NRMC | HIPAA Compliance Intervention Proposal
HIPAA COMPLIANCE INTERVENTION
Michael L. Sanford
Portfolio Sample Only.
Please be aware that any product or corporate names mentioned in this document may be trademarks or registered trademarks, and are used solely for identification and explanation purposes without any intent to infringe. The Program Content in this document is designed to help you improve your talent development skills and is intended for personal use only. Please note that the Program Content may be updated or modified without prior notice. It is important to understand that you cannot copy, share, or use the Program Content to train others. However, once you have completed the course, you are welcome to share your insights with your peers, refer to specific models or concepts that you learned in the course (as long as you do not use them for training purposes), and review the Program Content to reinforce your learning. It is important to note that the Program Content is provided "as is" and does not constitute professional advice or endorsement of any views or opinions expressed therein. You are solely responsible for using the Program Content, and any consequences that may arise.
Table of Contents PROJECT SPONSOR REQUEST FOR PROPOSAL ....................................................................................................................................................................................................... 3 CLIENT PROFILE ..................................................................................................................................................................................................................................................... 3 NEEDS ASSESSMENT – KEY INSIGHTS ..................................................................................................................................................................................................................... 4 LEARNING OBJECTIVES .......................................................................................................................................................................................................................................... 6 INTERVENTION DESCRIPTION ................................................................................................................................................................................................................................ 7 DATA COLLECTION PLAN ....................................................................................................................................................................................................................................... 9 REPORTING STRATEGY ........................................................................................................................................................................................................................................ 14
Project Sponsor Request for Proposal NRMC is a three-hundred-bed healthcare facility providing emergent and surgical services for an exurb community in metro Atlanta, Georgia. The leadership team is in talks to merge with another healthcare system. One of the potential agreement conditions is for NRMC to demonstrate compliance across many key administrative and regulatory areas of their operations. Presently, many of the staff at NRMC frequently violate the terms of the Health Insurance Portability and Accountability Act (HIPAA), primarily due to printing records from their system that contain personal information about their patients. Senior executives are exploring ways to improve HIPAA compliance, and they perceive that developing a healthcare compliance course for all hospital employees would be an excellent way to achieve their operational efficiency and risk management goals.
Client Profile Client: Sector:
Noncompliant Regional Medical Center (NRMC) [A 350-bed non-profit surgical center in an exurb of metro Atlanta, Georgia.]
Healthcare Purpose: Regulatory Compliance [Merger is contingent upon the improvement of specific compliance benchmarks.] In 2022 NRMC suffered a significant blow to its reputation when an employee left several printed pages of a patient’s file on a table in a public area that were found by a visitor to the facility who then photographed the documents and posted the images to social media causing a viral incident that damaged the reputation of the facility and its leadership team. The incident was just one example of the lapses concerning the potential merger. The following assessment aims to identify the underlying causes of the lapses in compliance and present a training intervention to address the matter so NRMC can move forward with its merger.
Needs Assessment – Key Insights Identify Target Audience: •
Determine the groups within the hospital that require HIPAA training, such as healthcare providers, administrative staff, IT personnel, and anyone who handles patient information.
Assess Knowledge Gaps:
•
Conduct a survey or interviews to gauge the current level of understanding regarding HIPAA regulations among the target audience. Identify common misconceptions, areas of confusion, or gaps in knowledge.
Review Compliance Issues:
•
Analyze past HIPAA compliance incidents or violations within the hospital. Understand the root causes, patterns, and recurring issues to focus the training program on these specific problem areas.
Determine Training Objectives:
•
Based on the assessment findings, define clear training objectives that address the identified knowledge gaps and compliance issues. Examples may include understanding HIPAA privacy and security rules, maintaining patient confidentiality, proper handling of PHI, incident reporting, etc.
Develop Content:
•
Create engaging and interactive training materials aligned with the objectives. This can include presentations, case studies, videos, quizzes, and practical exercises. Ensure the content is tailored to different job roles and incorporates real-life scenarios specific to the hospital environment.
