D.49- SYRACUSE VAMC PRIVACY POLICY MCP 00-021.pdf

SYRACUSE VAMC PRIVACY POLICY

MCP 00-21

Syracuse VA Medical Center Syracuse, NY 13210

Signatory Authority:

Medical Center Director

Responsible Owner:

Privacy Officer

Rescinded Document:

MCM 00-21, Privacy Policy, March 2018

Effective Date:

January 2021

Recertification Date:

January 2026

1. POLICY

This medical center policy will develop, implement, maintain, and enforce a structured privacy program to properly use, disclose and safeguard individually identifiable information. The privacy program is designed to allow continued operation of mission-critical activities while ensuring the integrity, availability, confidentiality, and authenticity of data and information; minimum necessary access to protected health information;

and a continuing awareness of the need for, and the importance of, information privacy within the facility.

2. JUSTIFICATION

All members of the workforce are responsible for complying with this privacy policy, applicable federal laws and regulations, VA/VHA policies, as well as the procedures and practices developed in support of these policies. All facility privacy policies and procedures must be consistent with VHA 1605 Directives and Handbooks.

3. RESPONSIBILITIES

a. Executive Management (Director, Associate Director, Chief Nursing Executive, Chief of Staff). The Executive Management is responsible for:

(1) Providing the necessary resources (funding and personnel) to support the Privacy Program, maintaining a culture of privacy, and ensuring that the facility meets all the privacy requirements mandated by VA/VHA policy and other federal legislation [e.g., Freedom of Information Act (FOIA) [5 U.S.C.§ 552], Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [45 C.F.R. Parts 160 and 164], Health Information Technology for Economic and Clinical Health (HITECH) Act, Privacy Act (PA) [5 U.S.C. §552a], VA Claims Confidentiality Statute [38 U.S.C. 5701], Confidentiality of Medical Quality Assurance Review Records [38 U.S.C. 5705], and Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Medical Records [38 U.S.C. §7332]].

Attachment D.49 RFP 36C24224R0049

January 2021 MCP 00-21

(2) Ensuring Privacy Officer coverage for the facility and its associated clinics. It is required by VHA Privacy Policy that the facility Privacy Officer report directly to the VA Health Care Facility Director, Associate Director or senior individual who reports directly to and is supervised by the VA Health Care Facility Director and whose primary responsibilities at the facility include privacy program compliance. When the facility Privacy Officer or Alternate is not available, provide coverage for off-hours operations if conducting 24/7 operations.

(3) Ensuring facility Privacy Officers are fully involved in all projects concerning the access, collection, maintenance, use and/or disclosure, transmission, amendment, and/or disposal of Individually identifiable information (III).

(4) Ensuring that new and revised Memorandums of Understanding (MOU), Contracts, Data Use Agreements (DUA), Business Associate Agreements (BAA), or similar agreements which involve the collection, transmission, use or sharing of information are reviewed by the facility Privacy Officer, in accordance with VA Handbook 6500.6, Contract Security, prior to approval by Executive Leadership.

(5) Ensuring that the facility Privacy Officer is included in discussions and privacy concerns of the facility, which are addressed in strategic initiatives, and maintains a facility privacy culture.

(6) Cooperating with the facility Privacy Officer in any investigation, mediation strategies, or correspondence that is required in order to investigate and resolve a complaint or allegation and ensuring that appropriate disciplinary action is taken.

(7) Certifying annually or on an as needed basis, to the VHA Privacy Office, that privacy training has been completed for all personnel. This shall include all employees, volunteers, contractors, students, residents, and any other person performing or conducting services on behalf of the facility.

(8) Cooperating fully in submissions of Facility Self-Assessments (FSA) and ensuring full facility wide cooperation for Privacy Compliance Assurance Audits as required by the Privacy Compliance Assurance (PCA) Office.

(9) Ensuring that signs are placed alerting Veterans to auditory privacy concerns in areas, elevators, and other spaces requiring auditory privacy and that facility employees exercise appropriate precautions and safeguards when discussing Veterans’ III in public areas, such as clinic waiting rooms.

b. Privacy Officer. The Privacy Officer is responsible for:

(1) Developing, implementing and updating local privacy policies and procedures.

(2) Reviewing all health care center facility policies to ensure compliance with all privacy laws and regulations.

(3) Conducting periodic physical assessments, compliance reviews and/or audits of the facility’s collection, use, storage and maintenance of personal information. Reviews will include identification and correction of privacy vulnerabilities related to incidental disclosure such as posted and displayed PHI in clinical areas.

(4) Establishing effective working relationships with the facility Information System Security Officer (ISSO), Area Manager, Contracting Officer, Research Compliance Officer, Compliance Officer, and Human Resources Management personnel to ensure that local policies and procedures which may impact the privacy program support and complement each other.

(5) Ensuring that Executive Leadership is apprised of all privacy vulnerabilities and related issues.

(6) Coordinating with the facility Information System Security Officer (ISSO) for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, HITECH or other federal privacy statutes.

