10203 Privacy And HIPAA Training-FY2023.pdf

Privacy and HIPAA-Focused Training Welcome and Introduction

Welcome and Introduction

Welcome to the Privacy and HIPAA Focused Training. This course is designed to be finished in

50-60 minutes.

If you experience technical problems or need assistance while you are going through the training, contact the Enterprise Service Desk (ESD) (1-855-673-4357 - available 24/7/365) or VA

Employees may use the YourIT icon on their equipment's desktop to enter a support ticket.

Audience

All staff with direct access to protected health information (PHI) or access to PHI through VHA computer systems is required to complete this training annually.

All new employees with direct access to PHI or access to PHI through VHA computer systems are required to take this training within 30 days of hire or prior to the employee being allowed access to PHI in any format.

A team of subject matter experts from the VHA Privacy Office have created this training.

Goal Statement and Audience

The goal of this training is to provide knowledge of:

• Module 1 — Basic Privacy Statutes and Employee Responsibilities

• Module 2 — Veteran's Rights

• Module 3 — Introduction to Uses and Disclosures of Information

• Module 4 — Authorization Requirements and Privacy of photographs, digital images, video, and audio recordings

• Module 5 — Special Privacy Topics

• Module 6 — Freedom of Information Act (FOIA)

Basic Privacy Statutes and Employee Responsibility

Lesson Objectives

In this module, you will learn about the background and scope of applicable privacy and confidentiality statutes and regulations.

Specifically, you will learn the following:

• Seven statutes that govern the collection, maintenance, and release of information from

Veterans Health Administration (VHA) records,

• Employee responsibility in the use and disclosure of information,

• Unauthorized Use, Access or Disclosure of Personally Identifiable or Protected Health

Information, and

• Functional Categories and Minimum Necessary Standard

Basic Privacy Statutes

VHA health care facilities should comply with all applicable federal confidentiality or privacy statutes simultaneously so that the result will be the application of the most stringent provision for all uses and/or disclosures of data and the exercise of the greatest rights for the individual.

VHA Directive 1605.01 is the policy that combines the requirements of the below statutes and regulations.

The Privacy Act (PA), 5 U.S.C. 552a

"The Privacy Act of 1974, 5 U.S.C. §552a" establishes a code of fair information practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by federal agencies.

Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulation the HIPAA

Privacy Rule

Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information.

At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes.

Health Information Technology for Economic and Clinical Health (HITECH) Act

Addresses the privacy and security concerns associated with the electronic transmission of health information.

38 U.S.C. §5701 Confidentiality Nature of Claims

38 U.S.C. Section 5701 makes VA benefits records and the names and home addresses of present and former armed forces personnel and their dependents confidential.

38 U.S.C. §5705 Confidentiality of Healthcare Quality Assurance Review Records

38 U.S.C. 5705 Confidentiality of Healthcare Quality Assurance Review Records makes information and records generated by VA’s medical quality assurance program confidential and privileged and exempt from disclosure under the FOIA.

38 U.S.C. §7332 Confidentiality of Certain Medical Records

38 U.S.C. Section 7332 makes strictly confidential all VA records that contain the identity, diagnosis, prognosis or treatment of VA patients or subjects for drug abuse, alcoholism or alcohol abuse, infection with human immunodeficiency virus (HIV/AIDS), or Sickle Cell Anemia.

Disclosures can only be made with patient authorization or as explicitly authorized by the Act.

On June 6, 2018, Title 38 U.S.C 7332 was amended to allow for the release of this information for treatment and billing purposes without a specific authorization.

All other purposes still require a specific authorization.

The Freedom of Information Act (FOIA),5 U.S.C. 552

The FOIA requires Federal departments and agencies, such as VA, to release their records unless FOIA specifically exempts the information or record from disclosure.

Employee Responsibility in the Use and Disclosure of Information

VHA employees must comply with all Federal laws and regulations, VA regulations and policies, and VHA policies regarding the confidentiality and privacy of Veteran and employee records. See VHA Directive 1605.01.

All VA employees are responsible for reporting all actual or suspected breaches of privacy in a timely and complete manner to the appropriate privacy official, according to established policy.

In addition, all VHA employees must conduct themselves in accordance with the rules of ethical conduct.

• Personally identifiable information (PII) and protected health information (PHI) on

Veterans and employees should only be collected, accessed or viewed by VHA employees with a need for that information in the performance of their official VA duties for payment, treatment, health care operations or as permitted in VHA Directive

1605.01. However, VA employees are prohibited from accessing or viewing the PII/PHI of their coworkers or Veterans for non-health care-related reasons, for employment-related purposes or personal reasons.

• Verbal permission from a coworker or Veteran to access their PII/PHI is not acceptable authority if the purpose of access violates the above guidance.

