YALE-NEW HAVEN HOSPITAL Application & Instructions for Electives

     Yale-New Haven Hospital requires all visiting house staff who are applying for an elective to complete the attached appointment packet. A completed packet, with all the required attachments, must be received by the House Staff Office prior to the start of a resident’s elective.  APPLICATION FOR ELECTIVE

Complete all sections, especially NPI number (this will be used as your unique identifier). This form authorizes the Residents from affiliated hospitals to practice at Yale-New Haven Hospital. List all training (undergraduate, medical school, 5th pathway, hospital residency training, in the U.S., Canada or Puerto Rico only), dates of training, and the name of the institution (no abbreviations) where you completed your training. Note: There cannot be any gaps in dates from time of medical school graduation until now. If there is not enough room, attach an up-to- date CV listing all education and training with no gaps in dates.

PGY level must be that of the academic year in which the elective is being done. Resident must sign and date bottom of form.

 DOCUMENTS TO BE RETURNED WITH YOUR APPLICATION

Copy of Medical School diploma - with English translation when applicable Copy of Resident’s current annual contract Copy of ECFMG certificate or Fifth Pathway, if applicable Copy of up-to-date CV (use actual dates) Completed Mandatory Medical Clearance Form (included in packet) Completed HIPAA Privacy Post-Test (included in packet) Proof of malpractice while working at YNHH Must provide Program Letter of Agreement between Sponsoring Institution and YNHH Check in at the House Staff Office, T-209 prior to going to parking or the ID office

 INSTRUCTIONS/MAPS

� Instructions for house staff � YNHH Commuter Parking

     Changes in Elective rotation(s) or date(s) of rotations must be reported to TRACY CROSBY (tracy.crosby@yale.edu, 203-785-2479) or BARBARA WANCIAK (barbara.wanciak@yale.edu, 203-785-6963).  Return completed applications and documents to:

 for US Postal Service, please use: Tracy Crosby, YAHP Coordinator Dept of Internal Medicine Yale University School of Medicine PO Box 208030 New Haven, CT 06520-8030

     for FedEx, UPS, DHL, please use: Tracy Crosby, YAHP Coordinator Dept of Internal Medicine Yale University School of Medicine 333 Cedar St, FMP 104 New Haven, CT 06510 203-785-2479

 Revised 8/2009

Rev. 10/08  YALE-NEW HAVEN HOSPITAL

APPLICATION FOR SHORT TERM ROTATION

   ¨DB ¨ Iris ¨MB Clinic Days ¨Scanned

 The Employing Institution must (1.) hold a Permit to Practice Medicine in Connecticut for the Resident, (2.) Submit proof of malpractice coverage with each application. (3.) Submit a copy of the resident’s Medical School Diploma. (4.) Submit an up-to-date CV. (5.) Submit a copy of a valid ECFMG Certificate for graduates of foreign medical schools, (6.) Complete all Sections (7.) mail to the appropriate YNHH department prior to the residents arrival. Please call Heather Russell Milici or Cheryl Guliuzza at (203)688-2259 or email Cherylann.Guliuzza@ynhh.org or Heather.Russell-Milici@ynhh.org FORMS MUST BE SIGNED BY THE APPROPRIATE YALE-NEW HAVEN HOSPITAL CHIEF OF SERVICE

 Name: NPI Number:

(Last Name) (First Name) (Middle Name) Social Security # Date of Birth: Sex: Race: Email:

   

Name of current residency training program:( i.e. Medicine, Pediatrics, Med/Peds) PGY Level at the time of Rotation at YNHH: Is this a preliminary year? Y O N O If yes, what residency training program will you be entering after your preliminary year(s)? If you were in the NRMP(National Residency Matching Program) what program (not Hospital) did you match for?

     

Department : TO BE COMPLETED BY HOUSE STAFF OFFICE  

Section: From: To:  

Section: From: To:  

Section: From: To:  

Section: From: To:      

Medical School: Degree:  

Graduation Date: Foreign Medical Graduate ¨ Yes ¨ No ECFMG Issue Date: MM/DD/YYYY MM/DD/YYYY

For Foreign Medical Graduates: Application will not be accepted without copy of ECFMG Certificate       Internship, residency, fellowship training:

(Note clinical or research) U.S. and Canadian appointments Only Name of Training program (i.e. medicine, pediatrics, surgery, etc.)

 PGY Level

 Hospital

Appointment Dates  

From: To:          

         

         

         

   

References: Name of Current Dept. Chief:

 Dept.Contact person: Contact Email:

 Name of Current Department (Not YNHH) Hospital:

 Dept. Telephone # Dept. Fax #

   

Resident’s Signature: Date:  

Chief of Service Signature Yale-New Haven Hospital

Date:

YALE-NEW HAVEN HOSPITAL MANDATORY MEDICAL CLEARANCE FORM

 Name: Current Hospital:

 Signature: Date:

   

1. Date of most recent PPD / / (within the last year, if negative)  

If PPD positive, date and result of chest x-ray subsequent to positive PPD:  

DATE / / RESULT  

2. Have you ever had the chickenpox? YES NO  

If you have had a varicella titer drawn, what was the result?  