(7) Serving as the facility’s point of contact (POC) for matters relating to privacy policies and procedures.

(8) Ensuring that members of the workforce receive training and education about privacy policies and procedures as required by VHA Privacy Program.

(9) Ensuring that members of the workforce know whom to contact when a privacy complaint or incident is identified or received.

(10) Monitoring facility and workforce compliance with VHA privacy policies and procedures as well as compliance with local privacy policies and procedures.

(11) Identifying and reviewing areas within the facility for auditory privacy risks, to ensure appropriate safeguards are in place to limit incidental disclosures. Ensure the placement of signs alerting Veterans and staff to auditory privacy concerns in the waiting areas, elevators, and other spaces requiring auditory privacy and ensure the placement of chairs in waiting areas are optimally placed to minimize auditory privacy violations.

(12) Ensuring the placement of signs prohibiting the use of camera phone or video in restricted areas comply with VHA Directive 1078(1).

(13) Ensuring processes are in place for the appropriate accounting of disclosures of III made by the facility and appropriate utilization of the ROI Plus software or other tracking mechanism are used in accordance with the facility’s policies and procedures.

The processes will include accounting for authorization electronically conducted through iMed Consent.

(14) Collaborating with various program officials and the Contracting Officer, to ensure identification of all entities meeting the definition of Business Associates.

(15) Maintaining a list of active Business Associates (BA) utilized by the facility and ensuring all BA’s have a signed Business Associate Agreement (BAA) in place prior to disclosure of individually identifiable health information (IIHI) and that the BA adheres to the requirements of the BAA.

(16) Collaborating with the facility Records Manager to ensure that RCS 10-1 is followed for record control requirements and no unauthorized system of records are being kept. Refer to the facility Data Destruction standard operating procedure for information related to the local processes and procedures for ensuring that records are dispositioned according to schedule and that only approved system of records are being kept.

(17) Ensuring all facility developed paper, web-based or electronic forms that collect personal information from the Veteran, or personal representative, contain the appropriate Privacy Act statements. The facility Privacy Officer will serve as an Ad Hoc member of the Health Information Committee to ensure the Privacy Act statements are included on all local forms, as appropriate.

(18) Reviewing and approving all MOUs, Contracts and/or DUAs when required for the sharing of VA sensitive data between the facility and other parties.

(19) Ensuring prompt investigation and follow-up on allegations or known occurrences of privacy violations or complaints including logging the violation or complaint in the Privacy and Security Event Tracking System (PSETS). PSETS should be initiated upon one hour of notification of the violation during normal business hours or as soon as possible outside of normal business hours. If a privacy violation presents the risk of media involvement, congressional inquiry, legal action, immediate harm to the individual or any other high-risk outcome, the incident must be reported within one hour of discovery regardless of the discovery time (even during non-business hours).

(20) Reporting promptly to the VHA Privacy Office any potential privacy complaint, allegation, or activity that has VISN-level or national-level impact.

(21) As a non-voting member of the facility IRB and R&D Committees, the Privacy Officer will review all human subject research protocols, exempt and non-exempt, in accordance with VHA Directive 1200.05 and other applicable guidance to ensure legal authority exits prior to use and disclosure of VHA information for research.

(22) Collaborating with the facility Information System Security Officer (ISSO), Area Manager, and Information System Owner to ensure that a Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA), if applicable, is completed on all information technology systems, applications or programs that collect, maintain, and/or disseminate personally identifiable information (PII).

(23) Reviewing, processing, and monitoring requests to amend any information or record retrieved by an individual’s name that is contained in a VA system of records, to include designated record sets, and coordinating such requests with the author of the document.

(24) Collaborating with the facility Information System Security Officer (ISSO), Contracting Officer Representative (COR) and the Contracting Officer to ensure all contracts are reviewed in compliance with VA Handbook 6500.6.

(25) Ensuring all facility’s policies and procedures relating to HIPAA, HITECH, Privacy Act, 38 U.S.C. §5701, §5705, and §7332, and FOIA are consistent with current guidelines and requirements, complementing and supporting each other.

(26) Ensuring local departmental policies and procedures are developed if not specifically outlined in the facility Privacy policies.

(27) Provide awareness training through various means to inform Veterans them of their privacy rights and responsibilities.

(28) Complete the Facility Self-Assessment (FSA) by the last business day of each quarter or as required by PCA and work with facility staff and leadership to facilitate a successful Privacy Compliance Audit.

(29) Ensuring that the reduction of SSN usage is reviewed to determine the necessity of using partial or full SSN.

(30) Other responsibilities as defined by the VHA Privacy Office.

c. Information System Security Officer (ISSO): The ISSO is responsible for:

(1) Coordinating with the facility Privacy Officer for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule or other federal privacy statutes.

(2) Coordinating, facilitating, and updating the establishment of information security policies and procedures, to work in tandem with privacy policies and procedures.

