Ethical Leadership In Health Care

US Congress created the Hipaa bill in 1996 because of public concern of how their private information was being used. It is the Health Insurance Portability and Accountability Act, which Congress created to protect confidentiality, privacy and security of patient information. It was also for health care documents to be passed electronically. Hipaa is a privacy rule, which gives patients control over their health information. Patients have to give permission any healthcare provider can disclose any information placed in the individual’s medical records. It helps limit protected health information (PHI) to minimize the chance of inappropriate disclosure. It establishes national-level standards that healthcare providers must comply with and strictly investigates compliance related issues while holding violators to civil or criminal penalties if they violate the privacy of a person’s PHI. Hipaa also has boundaries for using and disclosing health records by covered entities; a healthcare provider, health plan, and healthcare clearinghouse. It also supports the cause of disclosing PHI without a person’s consent for individual healthcare needs, public benefit and national interests. The portability part of Hipaa guarantees patients health insurance to employees after losing a job, making sure health insurance providers can’t discriminate against people because of health status or pre-existing condition, and keeps their files safe while being sent electronically. The Privacy

The penalties for violating the rules dictating by HIPAA are complicated because the guidelines are still very broad and the rules are still so new that with each case new standards are being set as to the way violations are being handled. Violation of HIPAA rules can result in civil and criminal consequences. There is case that marked history as the first health care organization to be fined for a HIPAA violation. Cignet Health in Maryland was fined $4.3 million for two violations: failure to provide patients a copy of their medical records within 60 days of a request and failure to cooperate with civil investigators. “HIPAA calls for civil and criminal penalties for privacy and security violations, including: -- fines up to $25K for multiple violations of the same standard in a calendar year -

In the health care business, there are certain standards and laws that have been put in place to protect our patients and their personal health information. When a health care facility fails to protect their patient’s confidential information, the US Government may get involved and facilities may be forced to pay huge sums of money in fines, and risk damaging their reputation.

Under the HIPAA compliance audit program if a healthcare organization has attested and is later audited and found not to be compliant with HIPAA, the organization could face penalties including giving back the meaningful use incentive money. (Goedert, 2013) provided the following ways to ensure compliance: conduct mock audits, make sure all data within the organization is encrypted, computer access is logged, network security gaps have been filled, policies and regulations have been updated and expanded, and most importantly that all staff complete annual HIPAA training courses with emphasis on privacy and security.

The main goal of HIPAA is to protect unauthorized access and misuse of confidential health information. It allows for the safe storage of any health facts used, collected, transmitted or maintained by any health organization. It states that all health information about a particular client is completely confidential, regardless of what the format is and whether it is transmitted, maintained or collected. Protected information is that health information that already identifies the patient or could be used in order to identify the patient; it also relates to any of the patient’s past, present or future health conditions, any treatment the patient receives and any payment the patient makes toward their care.

HIPAA and HITECH Act help address several problems associated with inappropriate use of healthcare information by authorized users. HIPAA requires minimum necessary infor-mation to be released while HITECH goes into a little further detail but still to release minimum necessary information. Several different organizations need to define how they go about han-dling inappropriate use of information. A guideline must be set within the organization on who will have access to the information and how it is disbursed to other healthcare organizations re-questing records.

In 2009 the American Recovery and Reinvestment Act established a civil penalty structure for HIPAA. If the individual did not know that they were violating HIPAA, the penalty would be $100 per violation, including a maximum $ 25,000 per repeat violations. The maximum penalty for violating HIPPA unintentionally is $50,000 with

6. A breach of confidentiality can result in what consequences for a health care professional? The penalties for violating HIPAA range from civil penalties of up to $100 per person per incident for minor improper disclosures of health information, and up to $25,000 for multiple violations of the same standard in a calendar year. Federal criminal liability for improper disclosure of information or for obtaining information under false pretenses carries sanctions (fines) of $50,000 and one year in prison. The liability for obtaining protected health information under false pretenses with the intent to sell, transfer, or use the information for personal gain or for a malicious action, such as Medicare fraud, carries penalties of $250,000 and/or up to ten years in prison. Severe penalties are in effect if lax security allows health information to be stolen. There is also a risk of a class action suit as well as public relations damage to the institution’s or physician’s image.