POSITIVE NEGATIVE  

3. Were you born after January 1, 1957? YES NO  

If yes, when was you most recent measles vaccine? DATE / /_  

If you hade a measles titer drawn what was the result?  

POSITIVE NEGATIVE  

4. Have you been vaccinated against rubella? YES NO  

If yes, when was you most recent rubella vaccine? DATE / /  

If you hade a rubella titer drawn what was the result?  

POSITIVE NEGATIVE  

5. Have you received the Hepatitis B Vaccine series? YES NO  

If yes, what was the date of the vaccine? DATE / /  

If you hade a hepatitis titer drawn what was the result?  

POSITIVE NEGATIVE  

I f y o u d o n o t h a v e a p o s i t i v e H e p a t i t i s B s u r f a c e a n t i b o d y t i t e r , h a v e n o t r e c e i v e d t h e H e p a t i t i s B , a n d d o n o t i n t e n d t o d o s o , p l e a s e s i g n t h e f o l l o w i n g d e c l i n a t i o n :

 I _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ d e c l i n e t o r e c e i v e t h e H e p a t i t i s B v a c c i n e .

( p r i n t n a m e )  

S i g n e d : _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _  

6. Have you been fit-tested for a respirator: YES NO  

If yes, what type of respirator:

           

Dear Colleague:  

The Health Insurance Portability and Accountability Act (HIPAA) went into effect on April 14, 2003.  

As a member of the YNHH Medical Staff, it is important for you to understand the policies and operational requirements that the Hospital must implement to be in compliance with HIPAA regulations.  

An Executive Summary of the new policies and Highlights of HIPAA at YNHHS containing important information relative to your activity as a member of the YNHH Medical Staff follow this page.  

Please read this information, complete, sign and date the brief Post-Test and return it with your application.  

Satisfaction of the above will serve as our record that you have familiarized yourself with YNHH HIPAA policies and understand the importance of adhering to these policies and good practice to satisfy the requirements of HIPAA.  

Thank you in advance for your attention to this important matter.

Sincerely,

     

Peter N. Herbert, M.D. Chief of Staff  

Enclosures        

Note: For reference, the full YNHHS HIPAA policies can be temporarily accessed from any YNHHS computer at: http://intranet.mis.ynhh.com/ynhhs/resources/hipaa/index.html. Under HIPAA Resources select “Task Force Meetings,” then “Privacy/Med Records” or “Security,” then “Policies & Procedures.”

Highlights of HIPAA at YNHH    

The Notice of Privacy Practices. At first entry to our hospital, patients will be given the Notice to sign as an acknowledgment that they understand how we will use their Protected Health Information (PHI) for the purposes of treatment, payment, and certain operations to improve our clinical effectiveness. They will also learn of their rights under HIPAA to access their medical record, request an amendment to their record, request an accounting of disclosures of their PHI outside of treatment, payment, and operations (TPO), request a restriction or confidential communication, file a complaint, and opt out of our facility directory. We will flag in our systems that the patient has received our Notice.  

Research. In order to access patient information for any research-related purpose, including pre-research reviews, a Request for Access to PHI for a Research Purpose form will need to be completed. For individuals who are not full-time faculty members or YNHHS attending physicians, appropriate signatures will also need to be obtained to access records for reviews preparatory to research or research on decedents. Requests to access records for research approved by the IRB will need to be accompanied by a copy of the Research Authorization or waiver.  

Marketing Authorizations. You are allowed to discuss with a patient health related products and services provided by YNHHS facilities, as well as for treatment of the individual, case management/care coordination, or to recommend alternative treatments, therapies, healthcare providers or settings of care. A patient’s authorization will need to be completed in order to provide the patient’s PHI to an outside company for the purposes of marketing the outside company’s products or services.  

E-Mail and Electronic Messaging. Use of commercial e-mail services such as Hotmail and AOL to transmit PHI is not permitted given that the information can be easily intercepted. E-mailing and messaging is allowed within the firewalls of our facilities across the Health System and Yale University. MDLink, a secure web portal, is also an acceptable option.  

Faxing. Transmitting PHI via fax is allowed, as long as care is taken to confirm the receiver’s fax number, and any fax sent from a YNHHS facility includes the following confidentiality disclaimer: “This message originates from Yale New Haven Health System. The information contained in this message may be privileged and confidential. If you are the intended recipient, you must maintain this message in a secure and confidential manner. If you are not the intended recipient, please notify the sender immediately and destroy this message. Thank you."  