• Supervisors may not view the Veteran health records of their employees to look at their clinic appointments or other health information for employment-related purposes without the signed, written authorization of the employee. If an employee signs a written authorization, the disclosure must be made through Release of Information and the record not accessed directly by the supervisor using their CPRS access. These unauthorized accesses will be considered privacy violations and disciplinary action will be taken.

• Supervisors may not obtain an employee’s records from Employee Occupational Health for employment-related purposes without the employee’s signed, written authorization.

• VA employees who collect, access or view PII/PHI on Veterans or employees for purposes other than those for official VA duties, including curiosity, are subject to disciplinary action. Even if the VA employee had good intentions in accessing or viewing the Veteran or employee information, such as to look up a home address to send a sympathy card, it is a privacy violation and disciplinary action may result.

• A VA employee may only access the health record of a Veteran in the performance of their official VA job duties. A Veteran may not give verbal or written authorization for their family member, who is also a VA employee, to access their health record for personal reasons. If a VA employee is officially part of the treatment team of a family member your facility should have a local policy (e.g., ethics, HR or include in the privacy policy) to addresses instances where there may be no other staff member to complete the job function related to the Veteran family members' care.

Unauthorized Use, Access or Disclosure of Personally Identifiable or Protected Health

Information

The following are examples of unauthorized use and/or access that will result in appropriate disciplinary action:

• Accessing information outside the scope of your functional category.

• Checking your own health record for a purpose unrelated to your official VA duties. To obtain copies of your health records you must go through the Release of Information

(ROI) office.

• Checking a co-worker's health record for employment-related purposes or for another purpose unrelated to your official VA duties even upon request of the co-worker.

• Checking a Veterans' health record, including family members' health records, even upon their request for personal reasons or a purpose unrelated to your official VA duties. This includes accessing the health record of a patient or family member who you are the personal representative of (i.e., caregiver ).

• Checking Veteran's or employee's health records out of curiosity or at the request of your supervisor or others.

• Supervisors cannot access their employee Veterans' health records under the Privacy

Act 5 USC 552a(b)(1), "need to know" for employment-related purposes or personal reasons.

• Removing PII/PHI from the facility without permission from supervisor/facility director.

• Repeating information to VA employees outside of your job responsibilities is a privacy violation. Examples include co-workers, unions, family members, and friends.

The following are potential disciplinary actions that may be taken by the supervisor with guidance from

Human Resources:

• Reprimand being placed in personnel file,

• Suspension from job,

• Demotion, or job loss,

• Reporting to Department of Justice (DOJ) for civil or criminal prosecution, or

• Reporting to DOJ or Health and Human Services Office for Civil Rights (HHS)(OCR) for fines or imprisonment.

Functional Categories and Minimum Necessary Standard

VHA Directive 1605.02, Minimum Necessary Standard for Access, Use Disclosure, and

Requests for Protected Health Information discusses the requirement for assignment of functional categories. HIPAA Privacy Rule mandates that VHA identify the persons, or classes of persons, who need access to PHI to carry out their duties, the types of PHI accessible, the allowable Systems of Records Notices for limited access and the primary conditions for access to PHI.

VHA personnel must be assigned a functional category by their supervisor upon initial hire, position change, and annually thereafter to review the applicability of access to PHI for their official job duties. Every employee is responsible for knowing and adhering to their functional category. VA Form 10-0539, Assignment of Functional Categories must be used to document the assignment of functional categories.

Employees and supervisors must sign and date the form annually.

Veteran’s Rights

In this module, you will learn about the rights granted to Veterans by the Privacy Act and the

HIPAA Privacy Rule. When the Privacy Act and the HIPAA Privacy Rule are in conflict, the regulation that grants the Veteran the most rights is used.

VHA Directive 1605.01 Privacy and Release of Information is the policy that combines the requirements of the Privacy Act and HIPAA Privacy Rule and the other VA statutes in one place so that disclosures can be made with the appropriate legal authority.

Specifically, you will learn about the Veteran's right to:

• A Notice of Privacy Practices (NoPP),

• A copy of their own Protected Health Information (PHI),

• Request an amendment to health records,

• Request an Accounting of Disclosures,

• Request and receive confidential communications,

• Request restriction of use or disclosure of records, and

• File a privacy complaint.

These rights extend to the personal representative of a deceased individual (e.g. Executor of the Estate, Next of Kin). Employees must protect PHI about a deceased individual in the same manner and to the same extent as that of living individuals for as long as the records are maintained.

Notice of Privacy Practices (NoPP)

A Veteran or Non-Veteran receiving treatment has the right to receive a copy of the VHA

Notice of Privacy Practices (NoPP). All newly registered Veterans are mailed a Notice of Privacy

Practices by the Health Eligibility Center (HEC). The VHA Privacy Office is responsible for updating the NoPP and ensuring Veterans are provided the NoPP every three years or when there is a significant change.

