Performance Assessment

1 A. Create a planning, organize, directing, controlling (PODC) HIPAA training model by doing the following: 1.Describe how you would teach the hospital employees the rules and regulations regarding HIPAA. I would teach the hospital employees the rules and regulations regarding HIPPA in a hands-on training session with the employees. Due to having employees working this would have to be split up into different sessions so that all employees receive the proper training on how to understand all parts on HIPAA & how to use new and safe technology. This would be a session that would be required for all new employees as well to take after they start. This session would be taught to a specific department leader to they could teach this session to new employees or as a refresher course. P- I feel that I would have this session planned out ahead of time, using my time frame that I have set aside for each session, broken down into all parts needed to train. Keeping the employees engaged, so that they are understanding all information they need to properly utilize HIPAA will include time for role playing activities, as well as how to utilize the new software programs. O- I would require that the employees would come to a meeting room of some sort and be paid for their time working in the session. I would require my team to help run the meeting. I would also need the new software in the building to teach the employees how to utilize it. D- I would make a Power Point to train the employees as well as using the software that is being implemented in the hospital for training. The employees would complete the training in the session. 2 There would be no need to worry about having to complete at home. I believe using role playing as well as hands on training would motivate the employees to want to learn! C- At the end of the session there would be a 1-on-1 test with a member of my team to make sure the employees understand the new software as well as understand how to follow all HIPAA rules and regulations. A. i. 3 Appropriate types of PHI that can be shared between staff 1. Patient’s Name 2. Patient’s Demographics 3. Patients Admission and/or Discharge Dates ii. Where in the facility can the information be shared? The information should be shared in private places where people who are NOT part of the medical team can hear. Talking in a doctor’s ofÏce, or a private nurse’s station would be appropriate places. Talking in the elevator or the cafeteria would NOT be appropriate places. iii. 3 Individuals who can use and disclose information? 1. Doctors 2. Nurses 3. Healthcare Managers/ Nurse Managers B. 2 penalties associated with breaching patient information The violation of breaching patient’s information can have 2 outcomes, but it depends on the reason of breach. A failure of a covered entity to comply with HIPAA standards can end up with a $100 per violation fine and up to $25,000 fine. But a much more severe violation would be due to the 3 intentional misuse of a patient’s information’s (this can be for commercial advantage, personal gain, or malicious harm against the patient) which would cause a range of a fine from $50,000 to $250,00 and from 1 year to 10 years in prison. C. Identify 2 appropriate ways to secure data from one working shift to another using HIPAA guidelines. One way would be by having the system lock itself requiring the next working person to have to log in using their personal credentials to make sure they have access to the patient’s information. The next would be by making sure there is a security software in place that would alert if anyone from outside the organization was trying to access data, or if someone was trying to access data that they don’t have the rights to access. 2. Complete an internal audit plan of all security measures meant to protect health information by doing the following: a. Identify which department will oversee the audit. The best department to oversee the audit that would be put in place would be a Health Information Manager/Information Technology (IT)Department in combination. They would be the department that would help get the software installed into the system, so they are going to know the best on how the system works. b. Explain three security practices the audit will review. 1. Making sure there is up to date security software installed on all computers that are being used. 4 2. Making sure that everything is password protected, and the correct people have received passwords once they have completed a background check. 3. Making sure that e-mail accounts are not accessible outside of the hospital. Example- on cell phones, iPads, or tablets. This can be a security breach due to being outside of the hospital. c. Describe three potential changes that can be made within the organization to address the results of the audit. 1.When doing the audit, you can see if there is up to date security software on each computer. If not, you are vulnerable to outside attacks. If needed, make sure the update happens immediately. 2. During your audit, you need to make sure all correct items are password protected. If not, they need to be. You also would see that all employees who have completed their background check have passwords. If they have not completed their background check, they should not have passwords. Make sure each person is using their own password as well and not someone else. Make sure any employees who no longer work there also have their passwords deleted. Double checking who is employeed and if they have a current password. A system should be in place to verify this. 3. Making sure that e-mail accounts are not being accessed from other sources outside of the hospital. If a hospital employee is accessing their e-mail from an outside source, they may not be on the correct network and could be hacked. Patients health information could get out a lot easier. Make sure the email is over the correct network, so it can only be accessed inside the hospital. Also, an alert should be received if someone accesses this email from outside the hospital with their IP address, date, and time. 5 d. Create a risk assessment plan to identify the potential for any future security breaches. i. Identify how often this assessment plan should be completed. The assessment plan should be completed by both the Health Information Manager as well as the IT department. ii. Identify who will complete this assessment plan. This assessment plan should be reviewed on a monthly basis. 