Verification. If the patient (or the patient’s legal personal representative) has not provided consent, we need to be careful about to whom we disclose patient information. In regard to unknown callers/individuals who claim to be family members, please first verify that the patient has not opted-out of the facility directory (688-4242), or has placed restrictions on his/her PHI (e.g., an alias). The unknown individuals should then be asked to verify a few patient identifiers such as address, date-of-birth, or social security number before information is disclosed. It is a good rule of thumb in these instances to share general information about the patient’s condition only, unless it is evident from the conversation that the individual already knows more than this. Use common sense. In addition, before discussing a patient’s condition and treatment in the company of visitors, politely ask the visitors to leave. The choice is then left up to the patient to voice whether the visitors should stay.  

Patient’s Right to Their Record. Patients may request access to their PHI by submitting a completed Authorization for Access/Release of Information form to the Medical Records or Billing Department. For requests from inpatients, you may be asked to review the record with them or to identify a clinician designee to do so, similar to current practice.

Patient’s Right to Request an Amendment of Their Record. Patients will need to complete and submit a Request for Amendment to Protected Health Information Retained in Designated Record Sets form to the Medical Records or Billing Department. You will receive a copy of the patient’s request with a cover letter explaining that you may deny the request for amendment, accept the request, or accept the request as an alternative opinion. The patient would then be notified of your decision.  

Patient’s Right to an Accounting of Disclosures. If you disclose PHI outside of normal TPO, which the patient has not authorized, such as for reviews preparatory to research; to the state for public health reporting; to coroners, medical examiners, funeral directors, and for cadaveric organ donation purposes; in response to valid subpoenas or court orders; for health oversight or law enforcement requests, for worker’s compensation reporting, etc., please be aware that these disclosures must be documented and tracked. Please contact Jean Pawlich (jean.pawlich@ynhh.org) and Jean Ahn (jean.ahn@ynhh.org) via email or at 688- 8605. Patients may request an accounting of disclosures of their PHI by completing the Request for Accounting of Disclosures form.  

State Laws. A state law preemption is in effect, which means that if state law is more stringent it would supersede the HIPAA regulations. HIPAA also contains an exception for any reporting specifically required for state law (e.g., abuse and neglect reporting).

 Privacy Officer. HIPAA questions and complaints regarding Yale-New Haven Hospital or System facilities should be referred to the Office of Privacy and Compliance at 688-8416.  

Portable Electronic Devices/Working Offsite. Any device containing or storing PHI (e.g., laptops, PDAs) must be password protected and secured when not in use. In addition, any PHI used or accessed should be safeguarded at all times, regardless of device used or location.  

Presenting at Conferences. All identifying information needs to be masked or removed from slides, photographs, overhead transparencies, other media used, and handouts in order to keep the patient’s identity confidential. In addition, please pick up any remaining copies following meetings and make sure that they are disposed of appropriately.  

Disposal of PHI. Locked confidential bins are now located on each unit at the hospital. The contents will be shredded. Use these bins to destroy written PHI. Please see full policy for other types of media.  

Good Faith Efforts. Not all of our areas of the hospital allow for confidential communications with patients or the secure storage of PHI. What is asked for are good faith efforts and reasonable measures. For example, turn charts over at the nursing station, pull curtains, talk in hushed tones if possible, use empty conference rooms where available, and avoid conversations in public areas such as elevators, hallways, and cafeterias. When you know it is unavoidable that others will hear your attempts at private conversation, let the patient know that you value keeping their information private and ask if they’d prefer another method to collect or discuss their PHI, particularly if it concerns HIV, drug and alcohol, or mental health information.

Executive Summaries of YNHHS HIPAA Policies  PRIVACY SUMMARIES:

 Patient’s Right to Access Protected Health Information (PHI) The Right to Access policy outlines how patients may access, inspect, or obtain a copy of their protected health information.

 Key Points � All patients who would like access to their PHI (both inpatients and outpatients) should submit a completed Authorization for

Access/Release of Information form, which will be forwarded to the relevant Health Information Management/Medical Records Department.

� Inpatients may request to inspect a copy of their medical records in the presence of their physician or the physician’s designee. � A copy of requested records shall be provided within 30 days after the record is completed. � Documentation of actions taken should be noted in the electronic record and/or on the Authorization for Access/Release of

Information form and a copy placed in the patient’s record.    Accounting of Disclosures The Accounting of Disclosures policy provides guidelines regarding the patient’s right to request an accounting of disclosures. An accounting of disclosures is a listing of where a patient’s PHI has been sent, to whom, and for what purpose. The accounting does not need to include those recipients to whom the patient has authorized information be sent, or those that the HIPAA regulations specifically exclude, such as for treatment, payment, and some operations.