This notice includes the uses and disclosures of PHI by VHA, as well as, the Veteran's rights and

VHA's legal responsibilities with respect to PHI. There is one NoPP for all of V HA.

A copy of the NoPP, as well as answers to questions about the NoPP, can be obtained from the

Privacy Officer or at the following website:

http://vaww.va.gov/vhapublications/publications.cfm?Pub=8.

http://vaww.va.gov/vhapublications/publications.cfm?Pub=8

Right of Access

Veterans have a right to obtain a copy of their own health record or review their computerized health record in the VA Electronic Health Record system. A Veteran must submit a signed written request to the VHA health care facility where the records are maintained.

VA employees may not access their family members health records UNLESS it is in the performance of their official job duties. However, prior to accessing your family members health record or other records for official VA job responsibilities, VHA employees should consider having another VA employee with the same official VA job responsibility complete the task. (e.g., processing billing or coding your relative's record.)

VA employees should not be accessing their own Veteran health record in the VA Electronic

Health Record system and should either obtain copies through the Release of Information (ROI)

Office or through a MyHealtheVet or My VA Health account.

VHA employees should refer all requests from Veterans for copies of their records to the

Release of Information (ROI) Office or to another appropriate office that has a mechanism in place to track those disclosures. Veterans requesting copies of their health records must always provide sufficient information to verify their identity (e.g., driver's license or other picture identification, sufficient identifiers with handwritten or electronic signature, if accepted), to ensure appropriate disclosure.

Clinical providers may provide a copy of health information to the patient at the Point of Care, without a written request, if it is for patient education purposes or discharge planning. If the

Veteran is requesting their health information for any other purpose, they must submit a signed written request and be referred to the facility Release of Information (ROI) office.

VA employees should NOT be accessing their own Veteran health record.

Right to Request an Amendment

The Veteran has the right to request an amendment (i.e., correction, deletion, addition, replacement) to any information in their health record. The request must be in writing and adequately describe the specific information the Veteran believes to be inaccurate, incomplete, irrelevant, or untimely, and the reason for this belief.

The written request should be mailed or delivered to the VHA facility that maintains the record.

Requests for amendments to health records should be directed to the facility Privacy Officer or

Chief of Health Information Management Service (HIMS). Other VA employees, including health care providers, who authored or wrote the note in question may NOT process a Veteran's amendment request. This is due to legal requirements under both the Privacy Act and HIPAA.

The facility Privacy Officer or Chief, HIMS will contact the Authors of the record for the requested amendments from the Veteran and will work with the Authors so that a timely and legally compliant response is given.

The Veteran has the right to request an amendment to any information in their health record.

Right to an Accounting of Disclosures

A Veteran may request a list of all written disclosures of information from their records. VHA facilities and program offices are required to keep an accurate accounting for each disclosure made to a party external to VHA. All requests for copies of health records MUST go through the

Release of Information (ROI) Office as they use software that generates the mandatory accounting of disclosures. Requests for images, videos or X-ray films that are part of the health record may be processed by other areas within the facility, as long as the accounting of the disclosures is maintained.

An accounting is not required to be maintained in certain circumstances, including when the record is provided to VA/VHA employees who have a need for the information in the performance of their official VA duties, if the release is to the individual to whom the record pertains, or the release of information is pursuant to a FOIA request.

Entry of a Veteran by name or other identifier into a State Prescription Drug Monitoring program (SPDMP) is considered a disclosure that must be accounted for. The VA employee making the disclosure must do the accounting of disclosures; this can be done through creating a note in the VA Electronic Health Record system. Work with your VHA facility Privacy Officer or

Chief of HIMS for additional guidance.

Electronic batch reporting by the IT system will capture the information needed to generate the accounting of disclosures retrospectively when requested.

Right to Confidential Communications

The Veteran has the right to request and receive communications confidentially from VHA by an alternative means or at an alternative location. VHA considers an alternative means to be an in-person request, and an alternative location to be an address other than the individual's permanent address.

VHA shall accommodate reasonable requests from the individual to receive communications at an alternative address entered in the Veterans Health Information System and Technology

Architecture (VistA), a site for any of the five correspondence types below:

• Eligibility or enrollment,

• Appointment or scheduling,

• Co-payments or Veteran billing,

• Health records, and

• All other

Requests to send documents or correspondence to multiple addresses will be considered unreasonable and therefore denied (all or none to one address).

For Cerner Millennium sites, VHA shall accommodate reasonable requests from individuals to receive medications at an alternate mailing address.

Requests for confidential communications, in person or in writing, shall be referred to the appropriate office, such as eligibility or enrollment, for processing.

Right to Request a Restriction

The Veteran has the right to request VHA to restrict the use or disclosure of PHI to carry out treatment, payment, or health care operations. The Veteran also has the right to request VHA to restrict the disclosure of PHI to the next of kin, family, or significant others involved in the individual's care. This request must be in writing and signed by the Veteran.

