D7 - Attachement A Facility Privacy Policy.pdf

FACILITY PRIVACY POLICY

MCP 637-00-60

Charles George VA Medical Center Asheville, NC 28805

Signatory Authority:

Charles George VA Medical Center Executive Director

Responsible Owner:

Privacy/FOIA Officer

Rescinded Document:

637-00-60, Facility Privacy Policy dated January 2019

Effective Date:

February 2022

Recertification Date:

February 2027

1. POLICY

This medical center policy (MCP) will develop, implement, maintain, and enforce a structured privacy program to properly use, disclose and safeguard individually identifiable information. The privacy program is designed to allow continued operation of mission-critical activities while ensuring the integrity, availability, confidentiality, and authenticity of data and information; minimum necessary access to protected health information; and a continuing awareness of the need for, and the importance of, information privacy within the facility.

2. JUSTIFICATION

All members of the workforce are responsible for complying with this privacy policy, applicable federal laws and regulations, VA/VHA policies, as well as the procedures and practices developed in support of these policies. All facility privacy policies and procedures must be consistent with VHA 1605 Directives and Handbooks.

3. RESPONSIBILITIES

a. Executive Management (Executive Director, Assistant Director, Associate

Director, Chief Nursing Executive, Chief of Staff). The Executive Management is responsible for:

(1) Providing the necessary resources (funding and personnel) to support the Privacy Program, maintaining a culture of privacy, and ensuring that the facility meets all the privacy requirements mandated by VA/VHA policy and other federal legislation [e.g., Freedom of Information Act (FOIA) [5 U.S.C.§ 552], Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [45 C.F.R. Parts 160 and 164], Health Information Technology for Economic and Clinical Health (HITECH) Act, Privacy Act (PA) [5 U.S.C. §552a], VA Claims Confidentiality Statute [38 U.S.C. 5701], Confidentiality of Medical Quality Assurance Review Records [38 U.S.C. 5705], and Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human

February 2022 MCP 637-00-60

Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Medical Records [38 U.S.C. §7332]].

(2) Ensuring Privacy Officer coverage for the facility and its associated clinics. It is required by VHA Privacy Policy that the facility Privacy Officer report directly to the VA Health Care Facility Director, Associate Director or senior individual who reports directly to and is supervised by the VA Health Care Facility Director and whose primary responsibilities at the facility include privacy program compliance. When the facility Privacy Officer or Alternate is not available, provide coverage for off-hours operations if conducting 24/7 operations.

(3) Ensuring facility Privacy Officers are fully involved in all projects concerning the access, collection, maintenance, use and/or disclosure, transmission, amendment, and/or disposal of Individually identifiable information (III).

(4) Ensuring that new and revised Memorandums of Understanding (MOU), Contracts, Data Use Agreements (DUA), Business Associate Agreements (BAA), or similar agreements which involve the collection, transmission, use or sharing of information are reviewed by the facility Privacy Officer, in accordance with VA Handbook 6500.6, Contract Security, prior to approval by Executive Leadership.

(5) Ensuring that the facility Privacy Officer is included in discussions and privacy concerns of the facility, which are addressed in strategic initiatives, and maintains a facility privacy culture.

(6) Cooperating with the facility Privacy Officer in any investigation, mediation strategies, or correspondence that is required in order to investigate and resolve a complaint or allegation and ensuring that appropriate disciplinary action is taken.

(7) Certifying annually or on an as needed basis, to the VHA Privacy Office, that privacy training has been completed for all personnel. This shall include all employees, volunteers, contractors, students, residents, and any other person performing or conducting services on behalf of the facility.

(8) Cooperating fully in submissions of Facility Self-Assessments (FSA) and ensuring full facility wide cooperation for Privacy Compliance Assurance Audits as required by the Privacy Compliance Assurance (PCA) Office.

(9) Ensuring that signs are placed alerting Veterans to auditory privacy concerns in areas, elevators, and other spaces requiring auditory privacy and that facility employees exercise appropriate precautions and safeguards when discussing Veterans’ III in public areas, such as clinic waiting rooms.

b. Privacy Officer. The Privacy Officer is responsible for:

(1) Developing, implementing, and updating local privacy policies and procedures.

(2) Reviewing all health care center facility policies to ensure compliance with all privacy laws and regulations.

(3) Conducting periodic physical assessments, compliance reviews and/or audits of the facility’s collection, use, storage and maintenance of personal information. Reviews will include identification and correction of privacy vulnerabilities related to incidental disclosure such as posted and displayed PHI in clinical areas.

(4) Establishing effective working relationships with the facility Information System Security Officer (ISSO), Area Manager Contracting Officer, Research Compliance Officer, Compliance Officer, and Human Resources Management personnel to ensure that local policies and procedures which may impact the privacy program support and complement each other.

(5) Ensuring that Executive Leadership is apprised of all privacy vulnerabilities and related issues.

(6) Coordinating with the facility Information System Security Officer (ISSO) for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, HITECH or other federal privacy statutes.

(7) Serving as the facility’s point of contact (POC) for matters relating to privacy policies and procedures.

