2011 Health Information Portability and Accountability Act of 1996

Georgia State Seal

Georgia Division of Family and Children Services
Medicaid Policy Manual

Policy Title:

Health Information Portability and Accountability Act of 1996

Effective Date:

December 2019

Chapter:

2000

Policy Number:

2011

Previous Policy Number(s):

MT 37

Updated or Reviewed in MT:

MT-57

Requirements

DFCS is required to comply with the Health Information Portability and Accountability Act (HIPAA) of 1996, including its rules regarding security and privacy of confidential health information.

Basic Considerations

HIPAA was enacted by Congress to provide group and individual insurance reform, introduce tax-related health care provisions, control healthcare fraud and abuse, and to ensure improvement in healthcare systems.

Covered Entity Status

The Georgia Department of Human Services (DHS) has chosen Covered Entity status to promote simplification of information sharing within the Department.

Who Must Comply

This policy applies to all individuals who are Georgia Department of Human Services (DHS) employees, volunteers, trainees, and contractors who perform duties in conjunction with the access, distribution, dissemination, modification, and management of protected health information.

DHS administers programs and provides services that have more stringent requirements than those provided by the Privacy Rule. In the administration of such programs and provision of such services, the Department will adhere to the more stringent requirements.

Privacy Rule

The Privacy Rule, effective April 14, 2003, ensures privacy protection by limiting the ways that Protected Health Information (PHI) can be used and released.

Notice of Privacy Practices

Each adult AU/BG member and, if applicable, each PR must be provided with a Notice of Privacy Practices upon receipt of an application for assistance, or when he/she is added to an existing AU/BG. This includes instances in which an A/R is currently receiving benefits in another program, such as food stamps, and applies for Medicaid. The notice must be mailed to each adult who is not present for a face-to-face interview. It is preferable, but not required, that each adult sign and return his/her notice, however the case record must be documented that the notice(s) was sent.

Personally Identifiable Information (PHI)

PHI is individually identifiable health information. Examples of PHI include, but are not limited to the following:

  • demographic information, such as name, age, gender

  • health status information

  • prescription drug information

  • healthcare payment information

  • prior existing conditions

  • eligibility information

  • authorization and referral certifications PHI may be in electronic, paper-based, or oral form.

Minimum Necessary

Covered entities may use and share only the minimum amount of protected information necessary to accomplish a particular purpose.

DHS is responsible for determining the amount of PHI required per function. Upon determination of minimum necessary PHI, DHS will communicate this decision to all affected parties.

Use and Disclosure

The Privacy Rule prohibits the use and disclosure of PHI for purposes not related to treatment, payment, or health care operations. The identity of a person requesting PHI and his/her authority to receive such information must be verified prior to release of PHI. Computer matches are accessed via system terminals or through personal computers connected to the system.

As a covered entity, DHS is permitted, but not required, to use and disclose PHI, without an individual’s authorization in certain situations and for specific purposes.

The following uses and disclosures do not require authorization from the individual:

  • treatment, payment, and health care operations (TPO)

  • public health agencies activities

  • health oversight and regulatory agency activities

  • judicial proceedings and law enforcement investigations

  • healthcare fraud investigations

  • emergency situations

  • de-identified information (health information not connected with information identifying the individual)

The following uses and disclosures do require authorization from the individual:

  • third party disclosures

  • marketing and fund raising activities

  • non-health related affiliates

  • underwriting or related affiliates

  • employment determinations

  • sale, rental or barter of PHI

  • psychotherapy records other than psychotherapy notes

Form 5459

Prior to the release of PHI that requires authorization, the A/R must complete and sign DHS Form 5459 (rev. 07/2016), Authorization for Release of Information.

Signed, blank Forms 5459 are not permissible and may not be obtained or used for any purpose. Form 5459 may be used to release or obtain information only if the A/R or PR has specified on the Form 5459 to whom information is to be released or from whom information is to be obtained. At the point the A/R signs Form 5459 it must be dated. Form 5459 should be used within 30 days from the date it is signed.

Administrative Requirements

DHS will maintain compliance with HIPAA Privacy Rule administrative requirements including, but not limited to:

  • designation of a privacy officer who is responsible for the development, implementation and maintenance of privacy policies and procedures

  • development, implementation, and documentation of timely and effective privacy training

  • development, maintenance, and enforcement of complaint procedures

  • enforcement of appropriate sanctions for failure to comply with HIPAA regulations

Security Rule

The HIPAA Security Rule ensures the security of PHI by specifying how PHI is stored, transmitted, and accessed.

PHI Safeguarding Practices

Guidelines for safeguarding PHI include, but not limited to:

  • PHI will be discussed with the A/R or PR only in private areas

  • PHI will be discussed with staff members on a need-to-know basis and in non-public areas only

  • telephone calls regarding PHI will be held in areas in which the conversation cannot be overheard

  • computer monitors will be positioned in a way that does not permit observation by anyone other than the A/R or PR

  • computer passwords will not be shared and will be recorded only in secure locations

  • PHI will be disclosed only by those staff members authorized to do so

  • access to fax machines will be limited to authorized staff

  • case records, mail, documentation, and other materials containing PHI will be maintained in locked or otherwise secure locations, away from the general public

  • staff members will wear appropriate agency-issued identification at all times

  • PHI will be discarded in appropriate secure containers.