Attachment 23 - VASDHS MCM 00-97 Privacy Policy.pdf

VA San Diego Healthcare System MEMORANDUM 00-97 San Diego, CA August 9, 2021

PRIVACY POLICY

1. PURPOSE: To establish policy and procedures for a privacy program that will properly uuse, disclose, and safeguard individually identifiable information.

2. POLICY: The privacy program supports continued operation of mission-critical activities while ensuring the integrity, availability, confidentiality, and authenticity of data and information; the minimum necessary access to protected health information; and the continuing awareness of the need for, and the importance of, information privacy within the facility. All facility privacy policies and procedures must be consistent with VHA Directive 1605 Directives and Handbooks.

3. DEFINITIONS: Terms used in this facility policy that are not defined below have the same meaning as in VHA Directive 1605.01.

a. Access means the ability or means necessary to read, write, modify, or communicate data/information or otherwise use any system resource.

b. Availability means that data or information is accessible and useable upon demand by an authorized person.

c. Business Associate is an entity, including an individual, company, or organization that performs or assists in the performance of a function or activity on behalf of this VHA facility that involves the creation, receiving, maintenance or transmission of PHI, or that provides to or for this VHA facility certain services as specified in the Privacy Rule that involve the disclosure of PHI by this VHA facility.

d. Compelling Business Need A compelling business need is one that requires the capture of SPI in logbook form to meet a policy, regulatory, accreditation or statutory requirement. Additionally, compelling business needs may support reasonable and appropriate business operations, patient safety or quality improvement efforts, or other prudent and important health care operations needs such as the board certification of clinical staff including residents and trainees.

e. Computer matching describes the computerized comparison of records from two or more automated systems of records. For more information, reference VHA Handbook 1605.1, section 37.

f. Confidentiality means that property, data, or information is not made available or disclosed to unauthorized persons or processes.

g. Electronic media means: Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or (2) transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media, because the information being exchanged did not exist in electronic form before the transmission.

h. Individual means the person who is the subject of protected health information.

i. Individually Identifiable Information (III) is any information pertaining to an individual that is retrieved by the individual’s name or other unique identifier, as well as Individually Identifiable Health Information regardless of how it is retrieved. Individually Identifiable Information is a subset of Personally Identifiable Information and is protected by the Privacy Act.

j. Physical Logbook A physical logbook is any written (i.e., not electronic) record of activities or events comprised of data which may uniquely identify an individual or contain SPI that is maintained over a period of time for the purpose of monitoring an activity, tracking information or creating a historical record.

1). The following are examples of physical logbooks:

a). Respiratory therapy logs.

b). Laboratory logs.

c). Autopsy logs.

d). Facility access logs.

e). Wound care logs.

f). Logs of cases cleared.

g). Printouts of Excel spreadsheets.

h). Access data base printouts.

2). Examples of items which are NOT physical logbooks include:

a). Any electronic file b). A list of codes only, such as study identification codes that do not identify an individual.

c). Paper documents required by health care providers for the care of individual patients (e.g., index cards).

d). Police pocket note cards, with incident information and daily activities.

e). Paper sign-out records (hand-offs) with information on multiple patients constituting a team or panel and required to transfer the care of patients between health care providers.

f). A contact list of employees’ names, work phone numbers or work addresses. (g) Work process list.

k. Protected Health Information (PHI) The HIPAA Privacy Rule defines PHI as Individually Identifiable Health Information transmitted or maintained in any form or medium by a covered entity, such as VHA.

1). NOTE: VHA uses the term protected health information to define information that is covered by HIPAA but, unlike individually-identifiable health information, may or may not be covered by the Privacy Act or Title 38 confidentiality statutes. In addition, PHI excludes employment records held by VHA in its role as an employer.

l. Right of access is an individual’s right to have access to (e.g., look at, view) or obtain a copy of records pertaining to the individual that contain individually-identifiable information.

m. Unique Identifier is an individual’s name, address, social security number, or some other identifying number, symbol, or code assigned only to that individual (e.g., medical record number and claim number). If these identifiers are removed, then the information is no longer Individually Identifiable Information and is no longer covered by the Privacy Act, 38 U.S.(C) § 5701, or 38 U.S.(C) § 7332. However, if the information was originally Individually Identifiable Health Information, then it would still be covered by the HIPAA Privacy Rule unless all 18 Patient Identifiers listed in the de-identification standard have been removed.