A verbal request to a VA provider by a Veteran to restrict sharing of PHI is not a valid restriction request. In addition, documenting the request in the VA Electronic Health Record system, such as in a progress note, does not constitute a valid restriction request. However, if the Veteran is informing the VA provider that a family member is no longer involved in their care, a progress note would be appropriate to document the fact for informing other VA providers.

Notification to VA that a family member is no longer involved in the patient's care is not a restriction request, but rather a clarification that information should not be shared with the named family member outside the presence of the patient. For more information contact your facility Privacy Officer.

VHA is not required to agree to such restrictions, but if it does, VHA must adhere to the restrictions to which it has agreed unless VHA terminates the restriction.

VHA may terminate a restriction if VHA informs the individual, in writing, that it is terminating its agreement to a restriction and that such termination is only effective with respect to protected health information created or received after VHA has so informed the individual.

A request for restriction should be delivered to the facility Privacy Officer or designee for processing. Veterans should be notified in writing of the VHA facility's decision regarding the

Veteran's restriction request.

The Veteran has the right to request VHA to restrict the disclosure of PHI to the next of kin, family, or significant others involved in the individual's care.

This request must be in writing and signed by the Veteran.

Right to Opt-Out of Facility Directory

A Veteran has the right to opt-out of the facility directory. The facility directory is used to provide information on the location and general status of a Veteran. Veterans must be in an inpatient setting in order to opt-out and thus it does not apply to the emergency room or other outpatient settings. If the Veteran opts out of the facility directory, no information will be given to a member of the public from the directory unless required by law. The Veteran will not receive mail or flowers. If the Veteran has opted out of the directory, visitors will only be directed to the Veteran's room if they already know the room number.

If the Veteran is admitted emergently and medically cannot give their opt-out preference, the provider will use their professional judgment and make the determination for the Veteran. This determination may be based on previous admissions, or by a family member who is involved in the care of the Veteran. When the Veteran becomes able to make a decision, staff is required to ask the individual their preference about opting out of the facility directory and change the opt-out decision, if necessary.

Right to File a Complaint

Patients have a right to file a complaint if they believe that VHA has violated their (or someone else's) health information, privacy rights or committed another violation of the Privacy or

Security Rule.

A complaint can be filed by contacting one or more of the following:

• The VHA health care facility's Privacy Officer, where they are receiving care,

• The VHA Privacy Office,

• VA Office of Inspector General, or

• The U.S. Department of Health and Human Services, Office for Civil Rights

Uses and Disclosures of Information

In this module, you will learn about the use and disclosure purposes for release of PHI within

VA that do not require a written authorization from the Veteran.

Specifically, you will learn:

• Using or disclosing PHI for treatment, payment and/or health care operations (TPO),

• Disclosure of PHI without an authorization for other than TPO,

• Non-VA Law Enforcement

• Incidental Disclosures, and

• Systems of Records

Using or Disclosing PHI for treatment, payment, and/or health care operations (TPO)

VHA employees may use PHI on a need to know basis for their official job duties for purposes of treatment, payment and/or health care operations.

"Treatment" generally means the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.

"Payment" encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care.

"Health care operations" are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment.

Use or Disclosure of PHI without an Authorization for other than treatment, payment, or health care operations

VHA may use PHI internally, without an authorization, in a number of situations for purposes other than treatment, payment, or health care operations (TPO), including quality improvement activities and gathering information for public health or abuse reporting. VHA Directive

1605.01 outlines policy on how VHA may use PHI for purposes other than TPO.

For the purpose of determining a Veteran's eligibility, entitlement, and/or provision of benefits, VHA may disclose Veteran PHI to the following groups:

• Veterans Benefits Administration (VBA)

• National Cemetery Administration (NCA)

• Board of Veterans Appeals (BVA)

• VA contractors (as long as there is a business associate agreement in place)

Disclosure of PHI without an Authorization for other than treatment, payment, or health care options

There are also a number of situations where VHA may disclose information, without an authorization, for other than treatment, payment, or health care operations.

Examples of some of these include:

• Public Health Activities (e.g., giving information about certain diseases to government agencies)

• When Required by Law

• Quality Improvement Activities

• Abuse Reporting (e.g., giving information about suspected abuse of elders or children to government agencies)

• Law Enforcement

• Querying State Prescription Drug Monitoring Program (SPDMP)

For additional information and guidance, contact your Privacy Officer.

Law Enforcement

VHA may disclose individually-identifiable health information — excluding 38 U.S.C.7332 protected information — to Federal, State, county, local, or Tribal law enforcement entities, agencies, authorities, or officials without individual authorization in the following cases.

• Routine Reporting to Law Enforcement Entities. Pursuant to Standing Written Request

Letters, 38 U.S.C. 5701(f) and corresponding published routine use in VA Privacy Act system of records.