 Key Points � Patients may request an accounting of disclosures by submitting a completed Request for Accounting of Disclosures form to

the Health Information Management/Medical Records or Billing Departments. � In general, a patient must receive an accounting within 60 days, or within that same time frame, receive notification that an

additional 30-day extension will be necessary. � Examples of disclosures which must be included in the accounting are disclosures made in response to a subpoena,

for public health activities, for abuse and neglect reporting, for health oversight activities or law enforcement purposes, for workers’ compensation, for reviews preparatory to research, and to coroners, medical examiners, funeral directors, and for cadaveric organ donation purposes. A complete list can be found in the policy.

� The affected departments must provide the disclosure information as requested to the Medical Records/Health Information Management (HIM) Department.

   

Amendment to PHI in Medical and Billing Records (Patient’s Right to Request) As its title indicates, the Patient’s Right to Request Amendment to PHI in Medical and Billing Records policy outlines how patients may request an amendment to the protected health information in their medical and billing records. Guidelines are provided for clinicians who will review the request and decide whether the request for amendment will be accepted as a necessary correction to the record, accepted as an alternative viewpoint, or denied.

 Key Points � To request an amendment, patients must complete the Form to Request Amendment to Protected Health Information

Retained in Designated Record Sets and must provide verification of identity. � One exception is that routine requests for billing amendments may be received via telephone, given that the caller verifies

certain patient identifiers. For non-routine requests, patients will be sent the Form to Request Amendment to Protected Health Information Retained in Designated Record Sets.

� A patient must receive a response within 60 days, or, within that same time frame, receive notification that an additional 30-day extension will be necessary.

� In the case of medical records, the patient’s request for amendment as well as an explanatory cover letter will be sent to the clinician who authored the portion of the patient record in question for review and response (e.g., accept as necessary, accept as alternative viewpoint, or deny) within the allotted time.

� The original copy of the request form, with the clinician/author’s decision noted at the bottom, will be placed or scanned into the patient’s record, and a copy sent to the patient.

� As appropriate, reference to accepted amendments and/or actions taken will be noted at the appropriate site in the record by HIM or Billing staff.

De-identification For uses and disclosures of PHI that are not authorized or permitted by the HIPAA regulations or YNHHS policies and procedures (e.g., as defined in the Release of Protected Health Information policy), de-identification of the PHI will be required.

 Key Points � De-identification of PHI requires the removal of a complete list of specific identifiers to render the health information no longer

identifiable (e.g., names, dates, addresses, account numbers, etc.). � De-identification of PHI may be performed by a statistician or other person with appropriate knowledge and experience with

statistical and scientific principles and methods for rendering the information not individually identifiable. � If the individual who will perform the de-identification is not a member of the workforce, a business associate agreement will be

required.  Designated Record Sets of Medical and Billing Records The Designated Record Set policy identifies those components of the medical and billing records to which patients or their personal representatives may request access or amendment. Billing records must be maintained for at least seven years. Medical records must be maintained for the minimum period required by state law (e.g., 25 years for most hospital departments, and 7 years for physician offices).

   Facsimile (Fax) Transmittal Protected health information (PHI) and confidential information must be safeguarded when faxed.

 Key Points � Confirm that the receiver’s fax number is accurate. � When possible, pre-program regularly used fax numbers to avoid mis-dialing. � Use the facility’s standard fax cover sheet that includes a disclaimer for all faxes that are sent. � Report faxes with PHI that are sent to the wrong location to the Office of Privacy and Compliance at 688-8416. � Make sure fax machines as well as faxes sent or received are located in controlled/properly staffed or non-viewable areas.

   Uses and Disclosures of PHI for Fundraising The Fundraising policy provides guidelines for using and disclosing protected health information (PHI) for fundraising purposes.

 Key Points � Only limited PHI may be used for fundraising without a patient’s authorization. Permitted PHI include dates of service

information and patient demographic information. � Fundraising materials must include opt-out language. � YNHHS must make all reasonable efforts to honor patient opt-out requests.

   Uses and Disclosures of PHI for Marketing The Marketing policy document outlines both the marketing uses and disclosures of PHI for which an authorization needs to be obtained. It also outlines the exceptions.

 Key Points � Permitted communications that are not considered marketing under the HIPAA regulations include communications made by

the YNHHS facilities regarding their own health-related products or services; communications regarding treatment of a patient; and communications to a patient regarding case management, care coordination, or recommendation of alternative treatments, therapies, health care providers, or settings of care.

� A patient’s authorization must be obtained for any use or disclosure of PHI for marketing purposes unless it occurs during a face-to-face communication with the patient or only involves a promotional gift of nominal value.

   Minimum Necessary The Minimum Necessary policy states that YNHHS facilities will limit the protected health information (PHI) used, disclosed, or requested to the minimum amount necessary to carry out workforce members’ job duties, or to fulfill the purpose of the disclosures or requests.

