Under provision §160.103, any health sector involved in the “sale or dispensing of a drug, device, or equipment,” is subject to HIPAA laws. This entails the pharmaceutical industry, even those based overseas if they serve U.S. clients and exchange information electronically. Compliance isn’t always easy in practice, especially with the seemingly endless page-after-page of formal guidelines, many of which are often open for interpretation. Fortunately, with LMS implementation and some best practices, compliance becomes more manageable for HR and staff alike.
Define protected health information (PHI)
PHI is any information that identifies the patient, including but not limited to name, address, health insurance/beneficiary number, social security number, and profile photos. It also includes the patient’s medical records, such as prescribed medications, medical treatment history, and test results. Compliance training via e-learning should begin with PHI as the introduction topic. This is the foundation for all subsequent modules. At the end of this introductory module, learners should be able to:
- Define PHI in their own words
- Explain PHI to a patient or non-medical personnel using layman’s terms
- Give examples of what is and isn’t PHI
- Know what credible sources (outside the LMS) to turn to for further HIPAA-related learning
Describe ePHI in depth
The next stage of the course is to go into precise detail about what constitutes ePHI. As suggested in its name, it’s PHI stored electronically. This includes medical correspondence stored and/or transmitted through email, cloud, and social media. HIPAA outlines extensive guidelines regarding storage, security, and how the info can and cannot be transmitted.
By the end of this module, learners should know, for example, whether specific scenarios like sending test results to patients via email is permissible. Present multiple similar scenarios and have learners identify which ones are appropriate and the ones that are violations.
Remote learning combined with field practice
Remote learning via LMS affords learners flexibility, convenience, and high-quality content. However, don’t limit the training to book learning. Incorporate hands-on training; this may be completed fully or partially through webinars with learners performing demos virtually.
Introduce mock scenarios. For example, administrators can role-play as a patient who requests his/her medical records through an attachment via Line. Can the learner identify on the spot whether this is a HIPAA-accepted way of digital correspondence?
Role-specific courses
Create side courses specific to select personnel who take on secondary positions. For example, HIPAA guidelines permit pharmacies to appoint employees as privacy and security officers. Create a side module on the role of a security/privacy officer. This may delve into duties and descriptions like risk assessment, identifying confidentiality threats, and overseeing the integrity of patient records and other PHI.
PHI disposal procedures
HIPAA sets guidelines for the disposal of both paper and electronic PHI. Medical documents, labels, and billing statements need to be properly discarded when no longer needed. This isn’t as simple as deleting E-records or shredding paper documents. The regulations state that records must be disposed of in a manner that cannot be reconstructed or duplicated. Consider these main points:
- Staff are prohibited from making digital copies and storing it in their personal devices for reference
- Paper documents must be discarded using shredders with micro cross-cut technology. This ensures the shreds are small enough that it’s not feasible to re-piece the documents.
- Messages containing records via attachments must be permanently deleted
Compliance with third-party vendors
Many pharmacies work with third-party vendors to handle logistical tasks like billing, invoicing, and customer service. These vendors may need to access patient records, and therefore, handle PHI on a daily basis. These vendors are identified by HIPAA as “business associates.” While they’re not subject to the same rigorous HIPAA compliance, they do need to sign an agreement affirming their understanding and commitment to follow confidentiality and recordkeeping procedures. This applies even for virtual assistants based overseas.
Some pharmacies have third-party vendors and their staff take the same HIPAA course. Others have the vendors agree to a shortened version of the course, such as limiting the content to relevant modules.
Worst-case scenario training
Even with diligent adherence, breaches can still occur. Create drills outlining various mock worst-case scenarios. Put staff in a safe environment replicating emergency situations that may arise. HIPAA has a breach notification rule with procedures on how to handle confidentiality breaches. Learners should understand and be tested extensively on response procedures. They should be able to:
- Describe the specific breach to HR
- Identify the PHI that was leaked
- Notify the patients whose records were potentially leaked
- Provide a detailed brief to patients on corrective actions to safeguard their sensitive information
Dokeos simplifies HIPAA compliance with its comprehensive LMS
HIPAA compliance can be complex to navigate; for drugstore pharmacists, it may feel like an oversight on top of their already hectic day-to-day operations. Dokeos makes compliance more manageable; our comprehensive SaaS solution incorporates the latest in LMS technology including but not limited to medical conferencing tools, security audits, double-blind evaluations, and synchronization with our cloud system.
Our clients include pharmaceuticals required to follow HIPAA, the General Data Regulation Protection (GDRP), as well as various European and international guidelines. Test our GxP compliant LMS with a free trial today!
