHSC-NO for the disclosure, the authorization must state so.

14 LSUHSC-NO Marketing Authorization can be found in Chancellor s Memorandum 53 (LSUHSC-NO HIPAA Policies and Procedures) 53/AttachmentA-AuthorizationForMarketing.pdf

15 While some forms of marketing do not require an authorization form, it is a good idea to include an opt-out provision in those communications as a patient-friendly service. If an opt-out provision is provided, you must honor it.

16 Suppose LSUHSC-NO Cancer Center wants to expand its efforts in cancer research. In order to assist in these efforts, the LSUHSC-Foundation wants to send all patients diagnosed with cancer at LSUHSC-NO clinics materials on enrolling clinical trials. This marketing requires a HIPAA authorization signed by the patient prior to receiving such communications.

17 Suppose LSUHSC-NO is considering selling lists of patients to pharmaceutical companies, so the companies can directly market particular drugs to patients with particular diagnoses. This marketing requires a HIPAA authorization signed by the patient prior to the mailing list being sold. - This disclosure is to a third party for remuneration for the purpose of marketing. - This disclosure does not fall under the treatment exception.

18

19

20 These restrictions apply to: - LSUHSC-NO - Institutionally-related foundations that are being used to raise funds on behalf of LSU, e.g. The LSUHSC-NO Foundation, alumni associations, etc. - Any third-party business associate hired on behalf of LSUHSC-NO for the purpose of fundraising

21 Fundraising: - Not specifically defined in HIPAA - DHHS interprets fundraising to mean: Activity for the specific purpose of raising funds for the institution, rather than a general charitable purpose Examples of LSUHSC-NO Fundraising Activities: - Camp Tiger - Tiger Run

22 LSUHSC-NO must obtain an individual s authorization before using or disclosing protected health information ( PHI ) for FUNDRAISING purposes - If the fundraising arrangement involves any direct or indirect remuneration (money or benefits) to LSUHSC- NO from a third party, the authorization must state so.

23 Exceptions to the Authorization Requirement: - Basic demographic information about a person Generally, name, address, and other contact information, age, gender and insurance status. EXCLUDES: Any information about the illness or treatment or any information about diagnosis or nature of services - Health care provided to that person Dates of past encounters Treating physician Outcome information Health insurance status

24 Suppose LSUHSC-NO has an informal practice of notifying administration when a grateful patient is present in the clinic. This allows the administration to make contact and discuss donation options face-toface. This disclosure is NOT permissible under HIPAA, UNLESS the patient has signed a HIPAA authorization form for the use and disclosure of PHI for fundraising.

25 LSUHSC-NO is affiliated with the LSUHSC-NO Foundation, as its non-profit fundraising organization. Suppose LSUHSC-NO wants sent a list of VIP patients to the Foundation so that the Foundation may contact them about donation opportunities. LSUHSC-NO can only send basic demographic information and dates of past service only. LSUHSC-NO can NOT send date of future appointments without a signed patient authorization for fundraising.

26 Suppose LSUHSC-NO wants to focus on raising funds for the Cancer Center. LSUHSC-NO wants to target a mailing list to patients (both clinical and research) who have been seen in the facility for the last five years. This is NOT permissible under HIPAA because the fact that these are patients of the Cancer Center reveals information about the patients diagnosis, i.e. cancer, UNLESS the patients has signed a HIPAA authorization form for the use and disclosure of PHI for fundraising Without an authorization, the mailing must go to all patients; not just Cancer Center patients.

27 Suppose the LSUHSC-NO has a plastic surgery clinic and wants to raise money to perform surgery for free on children who have facial abnormalities. Under HIPAA, the patients may receive literature on fundraising while they are seen at the clinic. If the Foundation were to obtain a list of patients who had procedures performed at the clinic after the procedure, any contact for fundraising with those patients would be in violation of HIPAA, UNLESS the patients signed a HIPAA Authorization for fundraising.

28 Fundraising activities of any kind must be indicated in the Notice of Privacy Practices. - Including those that require authorizations and those that do not require authorizations. Fundraising communications must have an optout provision. - Persons can indicate that they no longer wish to receive future solicitations or communications. - LSUHSC-NO must make reasonable efforts to promptly honor opt-out requests.