 Key Points � Healthcare professionals may access the PHI of any patient for whom they are assigned care; other staff will be granted access

based on their roles and job functions. Information access controls will be implemented as necessary.

� Inappropriate or unauthorized access will result in disciplinary action up to and including termination of employment or removal from the Medical Staff.

� Both when disclosing PHI to other entities or requesting PHI from other entities, only the minimum necessary amount of PHI should be disclosed or requested. Appendix B of the policy provides general guidance regarding what is minimally necessary disclosures for routine or recurring requests.

� Criteria for determining what is minimally necessary for non-routine disclosures are also outlined in the policy.    Notice of Privacy Practices The Notice of Privacy Practices outlines for patients or their personal representatives how their protected health information (PHI) may be used and disclosed. It also outlines patients’ rights in regard to their protected health information (e.g., concerning access, amendments, accounting of disclosures, restrictions, confidential communications, and complaints).

 Key Points � The Notice must be provided to the patient on their first visit, and good faith efforts must be made to obtain the patients’ written

acknowledgement of receipt of the Notice. � Either a copy of the patient’s signed acknowledgement or documentation of good faith effort to obtain the acknowledgement

must be maintained in the medical record and/or noted electronically. � The most current Notice must be prominently posted within the System facilities and on facility Websites.

     Personal Representatives and Communication with Patient Families The Personal Representatives and Communication with Patient Families policy defines who is a legal personal representative acting on behalf of the patient as well as discusses communication with designated family spokespersons who are not legal personal representatives. Both categories of individuals may receive protected health information (PHI) as needed to act on the patient’s behalf. Good-faith efforts should be made to identify individuals requesting PHI before sharing the information.

 Key Points � A personal representative is a person legally appointed to act on the patient’s behalf, such as a conservator, guardian, or durable

power of attorney. � Before sharing PHI with an unknown individual claiming to be a family member, confirm that the patient has not opted out of

the facility directory or placed restrictions on the release of his/her information. The individual should be asked to verify a few patient identifiers such as the patient’s address, date-of-birth, social security number, or hospital account number. Restrict the information released to the minimum necessary.

� Regarding communication with patient families, patients may be requested to designate a family spokesperson with whom YNHHS staff can regularly communicate PHI about the patients.

     Privacy Complaints A suspected privacy violation or privacy complaint may be reported by any individual regarding inappropriate use, access, or disclosure of protected health information (PHI).

 Key Points � Patient privacy complaints should be directed to the Patient Relations Department, who will log the information and inform the

Office of Privacy and Compliance. � Privacy complaints occurring at non-hospital YNHHS facilities should be reported to the facility administrator immediately. � Complaints will be investigated and disciplinary measures will be taken when wrongdoing has been determined.

   Release of Protected Health Information The Release of Protected Health Information policy provides guidelines on appropriately releasing/disclosing patients’ protected health information (PHI), including for research purposes, to insurance companies, to government agencies, to physicians and other health care facilities, pursuant to subpoenas, to the media, for the facility directory, and to clergy.

 Key Points � A patient’s written authorization, valid subpoena, court order, or other authorized documentation will generally be required for

most releases and disclosures made for non-TPO (treatment, payment, and health care operations) purposes. Exceptions are outlined in the policy. For example, only certain limited PHI may be disclosed to law enforcement for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person.

� Unless necessary to perform job duties, workforce members must not use or disclose patients’ medical or billing PHI either internally within the facility, or externally outside of the facility.

� Inappropriate use or disclosure will be subject to disciplinary action up to and including termination of employment or removal from the Medical Staff.

   Research Authorizations The Research Authorizations policy identifies the necessary elements for a valid patient authorization for the use and disclosure of protected health information (PHI) for research purposes.

 Key Points � All required elements listed in the policy must be included in the research authorization in order for the authorization to be valid. � In most cases, the authorization will be a stand-alone document appended to the back of the informed consent. � The specifics of privacy guarantees and security procedures relating to PHI should be delineated in the research protocols.

     Request for Access to Protected Health Information for a Research Purpose Form (Researcher Representation form) The Request for Access to Protected Health Information for a Research Purpose form provides a means of assurance that a request presented by a researcher to access YNHHS facility records for research purposes, including reviews preparatory to research and research on decedents, is valid.

 Key Points � Researchers must present a copy of the completed Request for Access to PHI for a Research Purpose form, with appropriate

signatures, in order to obtain PHI for any research purpose. � If the researcher is not a full-time Yale University faculty member or YNHHS attending physician, s/he will need to obtain the

signature of a YNHHS Clinical Department Chair or Section Chief, YSM/YSN full-time Faculty Member, YNHHS Attending Physician, or YNHHS Nurse Manager.

