HIPAA is Changing – Are You Up to Speed?

 The NASW Legal Defense Fund is pleased to announce the availability of updated HIPAA resources to facilitate members’ understanding and compliance with recent changes mandated by the HITECH Act.  The HIPAA tools are made available to members through the work of the NASW Legal Defense Fund, funded by member contributions.   

HIPAA Highlights for Social Workers  (www.socialworkers.org/hipaa):  This is the primary web address where you can find HIPAA information.  Members may access all of NASW’s online HIPAA resources through this portal; however, more specific website addresses are provided below for targeted responses to member inquiries. 

·         HIPAA Online Training Courses (www.hipaaprof.com/nasw):    NASW has updated the online HIPAA Training Program, including a new course offering:  Understanding HITECH.  The new course is an overview of the newest changes to HIPAA for social workers who already have experience and training on the HIPAA requirements. 

Members who are inexperienced with HIPAA should take the HIPAA Basics courses (Privacy and Security) or consider purchasing the entire package of 6 courses.  There is a discount for the package and a discount for NASW members who register for the courses with their member ID#. 

The training courses are not housed on NASW’s website—they are offered by in conjunction with our contractor, HIPAAprof, at www.hipaaprof.com/nasw.  The courses are for sale and once a social worker has registered as a student they will receive a separate login and password from HIPAAprof.  This is not the same as the login for NASW’s website.

Complete HIPAA Course Listings:          

-          Understanding HITECH

-          HIPAA Security Basics

-          HIPAA Privacy Basics

-          Clients’ Rights

-          Uses and Disclosures of Protected Health Information

-          Notice of Privacy Practices

-           ·         Updated 2010 HIPAA Sample Forms and Policies (www.socialworkers.org/hipaa/sample.asp): (NASW UserID and password required for access)

The HIPAA forms and policies you use may need to be updated to be compliant with the new changes. You should review these are sample documents and consider revision based on the needs of your individual practice setting and more stringent state privacy laws. 

o   Notice of Privacy Practices and Instructions for Use

o   Notice of Privacy Practices Policy

o   Acknowledgement of Receipt of Notice of Privacy Practices

o   Business Associate Contract

o   Business Associate Policy

o   Breach Notification Policy

o   Breach Notification Sample Letter to Clients

o   Breach Notification Sample Letter to DHHS

o   Breach Incident Log

o   Authorization to Release Protected Health Information (for mental health records)

o   Authorization to Release Protected Health Information Policy (for alcohol and drug abuse treatment records)

o   Accounting of Disclosures Policy

o   Accounting of Disclosures Log

·         LEGAL ISSUE OF THE MONTH ARTICLES FROM LEGAL DEFENSE FUND (www.socialworkers.org/ldf/legal_issue/default.asp):  (NASW UserID and password required)

o   Disclosing Confidential Information to Social Workers’ Business Associates (March 2010)  https://www.socialworkers.org/ldf/legal_issue/2010/201003.asp

This LDF article addresses social workers’ business associates and the HIPAA requirements for having a signed confidentiality agreement for handling client information.  It includes suggestions for how to complete the sample HIPAA Business Associate Agreement and a link to the sample agreement.

o   HIPAA Amendments for a New Decade:  2010 and Beyond (February 2010) https://www.socialworkers.org/ldf/legal_issue/2010/201002.asp

This LDF article provides a review of HITECH Act HIPAA amendments that became effective on February 17, 2010 and a review of other recent changes.

o   HITECH HIPAA for Social Workers (February 2009) https://www.socialworkers.org/ldf/legal_issue/2009/200903.asp

This LDF article gives an over of HITECH Act amendments and provides specific information about what must be included in a breach notification when a privacy breach has occurred.  Members who have had confidential client information lost or stolen (e.g. stolen laptop) will find this article useful.