• Specific Criminal Activity, 5 U.S.C. 552a (b) (7). Disclosure is contingent upon a valid written request received from a law enforcement agency (e.g., Federal Bureau of

Investigation, local Police Department) when such a request is for information needed in the pursuit of a focused (individual specific or incident specific) activity such as a civil or criminal law enforcement investigation authorized by law. The request must state that de-identified data cannot be used for the investigation.

• Identification and Location of Individuals. Disclosure may be made in response to a written request that meets the requirements of a specific criminal activity request discussed above.

• Identification and Location of Missing Patients for Health and Safety Reasons.

Information would include name, height, weight, hair color, clothing when last seen, and a Veteran Health Identification Card (VHIC) photograph or other photograph, if available. Limited additional information may be disclosed where necessary to convey the urgency of the situation or to assist in handling the patient when located.

• Serious and Imminent Threat to Individual or the Public. The law enforcement agency must be reasonably able to prevent or lessen the serious and imminent threat and notification to the last known address of the individual to whom the information pertains is required.

• Drug Enforcement Administration. For the purpose of inspecting, copying, and verifying the correctness of records, reports, or other documents required to be kept or made, the Drug Enforcement Administration (DEA) is authorized to enter controlled premises and to conduct administrative inspections.

An accounting of disclosure is required for all disclosures to any VA law enforcement entity unless there is an ongoing investigation and then the accounting is not required to be kept until the investigation is closed. For additional guidance, contact your facility or administrative

Privacy Officer.

Incidental Disclosures

Many routine health care communications and practices play an essential role in ensuring that

Veterans receive prompt and effective health care. Due to the nature of these communications and practices, as well as the various environments in which Veterans receive health care or other services from VHA, the potential exists for a Veteran's health information to be disclosed incidentally. For example:

• A hospital visitor may overhear a provider's confidential conversation with another provider or a patient.

• A patient may see limited information on sign-in sheets.

• A Veteran may hear another Veteran's name being called out for an appointment.

• A Veteran may see limited information on bingo boards or white boards.

These rights extend to the personal representative of a deceased individual (e.g. Executor of the Estate, Next of Kin). Employees must protect PHI about a deceased individual in the same manner and to the same extent as that of living individuals for as long as the records are maintained.

Many health care facilities providers and professionals have long made it a practice to ensure reasonable safeguards are in place for Veterans PHI. For instance:

• Speaking quietly when discussing a patient's condition with family members in a waiting room or other public area,

• Limiting the patient information or identifiers displayed on white boards in clinical treatment areas to the minimum information required for the treatment function.

• Avoiding using patients' names in public hallways and elevators, and posting signs to remind employees to protect patient confidentiality,

• Using Veterans Health Identification Cards (VHIC) when checking in the patient instead of asking for their SSN.

• Displaying information in treatment areas that are not viewable by the public, the following data elements can be displayed:

o location (room/bed/department), o patient last name, o complaint, o comment, o provider/resident/nurse initials, o acuity (a number from 1-5), o number of unverified orders, o number of active orders/numbers of completed orders, and o elapsed minutes.

Patient name can be posted outside of the patient’s room. Other data elements may be included if determined to be clinically relevant and limited to the minimum extent possible after consulting with the Facility Privacy Officer.

System of Records

A Privacy Act System of Records (SOR) is a group of records under the control of the agency from which information about an individual may be retrieved by the name of the individual or by some other unique identifier, such as full SSN, or unique symbol.

• An advance public notice known as the System of Records Notice (SORN) must be published prior to an agency collecting information for a new SOR.

• Publication in the Federal Register is required to provide an opportunity for interested persons to comment.

• One SORN that is familiar in VHA is 24VA10P2 — Patient Medical Records — VA.

• Within the SORN, there is a section describing routine use disclosure statements (RU), which is a term that is unique to the Privacy Act and means the disclosure of a record outside of VA for a reason compatible with the purpose for which the record was collected.

• Under the Privacy Act a "routine use" gives authority to allow for disclosure of a record outside of VA without a signed, written authorization from the record subject. A

"Routine Use" has nothing to do with the internal use of records within VA.

• For additional information on a System of Records, contact your administration or VHA facility Privacy Officer.

NOTE: The VHA Privacy Office handles the creation of SORNs within VHA for publication.

For a list of all VHA systems of records, go to https://dvagov.sharepoint.com/sites/vacovetsprivacy/vhapo/Pages/SystemofRecords.aspx . You will only be able to access this address through the VA Intranet.

https://dvagov.sharepoint.com/sites/vacovetsprivacy/vhapo/Pages/SystemofRecords.aspx

Authorization Requirements and Privacy of photographs, digital images, video and audio recordings, and Microsoft Office Applications

In this module, will discuss the rules regarding authorizations, recordings and Microsoft Office

Applications.

