Committee Meetings and Minutes

Administrative Login

HIPAA Task Force Committee

Meeting Minutes

Current Status of Minutes: Final
Date	November 7, 2013
Time	11:45 AM - 1:30 PM
Location	EVC, Bldg. 8000, Room 8356

Members Present
Azure Brown, Renee Cornett, Security Officer, Ross Greves, Eileen Klein, Ginger Locke-Floyd, Renee Miller, Kellie Murphree, Marilyn Rehm-Skewis, Support Staff, Robyn Richter, Regina Swearengin, Nancy Walters, Privacy Officer, Nocomus (Noko) Wilson
Guests Present
No guest attendance has been recorded.

Item # 1:	Patricia Recek
Presenter
Discussion	Discussion: Request by P. Recek to add the topic "Mobile Devices" to the agenda under the topic Old Business Decision/Action: Gina Swearengin made a motion to accept the agenda as revised. Renee Cornett seconded the motion. Agenda was approved by committee.

Item # 2:	Patricia Recek
Presenter
Discussion	Discussion: Pat Recek gave an overview on how to find the minutes on the ACC web site. A hard copy of minutes from the March 28th meeting was passed around for new members to review. Decision/Action: Minutes were shared on Google Drive and hard copy available for review at meeting. Renee Cornett made a motion to approve the minutes. Mr. Noko Wilson second the motion and the minutes were approved by the committee members. Follow-up Items: None Person Responsible: Deadline:

Item # 3:	Patricia Recek
Presenter
Discussion	Discussion: o New members were welcomed o New members were encouraged to review the HIPAA website www.austincc.edu/hipaa and to take the HIPAA training module. o Overview of the HIPAA Committee, meeting schedule and the committee member's responsibilities provided. o Various ACC web sites for HIPAA were discussed including the Committee Meetings and Minutes Repository http://www3.austincc.edu/it/meetingminutes/ o Review of the HIPAA components provided. Decision/Action: None Follow-up Items: None Person Responsible: Deadline:

Item # 4:	Patricia Recek
Presenter
Discussion	Discussion: o R. Cornett, Dental Hygiene (covered entity). Provided overview of how students document patient care. Student documents patient progress on a generic form. The information then goes into Eagle Soft. EagleSoft is password protected with access by faculty. The student retains access to the account after they leave the program so that their background and skills can be reviewed by employment. The collected data may be used for research and each student has an option to have their data used or not used. Data in report is not specific and would not breach HIPAA. o ACC has signed a Business Associate Agreement with Appointment Plus which is an online appointment scheduling system. o P. Recek continues to explore the need for ACC to generate a BAA with FISDAP for the EMSP Program and Medical Digital Imaging (Sonography) o Robyn Richter provided overview of how EMSP students use FISDAP Students are required to purchase access to FISDAP which allows for scheduling and data tracking. Students schedule their clinical on-line based on availability. The schedule will have date, times of clinical, and clinical site. This is the only place in the process where an actual clinical site is linked to a date and time. Once the student completes a clinical, they go to their schedule on FISDAP, open that clinical rotation, and enter skills performed and patient contact information (age, but not name). This includes some minimal patient data which we are required to track for accreditation purposes and skills. (see Table B below) There is an open text box at this point in which students can enter additional data. Once the data is entered, it is utilized to generate reports accessible to students to create a portfolio or for faculty to see individual student performance or to track overall class/ program information. The data contains no patient information, nor is it site or date specific. Students have access only to their individual accounts and designated faculty has access. FISDAP staff does have access to all accounts. FISDAP may generate aggregated data for research purposes. Copy of a report that might be generated provided by R. Richter (attached to minutes). Gina Swearingen provided an overview of how Sonography students use MDI Students perform scans on volunteers or each other at on campus laboratories. The images are archived in the PACs system for review by the student/s and faculty. Images are assigned a unique identifier number and should not have a name assigned to the image although there have been instances when a name has been entered. Student do also scan each other and are able to view all of those images. The company does have access to the images and also provides technical support. o Eileen Klein led a discussion on items that involve the SONO students: 1. Consequences of students using real names on images and also when they are the patient 2. How a case study is viewed in class. 3. The system's ability to tract who logged in and what case study they review. 4. What HIPAA procedures are in place in an open lab when each student sees each other's scans? 5. Student waiver. Decision/Action: Legal review of need to BAA with FISDAP and MDI Follow-up Items: Final Business Associate Agreement Person Responsible: Pat Recek Deadline: As soon as possible