Incorporate Interactive Elements:
•
Utilize interactive elements such as role-playing exercises, group discussions, and simulations to reinforce learning and encourage active participation. This approach helps employees understand how to handle various situations while adhering to HIPAA regulations.
Develop Assessment Measures:
•
Include assessments, quizzes, or scenario-based exercises to evaluate participants' understanding of HIPAA compliance. This provides an opportunity to measure the effectiveness of the training program and identify areas that require additional focus or reinforcement.
Track Progress and Compliance:
•
Implement a system to track employees' completion of training and monitor their adherence to HIPAA requirements. This can include documentation of training completion, regular audits, and reporting mechanisms to identify and address any compliance gaps.
Business Impact Goals: • revenue growth
•
operational efficiency
•
customer satisfaction
• • •
employee foundational knowledge and skills managing risks regulatory compliance
Learning Objectives Level 1: Reaction and Planned Action Level 2: Knowledge and Skills At the end of the online course, participants will complete a survey in After completing the online course, Noncompliant Regional Medical Center which they will rate the following statements on a five-point scale (NRMC) staff will be able to: where one indicates no agreement at all, and five indicates complete • Successfully complete a simulation of patients' information agreement: disclosure in 10 minutes. • The key concepts were explained thoroughly. • Identify five examples of HIPAA violations. • The training format was engaging. • Define personally identifiable information and give seven • The course presented the most up-to-date compliance examples. and data security information. • Demonstrate how to report privacy breaches and security • I have created a plan I will implement to comply with incidents in 5 minutes. HIPAA (Health Insurance Portability and Accountability). • Identify the six permitted disclosures under HIPAA. • The program was important to my job success. • Explain the consequences of HIPAA noncompliance. • Participants can demonstrate acceptable performance on each major competency. • Identify ways to be HIPAA compliant (based on the job role) Level 3: Application and Implementation Level 4: Business Impact When the course is implemented: After the implementation of this course: • HIPAA compliance incidents and violations will be down • The number of HIPAA violations and incidents should by 50% decrease by 50% in one year • 100% of participants will utilize competencies daily • After six months, patients' HIPAA-related grievances will be • 75% of participants will be able to successfully write an reduced by 50%. incident report • 100% of participants will safeguard PHI (protected health information) • Printing of patient documentation will cease within 3 months of course implementation • Within one month, all managers will communicate the transformational shift to all employees.
Intervention Description Compliance Intervention Components Orientation Session – The Critical Role of Compliance: The orientation session covers the basics of HIPAA regulations, including: • what are they, • why they are essential, and • how they impact patient care. Additionally, the orientation session provides employees with resources such as a HIPAA handbook to refer to as needed. Incorporating an orientation session into this HIPAA training program ensures that all employees possess the minimum essential information for HIPAA compliance. Management Messaging and Engagement – Everyone is Responsible for Compliance: By providing employees with explicit instruction from their direct managers and the leadership of the facility more broadly, the onus of responsibility is not diluted such that any member of the staff can believe that the actions causing the compliance issue are due to someone other than themselves. Every staff member is responsible for doing their part to ensure the facility maintains HIPAA compliance. Future compliance failures will be remediated with mandatory one-on-one coaching and direct, immediate feedback. This will help individual learners internalize the material and feel more responsible for and confident in their ability to comply with HIPAA regulations. Self-assessment – Recognition of Everyone’s Role in Compliance: The self-assessment component of the training allows employees to take the time to evaluate their understanding and adherence to HIPAA regulations and can help staff recognize where there is a need to improve their procedures and practices to protect patients’ privacy better. This HIPAA training program includes opportunities for self-assessment and encourages ongoing self-reflection through weekly reminders of processes related to HIPAA compliance. In addition, whenever a patient record is sent to a printer, the system will require the staff member to review a self-assessed checklist of alternatives to printing the document to reduce this problematic practice by the staff. Interactive Scenario-Based Learning Modules – The Practices of Compliance: The responsibility for data protection is vital to this HIPAA training program and is crucial for maintaining patient confidentiality and trust. Online learning modules emphasize the importance of securing patient information, identifying potential risks, and outlining proper protocols for handling sensitive data. The modules include practical examples and scenarios to help reinforce the message with case studies and branching scenarios where the learners engage with realistic situations where patient data is at risk, demonstrating the proper procedures to safeguard that data. Compliance Simulations – Peer Feedback-Driven Learning: In small group sessions of three staff members, learners will review a series of scenarios demonstrating HIPAA compliance dilemmas. During the sessions, one learner will be the decision maker; one will present the scenario, and the third will record observations and provide feedback on the decisions made in the scenario.