Specifically, you will learn about:

• Authorization Requirements,

• Privacy of photographs, digital images and video and audio recordings, and

• Use of Individually Identifiable Information in Microsoft Office Applications.

Definition of Authorization

An authorization as defined by the HIPAA Privacy Rule is an individual's written permission for a covered entity to use and disclose protected health information (PHI) .

A written authorization signed by the individual to whom the information or record pertains is required when:

• VHA needs to use PHI for a purpose other than treatment, payment, or health care operations and other legal authority to use the PHI does not exist,

• VHA needs to disclose PHI for any purpose for which other legal authority does not exist, or

• VHA wants to conduct marketing.

Authorization Requirements

If VA employees receive a request for PHI that is accompanied by a valid signed written authorization, disclosure should be made in accordance with the authorization. When an individual submits a valid signed written authorization every attempt to provide the disclosure should be made.

When a signed written authorization of the individual is required for use or disclosure of PHI, the authorization must contain each of the following elements to be valid:

• Be in writing,

• Identify the individual to whom the requested information pertains to,

• Identify the permitted recipient or category of recipients (e.g., health care providers) or user,

• Describe the information requested,

• Describe the purpose of the requested use or disclosure,

• Contain the signature of the individual whose records will be used or disclosed,

• Contain an expiration date, condition (e.g., satisfaction of a need) or an event,

• Include a statement that the patient may revoke the authorization in writing, except to the extent the facility has already acted in reliance on it, and a description of how the individual may revoke the authorization,

• Include a statement that treatment, payment, enrollment, or eligibility for benefits cannot be conditioned on the individual completing an authorization, and

• Include a statement that the information may no longer be protected from re -disclosure.

If any of the authorization requirements listed above have not been satisfied the authorization will be considered invalid. See VHA Directive 1605.01 for details on authorization content requirements.

There are some cases when a written authorization is not required such as when:

• PHI is used for treatment, payment, and/or health care operations (TPO), or

• Other legal authority exists.

If there are questions from VA employees on legal authority to make disclosures, your Privacy

Officer should be contacted prior to making the disclosure.

Privacy of photographs, digital images, and video and audio recordings

VHA facilities must post obvious signage at each entrance of the facility clearly stating the local policy regarding photography, digital imagery, or video/audio recording in public areas.

VA Form 10-3203, Consent for Production and use of Verbal or Written Statements, Photographs, Digital

Images, and/or Audio Recordings

• VA is not required to obtain consent on VA Form 10-3203 when a personally identifiable image, likeness, or recording is taken as part of the individual’s treatment.

VA must obtain consent when a personally identifiable image, likeness, or recording of a member of the VHA workforce is produced or used by VHA for official VA purposes.

Some examples of activities for official purposes include but are not limited to certain education activities (e.g., development of educational brochures, face -to-face or virtual training videos and materials); biographies on web sites; communication; outreach, including promoting services using a patient or group photograph in facility newsletters, facility outreach programs, or social media; or preparation of publications. No personally identifiable image, likeness, or recording of members of the VHA workforce can be used by VHA unless the person gives written consent. Except in the following circumstances:

o VA Form 10-3203 is not needed when staff communications using teleconferencing, video-conferencing, or other similar platforms are used for official purposes. However, if a teleconference or videoconference will be audio-recorded, notice should be provided at the beginning of the meeting. Consent is implied by the staff through their use of the capabilities and participation in the meeting.

• Participants of office functions, staff meetings or holiday parties should be told they may be subject to photography, imaging, or recording. A written consent form is not required.

VA employees may not secretly take pictures or record conversations of anyone (e.g., Veterans, visitors, or coworkers) without consent from the other party.

VA Form 10-3203a, Informed Consent and Authorization for Third Parties to Produce or Record

Statements, Photographs, Digital Images, or Video or Audio Recordings:

• Is required when a staff member or a Veteran is going to be interviewed by a third party, such as the Media.

See VHA Directive 1078, "Privacy of Persons Regarding Photographs, Digital Images, and Video or Audio Recordings" for additional guidance.

Use of Individually Identifiable Information in Microsoft Office Applications

Here are some common questions regarding Microsoft products.

Is patient-provider communication that contains PHI or PII acceptable over email?

The VHA Program Office makes the determination to allow communication between patient and provider using Azure RMS. Please reach out to the VHA Program Office to ensure patient provider communication is acceptable.

NOTE: For more information on Azure RMS, please contact your facility or administration.

Can VA employees’ text a Veteran with appointment information?

• Generally, no. Text messaging is not secure. Therefore, no PII/PHI may be sent to a

Veteran via text. However, if the Veteran has electronically agreed to participate in the

VA texting program, VEText, it is permissible. Consult your Privacy Officer and ISSO with questions on texting.

Can VA employees email PHI to their personal email accounts?