(8) Ensuring that members of the workforce receive training and education about privacy policies and procedures as required by VHA Privacy Program.

(9) Ensuring that members of the workforce know whom to contact when a privacy complaint or incident is identified or received.

(10) Monitoring facility and workforce compliance with VHA privacy policies and procedures as well as compliance with local privacy policies and procedures.

(11) Identifying and reviewing areas within the facility for auditory privacy risks, to ensure appropriate safeguards are in place to limit incidental disclosures. Ensure the placement of signs alerting Veterans and staff to auditory privacy concerns in the waiting areas, elevators, and other spaces requiring auditory privacy and ensure the placement of chairs in waiting areas are optimally placed to minimize auditory privacy violations.

(12) Ensuring the placement of signs prohibiting the use of camera phone or video in restricted areas comply with VHA Directive 1078(1).

(13) Ensuring processes are in place for the appropriate accounting of disclosures of III made by the facility and appropriate utilization of the ROI Plus software or other tracking mechanism are used in accordance with the facility’s policies and procedures.

The processes will include accounting for authorization electronically conducted through iMed Consent.

(14) Collaborating with various program officials, and the Contracting Officer, to ensure identification of all entities meeting the definition of Business Associates.

(15) Maintaining a list of active Business Associates (BA) utilized by the facility and ensuring all BA’s have a signed Business Associate Agreement (BAA) in place prior to disclosure of Individually Identifiable Health Information (IIHI) and that the BA adheres to the requirements of the BAA.

(16) Collaborating with the facility Records Manager to ensure that RCS 10-1 is followed for record control requirements and no unauthorized system of records are being kept. The Privacy Officer will meet periodically with the Records Officer to ensure that only approved system of records are being maintained in Service file plans/inventory sheets.

(17) Ensuring all facility developed paper, web-based or electronic forms that collect personal information contain the appropriate Privacy Act statements. The Medical Records Committee will provide any documentation that is created for use, outside of the electronic health record, to the Privacy Officer for review prior to putting the form into use or publishing.

(18) Reviewing and approving all MOUs, Contracts and/or DUAs when required for the sharing of VA sensitive data between the facility and other parties.

(19) Ensuring prompt investigation and follow-up on allegations or known occurrences of privacy violations or complaints including logging the violation or complaint in the Privacy and Security Event Tracking System (PSETS). PSETS should be initiated upon one hour of notification of the violation during normal business hours or as soon as possible outside of normal business hours. If a privacy violation presents the risk of media involvement, congressional inquiry, legal action, immediate harm to the individual or any other high-risk outcome, the incident must be reported within one hour of discovery regardless of the discovery time (even during non-business hours).

(20) Reporting promptly to the VHA Privacy Office any potential privacy complaint, allegation, or activity that has VISN-Level or national-level impact.

(21) As a non-voting member of the facility IRB and the R&D Committee, the Privacy Officer will review all human subject research protocols, exempt and non-exempt, in accordance with VHA Directive 1200.05 and other applicable guidance to ensure legal authority exits prior to use and disclosure of VHA information for research.

(22) Collaborating with the facility Information System Security Officer (ISSO), Area Manager and Information System Owner to ensure that a Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA), if applicable, is completed on all information technology systems, application or programs that collect, maintain and/or disseminate personally identifiable information (PII).

(23) Reviewing, processing, and monitoring requests to amend any information or record retrieved by an individual’s name that is contained in a VA system of records, to include designated record sets, and coordinating such requests with the author of the document.

(24) Collaborating with the facility Information System Security Officer (ISSO), Contracting Officer Representative (COR) and the Contracting Officer to ensure all contracts are reviewed in compliance with VA Handbook 6500.6.

(25) Ensuring all facility’s policies and procedures relating to HIPAA, HITECH, Privacy Act, 38 U.S.C. §5701, §5705, and §7332, and FOIA are consistent with current guidelines and requirements, complementing and supporting each other.

(26) Ensuring local departmental policies and procedures are developed if not specifically outlined in the facility Privacy policies.

(27) Provide awareness training through various means to inform Veterans of their privacy rights and responsibilities.

(28) Complete the Facility Self-Assessment (FSA) by the last business day of each quarter or as required by PCA and work with facility staff and leadership to facilitate a successful Privacy Compliance Audit.

(29) Ensuring that the reduction of SSN usage is reviewed to determine the necessity of using partial or full SSN.

(30) Other responsibilities as defined by the VHA Privacy Office.

c. Information System Security Officer (ISSO): The ISSO is responsible for:

(1) Coordinating with the facility Privacy Officer for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule or other federal privacy statutes.

(2) Coordinating, facilitating, and updating the establishment of information security policies and procedures, to work in tandem with privacy policies and procedures.

(3) Establishing effective working relationships with the facility Privacy Officer, Area Manager, Contracting Officer, < Research Compliance Officer, if applicable>, Compliance Officer, and Human Resources Management personnel to ensure that information technology (IT), security and HIPAA/FOIA/PA/Federal Information Security Management Act (FISMA) policies and procedures compliment and support each other.