1). NOTE: The VA Office of General Counsel has indicated that the first initial of last name and last four of the social security number (e.g., A2222) is not a unique identifier; therefore, inclusion of this number by itself does not make the information identifiable or sensitive.

n. Use is the sharing, employment, application, utilization examination, or analysis of information within VHA.

o. VA Sensitive Information/Data is all Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifiers an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions.

p. Workforce member means on-site or remotely located facility employees, contractors, students, WOC, volunteers, and any other appointed workforce members of this facility.

q. ACRONYMS

1). ADPAC: Automated Data Processing Application Coordination

2). ADUSH: Assistant Deputy Under Secretary for Health

3). AIB: Administrative Investigation Board

4). AITC: Austin Information Technology Center

5). AOD: Administrative Officer of the Day

6). BAA: Business Associate Agreement

7). CCA: confidential communications address

8). (C)(F)R.: Code of Federal Regulations

9). CMS: Centers for Medicare and Medicaid Services

10). COR: Contracting Officer Representative

11). CPRS: Computerized Patient Record System

12). DUA: Data Use Agreement

13). EEO: Equal Employment Opportunity

14). FOIA: Freedom of Information Act

15). HHS: Department of Health and Human Services

16). HIPAA: Health Insurance Portability and Accountability Act

17). HRMS: Human Resources Management Service

18). IIHI: Individually Identifiable Health Information

19). III: Individually Identifiable Information

20). IRB: Institutional Review Board

21). ISO: Information Security Officer

22). IT: Information Technology

23). MCCR: Medical Care Cost Recovery

24). MOU: Memorandum of Understanding

25). OCIS: Office of Cyber and Information Security

26). OCR: Office for Civil Rights

27). OGC: Office of General Counsel

28). OIG: Office of the Inspector General

29). ORM: Office of Resolution Management

30). ORC: Office of Regional Counsel

31). PA: Privacy Act

32). PHI: Protected Health Information

33). PO: Privacy Officer

34). POA: Power of Attorney

35). PSETS: Privacy and Security Event Tracking System

36). QM: Quality Management

37). R&D: Research and Development

38). RCS: Records Control Schedule

39). ROI: Release of Information

40). TIU: Text Integrated Utilities

41). U.S.C.: United States Code

42). VA: Department of Veterans Affairs

43). VAMC: Veterans Affairs Medical Center

44). VHA: Veterans Health Administration

45). VHACO: Veterans Health Administration Central Office

46). VHIC: Veteran Health Identification Card

47). VIReC: VA Information Resource Center

48). VISN: Veterans Integrated Service Network

49). VistA: Veterans Health Information Systems and Technology Architecture

50). VSSC: VHA Support Service Center

4. RESPONSIBILITIES:

a. Executive Leadership Team (ELT) is responsible for:

1). Providing the necessary resources (funding and personnel) to support the Privacy Program, maintaining a culture of privacy, and ensuring that the facility meets all the privacy requirements mandated by VA/VHA policy and other federal legislation [(e)g., Freedom of Information Act (FOIA) [5 U.S.(C)§ 552], Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [45 (C)(F)R. Parts 160 and 164], Health Information Technology for Economic and Clinical Health (HITECH) Act , Privacy Act (PA) [5 U.S.(C) §552a], VA Claims Confidentiality Statute

[38 U.S.(C) 5701], Confidentiality of Medical Quality Assurance Review Records [38 U.S.(C) 5705], and Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Medical Records [38 U.S.(C) §7332]].

2). Ensuring Privacy Officer coverage for the facility and its associated clinics. It is required by VHA Privacy Policy that the facility Privacy Officer report directly to the Medical Center Director, Associate Director or senior individual who reports directly to and is supervised by the VA Health Care Facility Director and whose primary responsibilities at the facility include privacy program compliance. When the facility Privacy Officer or Alternate is not available, provide coverage for off-hours operations if conducting 24/7 operations.

3). Ensuring facility Privacy Officers are fully involved in all projects concerning the access, collection, maintenance, use and/or disclosure, transmission, amendment, and/or disposal of Individually-Identifiable Information (III).

4). Ensuring that new and revised Memorandums of Understanding (MOU), Contracts, Data Use Agreements (DUA), Business Associate Agreements (BAA), or similar agreements which involve the collection, transmission, use or sharing of information are reviewed by the facility Privacy Officer, in accordance with VA Handbook 6500.6, Contract Security, prior to approval by Executive Leadership.

5). Ensuring that the facility Privacy Officer is included in discussions and privacy concerns of the facility, which are addressed in strategic initiatives, and maintains a facility culture of privacy.

6). Cooperates with the facility Privacy Officer in any investigation, mediation strategies, or correspondence that is required in order to investigate and resolve a complaint or allegation and ensuring that appropriate disciplinary action is taken.

7). Certifying annually or on an as needed basis, to the VHA Privacy Office, that privacy training has been completed for all personnel. This shall include all employees, volunteers, contractors, students, residents, and any other person performing or conducting services on behalf of the facility.

8). Cooperating fully in submissions of Facility Self-Assessments (FSA) and ensuring full facility wide cooperation for Privacy Compliance Assistance Audits as required by the Privacy Compliance Assurance (PCA) Office.