(3) Establishing effective working relationships with the facility Privacy Officer, Area Manager, Contracting Officer, Research Compliance Officer, Compliance Officer, and Human Resources Management personnel to ensure that information technology (IT), security and HIPAA/FOIA/PA/Federal Information Security Management Act (FISMA) policies and procedures compliment and support each other.

(4) Reviewing and evaluating the security program impact(s) of any proposed facility information privacy policy and procedure changes.

(5) Collaborating with the facility Privacy Officer on addressing/resolving privacy complaints, investigations, and access rights to audits and other information maintained by the facility ISSO.

(6) Collaborating with the facility Privacy Officer, Area Manager, and System Owner to ensure that the Privacy Threshold Analysis (PTA) and the Privacy Impact Assessment (PIA), if applicable, are completed and fully executed on all information technology systems, applications or programs that collect, maintain and/or disseminate

PII.

(7) Entering all Information Security violations through the Privacy and Security Event Tracking System (PSETS) to the VA Cyber Security Operations Center (VA- CSOC) within 1 hour of discovery.

(8) Ensuring that all media (paper, electronic, CDs, disks, portable devices, etc.) with III is disposed of via approved means.

d. Clinical staff or designee: The Clinical staff or designee are responsible for:

(1) Reviewing and determining appropriateness for granting individuals’ requests for record amendment requests.

(2) Accessing, using and disclosing protected health information only when legal authority exits.

e. Area Manager : The Area Manager is responsible for:

(1) Coordinating with facility Information System Security Officer (ISSO) and facility Privacy Officer to provide technical advice and other assistance relative to the reasonable safeguards requirements of privacy statutes and regulations dealing with implementation of IT systems, policies and procedures.

(2) Identifying each locally maintained computer system that contains III and providing technical input for various mandated documents, reports, and investigations.

(3) Ensuring all computer rooms meet acceptable reasonable safeguards and that minimum necessary access is maintained.

(4) Collaborating with the ISSO, PO and Information System Owner to ensure that the PTA and the PIA, if applicable, are completed and fully executed on all information technology systems, applications or programs that collect, maintain and/or disseminate

PII.

f. Chief, Human Resources Management Service (HRMS) or designee: The Chief, Human Resources Management Service (HRMS) or designee is responsible for:

(1) Providing consistent and uniform guidance to supervisors and managers regarding personnel actions, sanctions, or other actions to be taken when employees have violated information privacy practices, laws, regulations, policies and procedures, and rules of behavior (see VA Directive 5021).

(2) Ensuring that appropriate disciplinary action is taken when privacy violations are brought to their attention.

(3) Providing appropriate information to facility Privacy Officer for completion of PSETS entries in a timely manner regarding mitigation/disciplinary actions.

(4) Coordinating with facility Privacy Officer on the privacy and disclosure of personnel records and other records maintained by HRMS.

(5) Ensuring that personnel records maintained by the HRMS are maintained in compliance with applicable privacy policies, statutes and regulations.

g. VA Contracting Officer (CO)/Contracting Officer Representative (COR). The CO/COR is responsible for:

(1) Determining the appropriate security and privacy language in all contracts by collaborating with the facility Privacy Officer to ensure that privacy responsibilities are included (see VA Handbook 6500.6, Appendix C).

(2) Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

(3) Ensuring that Business Associate Agreements are enacted for contracts which the contractor meets the definition of a Business Associate. A BAA should be a separate document from the contract.

(4) Ensuring that contractors receive the appropriate privacy and, if applicable, security training upon initiation of the contract and annually thereafter.

(5) Ensuring that contract requirements for privacy are met to include mediating and/or terminating the contract.

h. Local Managers, Supervisors and their designees. Local Managers or Supervisors are responsible for:

(1) Identifying and protecting all individually identifiable information (III) used by supervised personnel, including contractors and other workforce members. Ensuring that individuals are only provided access to III when authorized and the appropriate training has been completed such as in the case of volunteers. (Note: CWT, compensated work therapy, patients are prohibited to have access to PHI).

(2) Ensuring that III, whether electronic or printed, is secured when work areas under their supervision are unattended.

(3) Facilitate or provide training to new and existing personnel on roles and responsibilities for protecting III, to include the requirement that possible suspected privacy violations are reported to the Privacy Officer at the time of discovery.

(4) Identifying and assigning functional categories in accordance with facility policy and ensuring VA personnel have only the minimum necessary access level required to carry out their authorized functions or assigned duties and that VA personnel understand what their minimum level of access is and that access beyond the scope of their responsibilities will result in disciplinary action.

(5) Ensuring applicable personnel complete the “Information Security and Privacy Awareness and Rules of Behavior” training. If access to protected health information (PHI) is required, then “Privacy and HIPAA Focused” training must be completed within 30 days of hire or before access to PHI is given. Training must be completed annually thereafter and documented using the Talent Management System (TMS). Workforce members must be enrolled in TMS through either self-enrollment (e.g. contractors and volunteers) or automatic enrollment upon hire.

(6) Assists the facility Privacy Officer and Human Resource Management Service with the investigation and resolution of privacy incidents involving their employees and/or program(s). However, supervisors are not to access a record for investigation without express permission from the Privacy Officer.