(4) Reviewing and evaluating the security program impact(s) of any proposed facility information privacy policy and procedure changes.

(5) Collaborating with the facility Privacy Officer on addressing/resolving privacy complaints, investigations, and access rights to audits and other information maintained by the facility ISSO.

(6) Collaborating with the facility Privacy Officer, Area Manager and System Owner to ensure that the Privacy Threshold Analysis (PTA) and the Privacy Impact Assessment (PIA) if applicable, are completed and fully executed on all information technology systems, applications or programs that collect, maintain and/or disseminate

PII.

(7) Entering all Information Security violations through the Privacy and Security Event Tracking System (PSETS) to the VA Cyber Security Operations Center (VA- CSOC) within 1 hour of discovery.

(8) Ensuring that all media (paper, electronic, CDs, disks, portable devices, etc.) with III is disposed of via approved means.

d. Clinical staff or designee: The Clinical staff or designee are responsible for:

(1) Reviewing and determining appropriateness for granting individuals’ requests for record amendment requests.

(2) Accessing, using and disclosing protected health information only when legal authority exits.

e. Area Manager: The Area Manager is responsible for:

(1) Coordinating with facility Information System Security Officer (ISSO) and facility Privacy Officer to provide technical advice and other assistance relative to the reasonable safeguards requirements of privacy statutes and regulations dealing with implementation of IT systems, policies and procedures.

(2) Identifying each locally maintained computer system that contains III and providing technical input for various mandated documents, reports, and investigations.

(3) Ensuring all computer rooms meet acceptable reasonable safeguards and that minimum necessary access is maintained.

(4) Collaborating with the ISSO, PO and Information System Owner to ensure that the PTA and the PIA, if applicable, are completed and fully executed on all information technology systems, application or programs that collect, maintain and /or disseminate

PII.

f. Chief, Human Resources Management Service (HRMS) or designee: The HRMS is responsible for:

(1) Providing consistent and uniform guidance to supervisors and managers regarding personnel actions, sanctions, or other actions to be taken when employees have violated information privacy practices, laws, regulations, policies and procedures, and rules of behavior (see VA Directive 5021).

(2) Ensuring that appropriate disciplinary action is taken when privacy violations are brought to their attention.

(3) Providing appropriate information to facility Privacy Officer for completion of PSETS entries in a timely manner regarding mitigation/disciplinary actions.

(4) Coordinating with facility Privacy Officer on the privacy and disclosure of personnel records and other records maintained by HRMS.

(5) Ensuring that personnel records maintained by the HRMS are maintained in compliance with applicable privacy policies, statutes and regulations.

g. VA Contracting Officer (CO)/Contracting Officer Representative (COR): The CO/COR is responsible for:

(1) Determining the appropriate security and privacy language in all contracts by collaborating with the facility Privacy Officer to ensure that privacy responsibilities are included (see VA Handbook 6500.6, Appendix C). Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

(2) Ensuring through the COR that contracts are aware of, and abide by, those privacy responsibilities as state din contracts with VA and VHA.

(3) Ensuring that Business Associate Agreements are enacted for contracts which the contractor meets the definition of a Business Associate. A BAA should be a separate document from the contract.

(4) Ensuring that contractors receive the appropriate privacy and, if applicable, security training upon initiation of the contract and annually thereafter.

(5) Ensuring that contract requirements for privacy are met to include mediating and/or terminating the contract.

h. Local Managers, Supervisors and their designees: Local Managers or Supervisors are responsible for:

(1) Identifying and protecting all individually identifiable information (III) used by supervised personnel, including contractors and other workforce members. Ensuring that individuals are only provided access to III when authorized and the appropriate training has been completed such as in the case of volunteers. (Note: CWT, compensated work therapy, patients are prohibited to have access to PHI).

(2) Ensuring that III, whether electronic or printed, is secured when work areas under their supervision are unattended.

(3) Facilitate or provide training to new and existing personnel on roles and responsibilities for protecting III, to include the requirement that possible suspected privacy violations are reported to the Privacy Officer at the time of discovery.

(4) Identifying and assigning functional categories in accordance with facility policy and ensuring VA personnel have only the minimum necessary access level required to carry out their authorized functions or assigned duties and that VA personnel understand what their minimum level of access is and that access beyond the scope of their responsibilities will result in disciplinary action.

(5) Ensuring applicable personnel complete the “Information Security and Privacy Awareness and Rules of Behavior” training. If access to protected health information (PHI) is required, then “Privacy and HIPAA Focused” training must be completed within 30 days of hire or before access to PHI is given. Training must be completed annually thereafter and documented using the Talent Management System (TMS). Workforce members must be enrolled in TMS through either self-enrollment (e.g. contractors and volunteers) or automatic enrollment upon hire.

(6) Assists the facility Privacy Officer and Human Resource Management Service with the investigation and resolution of privacy incidents involving their employees and/or program(s). However, supervisors are not to access a record for investigation without express permission from the Privacy Officer.

(7) Provide all responsive documents to the Privacy Officer upon request in a timely manner and require cooperation from staff in response to all FOIA requests.