9). Ensuring that signs are placed alerting Veterans to auditory privacy concerns in areas, elevators, and other spaces requiring auditory privacy and that facility employees exercise appropriate precautions and safeguards when discussing Veterans’ III in public areas, such as clinic waiting rooms.

b. The Privacy Officer is responsible for:

1). Developing, implementing, and updating local privacy policies and procedures.

2). Reviewing all health care center facility policies to ensure compliance with all privacy laws and regulations.

3). Conducting periodic physical assessments, compliance reviews and/or audits of the facility’s collection, use, storage and maintenance of personal information. Reviews will include identification and correction of privacy vulnerabilities related to incidental disclosure such as posted and displayed PHI in clinical areas.

4). Establishing effective working relationships with the facility Information System Security Officer (ISSO), Area Manager, Contracting Officer, Research Compliance Officer, Compliance Officer, and Human Resources Management personnel to ensure that local policies and procedures which may impact the privacy program support and complement each other.

5). Ensuring that Executive Leadership is apprised of all privacy vulnerabilities related issues.

6). Coordinating with the facility Information System Security Officer (ISSO) for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, HITECH, or other federal privacy statutes.

7). Serving as the facility’s point of contact (POC) for matters relating to the privacy policies and procedures.

8). Ensuring that members of the workforce receive training and education about privacy policies and procedures as required by VHA Privacy Program.

9). Ensuring that members of the workforce know who to contact when a privacy complaint, incident or violation is identified or received

10). Monitoring facility and workforce compliance with VHA privacy policies and procedures as well as compliance with local privacy policies and procedures.

11). Identifying and reviewing areas within the facility for auditory privacy risks, to ensure appropriate safeguards are in place to limit incidental disclosures. Ensure the placement of signs alerting Veterans and staff to auditory privacy concerns in the waiting areas, elevators, and other spaces requiring auditory privacy and ensure the placement of chairs in waiting areas are optimally placed to minimize auditory privacy violations.

12). Ensuring the placement of signs prohibiting the use of camera phone or video in restricted areas comply with VHA Directive 1078(1).

13). Ensuring processes are in place for the appropriate accounting of disclosures of individually identifiable information (III) made by the facility and appropriate utilization of the ROI Plus software or other tracking mechanism are used in accordance with the facility’s policies and procedures. The processes will include accounting for authorizations electronically conducted through iMed Consent.

14). Collaborating with various program officials and the Contracting Officer, to ensure identification of all entities meeting the definition of Business Associates.

15). Maintaining a list of active Business Associates utilized by the facility and ensuring all Business Associates have a signed Business Associate Agreement (BAA) in place prior to disclosure of individually identifiable health information (IIHI) and that the Business Associate adheres to the requirements of the BAA.

16). Collaborating with the facility Records Manager to ensure that RCS 10- 1 is followed for record control requirements and no unauthorized system of records are being kept. The Records manager is contacted via email or telephonically to ensure that records are dispositioned according to schedule and that only approved system of records are being kept.

17). Ensuring all facility developed paper, web-based or electronic forms that collect personal information contain the appropriate Privacy Act statements. The process for reviewing local forms from the Medical Record Committee is an email containing the documents which is sent to the committee for review. The documents are reviewed to ensure that Privacy Act statements are included on all forms, if needed.

18). Reviewing and approving all MOUs, Contracts and/or DUAs when required for the sharing of VA sensitive data between the facility and other parties.

19). Ensuring prompt investigation and follow-up on allegations or known occurrences of privacy violations or complaints including logging the violation or complaint in the Privacy and Security Event Tracking System (PSETS). PSETS should be initiated upon notification of the violation during normal business hours, within one hour of discovery during normal business hours or as soon as possible outside of normal business hours. If a privacy violation presents the risk of media involvement, congressional inquiry, legal action , immediate harm to any individual or any other high-risk outcome, the incident must be reported within one hour of discovery regardless of discovery time (even during non-business hours).

20). Reporting promptly to the VHA Privacy Office any potential privacy complaint, allegation, or activity that has VISN-Level or national-level impact.

21). As a non-voting member of the facility IRB Committee, the Privacy Officer will review all human subject research protocols, exempt and non-exempt, in accordance with VHA Handbook 1200.05 and other applicable guidance to ensure legal authority exists prior to use and disclosure of VHA information for research.

22). Collaborating with the facility Information System Security Officer (ISSO), Area Manager and system owner to ensure that a Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA), if applicable, is completed on all information technology systems, applications or programs that collect, maintain, and/or disseminate personally identifiable information (PII).

23). Reviewing, processing, and monitoring requests to amend any information or record retrieved by an individual’s name that is contained in a VA system of records, to include designated record sets, and coordinating such request with the author of the document.

24). Collaborating with the facility Information System Security Officer (ISSO), Contracting Officer Representative (COR) and the Contracting Officer to ensure all contracts are reviewed in compliance with VA Handbook 6500.6.

