Because we are human, it is easy to forget HIPAA rules. We all need reminders and training. Direct Care Workers are valued members of the team who have meaningful interactions with clients daily. The Agency will ensure all members of its workforce comply with the security policies of the agency as well as state and federal regulations regarding PHI as per HIPAA guidelines.

Protecting the privacy of clients should always be in the minds of Direct Care Workers as they perform their duties. Direct Care Workers also need to think about HIPAA when they are off duty as situations can occur where they might break the rules innocently.

Privacy is the most important element of HIPAA for Direct Care Workers. Direct Care Workers protect client privacy by knowing the HIPAA rules, applying them, and reporting any suspicions that the rules have been broken.

The Health Insurance Portability and Accountability Act (HIPAA) was passed by Congress and signed by President Bill Clinton in 1996. HIPAA is a large document containing many Federal privacy rules. These Federal privacy rules assure that client privacy is protected. Further, the rules safeguard an individual's personal health information in both written and electronic form.

Agencies where Direct Care Workers are employed are considered covered entities. All covered entities are required to see that their workforce follows HIPAA rules. If the rules are not followed, an employer can be punished with fines or other penalties.

Here are two examples of HIPAA rules that all Direct Care Workers need to know.

1. Direct Care Workers can only read the charts of clients if they need to know some information, and their agency allows them to read charts.
2. Direct Care Workers cannot tell others about their clients. They cannot share stories at home, even if they do not tell the client's name.

PHI stands for Protected Health Information. The HIPAA Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes.

Electronic protected health information (ePHI) is any individually identifiable health information that is created, saved, transferred, or received in an electronic format. Healthcare organizations and medical professionals collect and store ePHI to identify patients and determine their care needs. Examples of ePHI include Name, Phone number, Social Security number (SSN), Email, Date of birth, medical records, financial information, Employer information, and Photos.

Examples of PHI (Protected Health Information) and ePHI (Electronic Protected Health Information)

• Client names
• Client addresses
• Dates — Including birth and death dates
• Telephone and fax numbers
• Email addresses
• Social Security numbers
• Driver's license
• Medical record numbers
• Account numbers
• Insurance plan beneficiary numbers
• Medicare numbers

• Medicare bills
• Appointment calendars
• Vehicle identifiers, including license plate numbers
• Medical device identifiers and serial numbers
• Names of relatives
• Internet Protocol (IP) address numbers
• Finger and voiceprints
• Full face photos
• Blood test results
• MRI results

1. DO NOT talk about clients at work in elevators or cafeterias.

2. DO NOT talk about clients in public places.

3. DO NOT read the charts or care plans of any clients unless you are assigned to that client and need to read it to care for the client.

4. DO NOT read the charts of your relatives or friends.

5. DO NOT dispose of or destroy any shift or client notes.

6. DO NOT share any passwords for electronic systems or methods to document client service provided.

7. DO NOT post about clients on social media.

8. Report others who post about clients to your supervisor, privacy officer, or the Office of Civil Rights.

9. Report any suspicions of HIPAA rule-breaking to your supervisor or the facility Privacy Officer or the Office of Civil Rights.

10. DO NOT discuss any clients with their friends or neighbors.

11. DO NOT talk about one client while you are providing care for another client.

12. DCWs must keep client information secure and private.

13. DCWs should not talk to one client about PHI within the hearing range of another client.

14. DCWs should not discuss their clients with team members not directly involved in the clients' care.

15. DCWs who take care of clients in their homes for private pay must follow HIPAA rules.

I have read and understand this HIPAA Confidentiality and Protected Health Information (PHI) Agreement. I agree to comply with all confidentiality, privacy, and HIPAA requirements as a condition of my employment or association with Medallion Home Care of DE LLC. I understand that failure to comply may result in disciplinary action, up to and including termination.