(8) Assist employees with access to locked shred bins to retrieve documents inadvertently placed in the shred bin. The Service Chief, Supervisor, AO or designee will need to contact the Privacy Office by phone or email at vhaashprivacy@va.gov to schedule a time and location to pick up and sign out a shred bin key. Once the task is completed, the Service Chief, Supervisor, AO or designee must promptly return the shred bin key to the appropriate individual or as directed by the Privacy Office. The Privacy Officer, Alternate Privacy Officer and other designated individuals will have shred bin keys available.

(9) During after-hours the Service Chief, Supervisor or AO will need to contact the VA Police for assistance or to sign out a key. The VA Police may assist only if the need is urgent.

i. Quality Manager: Quality Management (QM) Confidentiality Officer is responsible for coordinating with the facility Privacy Officer on requests for copies of or access to QM documents. The facility Privacy Officer serves as the final approval authority for determining which documents are classified as quality management documents in accordance with VHA Directive 2008-077, Quality Management (QM) and Patient Safety Activities That Can Generate Confidential Documents prior to disclosure. The facility Privacy Officer will work with the FOIA Officer concerning any exception to disclosure under FOIA.

mailto:vhaashprivacy@va.gov

j. Administrative Officer of the Day (AOD): AOD is responsible for resolving and responding to disclosure issues and privacy incident reporting requirements consistent with VHA Directive and VHA Handbooks 1605 series, VA Directive 6500 series during non-business hours. The AOD is responsible for providing the Notice of Privacy Practices to employees who present at the Emergency Department and/or humanitarians. Acknowledgement of NOPP VA Form 10-0483 must be completed, signed, and provided to the Privacy Officer.

k. All Employees: All employees are responsible for:

(1) Accessing the minimum necessary Information for which they are authorized in accordance with all laws and regulations in the performance of their official VA duties.

(2) Employees must exercise appropriate precautions and safeguards when discussing Veterans’ individually-identifiable information in public areas to prevent an unauthorized disclosure.

(3) Protecting an individual’s rights to privacy and ensuring proper use and disclosure of information. All workforce members will be held accountable for compliance with these policies, procedures, and applicable laws.

(4) Appropriately safeguarding printed and electronic individually identifiable information.

(5) Reporting complaints and/or violations of privacy policies or procedures to the facility Privacy Officer immediately upon discovery.

(6) Co-operating with the facility Privacy Officer and/or the VHA Privacy Office throughout the complaint investigation process.

(7) Obtaining appropriate approval in accordance with Public Affairs policy to speak to the news media. Employees are not authorized to disclose any individually-identifiable information on a patient or Veteran during an interview without the prior signed, written authorization of the patient or Veteran. When an employee is asked to be interviewed by a third party, such as the news media, VA Form 10-3203a, Informed Consent and Authorization for Third Parties to Produce or Record Statements, Photographs, Digital Images, or Video or Audio Recordings must be completed.

(8) Consulting the facility Privacy Officer and VHA Directive 1605.01 for guidance in privacy situations not addressed in this document.

(9) Assist employees who are leaving the Western North Carolina VA Health Care System if they want to take personal electronic files with them. Removal of electronic files must be approved by the facility Executive Director. The employee must make the request to their Service Chief (or supervisor) and the facility Privacy Office at least 10 working days prior to their last day. The employee will need to create an electronic folder and place all documents in the folder. The Service Chief (or supervisor) should review the files for PII/PHI or other VA sensitive documents that would not be needed for the departing employee’s new assignment or that should not be removed from the facility records. The Service Chief or supervisor must then contact IT for assistance in preparing a link that will be sent to the Privacy Office. Once the Privacy Office reviews the files, the Privacy Officer will seek Executive Directors approval. Questions should be directed to the Privacy Office.

4. PROCEDURES

a. Administrative Requirements.

(1) Compliance with Privacy Policies.

(a) The facility and its workforce will comply with the contents of this policy, VHA

Directive 1605.01, and all other applicable privacy laws, regulations, and VA/VHA policies.

(b) The facility Privacy Officer will monitor compliance with this policy through various means, including continuous readiness reviews for privacy compliance.

(2) Documentation.

(a) This policy and any changes thereto, must be maintained in writing, either on paper or in electronic form, for a period of at least six (6) years.

(b) Changes in VHA Directive1605.01: When VHA Directive 1605.01, is updated which necessitates alteration of facility policies and procedures, the local privacy policies and procedures will be revised without delay. MCPs are utilized to communicate policies, instructions, guidelines and procedures of a continuing nature to medical center staff. MCPs must not restate national policy, regulations, or national clinical practice guidelines. MCPs are accessible to all employees. MCPs are reviewed annually, recertified five (5) years from the date of issue or previous recertification, and updated as needed when new guidelines (VHA handbooks, directives, accreditation standards, regulatory agency standards, etc.) are received. An MCP that is overdue for recertification must be followed until superseded by a more recent MCP or has been rescinded.

(3) Complaint Process.