25). Ensuring all facility’s policies and procedures relating to HIPAA, HITECH, Privacy Act, 38 U.S.C. §5701, §5705, and §7332, and FOIA are consistent with current guidelines and requirements, complementing and supporting each other.

26). Ensuring local departmental policies and procedures are developed if not specifically outlined in the facility privacy and FOIA policies.

27). Provide awareness training through various means for Veterans to inform them of their privacy rights and responsibilities.

28). Complete the Facility Self-Assessment (FSA) by the last business day of each quarter or as required by PCA and work with facility staff and leadership to facilitate a successful Privacy Compliance Audit.

29). Ensuring that the reduction of SSN usage is reviewed to determine the necessity of using partial or full SSN.

30). Other responsibilities as defined by the VHA Privacy Office.

c. Information System Security Officer is responsible for:

1). Coordinating with the facility Privacy Officer for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, or other federal privacy statutes.

2). Coordinating, facilitating, and updating the establishment of information security policies and procedures, to work in tandem with privacy policies and procedures.

3). Establishing effective working relationships with the facility Privacy Officer, Area Manager, Contracting Officer, Research Compliance Officer, Compliance Officer, and Human Resources Management personnel to ensure that information technology (IT) security and HIPAA/FOIA/PA/Federal Information Security Management Act (FISMA) policies and procedures compliment and support each other.

4). Reviewing and evaluating the security program impact(s) of any proposed facility information privacy policy and procedure changes.

5). Collaborating with the facility Privacy Officer on addressing/resolving privacy complaints, investigations, and access rights to audits and other information maintained by the facility ISSO.

6). Collaborating with the facility Privacy Officer, Area Manager and System Owner to ensure that the Privacy Threshold Analysis (PTA) and the Privacy Impact Assessment (PIA) if applicable, are completed and fully executed on all information technology systems, applications or programs that collect, maintain and/or disseminate PII.

7). Entering all Information Security violations through the Privacy and Security Event Tracking System (PSETS) to the VA Cyber Security Operations Center (VA-CSOC) within 1 hour of discovery.

8). Ensuring that all media (paper, electronic, CDs, disks, portable devices, etc.) with III is disposed of via approved means.

d. Clinical Staff are responsible for:

1). Reviewing and determining appropriateness for granting individuals’ requests for record amendment request.

2). Accessing, using and disclosing protected health information only when legal authority exits (HIPAA, Privacy Act and the Mission Act).

e. Area Manager is responsible for:

1). Coordinating with facility Information Security Officer and facility Privacy Officer to provide technical advice and other assistance relative to the reasonable safeguards requirements of privacy statutes and regulations dealing with implementation of IT systems, policies and procedures.

2). Identifying each locally maintained computer system that contains III and providing technical input for various mandated documents, reports, and investigations.

3). Ensuring all computer rooms meet acceptable reasonable safeguards and that minimum necessary access is maintained.

4). Collaborating with the ISSO, PO and Information System Owner to ensure that the PTA and the PIA, if applicable, are completed and fully executed on all information technology systems, application or programs that collect, maintain and /or disseminate PII.

f. Chief, Human Resources Management Service (HRMS) is responsible for:

1). Providing consistent and uniform guidance to supervisors and managers regarding personnel actions, sanctions, or other actions to be taken when employees have violated information privacy practices, laws, regulations, policies and procedures, and rules of behavior (see VA Directive 5021).

2). Ensuring that appropriate disciplinary action is taken when privacy violations are brought to their attention.

3). Providing appropriate information to facility Privacy Officer for completion of PSETS entries in a timely manner regarding mitigation/disciplinary actions.

4). Coordinating with facility Privacy Officer on the privacy of personnel records and other records maintained by HRMS.

5). Ensuring that personnel records maintained by the HRMS are maintained in compliance with applicable privacy policies, statutes and regulations.

g. Contracting Officer/Contracting Officer Representative (COR) is responsible for:

1). Determining the appropriate security and privacy language in all contracts by collaborating with the facility Privacy Officer to ensure that privacy responsibilities are included (see VA Handbook 6500.6, Appendix C).Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

2). Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

3). Ensuring that Business Associate Agreements are enacted for contracts which the contractor meets the definition of a Business Associate. A BAA should be a separate document from the contract.

4). Ensuring that contractors receive the appropriate privacy and if applicable security training upon initiation of the contract and annually thereafter.

5). Ensuring that contract requirements for privacy are met to include me requirements including mediating and/or terminating the contract if information privacy requirements are not being met.

h. Supervisors are responsible for:

1). Identifying and protecting all individually identifiable information (III) used by supervised personnel, including contractors and other workforce members. Ensuring that individuals are only provided access to III when authorized and the appropriate training has been completed such as in the case of volunteers. (Note: CWT, compensated work therapy, patients are prohibited to have access to PHI).

2). Ensuring that III, whether electronic or printed, is secured when work areas under their supervision are unattended.