(7) Provide all responsive documents to the FOIA Officer upon request in a timely manner and require cooperation from staff in response to all FOIA requests.

i. Quality Manager . The Quality Management (QM) Confidentiality Officer is responsible for coordinating with the facility Privacy Officer on requests for copies of or access to QM documents. The facility Privacy Officer serves as the final approval authority for determining which documents are classified as quality management documents in accordance with VHA Directive 2008-077, Quality Management (QM) and Patient Safety Activities That Can Generate Confidential Documents prior to disclosure.

The facility Privacy Officer will work with the FOIA Officer concerning any exception to disclosure under FOIA.

j. Administrative Officer of the Day (AOD ). The AOD is responsible for resolving and responding to disclosure issues and privacy incident reporting requirements consistent with VHA Directive and VHA Handbooks 1605 series, VA Directive 6500 series during non-business hours. The AOD will process incoming requests for patient information received from non-VA healthcare agencies during non-business hours and process only those determined to be emergent requests (i.e. patient in the Emergency Department, Psychiatry, or inpatient ICU at the time of request). The AOD will ensure receipt of a written request from the non-VA health care agency prior to faxing copies of the requested patient records to the requestor. The AOD will send the written request to the HIMS department for inclusion in the patient record and the account for the disclosure in the ROI Plus software.

k. All Employees . All employees are responsible for:

(1) Accessing the minimum necessary Information for which they are authorized in accordance with all laws and regulations in the performance of their official VA duties.

(2) Employees must exercise appropriate precautions and safeguards when discussing Veterans’ individually identifiable information in public areas to prevent an unauthorized disclosure.

(3) Protecting an individual’s rights to privacy and ensuring proper use and disclosure of information. All workforce members will be held accountable for compliance with these policies, procedures, and applicable laws.

(4) Appropriately safeguarding printed and electronic individually identifiable information.

(5) Reporting complaints and/or violations of privacy policies or procedures to the facility Privacy Officer immediately upon discovery.

(6) Co-operating with the facility Privacy Officer and/or the VHA Privacy Office throughout the complaint investigation process.

(7) Obtaining appropriate approval in accordance with Public Affairs policy to speak to the news media. Employees are not authorized to disclose any individually identifiable information on a patient or Veteran during an interview without the prior signed, written authorization of the patient or Veteran. When an employee is asked to be interviewed by a third party, such as the news media, VA Form 10-3203a, Informed

Consent and Authorization for Third Parties to Produce or Record Statements, Photographs, Digital Images, or Video or Audio Recordings must be completed.

(8) Consulting the facility Privacy Officer and VHA Directive 1605.01 for guidance in privacy situations not addressed in this document.

4. OTHER PARAGRAPHS - PROCEDURES

a. Administrative Requirements:

(1) Compliance with Privacy Policies :

(a) The facility and its workforce will comply with the contents of this policy, VHA Directive 1605.01, and all other applicable privacy laws, regulations, and VA/VHA policies.

(b) The facility Privacy Officer will monitor compliance with this policy through various means, including continuous readiness reviews for privacy compliance.

(2) Documentation :

(a) This policy and any changes thereto, must be maintained in writing, either on paper or in electronic form, for a period of at least six (6) years.

(b) Changes in VHA Directive 1605.01: When VHA Directive 1605.01 is updated which necessitates alteration of facility policies and procedures, the local privacy policies and procedures will be revised without delay as outlined in MCMPM 00-01, Memorandum and Policy, Development, Review and Approval Procedures.

(3) Complaint Process :

(a) All privacy complaints received by the facility are to be referred immediately to the facility Privacy Officer or Alternate Privacy Officer for review and processing.

(b) An individual has 3 years from the date of the complaint to request an investigation into the alleged complaint. Health and Human Services, Office for Civil Rights uses this same time frame for their complaints.

(c) The facility Privacy Officer or Alternate will enter all facility privacy incidents and complaints, regardless of validity, into the VA Privacy and Security Event Tracking System (PSETS). Individuals should contact the National Service Desk at 1-855- 673-4357 to report incidents as defined in this policy that occur outside of normal tour of duty hours. The National Service Desk with immediately notify the VA CSOC with the details of the incident. After the initial notification, appropriate follow-up will be the responsibility of the ISSO or PO for the facility where the incident occurred, as indicated in the above procedures. All incidents must be reported within one hour of discovery to the VA Cyber Security Operations Center (CSOC).

(d) Notice to Privacy Complainants: All individuals filing a privacy complaint, i.e., privacy complainants, will be provided a copy of the Notice to Privacy Complainants at the time of the complaint submission regardless of the way it was received (e.g. email, mail or verbal).

1. If the complaint is made verbally, the Privacy Officer, or Alternate Privacy Officer will obtain mailing information in order to send the Notice to Privacy Complainants.

2. The Notice to Privacy Complainants will be mailed to the privacy complainant within 2 business days if the Notice is not given in person to the complainant. A complaint acknowledgement cover letter will be included when the Notice is mailed.