Item # 5:	Patricia Recek
Presenter
Discussion	Discussion: o Health Sciences has a policy on use of Mobile Devices and storing PHI. There is no specific policy on securing those devices. o DHY confirms that students do enter phone numbers of the student's patients into mobile phones so if appointment cancellation is necessary when off campus (ie. Weather) students can contact patients. o Student Representative Renee Miller described how she uses her phone or laptop to contact patients in order to confirm appointments or for rescheduling. o Ms. Recek asked the committee for approval to include the HealthIT.gov link on the HIPAA HIPAA web page. Eileen Klein suggested the placement to be first reviewed and approved by the Information Technology Support Service Director. Committee agreed to move forward with IT approval and if approved to post site. Decision/Action: 1. Continue to explore need for more definitive policy on securing portable devices. Follow-up Items: Check with Teresa Harkins to receive approval to reference link to HealthIT.gov on the ACC HIPAA web page. Person Responsible : Pat Recek Follow-up Item: Review mobile devices for password protection and patient information on student equipment. Person Responsible: Renee Cornett Deadline: Ongoing

Item # 6:	Patricia Recek
Presenter
Discussion	Discussion: The Implementation of the Final Rule requires additions to the Privacy Practices Notice required by covered entities. The OCR provides a "Model Privacy Practices" that can be used as a template by the covered entity to ensure that all required components area included. o The current information was developed by the ACC legal department in 2005 with the initial implementation of the HIPAA law. . o The template allows the agency to include some exclusion to the items in the Model. Drafts of the two PP were reviewed by the committee. DCs for each covered entity are asked to provide input and then the final version will be used by the program o The Privacy Practices must be available on the website as well as onsite. Covered entities can determine the exact process for ensuring patients have access and sign an acknowledgment. o Discussion included ensuring that the document was accessible to meet ADA requirements. P. Recek has reviewed options with S. Christopher. o R. Cornett discussed moving to electronic data and away from paper. Decision/Action: None Follow-up Item: Review "Notice of Privacy Practices" handouts. Pat will review with the two Department Chair for use or develop update with current information. Person Responsible: Patricia Recek, Renee Cornett, Alex Matthews Deadline: As soon as possible.

Item # 7:	Patricia Recek
Presenter
Discussion	Discussion: The compliance review was explained to the new members. Ms. Recek asked for members to volunteer to review one of 23 programs on the list. An explanation of the process of setting up the time to review the programs web site, hand book, HIPAA documentation forms and department procedures were discussed. She also reminded that the training for the staff and the student's documentation had to be checked and maintained for six (6) years. The HIPAA and Privacy Compliance Review Business Associate/Other Non-Covered Entity form was enclosed in the packet of handouts. Ms. Recek asked for committee to review the form and make suggestions for updating it. She will use suggestions and post the document on drive for the use during the review. Decision/Action: Committee will send Patricia Recek recommendations for the Compliance Review form revisions. When complete Pat will post for use during review. Follow-up Items: Committee to submit changes to the Compliance Review form and sign up for a program to review Person Responsible: Committee Deadline: As soon as possible Follow-up Items: Post HIPAA and Privacy Compliance Review a Business Associate /Other Non-Covered Entity Form on Drive for use during review (type form and send to Pat) Person Responsible: Patricia Recek Deadline: After committee review of form. Follow-up Item: End of November to submit updates for Compliance Review form to Patricia Recek Person/s Responsible: Committee Deadline: November 29th.