3). Facilitate or provide training to new and existing personnel on roles and responsibilities for protecting III, to include the requirement that possible suspected privacy violations are reported to the Privacy Officer at the time of discovery

4). Identifying and assigning functional categories in accordance with facility policy and ensuring VA personnel have only the minimum necessary access level required to carry out their authorized functions or assigned duties and that VA personnel understand what their minimal level of access is and that access beyond the scope of their responsibilities will result in disciplinary action.

5). Ensuring applicable personnel complete the “Information Security and Privacy Awareness and Rules of Behavior” training. If access to protected health information (PHI) is required, then “Privacy and HIPAA” training must be completed within 30 days of hire or before access to PHI is given. Training must be completed annually thereafter and documented using the Talent Management System (TMS).

Workforce members must be enrolled in TMS through either self-enrollment (e.g. contractors and volunteers) or automatic enrollment upon hire.

6). Assists the facility Privacy Officer and Human Management Resource Service with the investigation and resolution of privacy incidents involving their employees and/or program(s).

7). Provide all responsive documents to the FOIA Officer upon request in a timely manner and require cooperation from staff in response to all FOIA requests

i. Quality Management (QM) Confidentiality Officer is responsible for coordinating with the facility Privacy Officer on requests for copies of or access to QM documents. The facility Privacy Officer serves as the final approval authority for determining which documents are classified as quality management documents in accordance with VHA Directive 2008-077, Quality Management (QM) and Patient Safety Activities that can generate confidential documents prior to disclosure. The facility Privacy Officer will work with the FOIA Officer concerning any exception to disclosure under

FOIA.

j. Administrative Officer of the Day (AOD) is responsible for resolving and responding to disclosure issues and incident reporting requirements consistent with VHA Directive 1605, VHA Handbooks 1605 series, VA Directive 6500, and VA Handbook 6500 series during non-business hours.

k. All Employees are responsible for:

1). Accessing the minimum necessary data for which they have authorized privileges and on a need-to-know basis in the performance of their official VA duties.

2). Employees must exercise appropriate precautions and safeguards when discussing Veterans’ individually-identifiable information in public areas to prevent an unauthorized disclosure.

3). Protecting an individual’s rights to privacy and ensuring proper use and disclosure of information. All workforce members will be held accountable for compliance with these policies, procedures, and applicable laws.

4). Appropriately safeguarding printed and electronic individually identifiable information.

5). Reporting complaints and/or violations of privacy policies or procedures to the facility Privacy Officer immediately upon discovery.

6). Cooperating with the facility Privacy Officer and/or the VHA Privacy Office throughout the complaint investigation process.

7). Obtaining appropriate approval in accordance with Public Affairs policy to speak to the news media. Employees are not authorized to disclose any individually-identifiable information on a patient or Veteran during an interview without the prior signed, written authorization of the patient or Veteran. When an employee is asked to be interviewed by a third party, such as the news media, VA Form 10-3203a, Informed Consent and Authorization for Third Parties to Produce or Record Statements, Photographs, Digital Images, or Video or Audio Recordings must be completed.

8). Consulting the facility Privacy Officer and VHA Handbook 1605.1 for guidance in privacy situations not addressed in this document.

5. PROCEDURES:

a. Administrative Requirements:

1). Compliance with Privacy Policies a). The facility and its workforce will comply with the contents of this policy, VHA Handbook 1605.1, and all other applicable privacy laws, regulations, and VA policies.

b). The facility Privacy Officer will monitor compliance with this policy through various means, including continuous assessment for privacy compliance.

2). Documentation:

a). This policy and any changes thereto, must be maintained in writing, either on paper or in electronic form, for a period of at least six (6) years.

b). Changes in VHA Directive 1605.1: When VHA Directive 1605.1, is updated which necessitates alteration of facility policies and procedures, the local privacy policies and procedures will be revised without delay using guidelines contained in MCM 00-97.

3). Complaint Process:

a). All privacy complaints received by the facility are to be referred immediately to the facility Privacy Officer or Alternate Privacy Officer for review and processing.

b). An individual has 3 years from the date of the complaint to request an investigation into the alleged complaint. Health and Human Services, Office for Civil Rights uses this same time frame for their complaints c). The facility Privacy Officer, Alternate Privacy Officer or Information Security Officer will enter all facility privacy incidents and complaints, regardless of validity, into the VA Privacy and Security Event Tracking System (PSETS). AODs will document privacy complaints and incidents after hours and report to the Privacy Officer. All incidents must be reported within one hour of discovery to the VA NSOC.

d). Notice to Privacy Complainants: All individuals filing a privacy complaint, i.e., privacy complainants, will be provided a copy of the Notice to Privacy Complainants at the time of the complaint submission regardless of the way it was received (e.g. email, mail or verbal).