     Right to Request Restrictions or Confidential Communications on the Use and/or Disclosure of PHI The Right to Restrictions or Confidential Communications policy states that YNHHS facilities will consider reasonable requests from patients for (1) confidential communications via alternative means or alternative locations and (2) restrictions on the use and/or disclosure of patients’ PHI.

 Key Points � A patient will be asked to submit the request in writing on the Form to Request Restrictions/Confidential Communications

on the Use and Disclosure of Protected Health Information. The form will be filed or flagged in the medical or financial record as applicable.

� The main criterion that will be used in reviewing patients’ requests for restrictions on their PHI is whether their health or life is in danger.

� Prior to disclosing PHI, staff must be aware if there is a restriction or confidential communication in place regarding patients’ PHI, in order to prevent unnecessary breaches.

   Tracking YNHHS Contracts and Agreements The Tracking YNHHS Contracts and Agreements policy provides guidelines on the appropriate tracking of all YNHHS contracts and agreements.

 Key Points � All contracts and agreements with business associates must include the YNHHS-approved business associate language. A

Business Associate is a person or entity, who on behalf of YNHHS or a YNHHS facility, performs or assists in the performance of a function or activity involving the use or disclosure of protected health information (PHI), including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing.

HIPAA Security Education at YNHHS      

Key Learning Points        

I. Computing devices other than those provided by the hospital may not be connected to the hospital network without prior clearance, in writing, from MIS. This is to protect the hospital environment from possible viruses and other malicious code.

 II. Any electronic protected health information (PHI) stored on a portable computing device or removable

storage device must be protected with encryption, to ensure against disclosure in the event of loss or theft.  

III. User ID’s and their corresponding passwords must be kept confidential and cannot be shared with anyone else. Using someone else’s ID and password may result in termination or loss of privileges.

 IV. If you observe any type of security incident (use of another’s ID, unauthorized access of PHI, malicious

use of computing resources, etc) or experience the loss or theft of PHI or devices containing PHI, you must report the incident. Incidents should be reported to the MIS Help Desk (8-HELP) or to the hospital’s Compliance Officer or Security Officer immediately.

 V. The health system has policies in place which address both privacy and security. If you have any

questions regarding our HIPAA policies please contact our System Privacy Officer & HIPAA Project Director at 688-8605.

Executive Summaries of YNHHS HIPAA Policies  SECURITY SUMMARIES:

   Appropriate Use of Electronic Resources YNHHS workforce members are required to use YNHHS’ electronic resources in a professional, lawful and ethical manner, and to prevent the unauthorized use or disclosure of protected health information or any other confidential information. Use of electronic resources will be subject to managerial review and based on job requirements.

 Key Points 1. YNHHS can monitor the use of the resources with available technologies, with or without the knowledge of the member of the

workforce, with the exception of phone conversations. 2. Electronic Resources include, but are not limited to: Personal Computers, E-mail, Voicemail, Telephones, Fax Machines,

Pagers, Laptops, Cell Phones, Copiers, and PDAs. 3. Some examples of inappropriate behavior that should be reported to the Information Security Officer and/or the Office of

Privacy and Compliance and that warrant disciplinary actions up to and including termination are: • Using someone else’s password or login ID. • Unauthorized viewing or use of PHI or confidential information. • Unauthorized access to system, data or hard copy information. • Unauthorized transmission of protected health information (PHI) or confidential data over the Internet (for example,

unencrypted transmission of a patient’s medications) • Breach of external networks (for example, firewalls, web servers and VPNs) • Actions that cause unexpected alert by intrusion detection systems. • Unauthorized entry into the Data Center.

   Audit Controls YNHHS facilities reserve the right to record and review audit trails of computer applications containing PHI and the operating systems they run on to ensure that data is only accessed and/or disclosed for treatment, payment and operations. Incidents of inappropriate access will be addressed by the Office of Privacy and Compliance and/or Information Security Officer.

   Computer Virus Protection YNHHS facilities will ensure that current computer virus protection software is used on all electronic computing devices to protect PHI.

 Key Points 1. Remote users or users of standalone devices must take reasonable steps to ensure adequate computer virus protection. 2. No member of the YNHHS workforce may intentionally remove or disable virus protection software installed on YNHHS-

provided electronic computing devices. 3. If the current virus protection software reports the unsuccessful handling of a virus, or if users suspect the existence of a

computer virus, they should immediately contact the Information Services’ Help Desk.

Disposal and Control of Documents and Media Containing PHI YNHHS workforce members must ensure the protection of PHI by controlling the use, storage, and disposal of documents and other media containing PHI.

 Key Points 1. Types of media with PHI include, but are not limited to: Paper, Disks (including hard disks, floppy disks and compact disks),

Microfiche, Overhead Transparencies, Photographs, Slides, Patient Identification Bands, I.V. Bags, Embosser Plates, Prescription Bottles.