(e) The facility Privacy Officer is responsible for:

1. Investigating all complaints regarding facility privacy practices regardless of validity.

2. Cooperating with the VHA Privacy Office on all HHS-OCR complaints and all other privacy complaints submitted to VHACO, in addition to providing timely access to complaint investigation files.

3. Acknowledging receipt of the privacy complaint by providing IB 10-68 Notice to Privacy Complainants in compliance with VHA Directive 1605.01.

4. Communicating with leadership, as appropriate (i.e., Director, VISN, VHA Privacy Office, Office of Inspector General, and Office of General Counsel).

5. Determining the validity of a complaint or incident and responding appropriately.

6. Responding as soon as possible or no later than 60 calendar days, in writing to the complainant when the complaint does not result in an incident.

7. Appropriately entering and updating the privacy complaint/incident in PSETS.

8. Documenting outcomes of the investigation and providing findings to the supervisor in coordination with other stakeholders (e.g., Human Resources for sanctions or disciplinary actions, union representatives, department heads).

9. Mailing the response letter to the complainant’s address.

10. Maintaining an administrative file for all complaints by PSETS ticket number or by date regardless of validity.

11. Trending the types of privacy complaints identified and reports these trends to the facility leadership bi-annually and to the VHA Privacy Office, upon request.

(f) Complaints Identified as Incidents: When the facility Privacy Officer determines during the investigation that a privacy complaint is a privacy incident, the PSETS ticket classification will promptly be changed from a complaint to an incident.

1. When a privacy complaint is made regarding access to a health record and the facility Privacy Officer cannot determine that the access is likely or not likely authorized, the access must be presumed to be unauthorized and will be reported as a privacy incident in PSETS.

2. All determinations as to whether a privacy incident warrants credit monitoring protection services or a notification letter will be made by the VA Data Breach Resolution Service (DBRS) and the Data Breach Core Team (DBCT).

3. The DBRS and DBCT will notify the facility Privacy Officer in accordance with VA Handbook 6500.2, Appendix C.

4. When required, the HIPAA notification letter or credit monitoring letter will be mailed no later than 60 calendar days from when the incident was reported by the facility Privacy Officer.

(g) Administrative Record Keeping: A privacy complaint file containing all the documentation concerning the privacy complaint and investigation will be retained by the facility Privacy Officer in accordance with Record Control Schedule (RCS) 1006.19, Privacy Complaint File. The complaint file will contain the following:

1. Initial written complainant’s concern or a Report of Contact by the facility Privacy Officer, if the complaint is made orally;

2. Written documentation of all interviews or statements; and

3. All written correspondence, including e-mails from the complainant or staff.

(h) All complaints (privacy and/or security related) received by the facility from the Department of Health and Human Services (HHS)-Office for Civil Rights (OCR) will be encrypted and forwarded immediately to the VHA Privacy Office mail group VHAPrivIssues@va.gov for appropriate processing. The facility does not have authority to respond to HHS-OCR complaints. However, the expectation is that the PO will respond timely to any questions that the VHA Privacy Office needs in order to respond to HHS OCR.

1. If an investigation arises as a result of an HHS-OCR complaint, this facility and its Business Associates, if applicable, must permit the Secretary of HHS access to information, during normal business hours, after coordinating with the VHA Privacy Office.

2. When addressing complaints, the facility Privacy Officer should reference resources available on the VHA Privacy Officer Share point site.

https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pages/ComplaintTracking.aspx

When Human Resources is contemplating employee disciplinary action, they should refer to VA Directive 5021 and VA Handbook 5021, Employee/Management Relations.

(i) The facility may not retaliate against a person for exercising rights provided by the HIPAA Privacy Rule, for assisting in an investigation by HHS-OCR or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates these provisions.

(j) The facility may not require an individual to waive any right under these provisions as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.

(4) Reasonable Safeguards :

(a) All facility workforce members shall ensure that appropriate administrative, technical, and physical safeguards are used to maintain the security and confidentiality of III, including protected health information (PHI), and to protect against any anticipated threats or hazards to their security or integrity. The facility’s personnel shall make reasonable efforts to limit use of III to the minimum necessary to accomplish the intended purpose of any use, disclosure, or request. This does not pertain to the treatment provision under the HIPAA Privacy Rule.

(b) All personnel may access and use information contained in VHA records as required for their official duties related to treatment, payment, and health care operations purposes.

(c) When disclosing VHA information, all applicable laws and regulations are reviewed and applied to the request in order to assure utilization of the most stringent provisions for all uses and/or disclosures of data in order to provide the greatest rights to the individual and the minimum necessary of III. III disclosure is mandatory with a valid written authorization, but disclosure must be limited to only the information necessary to satisfy the purpose of the request.

(d) Disposal of Paper Documents: Staff disposes of paper documents that contain III by following the process established locally. Refer to the facility Data Destruction Standard Operating Procedure for specific details regarding document destruction.