(1). If the complaint is made verbally, the Privacy Officer, or Alternate Privacy Officer will obtain mailing information in order to send the Notice to Privacy Complainants.

(2). The Notice to Privacy Complainants will be mailed to the privacy complainant within 2 business days if the Notice is not given in person to the complainant. A complaint acknowledgement cover letter will be included when the Notice is mailed.

e). The facility Privacy Officer will:

(1). Investigate all complaints regarding facility privacy practices regardless of validity.

(2). Cooperate with the VHA Privacy Office on all HHS-OCR complaints and all other privacy complaints submitted to VHACO, in addition to providing timely access to complaint investigation files.

(3). Acknowledge receipt of the privacy complaint by providing IB 10-68 Notice to Privacy Complainants in compliance with VHA Directive 1605.01.

(4). Communicate with leadership, as appropriate (i.e., Director, VISN, VHA Privacy Office, Office of Inspector General, and Office of General Counsel).

(5). Determine whether the complaint is a privacy violation/incident, (6). Respond as soon as possible or no later than 60 working days, in writing to the complainant when the complaint does not result in an incident, (7). Appropriately notate the privacy complaint/incident in

PSETS.

(8). Document outcomes of the investigation and providing findings to the supervisor in coordination with other stakeholders (e.g., Human Resources for sanctions or disciplinary actions, union representatives, department heads).

(9). Mail the response letter to the complainant’s address.

(10). Maintain an administrative file for all complaints by PSETS ticket number or by date regardless of validity.

(11). Trend the types of privacy complaints identified and report these trends to the facility leadership bi-annually and to the VHA Privacy Office, upon request.

f). Complaints Identified as Incidents: When the facility Privacy Officer determines during the investigation that a privacy complaint is a privacy incident, the PSETS ticket classification will promptly be changed from a complaint to an incident.

(1). When a privacy complaint is made regarding access to a health record and the facility Privacy Officer cannot determine that the access is likely or not likely authorized, the access must be presumed to be unauthorized and will be reported as a privacy incident in PSETS.

(2). All determinations as to whether a privacy incident warrants credit monitoring protection services, or a notification letter will be made by the VA Data Breach Resolution Service (DBRS) and the Data Breach Core Team (DBCT).

(3). The DBRS and DBCT will notify the facility Privacy Officer in accordance with VA Handbook 6500.2, Appendix C.

(4). When required, the HIPAA notification letter or credit monitoring letter will be mailed no later than 60 calendar days from when the incident was reported by the facility Privacy Officer.

g). Maintaining Record of Privacy Complaint: A privacy complaint file containing all the documentation concerning the privacy complaint and investigation will be retained by the facility Privacy Officer in accordance with Record Control Schedule (RCS) 1006.19, Privacy Complaint File. The complaint file will contain the following:

(1). Initial written complainant’s concern or a Report of Contact by the facility Privacy Officer, if the complaint is made orally;

(2). Written documentation of all interviews or statements; and

(3). All written correspondence, including e-mails from the complainant or staff.

h). All complaints (privacy and/or security related) received by the facility from the Department of Health and Human Services (HHS)

– Office for Civil Rights (OCR) will be encrypted and forwarded immediately to the VHA Privacy Office mail group VHAPrivIssues@va.gov for appropriate processing. The facility does not have authority to respond to HHS-OCR complaints.

However, the expectation is that the PO will respond timely to any mailto:VHAPrivIssues@va.gov questions that the VHA Privacy Office needs in order to respond to HHS OCR.

(1). If an investigation arises as a result of a HHS-OCR complaint, this facility and its Business Associates, if applicable, must permit the Secretary of HHS access to information, during normal business hours, after coordinating with the VHA Privacy Office.

(2). When addressing complaints, the facility Privacy Officer should reference resources available on the VHA Privacy Officer Share point site.

https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pag es/ComplaintTracking.aspx When Human Resources is contemplating employee disciplinary action, they should refer to VA Directive 5021 and VA Handbook 5021, Employee/Management Relations.

i). The facility may not retaliate against a person for exercising rights provided by the HIPAA Privacy Rule, for assisting in an investigation by HHS-OCR or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates these provisions.

j). The facility may not require an individual to waive any right under these provisions as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.

b. Reasonable Safeguards: All facility workforce members shall ensure that appropriate administrative, technical, and physical safeguards are used to maintain the security and confidentiality of III, including protected health information (PHI), and to protect against any anticipated threats or hazards to their security or integrity. The facility’s personnel shall make reasonable efforts to limit III to the minimum necessary to accomplish the intended purpose of any use, disclosure, or request. This does not pertain to the treatment provision under the HIPAA Privacy Rule.

1). All personnel may access and use information contained in VHA records as required for their official duties related to treatment, payment, and health care operations purposes.