2. When individuals have completed using PHI, media that contains PHI must be stored in a secure location, returned to the authorized owner, or the PHI or the media it is stored upon must be disposed of appropriately. Each type of media/document may require a specific disposal method for example, shredding confidential information.

   Information Security Incidents YNHHS workforce members are required to report all information security incidents to the Information Security Officer or the MIS Help Desk (8-4357). All reported incidents will be investigated and the results reported to YNHHS management.

 Key Points- Incident Examples 1. Using someone else’s ID or password. 2. Unauthorized transmission of protected health information (PHI) or confidential data over the Internet (for example,

unencrypted transmission of a patient’s medications) 3. Introduction of a virus or worm into the computing system or network. 4. Unauthorized use of computing equipment by workforce or non-workforce members.

   Portable Electronic Devices All members of the YNHHS workforce using portable electronic devices [e.g. laptops, mobile carts or PDAs], regardless of ownership, that store protected health information (PHI) must follow strict security standards since PHI can be inappropriately disclosed if the devices are stolen or accidentally lost.

 Key Points 1. All portable electronic devices need to be password protected or use some other form of user authentication, if

they are used to store or transmit PHI. 2. Portable electronic devices need to be physically stored in a secure location when not in use. 3. If the information on a portable electronic device does not exist elsewhere, it needs to be backed up periodically to

a secured location. 4. If the device is lost or stolen, it needs to be reported immediately to one’s manager.

   Safeguarding PHI and Confidential Information while Working Offsite YNHHS policies and procedures regarding confidentiality are to be followed at all times when working offsite with PHI or other confidential information.

 User Authentication to Computer Systems YNHHS workforce members are provided with access to various computing systems which are needed in the performance of their jobs. Each user is authenticated by the use of an ID and password or other security mechanism.

 Key Points

1. You may not share your password with anyone, for any reason. 2. Passwords are not to be stored on your computer or anywhere where they may be found by others. 3. Passwords should be at least 5 alphabetic and numeric characters in length. 4. You must report any unauthorized use of your password immediately.

1. The Notice of Privacy Practices only needs to be posted in prominent locations within the facility. There is no requirement to provide copies to patients for their signature.

T F

 

2. Transmitting protected health information (PHI) by fax is prohibited in YNHHS hospitals. T F  

3. Transmitting PHI via a commercial e-mail service (Hotmail, AOL, etc) is considered an T F unprotected form of communication at YNHHS hospitals.

 4. In situations where you know the patient has not placed any restrictions on the use of T F

his/her PHI (via facility directory opt-outs, aliases, etc.), a recommended practice when approached by someone claiming to be a member of a patient’s family is to request patient identifier information such as patient’s address, date-of-birth, social security number, etc.

 5. A “Request for Access to Protected Health Information for a Research Purpose” form must T F

be completed in order to access PHI for any research purpose, even if approved by the    

6. Communications about YNHHS health-related products or services are considered T F marketing, and therefore, require patient authorization before information can be shared.

 7. Laptops and PDAs that store PHI must be password protected with encryption. T F

 

8. Disclosures of PHI for purposes such as reviews preparatory to research, cadaveric organ T F donation, health oversight or law enforcement purposes, and public health reporting must

   

9. Physicians have the right to deny patients’ requests to amend their record, if they feel an T F amendment is not justified.

 10. It is required that you report all security incidents (shared passwords, introduction of T F

 

HIPAA Privacy & Security Post-Test  

Directions: Please circle the correct response to the questions provided, and then complete the information below. Return this sheet along with your application for Medical Staff Membership. A score of 80% is required to pass.

                                         

IRB/HIC.                    

be documented in a centralized accounting.            

Computer viruses, unauthorizied installation of software, etc.) to the YNHHS Security Officer of the MIS Help Desk (688-4357)

     

Full name (please print):  

I have read and understand the new HIPAA policies in effect in the Yale New Haven Health System facilities.

   

Signature Date

INSTRUCTIONS FOR HOUSE STAFF ROTATING THROUGH YALE-NEW HAVEN HOSPITAL

 Prior to arrival

� Call the House Staff Office (203)688-2259 to confirm paperwork is on file. If you do not check in with the House Staff Office, you will not be allowed to get parking, ID’s or SCM computer training.

� Call YNHH Information Systems Training (203-688-3017) prior to the day of arrival to schedule training

� Internal Medicine elective instructions contact info can be printed by accessing http://yahp.med.yale.edu/index.html , click on “Electives” on the left menu.

 Upon Arrival at Yale-New Haven Hospital

� Parking will need to be arranged through the Medical School Parking office SHM C E1 under the Sterling Hall of Medicine Rotunda. Phone 203-785-6456, email ysm.parking@yale.edu Parking must be paid by Credit Card only. Keycard deposit required.

� Go to the Yale-New Haven Hospital Main Entrance, 20 York Street and ask for directions to the House Staff Office, New Haven Unit, Tompkins 209.

