health insurance portability and accountability act.pptx

about regulatory affairs

1. HIPAA- New requirements for clinical study process Presented by- Amartya Nandi M.Pharm (Pharmaceutics) Reg No – 2023001515

2. Introduction HIPAA was in 1996 with two objectives. The first part "Health Insurance Portability part of the Act" To ensure that individuals would be able to maintain their health insurance between jobs. The second part of the Act is the "Accountability" portion. To ensure the security and confidentiality of patient information/data and mandates uniform standards for electronic data transmission of administrative and financial data relating to patient health information. The privacy of health information becomes an important concern for all intuitions delivering healthcare. The shift toward interoperable electronic health record leads patients to worried about their information privacy and losing of control over their data. The healthcare providers need to ensure effective level of privacy and security policies that safeguard the patient's rights.

3. The health records need to be under strict control. There is need to implement a global standard of handling patient data and such standards for electronic transfer of the medical information. Also need some guidelines to control the patient records both written and oral. The first and most considerable Federal legislation on health privacy and security is the Health Insurance Portability and Accountability Act known as the HIPAA

4. Goal of HIPAA To make law easier for people to keep health insurance Protect the confidentiality and security of health care information. Help healthcare industry to control Administrative cost. HIPAA consist of Standardized Electronic Data Interchange transactions and codes for all covered entities. Standards for security of data systems. Privacy protections for individual health information. Standard national identifiers for health care.

5. HIPAA Patient Rights HIPAA guarantees several rights to patients: Right to privacy Right to confidential use of their health information for their treatment, billing process, and other health care operations (such as quality improvement) Right to access and amend their health information upon request Right to provide specific authorization for use of their health information other than for treatment, billing and other health care operations. Right to have their name withheld from our patient directories To request that individuals are not told of their presence in our facilities

6. Requirements informed consent the HIPAA authorisation can be included with informed consent document or can be separated form the informed consent .see PHI authorisation page. Must contain a specific description of the information to be disclosed including Name of the person or class of person that will receive the disclosed information e.g principal investigator Statement that information received by the users may be used for future. Expiration date or expiration event when authorities may disclose the information. Statement containing a subject's right to revoke their authorization for discloser. Statement containing a subject's right to revoke their authorization for discloser. Statement documenting the ability to condition enrollment on informed consent. Statement documenting the possibility that the information may be re disclosed by recipient ( eg. To the FDA).

7. Institutional Review Boards Where HIPAA requirements are combined with the informed consent requirements, the entire document needs to be reviewed by the Institutional Review Board (IRB). The Office of Civil Rights as well as the FDA's General Counsel, had confirmed that IRB approval of subject authorization for use or disclosure of protected health information required by the HIPPA privacy rule is only required if the authorization language is to be part of the IRB-approved informed consent document for human subjects review. Privacy Boards In cases where IRBs are not responsible for reviewing, the HIPAA Authorization Privacy Board may be formed to undertake this task. Members of privacy boards should have varying backgrounds and appropriate professional Competence. At least one member must not be affiliated with the covered entity or research sponsor. As with the IRB, there must be no conflicts of interest on a case-by-case basis. A quorum consists of a majority of members.

8. Study Recruitment The covered entity's workforce can use protected health information to identify and contact prospective research subjects. The covered entity's health care provider can discuss the enrollment in a clinical trial with a potential subject before authorization is completed or there has been an Institutional Review Board or Privacy Board waiver of authorization. A clinician may use or disclose the PHI if such information is being used to treat the subject or using an experimental treatment that may benefit a subject. Privacy Waivers of Authorization Three criteria must be met for the IRB or Privacy Board to waive authorization for research: The use or disclosure of protected health information involves no more than a minimal risk to the privacy of the individual. The research could not practicably be done without the waiver. The research could not practicably be conducted without access to and use of the protected health information (PHI). The research will not adversely affect privacy rights or welfare. The privacy risks are reasonable in relation to anticipated benefits and the importance of the knowledge of the clinical results.

9. HIPAA Overview The Privacy Rule governs who has access to protected health information (PHI). The Security Rule specifies a series of administrative, technical and physical security procedures to assure the confidentiality, integrity and availability of ePHI. The American Recovery and Reinvestment Act (ARRA) goal is to establish secure electronic health records for all Americans by 2014 The Health Information Technology for Economic and Clinical Health Act (HITECH)

10. Protected Health Information (PHI) HIPAA protects all patient information whether it is verbal, written or electronic. It includes all individually identifiable health information that is transmitted or maintained in any form or medium. It includes demographic information that ties the identity of the individual to his or her health record. E.g. names, addresses, geographic codes smaller than state, all dates (except year) elements related to the person, telephone numbers, fax numbers, license numbers, social security numbers, etc.

11. HIPAA Privacy Rule Make sure that the policies are applied in a manner that ensures proper protection of data and not leaving room for mistakes. HIPAA set the rules of medical care in how to govern and use the PHI for handling patient issues. The health care institutions are charged with the role of informing the patients and getting permission for disclosing their personal data. Written permission is vital, and it accords them the right to access their medical data. Staff and students are free to communicate as required for quick, effective, and high-quality health care. The Privacy Rule also recognizes that overheard communications may be unavoidable and allows for these incidental disclosures.

12. HIPAA Security Rule Defines general standards and implementation requirements to protect electronic personal health information (ePHI), which is preserved by covered entity. Provides appropriate controls such as administrative, physical, technical and Policies, procedures and documentation requirements in order to guarantee the confidentiality, integrity, and availability of ePHI.

13. Administrative Requirements Business Associates Overview A Business Associate is a person or entity to whom an agency discloses PHI so that the person or entity may carry out, assist with, or perform a function on behalf of the agency (e.g., billing). The agency is required to have "satisfactory assurance" that any business associate will "appropriately safeguard" PHI received or created by the business associate in the course of performing services for the agency. The agency must document the satisfactory assurances through a written contract. The business associate provision does not apply to providers who receive information for treatment purposes.

14. Physical safeguards These are physical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. Technical Safeguards The technology and related policies and procedures that protect ePHI and control access to it. The Technical Safeguards standards apply to all ePHI. The Rule requires a covered entity to comply with the Technical Safeguards standards and provides the flexibility to covered entities to determine which technical security measures will be implemented.

15. HITECH and ARRA Rules HITECH - is designed to encourage health care providers to adopt health information technology in a standardized manner and to protect private health information. ARRA - is the direct result of modifications in the HIPAA Privacy, Security and Enforcement Rules and strengthens health information privacy and security protections. ARRA specifically addresses: Breaches Electronic Health Records (EHR) Personal Health Records (PHR)

16. Challenges of HIPAA Understanding and Interpretation: It might be difficult to comprehend and interpret the intricate requirements of the HIPAA standards. It is essential to trained and knowledgeable of the laws and regulations. Technological Difficulties : Securing electronic protected health information (ePHI) presents difficulties dependent on technology. implementing and preserving encryption techniques, safe information systems, and data integrity. Employee Education and Awareness : A major contributing element to data breaches is human mistake. It is essential to make sure that every employee has received the necessary training on HIPAA standards and understands the significance of protecting patient information. Vendor management : Third-party vendors, sometimes known as business partners, are frequently employed by healthcare organisations and may have access to patient data

17. THANK YOU