(a) All privacy complaints received by the facility are to be referred immediately to the facility Privacy Officer or Alternate Privacy Officer for review and processing.

(b) An individual has 3 years from the date of the complaint to request an investigation into the alleged complaint. Health and Human Services, Office for Civil Rights uses this same time frame for their complaints.

(c) The facility Privacy Officer or Alternate will enter all facility privacy incidents and complaints, regardless of validity, into the VA Privacy and Security Event Tracking

System (PSETS). All staff are required to report all incidents or complaints to the facility Privacy Officer (or Alternate) or the ISSO. Staff may report via phone or by sending an email to vhaashprivacy@va.gov. After hours staff should report incidents or complaint via email to vhaashprivacy@va.gov or by calling 1-855-673-4357 Opt 6, Opt 4 and/or to the AOD. All contact information for reporting during normal business hours or after-hours is explained on all PO/ISSO Posters readily available throughout the facility and at each CBOC. All incidents must be reported within one hour of discovery to the VA Cyber Security Operations Center (CSOC).

(d) Notice to Privacy Complainants: All individuals filing a privacy complaint, i.e., privacy complainants, will be provided a copy of the Notice to Privacy Complainants at the time of the complaint submission regardless of the way it was received (e.g. email, mail or verbal).

1. If the complaint is made verbally, the Privacy Officer, or Alternate Privacy Officer will obtain mailing information in order to send the Notice to Privacy Complainants.

2. The Notice to Privacy Complainants will be mailed to the privacy complainant within 2 business days if the Notice is not given in person to the complainant. A complaint acknowledgement cover letter will be included when the Notice is mailed.

(e) The facility Privacy Officer is responsible for:

1. Investigating all complaints regarding facility privacy practices regardless of validity.

2. Cooperating with the VHA Privacy Office on all HHS-OCR complaints and all other privacy complaints submitted to VHACO, in addition to providing timely access to complaint investigation files.

3. Acknowledging receipt of the privacy complaint by providing IB 10-68 Notice to

Privacy Complainants in compliance with VHA Directive 1605.01.

4. Communicating with leadership, as appropriate (i.e., Director, VISN, VHA Privacy Office, Office of Inspector General, and Office of General Counsel).

5. Determining the validity of a complaint or incident and responding appropriately.

6. Responding, as soon as possible or no later than 60 calendar days, in writing to the complainant when the complaint does not result in an incident.

7. Appropriately entering and updating the privacy complaint/incident in PSETS.

8. Documenting outcomes of the investigation and providing findings to the supervisor in coordination with other stakeholders (e.g., Human Resources for sanctions or disciplinary actions, union representatives, department heads).

9. Mailing the response letter to the complainant’s address.

10. Maintaining an administrative file for all complaints by PSETS ticket number or by date regardless of validity.

11. Trending the types of privacy complaints identified and report these trends to the facility leadership bi-annually and to the VHA Privacy Office, upon request.

(f) Complaints Identified as Incidents: When the facility Privacy Officer determines during the investigation that a privacy complaint is a privacy incident, the PSETS ticket classification will promptly be changed from a complaint to an incident.

1. When a privacy complaint is made regarding access to a health record and the facility Privacy Officer cannot determine that the access is likely or not likely authorized, the access must be presumed to be unauthorized and will be reported as a privacy incident in PSETS.

2. All determinations as to whether a privacy incident warrants credit monitoring protection services, or a notification letter will be made by the VA Data Breach Resolution Service (DBRS) and the Data Breach Core Team (DBCT).

3. The DBRS and DBCT will notify the facility Privacy Officer in accordance with VA Handbook 6500.2, Appendix C.

4. When required, the HIPAA notification letter or credit monitoring letter will be mailed no later than 60 calendar days from when the incident was reported by the facility Privacy Officer.

(g) Administrative Record Keeping: A privacy complaint file containing all the documentation concerning the privacy complaint and investigation will be retained by the facility Privacy Officer in accordance with Record Control Schedule (RCS) 1006.19, Privacy Complaint File. The complaint file will contain the following:

1. Initial written complainant’s concern or a Report of Contact by the facility Privacy Officer, if the complaint is made orally;

2. Written documentation of all interviews or statements; and

3. All written correspondence, including e-mails from the complainant or staff.

(h) All complaints (privacy and/or security related) received by the facility from the

Department of Health and Human Services (HHS)-Office for Civil Rights (OCR) will be encrypted and forwarded immediately to the VHA Privacy Office mail group VHAPrivIssues@va.gov for appropriate processing. The facility does not have authority to respond to HHS-OCR complaints. However, the expectation is that the PO will respond timely to any questions that the VHA Privacy Office needs in order to respond to HHS OCR.

1. If an investigation arises as a result of an HHS-OCR complaint, this facility and its

Business Associates, if applicable, must permit the Secretary of HHS access to mailto:VHAPrivIssues@va.gov information, during normal business hours, after coordinating with the VHA Privacy Office.

2. When addressing complaints, the facility Privacy Officer should reference resources available on the VHA Privacy Officer Share point site.

https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pages/ComplaintTracking.aspx When Human Resources is contemplating employee disciplinary action, they should refer to VA Directive 5021 and VA Handbook 5021, Employee/Management Relations.