6 B. Determine the financial impact of a new HER system by doing the following: 1. Develop a risk versus benefits summary for the key stakeholders of the hospital to show why an EHR system should be invested in and implemented. Benefits:  Protect patient’s Health Information by using appropriate technology.  It will make it easier to order medication, labs, and radiology orders.  By sending prescriptions electronically versus having to give paper copies.  It will give patients, the ease of being able to access the summary care record for other doctor’s appointments.  You can direct patient’s to different patient education materials.  Patient’s can view forms online via a patient portal.  Gives hospitals the ease of submitÝng electronic public health data when needed to the appropriate places. Risks:  Using an online software can result in unauthorized access to Patient’s Health Information.  There can be mishaps when ordering labs or radiology or if a specific department does not use the same program.  Patient’s can have a hard time navigating the programs they have access too.  Patient data from prior to using the new system would not be on there for the patients to access.  No paper trail for prescriptions when they are sent to the pharmacy with signatures. 7 a. Identify four key decision makers who give input and buy in. 1. Doctors/Nurses/Medical Assistants, etc.- These will be the front-line workers having to utilize the program the most. They will have the most contact with the patients and using the program. 2. Administrative Workers- These will be the people who will need to use the program to schedule, check-in, take phone messages, etc. and will have to know how to use the program when talking to these patients. 3. Managers- All managers will have to understand the programs so they can help any employees who are new, or anyone who may not understand something in the program. 4. Billing Department- They will have to use the program to get the correct code from the patient’s file in order to bill them for the correct thing. b. Include two CMS requirements for the new system. The Computerized Provider Order Entry (CPOE) and the clinical decision support will both have to be used in the new system. 2. List four new hardware components required for the new system. 1. Central Processing Unit (CPU) 2. Primary Storage 3.Secondary Storage 4. Input/Output Devices a. Identify the potential capital dollar investment for the new system. 8 The approximate cost to install tier 2 of Epic would cost around $7 Million dollars. b. Discuss which of the three EHR systems would be the best system for your organization. I believe that Epic Tier 2 would be the best. It is very similar to Meditech, but it also includes billing software as well as charging. This program is a very well-known program throughout the United States, so many new employees may already have training on this program as well, even though training is included. It includes many differet benefits that will help our hospital including clinician documentation, medication tracking, admission/transfer/discharge paperwork, and much more. Ordering labs and X-rays will all be through the system now. When installing, we will also have support of the team and integration with other hospital systems. 3. Identify three components or applications that will need to be incorporated into the HER system at your small critical access hospital. 1. The hospital will need to implement a system for admission/transfer/ and discharging of patients through the system, so when a patient gets transferred, they have all the correct data. 2. Physicians will be able to order lab, x-ray, therapy by electronically submitÝng them, so even though it is not at the small hospital, it can still be seen by the other hospital. 3. Doctors and nurses will be able to utilize the system to take clinician documentation versus having to write everything out and record it in patient’s health records. a. Discuss the key security and privacy components of the EHR System you selected in part B2b. Implementing this system will be the biggest security and privacy issue. Making sure that everything is running correctly and there is no way for outsiders to hack into the system are a big deal. You will also need to make sure that passwords are set up correctly and immediately. Utilizing the audit that was talked about earlier will make a big difference as well. You are also going to want to make sure 9 that you have an IT department ready for this change, and that there is always an IT member at the hospital to help in real time. There must be safeguards in place so that HIPAA is not violated in any way. Having alerts that go to a specific person, if someone is accessing materials, they shouldn’t so that a conversation can be had with the person. A system that if someone tries and enters a password more than 3 times, it locks them out and can only be fixed by IT. Lastly, a system that audits each user and what they are doing when logged in and can track it. C. Create an appropriate training plan for all clinical and non-clinical staff by doing the following: 1. Identify the estimated number of total hours required to learn the EHR system for both clinical and non-clinical staff. Clinical staff will need between 10 hours to learn the system and non-clinical staff will need between 5-6 hours. 