If Kaiser Permanente did not take steps to quickly resolve the issues within the group and organization they might face a HIPAA violation. HIPAA Violators can be sentenced for up to 10 years in prison and fined up to $250,000 in criminal penalties for failure to comply. In addition, civil penalties can be imposed that include $100 per violation and up to $25,000 per person, per year for each violation (DMA.org, 2002).

Ten years ago after much challenges and questionable skepticism, the HIPAA policy became effective and has been shaping healthcare one regulatory policy at a time. The evolution of the HIPAA privacy act helped establish the HIPAA Security Rule which was published in 2003 and became effective in 2005, and then eventually led to the HIPAA Enforcement Rules and the Breach Notification Rule. With it joint fortification of the 2009 HITECH Act and HIPAA’s modifications to regulations, it was released in January 2013 to the industry (American Health Information Management Association, 2013).

Release or not to release is the question in today’s healthcare? Being a patient, and going to a doctor’s appointment has really changed versus how it was years ago. Most of us as patients know that we have a right to our own health information, but how is this beneficial to us as patients and healthcare providers? As healthcare is increasingly becoming complex what are ways to enforce these policies and rules? HIPAA rules and standards will need to be the same in each state so there is interoperability the proper way, but will we be able to really accomplish this? This paper will discuss these aspects and ways to overcome these obstacles that are occurring.

Working in the health care environment the world needs effective, wise and visionary leaders, leadership matters in every organisation to change the health care environment so it may continue to grow to ensure it gives us better evidence based practice (Evans & M.L, 2015, p 34-50). All health care professionals are required at some point in their position to engage in management or leadership. As an AIN, EN or RN they all have a responsibility to educate, lead and manage within the health care profession (Innis & Berta, 2016, p.2-22). This allows each individual to develop useful and excellent leadership skills and management strategies to be able to educate and lead an exceptional team (Innis & Berta, 2016, p. 2-22). Although our greatest

"HIPAA doesn?t necessarily prescribe the solutions, but it does require physicians to look at all of the ways that they use and access data today and determine whether that?s reasonable or not." to help you begin your HIPAA compliance process, following are some practical ideas for rethinking how you maintain and use patient information in your office. Appoint one or two staff members (depending on the size of your office) to review the HIPAA act, determine the changes your practice needs to make, and decide if you?ll need outside help. To keep this project manageable, do not wait until the last minute. Remember: most of the healthcare industry will have to be HIPAA compliant by April 14, 2003. Furthermore, compliance is not optional. Those found in violation of the act will be penalized: "Civil penalties range up to $25,000 per violation of each standard. Criminal penalties range up to $250,000 in fines and/or up to 10 years in prison."3

3.) Under HIPAA, covered entities (healthcare providers, health plans and healthcare clearinghouse) must comply with the privacy rules. A covered entity may develop its own privacy rules that would accommodate its own needs of protected health information (PHI) management but it most comply with the HIPAA guidelines. It is the responsibility of the entity to put in place a privacy official to oversee the policies, procedures and be on hand and available to be contacted in reference to the privacy rule. A patient should be given a privacy notice act at his/her health facility stating how their (PHI) is being used and to whom it will be shared. The covered entity should include in the notice their duty to assure the patients privacy as well as how and whom to contact if there is a complaint or they feel that their rights have been violated. As of 2009 the Office of Civil Rights (OCR) handles complaints that are made on privacy policies, procedure and practices of HIPAA covered entities.

Discipline and Mitigation. Employees or volunteers who violate the requirements of HIPAA or other laws and regulations regarding confidentiality of health care information shall be disciplined in accordance with the disciplinary policies of (Organization), but no retaliation shall be taken against any individual for exercising rights provided by the privacy regulations as provided by 45 CFR 164.530(g). (Organization) shall mitigate any improper disclosure of PHI to the extent practicable as provided 45 CFR 164.530(f).