In each session, three scenarios will be completed so that each learner can present a scenario, respond to a second separate scenario, and provide feedback to a peer based on their responses to a third distinct scenario. The dilemmas presented in the scenarios will be based on the HIPPA compliance failures identified during the needs analysis. During the session, if a learner fails to comply with HIPAA in their response, the peer team will complete a privacy breach and security incident report based on the simulation. HIPPA Compliance – Individual Engagement: To increase learner engagement, the training team used real-life examples to illustrate the importance of HIPAA compliance and how it impacts patients, healthcare providers, and the hospital. The training was adapted to address the various roles within the hospital because they each have different responsibilities regarding HIPAA compliance and how it applies to their specific job duties. Ongoing training will be provided because HIPAA regulations are constantly evolving. Ongoing Support - The Need for Coaching: The goal of coaching healthcare professionals is to ensure they can learn how to handle sensitive patient information and prevent potential breaches. This step also provides a safe space for healthcare professionals and support staff with access to patient data to ask questions, discuss scenarios, and receive feedback on their understanding of HIPAA regulations. By incorporating coaching into the HIPAA training program, we ensure that healthcare professionals are fully equipped to protect patient privacy and maintain compliance with HIPAA regulations. Compliance Scoreboard – Measuring and Celebrating Success: The employee login screen for all staff has been updated to include reporting compliance metrics. Any incidents of printing patient information or other disclosure of protected health information will be registered and tracked on this scoreboard so that all staff know the facility-wide success in maintaining compliance as a group.
Data Collection Plan Level 1
2
Measures/da ta At the end of the course, a) Learner learners will be able to Performan cite relevant details of ce in the HIPAA statute that tracked govern how they modules perform their role at of NRMC. eLearning. b) b) Learner Survey Responses . c) Learner HIPAA Action Plans created in program. Objective(s)
After completing the online course, Noncompliant Regional Medical Center (NRMC) staff will be able to: • Successfully complete a simulation of patients'
Learner Performance in tracked modules of eLearning and Learner Performance as reported from Peer Evaluated
Data collection method
Data sources
Timing
Responsibilities
a) LMS tracking and reporting. b) Microsoft Forms instrument Integrated in Teams with chatbot prompts to complete and follow ups until responses are obtained. c) Submitted by Learner to their Manager, who will integrate their plan into the annual review for the employee with details on observed compliance to plan and regulations annually. Plans should include similar elements; a form will be provided for the managers with drop downs to streamline the plan reporting process in the HRIS.
a) LMS collected data from completion of eLearning modules. b) Learner Supplied responses from survey at the end of the program. c) Learner to Manager to HRIS in annual review.
a) Throughout program. b) Collected Once at the end of the program. c) Collected by the manager at first review following end of the program, and with ongoing compliance updates annually during reviews.
Tracked within the LMS.
Learners and their peers from the peer evaluation exercises.
