Thurston County Board Briefing Request

Departments:

Briefing Date:

Item:

Responsible Staff:

Purpose and Expected outcome:

• Determine "Covered Entity Status" for Thurston County
• Review proposed policies necessary for HIPAA compliance
• Review training plan necessary for HIPAA compliance

Background:

• Congress passed the Health Information Portability and Accountability Act in 1996. This federal law includes requirements for protection of personal health information collected and used during the course of business in a number of Thurston County departments and offices. Requirements, and deadlines for compliance, include Privacy (April 2003), Transactions (October 2003), and Security (to be determined). The law also contains requirements of contract provisions for protecting personal health information that is collected by agencies that we contract with for services, our business partners.
• The Board appointed a Steering Committee in 2002 to conduct an assessment of the risks and gaps within Thurston County regarding HIPAA, recommend "covered entity status", recommend policies and procedures necessary for HIPAA compliance, create a training plan and conduct HIPAA audits.

Issues and Analysis:

• Disclosure of protected health information carries penalties including fines and jail time ranging from $100 per person per violation, up to ten (10) years in jail.
• There are a number of County offices and departments that collect and use protected health information. Public Health and Social Services, Juvenile Corrections, the LEOFF Disability Board, and Drug Court deal most consistently and directly with protected information through service delivery. We recommend these agencies be designated the "covered entity" of Thurston County.
• The following offices and departments collect and use protected health information, but do not provide health care as the core of their business: Adult Corrections, Coroner, Central Services, Communications, Human Resources, Pacific Mountain Job Development and Training, Parks and Recreation, Sheriff, and Medic One. Employees of these offices and departments should be required to attend training and be given copies of HIPAA related policies.
• All other County offices and departments should be offered training and be made aware of County policies regarding protection of health information. This will alleviate some risk to the County for inadvertent disclosure of protected health information by well-meaning employees.

Affected parties:

• Citizens that receive health services provided directly or by contract from Thurston County
• County Offices and Departments
• Agencies that provide health services by contract with Thurston County

Financial Impact:

Recommendation(s):

1. Determine "Covered Entity Status" for Thurston County as a "Hybrid Entity" per proposed resolution.
2. Approve policies necessary for HIPAA compliance per proposed draft.
3. Approve training plan necessary for HIPAA compliance per plan outlined above.