HIPAA Privacy and Security Requirements  

7.1 CONFIDENTIAL PATIENT/EMPLOYEE MEDICAL INFORMATION  

Each Employee must be fully aware of the highly personal, intimate and completely confidential nature of  the health care services delivered by SCFHC. All medical records, including but not limited to, the records of  all patients and Employees, are under protection of state and federal laws and are not to be disclosed  without specific written authorization as set forth herein. No Employee may divulge any patient’s medical  information, Employee’s Medical information or any other confidential information to anyone or any entity  without the written release and authorization of the patient and/or Employee, or his/her legal  representative. Any violation of this policy will subject an Employee to disciplinary action, as well as  potential legal liability. 

Protected Health Information (PHI) as defined in the Health Insurance Portability and Accountability Act of  1996 (HIPAA), as amended, including medical information regarding patients and employees is confidential.  You are not permitted, unless otherwise authorized, to release written or verbal PHI.  

Employees are prohibited from creating, receiving, or storing any PHI, including photographs of patients  (regardless of whether the patient’s face is in the photograph), on a personal device, such as a cell phone,  smartphone, tablet, laptop, or home computer. Employees are prohibited from including PHI in the body of  any text message or as an attachment to a text message, regardless of whether the text message is  transmitted using a personal or Company-issued device. Employees may transmit PHI by Company e-mail  using a Company-issued device only if the e-mail and/or attachment containing the PHI is password  protected and otherwise complies with HIPAA and any other pertinent state or federal laws. For any  questions regarding compliance with the law, employees should contact management.  

Employees who improperly use or disclose PHI will be subject to disciplinary action, up to and including  termination of employment.  

The Five Most Important Things That You Can Do To Protect The Privacy of Patient Information Are: 1. Store patient information securely.  

If you have patient information on your desk or at your work area, it should be stored so that  unauthorized people cannot just casually read it. This may require nothing more than keeping patient  information in folders, placing communications of test results face down, and making sure that all  patient information is stored where it belongs when you leave the office at the end of the day. 

2. Discuss patient information in private. 

If you are going to be discussing a patient, you should move to a location where you won’t be overheard  by other patients, by visitors to the office, or even by co-workers who are not really involved in the  patient’s care. 

3. Avoid unnecessary discussion of patient information. 

The only time that patients should be the topic of conversation is when the patient’s information is  being used for an approved purpose. You can use information for treatment, payment and health care  operations — but need to make sure that you are only using and sharing the minimum information  needed to accomplish a given task.

4.Review restrictions on disclosure and communications.  

When disclosing information, make sure the patient has not requested and been granted restrictions on  the people with whom you can share his/her medical information. Also, make sure that the disclosure  does not require the patient’s authorization. If it does, make sure the patient has authorized the  disclosure. 

Confirm the credentials of recipients before disclosing protected health information.  

We must be sure we know to whom we are speaking or handing over protected health information. If  you are unsure, ask them for additional information that can authenticate their identity, or ask for photo  ID.