(e) Disposal of Electronic Media: Electronic media containing III will be destroyed by either the local data destruction process or by turning electronic media into IT who tracks the device, removes the device from the inventory, and submits to the ISSO for final destruction by means of a VA-approved outside contractor.

(f) Disposal of Non-paper Items: Non-paper items (i.e. I.V. bags, wristbands, prescription bottles, etc.) containing III are destroyed by the staff removing the labels and wristbands containing the sensitive patient information and placing in the shredding bin for proper destruction.

Note: PII on labels for items that must be disposed of as medical waste can be placed in the red sharps containers which is later retrieved by the medical waste contractor for incineration.

(g) Maintaining Auditory Privacy: Staff only discusses patient care issues in appropriate areas that allow for the maintenance of auditory privacy. Facility staff does not discuss patient information in areas not conducive to confidentiality (e.g., canteen, elevators, or hallways). Signs must be posted alerting Veterans to auditory privacy concerns in waiting areas. VHA health care providers and staff must refrain from discussing patient information within hearing range of anyone who is not on the patient's treatment team or anyone who does not have a need to know the specific patient information unless an emergent condition arises whereby auditory privacy cannot be maintained. Administrative staff should follow the same guidance in any discussion involving individually identifiable sensitive information, (e.g., employee health issues or disciplinary actions.) Appropriate safeguards include training all staff on auditory privacy to include:

1. Using the Veterans Health Identification Card (VHIC) for identification upon check-in, if available;

2. Speak quietly when discussing a patient’s condition with the patient or the patient’s family members in a public or open area or where the conversation can be overheard such as a waiting room or multi-patient room.

3. Only discussing the information necessary to accomplish the function (e.g. not asking for the full Social Security Number (SSN) when the last four of the SSN is sufficient);

4. Asking other Veterans in line for clinical check-in to wait a short distance away from the desk to allow a zone of audible privacy as opposed to being right behind the Veteran being assisted;

5. Only calling Veterans back to an exam room, pharmacy window or other treatment area by name; and

6. Going behind closed doors to have discussions pertaining to the personal information of the Veteran.

(h) Use of Facsimile (Fax): When using fax technology, facility staff adheres to VA Handbook 6500, Risk Management Framework for VA Information Systems -Tier3: VA Information Security Program; VHA Handbook 1907.01, Health Information Management and Health Records; and VHA Directive 1605.01, Privacy and Release of Information.

(i) Electronic mail (e-mail) and information messaging applications and systems are used as outlined in VA policy (VA Directive 6301 and VA Handbook 6500). These types of messages never should contain III, unless the authentication mechanisms have been secured appropriately. Responding to a patient via email, which contains protected health information, should be done through My HealtheVet Secure Messaging.

(j) Mailing of Sensitive Information. Mailing of Veteran’s correspondences such as copies of records, appointment letters may be done so using the United States Postal Service. Envelopes, parcels, packaging or boxes containing sensitive information must be secured in a manner that prevents unauthorized access, tampering, or accidental loss of contents. Window envelopes must show the recipients’ names and addresses, but no other information. (See VA Directive 6609)

(k) To the extent practicable, this facility mitigates any harmful effect known to have resulted from an improper use or disclosure of III. Mitigation may include but is not limited to operational and procedural corrective measures; re-training, reprimanding, or disciplining workforce members; addressing problems with any involved Business Associates; incorporating the chosen mitigation solution(s) into facility procedures. Any employee who identifies improper use or disclosures of III or any other privacy incident must immediately report it to the Facility Privacy Officer via Outlook email or by phone.

(5) Sanctions

(a) All individuals who use or have access to VA information systems or sensitive information must sign and adhere to the Rules of Behavior, which bind them to the legal and moral responsibility of preventing unauthorized disclosure. (See VA Handbook 6500, Information Security Program Appendix D) This facility has established sanctions, which are applied against members of its workforce as appropriate, for failures to comply with privacy policies and procedures and Rules of Behavior.

(b) The facility Privacy Officer will determine privacy violations and provide evidence thereof. The employee’s supervisor will determine appropriate actions and may, in conjunction with Human Resources Management, take necessary steps and apply appropriate sanctions for any employees who are non-compliant with privacy policies and procedures. Penalties may be assessed against any individual(s) who accesses, uses, discloses, or obtains information without the individual's written authorization or not authorized by law regardless of whether it was an intentional violation or not.

(c) Appropriate sanctions must be taken in accordance with VA Directive 5021.

(6) Privacy Training and Education :

(a) The facility Privacy Officer will conduct privacy training at all facility New Employee Orientation (NEO) programs.

1. Employees are responsible for annual completion of their mandatory privacy training requirement prior to or on their anniversary date of privacy training the following year. The local requirements for timeframes for completion of training, methods of tracking training participation, provisions for managing non-cooperation from personnel, and other training requirements are outlined in the Privacy and Information Security Training Completion standard operating procedure.