2). When disclosing VHA information, all applicable laws and regulations are reviewed and applied to the request in order to assure utilization of the most stringent provisions for all uses and/or disclosures of data in order to provide the greatest rights to the individual and the minimum necessary of III. III disclosure is mandatory with a valid written authorization but disclosure must be limited to only the information necessary to satisfy the purpose of the request.

https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pages/ComplaintTracking.aspx https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pages/ComplaintTracking.aspx

3). Disposal of Paper Documents: Staff disposes of paper documents that contain III by using locked confidential waste containers or shredding documents to the point that they are unreadable prior to throwing away if confidential waste containers are not available.

4). Disposal of Electronic Media: Electronic media containing III will be destroyed by giving it to O&IT for evaluation and sanitization.

Electronic media containing III will be destroyed in compliance with VHA Handbook 6500, ITS #15, VA Directive 6371.

5). Disposal of Non-paper Items: Non-paper items (i.e., I.V. bags, wristbands, prescription bottles, etc. containing III are disposed of in sharps and biohazard containers and destroyed by incineration.

6). Maintaining Auditory Privacy: Staff only discusses patient care issues in appropriate areas, which allow the maintenance of auditory privacy.

Facility staff does not discuss patient information in areas not conducive to confidentiality (e.g., canteen, elevators, or hallways). Signs must be posted alerting Veterans to auditory privacy concerns in waiting areas.

VHA health care providers and staff must refrain from discussing patient information within hearing range of anyone who is not on the patient's treatment team or does not have a need to know the specific patient information unless an emergent condition arises whereby auditory privacy cannot be maintained. Administrative staff should follow the same guidance in any discussion involving individually identifiable sensitive information, (e.g. employee health issues or disciplinary actions. Appropriate safeguards include training all staff on auditory privacy to include:

a). Using the Veterans Identification Card (VIC) for identification upon check-in, if available;

b). Speak quietly when discussing a patient’s condition with the patient or the patient’s family members in a public or open area or where the conversation can be overheard such as a waiting room or multi-patient room;

c). Only discussing he information necessary to accomplish the function, (e.g. not asking for the full Social Security Number (SSN) when the last four of the SSN is sufficient);

d). Asking other Veterans in line for clinical check-in to wait a short distance away from the desk to allow a zone of audible privacy as opposed to being right behind the Veteran being assisted;

e). Only calling Veterans back to an exam room, pharmacy window or other treatment area by name; and f). Going behind closed doors to have discussions pertaining to the personal information of the Veteran.

7). Use of Facsimile (fax): When using fax technology, facility staff adheres to VA Handbook 6500, Risk Management Framework for VA Information Systems -Tier3: VA Information Security Program; VHA Handbook 1907.01, Health Information Management and Health Records; and VHA Directive 1605.01, Privacy and Release of Information.

a). Any disclosure of faxed information containing or requesting individually identifiable patient information must be accounted for in the ROI Plus software or on a manual spreadsheet.

b). Any staff member utilizing fax as a means of transferring III must take the following steps to ensure that III is sent to the appropriate destination and not to a machine accessible to the general public.

c). Verify the fax number prior to sending the fax and, in order to prevent misdialing, do not use pre-programmed numbers unless the number is tested prior to faxing. Periodically verify the fax numbers of frequent recipients. Ask those frequent recipients to notify the facility of any fax number changes.

d). A fax cover sheet with an appropriate confidentiality statement, instructing the recipient of the transmission to notify the facility if received in error, must be sent with all outgoing faxes. PHI should never be placed within the fax cover sheet as this negates the confidentiality statement on a fax coversheet. However, the Veteran’s name may be referenced in the subject line.

For example, when transmitting outside VA:

"This fax is intended only for the use of the person or office to which it is addressed and may contain information that is privileged, confidential, or protected by law. All others are hereby notified that the receipt of this fax does not waive any applicable privilege or exemption for disclosure and that any dissemination, distribution, or copying of this communication is prohibited. If you have received this fax in error, please notify this office immediately at the telephone number listed above" e). Notify the recipient before sending the fax in order to ensure that someone is present to receive the information or that the fax machine is in a secure location (e.g. locked room).

f). Review the fax confirmation slip to verify that the confidential information went to the proper destination number. If there has been an error, immediately contact the incorrect recipient and request return or destruction of the fax.