2. Describe the logistics required to train all employees on all shifts by doing the following: a. Identify how many training sessions would be reasonable for approximately 150 day-shift employees. I would split it up into 6 groups of 25 employees for the 10 hours. b. Identify how many training sessions would be reasonable for approximately 50 night-shift employees. I would again split into groups of 25, so 2 sessions. c. Identify how much the training will cost, assuming an average wage of $21 per hour and a total training length of 6 hours per employee and 10 hours per employee. The average cost for all 200 employees would be $33,600 for training. 10 d. Develop a training plan for 75 physicians. This training would take place over a 2-week time frame. This would cover each weekday, as well as 2 different time blocks for physicians to attend. 3. Describe a train-the-trainer program you could implement to ensure ongoing support and training of new employees. Train the trainer program would be nice, because then you can teach someone else and make it their responsibility to train any new employees. I would pick a training team and have them attend as many sessions as they could. This team would be made up of numerous employees, picking from various locations in the hospital as well as many positions. These team members would be stand out employees who have a great recommendation from their superior. I would make sure to have them attend at least 2 physicians, 2 clinical, and 2 administrative trainings. After that, I would hold a training class for them. This would be to cover any questions they may have, as well as give them a final to test to validate them in their position as a trainer! They would be the ones to train new employees, and once a month a conference call would be held with this team to make sure they are not running into any problems, and let them know of any updates they may need to know. 4. Describe a transition plan for employees transitioning from the old EHR system to the new EHR. 1. Map out where we currently stand- What are we using? How will things change? 11 Things will change to an all Electronic form, which is going to be going from paper and a big change for our staff. 2. Plan the change- What is going to change? Will the whole hospital change at once, or by department? It will be best to roll out the change in a 4 day period, where we can have numerous staff to help. Going to all electronic records should make it easier, as long as the staff took the training serious and really put a good effort to learn it all. 3. Plan for contingencies- Who will assist if things go wrong? Who will take the lead on the project of transitioning? Between IT, department managers, the trainers we have established and the HIM; these will be our leaders for this rollover. 4. Build an HER Implementation Plan- transitioning from paper to electronic. Who will take care of this project? We will have to hire 3-5 employees who have knowledge on transitioning paper records to electronic to start this project. 5. Plan for chart migration- who will lead this? The manager of the administrative team will be in charge. 6. Understand Data elements- What is all getÝng moved over to the new system? All health records will be moved over. Many new systems will be implemented to make it easier, including ordering medication, ordering labs and x-rays, how the doctors and nurses note in the files, ect. 7. Start thinking about privacy and security. (HealthIT.gov, 2019) 12 Having our IT team take the lead, and utilize our audit and all our other procedures we have discussed will cover our privacy and security. a. Describe how you will measure whether employees have demonstrated competency with the new system. First, I would make sure that all employees understand how to utilize the new system during training as well as giving them a test. Then I would do follow ups with all employees about 1 week, and 1 month after implementing the new system. If errors are found during the follow up, or at any time, I would make sure to have them work with a trainer that way they understand how to use the system properly. The trainers would be the ones doing the follow up. This can also go for any new employees who start after the upgrade. b. Identify the most appropriate time of day and the day of the week to initiate the transition. I would choose a Monday at 10 AM and have it roll into the evening shift, roughly 7 PM. This would cover both day and night shift help. I would also make sure to have this planned out ahead of time, so that no elective procedures where being scheduled on this day to make it a little easier. I would make sure our team was also around on Tuesday and Wednesday, just as assistance to anyone who may need it. i. Identify 3 Leaders who should be on site for the transition period. ii. Justify why you chose the three leaders. a. IT Department- They will help with making sure all technology is working correctly. b. Managers of Departments- They will be able to help make sure their department is making the change okay and assist their department. c. Trainers- They will be able to help with any last-minute training. 13 5. Describe one approach you could use in collaboration with your new administration team to reward the staff for successfully learning and transitioning to the new EHR system. I would make sure that all shifts would get food catered to them for their lunch/dinner breaks. Having a nice meal would be a nice treat. a. Explain how you would collaborate with your administration team to initiate the approach described in part C5. I would talk to all administrators during training and come up with a team who would be responsible for this undertaking. Once signed up, the team would be given a budget from administration and it would be their job to follow through on the incentive of food for all employees. This way the administrative team could focus on the rollover to the EHR. .