• No, even with supervisory approval to use, process, transport, transmit, download, or store electronic VA sensitive information remotely outside of VA, it is a security and privacy violation when employees email PHI to their own personal email accounts (e.g., Gmail, yahoo) as this information is not considered secured when it leaves VHA even if sent encrypted using Azure RMS.

Is it acceptable to include PHI in the Outlook Calendar?

• No. MS Outlook Calendar controls were not designed to secure Personally Identifiable information or Protected Health Information (PII/PHI). The security controls provided with Outlook calendars only allow for items that you do not wish to be displayed to other users through a shared Outlook calendar to be marked as "Private" (using

Microsoft Outlook "options" functionality setting).

However, you cannot rely on the Private feature to prevent others from accessing the details of the calendar items. Therefore, Veteran PII/PHI should not be placed in MS

Outlook Calendar invites. A Veteran's last name or their last initial with the last 4 of their

SSN on a Calendar for a clinical appointment is PHI.

Never use public electronic calendars, such as Google, MSN, AOL or Yahoo calendars, for

VA business. Public electronic calendars are not VA-approved.

Can we share PHI in MS Teams?

• VA employees may utilize MS Teams meeting in the performance of their official VA job duties knowing that there is a guaranteed end-to-end encryption, including the sharing of sensitive information (PII/PHI), if allowed by their organizational policy. Only discuss or display PII/PHI via MS Teams with VA employees, contractors or other individuals who have authority to view or receive PHII/PHI.

MS Teams group chats, individual chats, and video meetings are saved and will become official agency records covered by official record retention requirements. If users delete chat conversations or videos from MS Teams, that data is still maintained within Microsoft Office

365, and this data is all subject to discovery. It is important that you apply the same level of discretion to MS Teams content as you do to regular email per VA's Rules of Behavior.

Special Privacy Topics

In this module, you will learn about several special privacy topics that have not been discussed in previous modules.

Specifically, you will learn about:

• Release of 38 U.S.C. §7332 Information

• Compensated Work Therapy (CWT)

• Subpoenas

• Logbooks

• Patient Wristbands

• Whistleblower

• Compliance

• Veteran Health Information Exchange (VHIE)

• Social Media and Privacy Considerations

Release of 38 U.S.C §7332 Protected Health Information

38 U.S.C. Section 7332 makes strictly confidential all VA records that contain the identity, diagnosis, prognosis or treatment of VA patients or subjects for drug abuse, alcoholism or alcohol abuse, infection with human immunodeficiency virus (HIV/AIDS), or Sickle Cell Anemia.

This statute applies to information whether or not it is recorded in a document or a

Department record. This statute continues to protect the information even after death of the

VA patient or Veteran.

On June 6, 2018, 38 U.S.C. §7332 was amended to add paragraph (b)(2)(H)(i) and (I), which permits disclosure of treatment records regarding drug or alcohol abuse, HIV, or sickle cell anemia:

• (H)(i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to patients or performing other health care-related activities or functions.

• * * * *(I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary . . .

This amendment alters how VHA may disclose 38 U.S.C. 7332-protected information for treatment and billing purposes. Treatment is the provision, coordination, or management of heath care or related services by one or more health care providers (for example, physical examinations, diagnostic testing, prescribing, and filling medications). This includes the coordination of health care by a health care provider with a third-party, consultation between health providers relating to a patient and the referral of a patient for health care from one health care provider to another. See VHA Directive 1605.01, Paragraph 3. Definitions.

As a result of this amendment, disclosures of 38 U.S.C. 7332-protected information may be made to:

1. Non-VA entities, including non-VA health care providers, for the purpose of providing health care or treatment to patients without a signed, written authorization from the patient, and

2. Third parties for reimbursement for costs of VA care. With this amendment, there is now legal authority to make these disclosures pursuant to 38 U.S.C. § 7332(b)(2)(H)(i) and (I).

An authorization from the patient to disclose 38 U.S.C. 7332-protected information to a non-VA entity for treatment purposes is NOT necessary. However, an accounting of the disclosure is still required.

Release of 38 U.S.C §7332 Protected Health Information, continued

The following is a list of examples when 38 U.S.C. §7332-protected information cannot be disclosed without specific authorization such as a signed written authorization from the patient:

CANNOT BE DISCLOSED without specific authorization

• Pursuant to a Subpoena - a subpoena cannot require VHA to disclose Privacy Act-protected records, unless the subpoena is signed by a judge making it a court order.

• In court orders, if there is 38 U.S.C. § 7332-protected information in the health record, a very specific court order will be required. Please consult your Chief Counsel.

• To officials of any criminal or civil law enforcement governmental agency charged under applicable law with the protection of public health or safety in response to a standing written request letter.

• To Federal, State, and/or local public health authorities, charged with the protection of the public health or safety pursuant to a standing written request letter or other applicable legal authority with the exception of HIV Reporting. Please consult your

Privacy Officer.