2. The facility Privacy Officer, in coordination with the facility Education Coordinator, TMS Coordinator or Education Office, shall maintain a process of compiling annual training records in order to report the facility privacy training completion status to the VHA Privacy Office and to the health care facility Director upon request. All annual training records (to include paid employees, WOCs, volunteers and contractors) can be retrieved from the VA Talent Management System in the Syracuse Domain. The Education Office runs reports from TMS daily to determine the compliance rate for completion. Goal is to maintain at 100% daily.

a. The annual training records of completion of privacy training must be kept for all workforce members to include the following; employees, volunteers, students, and contractors for reporting of facility privacy training completion numbers by each group.

b. The facility Director will certify annual training completion to the VHA Privacy Office for all work force members based on the reports generated by the health care facility Privacy Officer and Education Coordinator, TMS coordinator or Education Office upon request.

3. The facility PO shall conduct other activities within the facility to enhance awareness of privacy and that have a positive impact on the overall privacy culture and posture of the facility. These activities shall include, but are not limited to, participation in VA’s annual Privacy Week activities, posting privacy posters and announcements throughout the facility, and conducting one-on-one training with personnel who have been observed displaying negative privacy culture behaviors.

(7) Privacy Threshold Analysis :

(a) The Privacy Threshold Analysis (PTA) is an internal document used by the Privacy Officers, information system owners and the Information System Security Officers (ISSOs). Based on the information in the PTA, Privacy Impact Assessment (PIA) support determines if a PIA is required under the E-Government Act of 2002.

(b) PTAs identify programs and systems that are privacy-sensitive and contain PII.

PTAs create an annual record of major system changes and standardize the privacy compliance process. PTAs strengthen the understanding of VA systems, programs, and projects. PTAs are written so that individuals who don’t have a technical background can understand what’s being stated.

(c) PTA’s are to be completed and submitted to the VA Privacy Service PIA support mail group PIAsupport@va.gov on an annual basis unless there is a major change to an IT system prior to the annual review.

(d) On a quarterly basis, the facility Privacy Officer will review the PTA/PIA Tracking spreadsheet to identify previously approved PTAs approaching renewal. The facility Privacy Officer will coordinate the completion of the updated PTA with the System Owner and other relevant stakeholders and subsequently submit to the VA Privacy Service PIA support mail group at PIAsupport@va.gov .

(8) Privacy Impact Assessment :

(a) Privacy Impact Assessments (PIA) outline the risks and effects of collecting, maintaining, and disseminating PII. They mitigate potential privacy risks by evaluating protections, such as security and privacy controls. They can also introduce alternative processes for handling information.

(b) PIAs help identify the overall privacy risk level of a system, program, or project.

PIA’s inform leadership, program offices, and Veterans about how VA is implementing privacy and mitigating risks associated with PII collection, use, and maintenance.

(c) PIA’s are to be completed and submitted to the VA Privacy Services PIA support mail group at PIAsupport@va.gov every three years unless there is a major change to the IT system prior to the three year period.

(d) On a quarterly basis, the facility Privacy Officer will review the PTA/PIA Tracking spreadsheet to identify previously approved PIAs approaching renewal. The facility Privacy Officer will coordinate the completion of the updated PIA with the System Owner and other relevant stakeholders and subsequently submit to the VA Privacy Service PIA support mail group at PIAsupport@va.gov.

(9) Personally Identifiable-Information Database Inventory :

(a) The facility Privacy Officer, in coordination with the facility Area Manager, ISSO, Records Manager and facility IT staff shall maintain a process for identifying databases which collect or maintain PII/PHI.

(b) The PO ensures databases identified with PII/PHI are accounted for in existing PTA and PIA.

(c) If the databases identified are not accounted for, then the PO, in collaboration with the Area Manager and ISSO, updates the PTA and PIA documents accordingly.

(d) Database inventories are done on an annual basis.

(e) On an annual basis, the facility Privacy Officer will coordinate the completion of a database inventory review with the AM and other relevant stakeholders. The AM, or designee, will utilize Map Scan software to conduct the review.

b. Individual Rights

(1) Verification of Identity

(a) In order to receive or view information from his or her VHA record, an individual must present staff with adequate information for verification of identity as outlined in VHA Directive 1605.01.

(b) A Veteran Health Identification Card (VHIC), passport, driver’s license, or employee identification card may be used to identify an individual who appears in person. Mail or fax identification requests may be verified by social security number, address and signature comparison to the VHA record.

(c) This facility shall recognize legally designated personal representatives as the individual when the individual is unavailable or unable to act on his/her own behalf.

Staff should recognize the following representatives of the individual:

1. Legal Guardian

2. Power of Attorney (POA): All POA’s are to be referred to the Chief, Health Information Management or District Counsel for determination that the POA meets the legal requirements for making disclosure decisions.

NOTE: Regardless of the type or source of the POA presented, the reviewer must always carefully check the document with General and Special Powers of Attorney. The document must be in writing; signed by the individual giving the power; dated; notarized and signed by a licensed notary public; and specifically designate, by name, the third-party agent, which may be an organization or entity, to act on behalf of the individual.