Throughout program as each exercise is completed.
a) Facilitator following up with learners as they complete the program. Learners to complete themselves. Reports reviewed by L&D team, and summary reports are circulated to management chain of the learner with full details available in HRIS with direct manager access. b) Learner to complete as prompted by chatbot system. Reports reviewed by L&D team, and summary reports are circulated to management chain of the learner and project stakeholders/sponsors. c) Learner for creating, Managers for collecting and documenting in HRIS during annual review and annually thereafter. Facilitator following up with learners as they complete the program. Learners to complete themselves. Reports reviewed by L&D team, and summary reports are circulated to management chain of the learner with full details available in HRIS with direct manager access.
Level
Objective(s) information disclosure in 10 minutes. • Identify five examples of HIPAA violations. • Define personally identifiable information and give seven examples. • Demonstrate how to report privacy breaches and security incidents in 5 minutes. • Identify the six permitted disclosures under HIPAA. • Explain the consequences of HIPAA noncompliance. • Participants can demonstrate acceptable performance on each major competency. Identify ways to be HIPAA compliant (based on the job role)
Measures/da ta Authentic Learning Exercises.
Data collection method
Data sources
Timing
Responsibilities
Level
Objective(s)
3
When the course is implemented: a) HIPAA compliance incidents and violations will be down by 50% b) 100% of participants will utilize competencies daily c) 75% of participants will be able to successfully write an incident report d) 100% of participants will safeguard PHI (protected health information) e) Printing of patient documentation will cease within 3 months of course implementation f) Within one month, all managers will communicate the transformational shift to all employees.
Measures/da ta a) HIPAA complianc e incidents reports. b) Behavioral Change Metrics (number of patient record print jobs and unauthoriz ed patient record access). c) Competen cy achieveme nt in program. d) Incidents reports per statute. e) EMR tracked and displayed number of print jobs appears on login screen for every employee individuall y, and
Data collection method
Data sources
Timing
Responsibilities
a) Reported in HRIS with EMR integration. b) Automatically tracked by EMR. c) Automatically tracked by LMS. d) Reported in HRIS with EMR integration. e) Automatically tracked by EMR. f) Reported in HRIS.
a) Incident reports filed by employees and patients. b) EMR system tracking. c) Learner performance within program. d) Employee reports per statute. e) Employee Behavior as tracked within EMR. f) Learner
a) Ongoing as incidents occur. b) Ongoing and continuous in real time. c) Collected during program. d) Ongoing and continuous in real time. e) Ongoing and continuous in real time. f) Once at the end of the program.
a) Reports reviewed by L&D team, and summary reports are circulated to management and project stakeholders/sponsors. Copies of full data sets to Compliance, Legal and Chief of Medicine. b) Reports reviewed by L&D team, and summary reports are circulated to learner management chain and project stakeholders/sponsors. c) Facilitators to follow up with Learners during program to ensure timely completion. Reports reviewed by L&D team, and summary reports are circulated to learner management chain and project stakeholders/sponsors. d) Reports reviewed by L&D team, and summary reports are circulated to learner management chain and project stakeholders/sponsors. e) Reports reviewed by L&D team, and summary reports are circulated to learner management chain and project stakeholders/sponsors. f) Direct management report of each Learner/participant,
Level
Objective(s)
4
After the implementation of this course: a) The number of HIPAA violations and incidents should decrease by 50% in one year b) After six months, patients' HIPAArelated grievances will be reduced by 50%.
5
Return on Investment
Measures/da ta facility wide. f) Learner reported occurrenc e of conversati on. HIPAA incident reports.
a) 1,693 employee s (for a 350 bed medium sized hospital) b) $1,479,00 0.00 – Salary expense of facilitywide time spent in training program.
Data collection method
Data sources
Timing
Responsibilities L&D team to follow up for any unreported instances every ten days, starting at 30 days after program completion.
Reported in HRIS with EMR integration.
Incident reports filed by employees and patients.
Ongoing as incidents occur.