(i) The facility may not retaliate against a person for exercising rights provided by the

HIPAA Privacy Rule, for assisting in an investigation by HHS-OCR or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates these provisions.

(j) The facility may not require an individual to waive any right under these provisions as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.

(4) Reasonable Safeguards.

(a) All facility workforce members shall ensure that appropriate administrative, technical, and physical safeguards are used to maintain the security and confidentiality of III, including protected health information (PHI), and to protect against any anticipated threats or hazards to their security or integrity. The facility’s personnel shall make reasonable efforts to limit use of III to the minimum necessary to accomplish the intended purpose of any use, disclosure, or request. This does not pertain to the treatment provision under the HIPAA Privacy Rule.

(b) All personnel may access and use information contained in VHA records as required for their official duties related to treatment, payment, and health care operations purposes.

(c) When disclosing VHA information, all applicable laws and regulations are reviewed and applied to the request in order to assure utilization of the most stringent provisions for all uses and/or disclosures of data in order to provide the greatest rights to the individual and the minimum necessary of III. III disclosure is mandatory with a valid written authorization, but disclosure must be limited to only the information necessary to satisfy the purpose of the request.

(d) Disposal of Paper Documents: Staff disposes of paper documents that contain

III by placing the items in locked shred bins located throughout the facility. If office type shredders are used, they must be approved crosscut shredders that shred documents so they are unreadable and cannot be easily reconstructed. If a shred bin is full or nearly full staff must secure any documents that can be removed, advise staff to stop using the shred bin, and contact EMS to have the shred bin emptied. The contents of all shred bins are collected by an approved contractor and shredded on site in a locked contractor truck to reduce risk during transport to the pulping facility. The contingency https://vaww.vets.vaco.portal.va.gov/sites/privacy/vhapo/Pages/ComplaintTracking.aspx plan in the event shred bins are not emptied in a timely manner by the contractor, the facility will provide other lockable containers for staff to use and/or provide constant overwatch of all sensitive documents awaiting proper disposal/destruction.

(e) Disposal of Electronic Media: Electronic media storage devices (such as CD’s and portable thumb drives) containing III must not be placed in shred bins. These items will be destroyed by the shredding contractor. Staff will need to contact Environmental Management Services (EMS) for instructions on where or when to deliver the electronic media for destruction.

(f) Disposal of Non-paper Items: Non-paper items (i.e. I.V. bags, wristbands, prescription bottles, etc.) containing III are destroyed by placing IV bags and wristbands in shred bins. These items will be collected following the same process as paper documents. Pharmacy staff will turn in empty prescription bottles to the shredding contractor each week. Disposal of non-paper Items: Non-paper items (i.e. I.V. bags, wristbands, prescription bottles, etc.) containing Ill are destroyed by various means.

Wristbands and IV bag labels may be shredded or placed in a locking shred bins. The bags themselves may be discarded in accordance with appropriate bio-hazard procedures when necessary. The Individually Identifiable Information on the label is removed and shredded.

(g) Maintaining Auditory Privacy: Staff only discusses patient care issues in appropriate areas that allow for the maintenance of auditory privacy. Facility staff does not discuss patient information in areas not conducive to confidentiality (e.g., canteen, elevators, or hallways). Signs must be posted alerting Veterans to auditory privacy concerns in waiting areas. VHA health care providers and staff must refrain from discussing patient information within hearing range of anyone who is not on the patient's treatment team or anyone who does not have a need to know the specific patient information unless an emergent condition arises whereby auditory privacy cannot be maintained. Administrative staff should follow the same guidance in any discussion involving individually identifiable sensitive information, (e.g., employee health issues or disciplinary actions.) Appropriate safeguards include training all staff on auditory privacy to include:

1. Using the Veterans Health Identification Card (VHIC) for identification upon check-in, if available;

2. Speak quietly when discussing a patient’s condition with the patient or the patient’s family members in a public or open area or where the conversation can be overheard such as a waiting room or multi-patient room;

3. Only discussing the information necessary to accomplish the function (e.g. not asking for the full Social Security Number (SSN) when the last four of the SSN is sufficient);

4. Asking other Veterans in line for clinical check-in to wait a short distance away from the desk to allow a zone of audible privacy as opposed to being right behind the Veteran being assisted;

5. Only calling Veterans back to an exam room, pharmacy window or other treatment area by name; and

6. Going behind closed doors to have discussions pertaining to the personal information of the Veteran.

(h) Use of Facsimile (Fax): When using fax technology, facility staff adheres to VA

Handbook 6500, Risk Management Framework for VA Information Systems -Tier3: VA Information Security Program; VHA Handbook 1907.01, Health Information Management and Health Records; and VHA Directive 1605.01, Privacy and Release of Information.

(i) Electronic mail (e-mail) and information messaging applications and systems are used as outlined in VA policy (VA Directive 6301 and VA Handbook 6500). These types of messages never should contain III, unless the authentication mechanisms have been secured appropriately. Responding to a patient via email, which contains protected health information, should be done through My HealtheVet Secure Messaging.