The following is a list of situations where 38 U.S.C. §7332-protected information may be used or disclosed without a signed written authorization:

MAY BE DISCLOSED without a signed written authorization

• To VA employees in the performance of their official duties related to treatment, payment, health care operations or as legally authorized. See VHA Directive 1605.01.

• For health care oversight activities, a signed written request is not required and VHA may only disclose 38 U.S.C. § 7332-protected information to the VA OIG for health care oversight activities.

• VHA may disclose any PHI to non-VA medical personnel to the extent necessary to meet a bona fide medical emergency.

• To non-VA health care providers (e.g. physicians, hospitals, clinics, and nursing homes) for treatment purposes.

• For the purpose of health care referrals, to resident care homes, assisted living facilities, and home health services.

• To an insurance company for billing purposes.

• To a public health authority for HIV Reporting pursuant to a standing written request letter.

• To Organ Procurement Organization for organ donation purposes.

• To State Prescription Drug Monitoring Databases to report information on VA prescribed medications.

Compensated Work Therapy (CWT)

Compensated work therapy (CWT) program members are considered patients – NOT

EMPLOYEES – therefore they cannot be given access to Veteran or patient PII/PHI. This includes computer systems and verbal or written access to PII/PHI. Appropriate placement for individuals enrolled in the CWT program should be in positions with no access to PII/PHI, which may include such areas as engineering, Acquisitions Material Management (AMM&S), groundskeeper, canteen/limited food service, and mail room as mail sorters.

If signed, written authorization is obtained from the Veteran or patient to permit sharing of

PII/PHI with a CWT worker to perform a VA duty, then such Veteran or patient PII/PHI may be provided or accessed by the CWT worker. Without such authorization, VA employees should never share PII/PHI with CWT workers.

Subpoenas

A subpoena is a document issued by or under the auspices of a court seeking a release of records or requesting an individual give testimony before a court of law. Subpoenas may be signed by attorneys, clerks of the court or judges. Subpoenas are generally not sufficient to permit disclosure of VA records under the Privacy Act, 5 U.S.C. 552a.

A subpoena must be signed by a judge for it to have the weight of a Court Order to permit VHA to disclose Privacy Act protected records. VHA cannot accept subpoenas signed by an attorney or Clerk of the Court to authorize disclosure of VA records.

Your Privacy Officer and Chief Counsel must be notified in all cases where any personnel receive a court order to produce records, a subpoena for records or for their appearance in court.

Logbooks

Paper Logbooks contain a written list of patients with specific identifiers which is maintained over time. Employees should never keep paper logbooks. VHA Directive 1605.01, Privacy and

Release of Information prohibits the use of physical (paper) logbooks unless there is a specific law or regulation that requires a paper logbook. Paper logbooks that are required by a law or regulation should be appropriately safeguarded, e.g., locked up when not in use, and converted to electronic once possible.

Electronic Logbooks should always be saved on the VA network.

• Use VA systems in an electronic format that can be encrypted, if possible.

• Use the least amount of VA sensitive information (PII/PHI) necessary in any log.

Patient Wristbands

Patient Wristbands should exclude information that changes or is no longer needed during treatment, including but not limited to clinical warnings, do not resuscitate (DNR) status, unit and room number.

VA medical facility staff members who are responsible for patient discharge must remove the patient wristband with blunt-tipped or safety scissors and destroy it at the time the patient is discharged or during the discharge process. A discharge note should be included stating that the patient wristband was removed or that the patient refused to have it removed.

For additional information about patient wrist bands please review VHA Directive 1605.06, Safeguarding and Disposing Patient Wristbands in VA Medical Facilities.

Whistleblower

In order to have legal authority for disclosure of protected health information and not violate any federal privacy law or regulation, a whistleblower, which is a member of the VA workforce or VHA business associate, who reasonably believes that VHA has engaged in conduct that is unlawful or otherwise violates professional or clinical standards or that the care, services, or conditions provided by VHA potentially endangers one or more patients, workers, or the public, may always disclose protected health information (PHI) to:

• A health oversight agency, such as VA OIG, Congressional Committees (e.g., House

Veterans Affairs Committee and Senate Veterans Affairs Committee) and the Office of

Special Counsel, authorized by law to investigate or otherwise oversee the relevant conduct or conditions of VHA,

• A public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of VHA; or

• An appropriate health care accreditation organization, such as The Joint Commission, for the purpose of reporting the allegation of failure to meet professional standards or misconduct by VHA.

An employee who is a whistleblower that discloses PHI to an entity other than those listed above will be considered to have made an unauthorized disclosure in violation of the Privacy

Act, HIPAA Privacy Rule and VHA policy. Whistleblowers may never disclose information containing PHI to the media, a veterans’ service organization, or any other member of the public.