Item # 8:	Patricia Recek
Presenter
Discussion	Discussion: o Ms. Recek discussed her correspondence with D Kirk Kirkland concerning data stored on copy machines that were recently removed from the ACC campuses and the new contract with the RICOH company for units placed. All RICOH units "employs data encryption protection" and the units "are set up by default to not store backup of any files unless a user manually instructs to the unit to store a copy of information for future use". o Ms. Brown discussed Records maintenance. o Mr. Ross discussed saving information on to ACC server. o Mr. Wilson discussed responding to student only by their ACC email address and not the student's personal web site. o Eileen Klein discussed personal copy machines or lease machines that may contain information not identified or listed as ACC property. o Ross Greves discussed fax machines and relocating to a more secure space within departments. Decision/Action: Continue to review data stored by Fax/Copy Machines. Review placement of fax machines and check for copy machines that are personal and not identified as ACC property. Suggestions to place an item on the compliance review form for personal or non ACC copy/fax machines and the process to "wipe" those machines when replaced. Follow-up Items: Continue to work in improving the location of the fax machines at all campus locations, departments, offices. Person Responsible: Committee Deadline: Ongoing Follow-up Items: Reference personal/non ACC equipment for copy or faxing on the Review Form. Person Responsible: Patricia Recek Deadline: On new form for Review of Departments

Item # 9:	Patricia Recek
Presenter
Discussion	Discussion: o Committee reviewed a PowerPoint "What is New with HIPAA and Texas Privacy Laws" that highlights changes applicable to ACC HIPAA components in the State Privacy Laws House Bill 300 Medical Privacy Act and HIPAA Omnibus Rule 1/25/2013. o Discussed linking this to the HIPAA information on ACC HIPAA web site. o Implications for HIPAA Training and reminders o Encrypt data for patient files. Decision/Action: o Committee approved placing the PowerPoint on the ACC HIPAA web site. o HIPAA Training and reminders o Continue to follow up on how to encrypt data for patient files being transmitted electronically. o Make sure training is followed for at a minimum of every two years for non Health Sciences HIPAA components. Supervisors will be responsible for tracking staff compliance with this training. Training is available under professional development workshops, but automatic reminders cannot be utilized because it is not required for all ACC staff. Follow-up Items: Link to What is New with HIPAA and Texas Privacy Laws on ACC HIPAA page. Person Responsible: Patricia Recek Deadline: Ongoing

Item # 10:	Patricia Recek
Presenter
Discussion	Discussion: Dental: Student left patient folder in operative bay at the end of the Dental Hygiene day where instructor found the file. No patient information left the operative, file observed by facility only. Progressive discipline policy followed by program and student had to redo HIPAA training. Associate Degree Nursing: Student took printed patient information to a public restroom and file was found by staff lying on the floor. This event in addition to other concerns resulted in the student not meeting clinical objectives and was withdrawn from the program. Decision/Action: No action by Committee for either the Dental Hygiene student or the Associate Degree Nursing student. Follow-up Items: None Person Responsible: Deadline:.

Item # 11:	Patricia Recek
Presenter
Discussion	None

Item # 12:	Patricia Recek
Presenter
Discussion	Decision/Action: Renee Cornet announced an event that the Dental Hygiene Students were participating in a free clinic for children for teeth sealant on Saturday, November 16th for students six (6) and up. If you are interested check with her and she will forward the information to you with the time and location. Follow-up Items: None Person Responsible: Deadline:. Next Meeting: To be Announced. To review instructions on review contact Patricia Recek 512-223-5779, part@austincc.edu Note: Some committee members were assigned after meeting. Notes: Committee Members Assigned to the following Programs: Azure G. Brown - Police Elizabeth Coccia - Health Sciences Administrative Office Rebecca Cole 1).Continued Education-Massage Therapy 2). Health Professions Institute Susan Corbett - Accounts Payable Carolyn De Cordova - Radiology Gloria Dove-Owens - Medical Lab Tech/Phlebotomy Rudy Garza - Surgical Technology Ross Greves - Records Management Theresa Harkins - Not Available Michael Hill - Environmental Health Safety & Insurance Eileen Klein - Not available Ginger Locke-Floyd - Pharmacy Tech Alex Matthews - Dental Hygiene Renee Miller - Student Representative - Do not participate Kellie Murphree 1). Associate Degree Nursing 2). Vocational Nursing Marissa Ramirez Student Representative - Do not participate Patricia Recek 1). Human Services 2). Personal Fitness Training Marilyn Rehm-Skewis - Health Information Technology – Coding Robyn Richter - Sonography Regina Swearengin - Physical Therapist Assistant Nocomus (Noko) Wilson - Human Resources

Austin Community College
5930 Middle Fiskville Rd.
Austin, Texas 78752-4390
512.223.4ACC (4222)