� Go to the House Staff Office for I.D. Form. The House Staff Office is normally open from 6:00 AM to 5:00 PM.

 ID Center – Security

� Security is located in the East Pavilion behind the main cafeteria. There are signs posted.

� ID Center is Rm. 11A ID Office hours are – M-F 8:00am-12:30pm and 1:00pm-2:30pm The office is closed from 12:30 to 1:00 pm Telephone – 688-6094

   Miscellaneous

� Beepers are issued by the department through which you are rotating � Parking is not reimbursed by YNHH � Toll Authorization numbers are not issued to rotating residents.

   

Rotating Resident Instructions 10/2008

                             

Air Rights Garage

300 George St. Information Systems Computer Training

Classrooms entrance

           

Front entrance Yale New Haven Hospital

                         Directions to 300 George St:

   From the main entrance of the hospital on 20 York Street, take a left.

Cross South Frontage Road.

Continue for one block and cross North Frontage Road.

Take a Right on North Frontage Road.

At the second driveway, you will see a sign for Café George. Walk up that driveway.

 

 The entrance to the building is half way up the driveway.

 

 Once in the building, you will then see signs directing you to the classrooms.

YALE-NEW HAVEN HEALTH REQUEST FOR SERVICE

PLEASE COMPLETE THE FOLLOWING INFORMATION, PRINT, SIGN, AND RETURN TO:

FAX: 203-502-4987 or E-MAIL: helpdesk@ynhh.org

Important: All research staff must FIRST contact Medical Records at 688-5843 to request authorization to access the Epic EMR prior

to completing this form. This request will not be processed unless the Medical Records authorization has been completed.

Section I – Requestor Information

Name: (Last) (First) (MI)

Email Address: Phone Number:

Section II – Access Request Type

□ New Hire New Hire Start Date: _____________________ □ Community Access

□ New Position Old: ______________________________ To: _________________________________

□ Delete Access □ Renew Access

Person with similar job functions: Name ______________________________ User ID __________________

Section III - New/Changes to System IDs and Access

Affiliation: □ YNHH □ YMG □ YU □ BH □ GH □ NEMG □ SRC

□ Private Practice □ HSC □ Vendor/Non-Clinician w/ BAA

Position/Job Title: □ Attending □ Med Student □ Fellow □ RPH □ ITS Staff □ MD □ DO

□ MBB □ RN □ APRN □ PA □ Resident □ OT □ PT □ SLP □ Support Staff

□ CNM □ RT □ Research Staff □ Consultant □ Student

□ Other: _______________________________ □ Employee? □ Credentialed YH, BH, GH?

NPI #: Office Phone:

Email Address: Contact Hours:

Department(s)/Service: Cell Phone/Pager:

Office Address: Office Fax #:

Office Bldg # / Floor #: Supervisor’s Name (PA):

YNHH Network ID: DEA #:

Employee ID#: CT License #:

Identity Verification (non-employees only)

What High School did you last attend? _________________________________________

How many siblings do you have? _______In what city were you born?__________________

Note: Employees must use ESS to enter this information.

Section IV - Sponsor Approval to be Completed by the Sponsor Sponsor/Office Manager Name:

I have considered segregation of duties for this request.

Signature: Date:

Office Phone: Email:

Section V – Software/System Information

□ Installation □ Upgrade Purchase Order # _________________

□ Non-Exempt Remote/Portal Access □ Exempt Remote/Portal Access

□ Outlook □ Network ID □ EPIC □ Cerner □ Meditech □ PYXIS □ OBIX □ APF

□ TSI □ Synapse □ HPF □ Other _________________________________________________________

Section VI – Hardware Information

Indicate Installation Type

□ New □ Upgrade □ Relocate Equipment □ Retire Hardware □ Re-use PC

□ Reimage PC □ Convert PC to CWS □ Convert CWS to Business PC

Indicate quantity next to the items being installed

□ PCs □ CWS □ Printers □ Monitors □ Scanners □ Laptops □ Keyboards □ Mouse

Equipment moves between buildings in New Haven must be coordinated through Plant Engineering.

Current Equipment Location Street Address ___________________________ Building ________ Floor _____ Room ___

New Equipment Location: Street Address ___________________________ Building ________ Floor _____ Room ___

Section VII – Researchers Only Access Information

□ HIC#: __________________ (HIC Approval Must be Attached)

Duration of Request Access From: __________________ To: __________________ Section VIII – Meditech Only Information

Mnemonic of User Access to Copy: ______________________________

□ Does the user need access to MobiLab?

List Menus, Applications, and Routines to be Added/Deleted: _________________________ _________________________________________________________________

Section IX – Comments

For Office Use Only A.D. ______ Credential Provider ______ NPI ______ SER New/Existing ______ EMP New/Existing ______ Link Template [______] Medical Records ______