(j) Mailing of Sensitive Information. Mailing of Veteran’s correspondences such as copies of records, appointment letters may be done so using the United States Postal Service. Envelopes, parcels, packaging or boxes containing sensitive information must be secured in a manner that prevents unauthorized access, tampering, or accidental loss of contents. Window envelopes must show the recipients’ names and addresses, but no other information. (See VA Directive 6609)

(k) To the extent practicable, this facility mitigates any harmful effect known to have resulted from an improper use or disclosure of III. Mitigation may include but is not limited to operational and procedural corrective measures; re-training, reprimanding, or disciplining workforce members; addressing problems with any involved Business Associates; incorporating the chosen mitigation solution(s) into facility procedures. All privacy complaints and/or incidents are reported to the Privacy Officer or Information System Security Officer(s) and immediate supervisor during regular business hours.

During off duty hours, staff will contact the Administrative Officer of the Day. The AOD will initiate the preliminary investigations concerning any event/incident and email vhaashprivacy@va.gov or contact the Privacy Officer.

(5) Sanctions.

(a) All individuals who use or have access to VA information systems or sensitive information must sign and adhere to the Rules of Behavior, which bind them to the legal and moral responsibility of preventing unauthorized disclosure. (See VA Handbook 6500, Information Security Program Appendix D) This facility has established sanctions, which are applied against members of its workforce as appropriate, for failures to comply with privacy policies and procedures and Rules of Behavior.

(b) The facility Privacy Officer will determine privacy violations and provide evidence thereof. The employee’s supervisor will determine appropriate actions and may, in conjunction with Human Resources Management, take necessary steps and apply appropriate sanctions for any employees who are non-compliant with privacy policies and procedures. Penalties may be assessed against any individual(s) who accesses, uses, discloses, or obtains information without the individual's written authorization or not authorized by law regardless of whether it was an intentional violation or not.

(c) Appropriate sanctions must be taken in accordance with VA Directive 5021.

b. Privacy Training and Education: The facility Privacy Officer will conduct privacy training at all facility New Employee Orientation (NEO) programs.

(1) Employees are responsible for annual completion of their mandatory privacy training requirements prior to or on their anniversary date of privacy training the following year. The facility Privacy Officer will develop a local training strategy in conjunction with the facility Education Coordinator or Education Office. This facility will make maximum use of the information contained within the Talent Management System (TMS). Employees, volunteers, students, contractors etc., receive notices periodically generated by TMS advising all when their training is due to expire. Reports are generated on a regular basis advising the Information System Security Officer (ISSO) and the Privacy Officer of those that are deficient in their training. Individuals whose training is deficient may have their computer access removed

(2) The facility Privacy Officer, in coordination with the facility Education Coordinator, TMS Coordinator or Education Office, shall maintain a process of compiling annual training records in order to report the facility privacy training completion status to the VHA Privacy Office and to the health care facility Director upon request. The Learning Resource Service generates reports on a regular basis so that training can be tracked by the Privacy Officer. The facility privacy officer prepares a monthly report entitled VISN 6 Privacy Facility Report that includes information concerning privacy training completed by members of the staff, volunteers, residents, contractors and students.

The information is converted into percentages and is measured against the VISN compliance standard which is 100%. At the beginning of the fiscal year a Privacy Training and Education plan is generated and reported to VISN on a quarterly basis.

(a) The annual training records of completion of privacy training must be kept for all workforce members to include the following; employees, volunteers, students, and contractors for reporting of facility privacy training completion numbers by each group.

(b) The facility Director will certify annual training completion to the VHA Privacy

Office for all work force members based on the reports generated by the health care facility Privacy Officer and Education Coordinator, TMS coordinator or Education Office upon request.

(3) The facility PO shall conduct other activities within the facility to enhance awareness of privacy and that have a positive impact on the overall privacy culture and posture of the facility. These activities shall include, but are not limited to, participation in VA’s annual Privacy Week activities, posting privacy posters and announcements throughout the facility, and conducting one-on-one training with personnel who have been observed displaying negative privacy culture behaviors.

c. Privacy Threshold Analysis.

(1) The Privacy Threshold Analysis (PTA) is an internal document used by the Privacy Officers, information system owners and the Information System Security Officers (ISSOs). Based on the information in the PTA, Privacy Impact Assessment (PIA) support determines if a PIA is required under the E-Government Act of 2002.

(2) PTAs identify programs and systems that are privacy-sensitive and contain PII.

PTAs create an annual record of major system changes and standardize the privacy compliance process. PTAs strengthen the understanding of VA systems, programs, and projects. PTAs are written so that individuals who don’t have a technical background can understand what’s being stated.

(3) PTA’s are to be completed and submitted to the VA Privacy Service PIA support mail group PIAsupport@va.gov on an annual basis unless there is a major change to an IT system prior to the annual review.