3. A personal representative of a deceased individual is a person, who under applicable law, has authority to act on behalf of the deceased individual as outlined by VHA Directive 1605.01.

(2) Notice of Privacy Practices

(a) An individual will be provided with a copy of IB 10-163, Notice of Privacy Practices, by this facility upon verbal or written request.

(b) An individual may obtain a copy of IB 10-163, Notice of Privacy Practices, from the Release of Information Office, Privacy Officer, Health Benefit Center, or employees may print from the VA website.

(c) All non-Veteran patients seen at the facility will be provided a copy of IB10-164, VHA Notice of Privacy Practices as required by VHA Handbook 1605.04.

(d) A Non-Veteran who receives care and treatment at a facility whether for humanitarian purposes or enrolled in a VA research study will be given a copy of the Notice of Privacy Practices from and sign the acknowledgement form. Humanitarians will receive a copy of the NOPP at the time of service (during registration). Non- Veterans involved in Research will receive a copy of the NOPP at the time of consent.

(e) In an Employee Health situation, an Employee Health staff member will maintain a copy of the acknowledgment form in a binder or in the blue employee health folder, if applicable. CPRS should be used only if there is not another place to keep the acknowledgement form.

(f) The Privacy Officer, or designee, will run a report using the “Non-Veteran Appointment” menu in VISTA to identify non-Veterans treated at the facility and perform a record review to ensure the NOPP was offered and/or provided. See VHA Handbook

1605.04 for further information.

(3) Right of Access

(a) If access is legally appropriate, individuals may obtain a copy of, or inspect their record or III. A request to obtain a copy or inspect their record or III must be made in writing by the individual or a personal representative as outlined in VHA Directive 1605.01.

(b) All requests for copies of individuals’ own health information will be directed to the Release of Information Office. All requests must show date received whether by use of a date stamp, writing date received on request, or entering the request in the ROI Plus software the exact same day as received in person or mail.

1. When an individual requests their Sensitive Patient Access Report (SPAR) and does not specify a period of time for the running of the report, the facility Privacy Officer should ask the individual for the timeframe desired. If the individual wants the SPAR for the entire timeframe for which it exists, then it would be provided as such under Right of Access.

(c) If the individual or the individual’s representative is not entitled to the records under any legal provisions, such as an Exempt Privacy Act SOR, the facility will not provide him or her with a copy of the records.

NOTE: This is an infrequent occurrence and the facility Privacy Officer should be consulted prior to such a denial.

(d) Access to view a record must be processed as follows:

1. When individuals appear in person at a VA health care facility, they must be advised at that time whether the right of access or review of records can be granted.

When immediate review cannot be granted due to staffing or availability of records, necessary arrangements must be made for a later personal review, or if acceptable to the individual, the copies may be furnished by mail.

2. Mailed requests must be referred to the facility Privacy Officer or Chief, Health Information Management (HIM) or HIM Supervisor for determination if the right of access review will be granted.

a. If additional information is required before the request can be processed, the individual requesting review of the records must be advised.

b. If it is determined that a request to review will be granted, the individual must be advised by mail that access to view the records will be given at a designated location, date and time in the facility, or a copy of the requested record will be provided by mail, if the individual has previously indicated or has been contacted to verify that a copy of the record will be acceptable.

(e) Typically, right of access requests, granted requests, denials and adverse determinations are documented in the ROI Plus software, in accordance with VHA Directive 1615, Mandated Utilization of Release of Information (ROI) Plus software.

However, departments that do not use the ROI Plus software (i.e. Social Work, Human Resources, Research, Social Work, Police and Security, Credentialing and Privileging, Employee Health, Fee Basis, MCCR, Quality, Research, Performance Management and Infection Control) will complete the spreadsheet posted on the T drive/Accounting of Disclosure Folder for their service as outlined in the Accounting of Disclosure Standard Operating Procedure.

(4) Amendment Request

(a) An individual has the right to request an amendment to any information or records retrieved by the individual’s name or other unique identifier contained in a VA Privacy Act system of records, as outlined in VHA Directive 1605.01. A request for name change is considered an amendment request and must have the appropriate legal documents for the Master Person Index (MPI) Coordinator to make the change.

(b) The amendment file must be retained and destroyed in accordance with the Record Control Schedule (RCS) 10-1, Privacy Amendment Case File under Section

1006.9. The amendment files are not scanned into the Veteran’s health record as they are not considered part of the health record. They may be maintained in a secure and locked file cabinet or scanned to a secure network drive but cannot be scanned into the administrative portion of VistA Imaging in the health record.

(c) Amendment requests are delivered to the Privacy Officer for a date to be placed on the request. The request must be hand delivered to the Privacy Officer, sent via interoffice mail in a Special Attention Envelope (VA 10-0461) addressed to the Privacy Officer, at mail code 00, or mailed directly to the facility Privacy Officer.

(d) Requests to amend records are acknowledged in writing within 10 working days of receipt and if a determination cannot be made within this time period the individual is advised of when the facility expects to notify the individual of the action…