8). Electronic mail (e-mail) and information messaging applications and systems are used as outlined in VA policy (VA Directive 6301 and VA

Handbook 6500). These types of messages never should contain III, unless the authentication mechanisms have been secured appropriately (see VA Handbook 6500). Responding to a patient via email, which contains protected health information, should be done through My HealtheVet Secure Messaging.Mailing of Sensitive Information: Mailing of Veteran’s correspondences such as copies of records, appointment letters may be done so using the United States Postal Service Envelopes, parcels, packaging or boxes containing sensitive information must be secured in a manner that prevents unauthorized access, tampering, or accidental loss of contents. Window envelopes must show the recipients’ names and addresses, but no other information. (See VA Directive 6609)To the extent practicable, this facility mitigates any harmful effect known to have resulted from an improper use or disclosure of III. Mitigation may include, but is not limited to: operational and procedural corrective measures; re-training, reprimanding, or disciplining workforce members; addressing problems with any involved business associates; incorporating the chosen mitigation solution(s) into facility procedures. Improper uses or disclosures of III or any other privacy incident should be reported to the Privacy Officer, Information Security Officer or Alternative Privacy Officer immediately.Sanctions:

1). All individuals who use or have access to VA information systems or sensitive information must sign and adhere to the Rules of Behavior, which bind them to the legal and moral responsibility of preventing unauthorized disclosure (See VA Handbook 6500, Information Security Program) This facility has established sanctions, which are applied against members of its workforce as appropriate, for failures to comply with privacy policies and procedures and Rules of Behavior.

2). The facility Privacy Officer will determine information privacy violations and provide evidence thereof. The employee’s supervisor will determine appropriate actions and may, in conjunction with human resources management, take necessary steps and apply appropriate sanctions for any employees who are non-compliant with privacy policies and procedures. Penalties will be assessed against any individual(s) who accesses, uses, discloses, or obtains information without the individual's written authorization or not authorized by law regardless of whether it was an intentional violation or not.

3). Appropriate sanctions must be taken in accordance with VA Directive 5021.

d. Privacy Training and Education:

1). The facility Privacy Officer will conduct privacy training at all facility New Employee Orientation (NEO) programs.

2). Employees are responsible for annual completion of their mandatory privacy training requirement prior to or on their anniversary date of privacy training the following year. All training is tracked through TMS.

TMS sends a bi-weekly email to users and supervisors when training is deficient. The Privacy Officer tracks delinquent accounts over 30 days, and users run the risk of losing their computer access until training is completed.

3). The facility Privacy Officer is responsible for developing a local training strategy in conjunction with the facility Education Coordinator or Education Office. The PO will assess the medical center’s privacy training compliance monthly, perform a privacy assessment at night or on the weekend at least quarterly and assess all CBOCs at least once annually to ensure privacy policies are being met. The Privacy Officer will ensure announcements are sent out regarding new privacy information using e-boards, e-news, the Outlook supervisor email group and the Privacy SharePoint site; meet with individual departments during staff meetings; attend Town Hall Meetings and/or conduct additional activities around the facility to promote privacy awareness for personnel and to enhance awareness of patient’s privacy rights. The health care facility Director will make the strategy available to the VHA Privacy Office upon request.

4). The facility Privacy Officer, in coordination with the facility Education Coordinator, TMS Coordinator or Education Office, shall maintain a process of compiling annual training records in order to report the facility privacy training completion status to the VHA Privacy Office and to the health care facility Director upon request. A report of “VA Privacy and Information Security and Rules of Behavior” training, VA Talent Management System (TMS) Item #10176, is available upon request to the Supervisory Training Specialist in the Education service. A report of “Privacy and HIPAA Focused Training”, VA TMS Item #10203, is automatically generated on a bi-weekly basis and sent via email to the Privacy Officer.

a). The annual training records of completion of privacy training must be kept for all workforce members to include the following;

employees, volunteers, students, and contractors in order for reporting of facility privacy training completion numbers by each group.

b). The facility Director will certify annual training completion to the VHA Privacy Office for all work force members based on the reports generated by the health care facility Privacy Officer and Education Coordinator, TMS coordinator or Education Office upon request.

5). The facility Privacy Officer shall conduct other activities within the facility to enhance awareness of privacy and that have a positive impact on the overall privacy culture and posture of the facility. These activities shall include, but are not limited to, participation in VA’s annual Privacy Week activities, posting privacy posters and announcements throughout the facility, and conducting one-on-one training with personnel who have been observed displaying negative privacy culture behaviors.

e. Privacy Threshold Analysis

1). The Privacy Threshold Analysis (PTA) is an internal document used by the Privacy Officers, information system owners and the Information System Security Officers (ISSOs). Based on the information in the PTA, Privacy Impact Assessment (PIA) support determines if a PIA is required under the E-Government Act of 2002.

2). PTAs identify programs and systems that are privacy-sensitive and contain PII. PTAs create an annual record of major system changes and standardize the privacy compliance process. PTAs strengthen the understanding of VA systems, programs, and projects. PTAs are written so that individuals who don’t have a technical background can understand what’s being stated.

3). PTA’s are to be completed and submitted to the VA Privacy Service PIA support mail group PIAsupport@va.gov on an annual basis unless there is a major change to an IT system prior to the annual review.

4). PTA’s are completed in collaboration with the Area Manager, ISSO, VBA, and our medical facility but submitted by the Privacy Officer.

f. Privacy Impact Assessment

1). Privacy Impact Assessments (PIA) outline the risks and effects of collecting,…