(4) The designated Area Privacy Officer will be responsible for initiating the PTA annually (PIA triennially) or when notified by the AM that there is a modification to the boundary in their areas and coordinating its completion with the respective facility and administration Privacy Officers and Information System Security Officers in their VA Area. Upon completion the designated Area Privacy Officer will submit the completed PTA/PIA for review, approval and publishing to the PIA Support Team (piasupport@va.gov).

d. Privacy Impact Assessment.

(1) Privacy Impact Assessments (PIA) outline the risks and effects of collecting, maintaining, and disseminating PII. They mitigate potential privacy risks by evaluating protections, such as security and privacy controls. They can also introduce alternative processes for handling information.

(2) PIAs help identify the overall privacy risk level of a system, program, or project.

PIA’s inform leadership, program offices, and Veterans about how VA is implementing privacy and mitigating risks associated with PII collection, use, and maintenance.

mailto:PIAsupport@va.gov

(3) PIA’s are to be completed and submitted to the VA Privacy Services PIA support mail group at PIAsupport@va.gov every three years unless there is a major change to the IT system prior to the three year period.

(4) PIA’s are to be completed and submitted to the VA Privacy Services PIA support mail group at PIAsupport@va.gov every three years unless there is a major change to the IT system prior to the three-year period.

(5) Six months prior to the expiration date of the current PIA, the Privacy Officer in coordination with, Information Technology, Information Security and the System Owners will complete a new PIA using all available tools. Upon completion of the PIA and prior to it being uploaded into the Governance Risk Compliance Database (GRC), it will be forwarded to the VA Privacy Service PIA support mail group for approval.

e. Personally Identifiable-Information Database Inventory.

(1) The facility Privacy Officer, in coordination with the facility Area Manager, ISSO, Records Manager and facility IT staff, shall maintain a process for identifying databases which collect or maintain PII/PHI.

(2) The PO ensures databases identified with PII/PHI are accounted for in existing PTA and PIA.

(3) If the databases identified are not accounted for, then the PO, in collaboration with the Area Manager and ISSO, updates the PTA and PIA documents accordingly.

(4) Database inventories are done on an annual basis.

(5) The Western North Carolina VA Health Care System conducts data base inventory reviews at least annually via CAVT-65 and provides updates to ESL groups about database updates as needed.

f. Individual Rights.

(1) Verification of Identity.

(a) In order to receive or view information from his or her VHA record, an individual must present staff with adequate information for verification of identity as outlined in VHA Directive 1605.01.

(b) A Veteran Health Identification Card (VHIC), passport, driver’s license, or employee identification card may be used to identify an individual who appears in person. Mail or fax identification requests may be verified by social security number, address, and signature comparison to the VHA record. Individuals may not verify identity by email.

mailto:PIAsupport@va.gov

(c) This facility shall recognize legally designated personal representatives as the individual when the individual is unavailable or unable to act on his/her own behalf.

Staff should recognize the following representatives of the individual:

1. Legal Guardian.

2. Power of Attorney (POA): All POA’s are to be referred to the Privacy Officer, ROI

Supervisor, or HIMS Chief determination that the POA meets the legal requirements for making disclosure decisions.

NOTE: Regardless of the type or source of the POA presented, the reviewer must always carefully check the document with General and Special Powers of Attorney. The document must be: in writing; signed by the individual giving the power; dated; notarized and signed by a licensed notary public; and specifically designate, by name, the third party agent, which may be an organization or entity, to act on behalf of the individual.

3. A personal representative of a deceased individual is a person, who under applicable law, has authority to act on behalf of the deceased individual as outlined by VHA Directive 1605.01.

(2) Notice of Privacy Practices.

(a) An individual will be provided with a copy of IB 10-163, Notice of Privacy Practices, by this facility upon verbal or written request.

(b) An individual may obtain a copy of IB 10-163, Notice of Privacy Practices (NOPP), from any VHA staff member or by contacting the facility Privacy Office. A copy of the NOPP is also available from the Privacy Officer and on the facility’s W:Drive>Privacy Public folder. Staff may also access a copy at:

https://vaww.va.gov/vhapublications/

1. All non-Veteran patients seen at the facility will be provided a copy of IB10-164, VHA Notice of Privacy Practices as required by VHA Handbook 1605.04.

2. A Non-Veteran who receives care and treatment at a facility whether for humanitarian purposes or enrolled in a VA research study will be given a copy of the Notice of Privacy Practices from and sign the acknowledgement form by the Admissions Clerk or the Administrative Officer of the Day. The Admissions Clerk or AOD will then forward the signed acknowledgement form to the Privacy Officer. To obtain a copy of the acknowledgement form (10-0483) use this link:

https://vaww.va.gov/vaforms/medical/pdf.vha-10-0483-fill.pdf.

3. In an Employee Health situation, an Employee Health staff member will maintain a copy of the acknowledgment form in a binder or in the blue employee health folder.

https://vaww.va.gov/vhapublications/ https://vaww.va.gov/vaforms/medical/pdf.vha-10-0483-fill.pdf

4. The Privacy Officer monitors Notices of Privacy Practice quarterly and when necessary, provides education to the admission clerks, AOD, and/or Occupational…