29 Common use of mixing marketing and fundraising communications: - Subject to the more restrictive rule when mixing marketing and fundraising - Needs to contain an opt-out provision.

30 Suppose LSUHSC-Foundation wants to include requests for donations, in a targeted letter to diabetic patients containing educational material on diabetes. In order to comply with HIPAA, - Those receiving the marketing and fundraising literature must have signed a HIPAA authorization for fundraising. Remember, fundraising can only be targeted to patients using demographic information or past dates of service, not data on treatment or condition.

31

32 Media Authorizations are required when there is the disclosure or perceived disclosure of PHI through a print, electronic or other information medium (e.g. Internet). Some examples of these instances are: - A person may be photographed in a waiting room for a brochure or promotional video - A person may be videotaped receiving treatment for a health segment on the evening news.

33 LSUHSC-NO Media Authorization can be found in Chancellor s Memorandum 53 (LSUHSC-NO HIPAA Policies and Procedures): 53/AttachmentB-AuthorizationforUse.pdf

34 Disaster Relief - Notification Purposes - Imminent Danger - Facility Directory Crimes on Premises Reporting Crime in Emergencies

35 LSUHSC-NO may use or disclose PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts for coordinating with the entity for: NOTIFICATION PURPOSES: - Health care providers can share patient information as necessary to identify, locate and notify family members, guardians, or anyone else responsible for the individual s care of the individual s location, general condition, or death. - The health care provider should get verbal permission from individuals, when possible; but, if the individual is incapacitated or not available, providers may share information for these purposes if, in their professional judgment, doing so is in the patient s best interest.

36 NOTIFICATION PURPOSE (cont.) - In addition, when a health care provider is sharing information with disaster relief organizations that, like the American Red Cross, are authorized by law or by their charters to assist in disaster relief efforts, it is unnecessary to obtain a patient s permission to share the information if doing so would interfere with the organization s ability to respond to the emergency.

37 IMMINENT DANGER - Providers can share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public -- consistent with applicable law and the provider s standards of ethical conduct. FACILITY DIRECTORY - Health care facilities maintaining a directory of patients can tell people who call or ask about individuals whether the individual is at the facility, their location in the facility, and general condition.

38 When necessary, LSUHSC-NO may notify the police, the press, or the public at large to the extent necessary to help locate, identify or otherwise notify family members and others as to the location and general condition of their loved ones.

39 LSUHSC-NO may disclose to a law enforcement official PHI that LSUHSC-NO believes in good faith constitutes evidence of criminal conduct that occurred on the premises of LSUHSC-NO. Please note: this does not limit a healthcare provider s ability to notify law enforcement officials when he or she believes a crime has been committed. - See 45 CFR (f) Disclosures for law enforcement purposes and 45 CFR (c) Disclosures about victims of abuse, neglect, or domestic violence.

40 There is a tiered system for assessing the level and penalty of each violation: Tier A-violations that are accidental not intentional-fines of $100 per violation up to $25,000 for violations of an identical type per calendar year. Tier B-violations due to reasonable cause and not willful neglect- fines of $1000 per violation up to $50,000 for violations of an identical type per calendar year.

41 Tier C- violations that the hospital corrected, but were due to willful neglect of the policies/procedures-fines $10,000 per violation up to $250,000 for violations of an identical type per calendar year. Tier D- violations due to willful neglect that the hospital did not correct-fines $50,000 per violation up to $1.5 million for violations of an identical type per calendar year.

42 Loss of your job or student status. Individuals and health care providers (hospitals, etc.) can also face civil and criminal prosecution, depending on the facts of the case.

43 Responds to HIPAA privacy complaints. Implements policies and procedures. Conducts educational programs. Reviews LSUHSC s privacy program. Is available to answer any privacy questions or concerns.

44 If anyone suspects or knows of mishandling or misuse of patient PHI, a complaint can be made to: Contact the LSUHSC-NO Privacy Officer or the Office of Compliance Programs by: Telephone at: Office: (504) Confidential reporting hotline: (504) , or at: nocompliance@lsuhsc.edu

45 Office of Compliance Programs 433 Bolivar St. Suite 807 New Orleans, LA