Reports reviewed by L&D team, and summary reports are circulated to management and project stakeholders/sponsors. Copies of full data sets to Compliance, Legal and Chief of Medicine.
a) HRIS tracked b) HRIS tracked c) HRIS tracked d) Reported by IT e) Set by Statute f) Reported by Accounting
a) HRIS b) HRIS c) HRIS d) IT e) Federal Register and the Department of Health and Human Services f) Accounting
All data points are collected and calculated annually to determine ROI for the year. The calculations included herein are projections for Year 1 of the program based on meeting metrics for the objectives of the intervention.
Projected Fines for the year (50% reduction): $1,199,499.50 Total Program Cost + Annual Fines: $2,998,499.50 Goodwill Not Lost due to HIPAA Violations: $4,360,940.86 Total Benefits = $5,560,440.36 Net Benefits = $2,561,940.86 ROI = 85.44%
Level
Objective(s)
Measures/da ta c) $300,000. 00 – salary expense of L&D team d) $20,000.0 0 – cost to modify and implemen t dashboard tracking in EMR e) $2,398,99 9.00 – Annual HIPAA penalty maximum f) $2,180,47 0,432.00 – Intangible Assets (Goodwill vulnerable to loss in the event of continued HIPAA violations)
Data collection method
Data sources
Timing
Responsibilities
Reporting Strategy Role Facilitator
Typical Decisions How can I improve my presentation and facilitation skills for the program? Am I contributing to the improvements with compliance within the facility?
Instructional Are my programs Designer meeting business needs? Are there any meaningful changes I can institute without rebuilding the entire course? Learners
Am I contributing to the improvements with compliance or hurting compliance efforts?
HR Compliance Officer
Are we on track to meet or exceed compliance targets? Are my programs effective? How can I
Critical KPIs Qualitative Evaluations (Survey Responses), L&D Management Feedback, Patient Data Print Job (PDPJ) and Unauthorized Records Access (URA) Metrics Qualitative Evaluations (Survey Responses), L&D Management Feedback, PDPJ and URA Metrics
Event-based Alert Daily Learning Report with Progress Updates for each Cohort During Program
Monthly Monthly Summary for HIPAA Compliance Plan Submissions and Granular Learner Performance Over Time with PDPJ and URA by Cohort
Quarterly Qualitative Evaluation Aggregate Reports Across Cohorts, PDPJ and URA Performance Comparison for Learners from Facilitator’s Cohorts vs The Facility Overall
Ad Hoc Data Access Full Access to Learning Reports from LMS, Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate
Cohort Performance Report as each group of Learners completes the Intervention, triggered when last Compliance Plan is submitted for each group.
Monthly Summary for HIPAA Compliance Plan Submissions and Aggregate Learner Performance Over Time with PDPJ and URA by Cohort
Qualitative Evaluation Aggregate Reports Across Cohorts, PDPJ and URA Performance
Number of PDPJ, Number of URA, Completion of HIPAA Compliance Plan, Completion of HIPAA Compliance Intervention Qualitative Evaluations (Survey Responses), L&D Management
Alert Report for URA, Alert Report for PDPJ, Alert Report for HIPAA Compliance Plan Delinquent 30/40/50/60 days
Summary of Alert Reports for PDPJ & URA, First Month After Completing Program – Receive Summary Report of Performance in Compliance Program
Summary of Monthly Alert Reports
Full Access to Learning Reports from LMS, Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate
Alert Report for URA or PDPJ Metrics exceeding compliance targets
Monthly Summary of Aggregate Learner Performance Over Time with PDPJ and URA
Qualitative Evaluation Aggregate Reports Across Cohorts, PDPJ and URA Performance Over Time
Full Access to Learning Reports from LMS, Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ
Role
Typical Decisions increase their impact for the organization?
Critical KPIs Feedback, PDPJ and URA Metrics
Event-based Alert
Monthly
L&D Director
Are we on track to meet or exceed compliance targets? Would an outside resource provide more impact for compliance?
Noncompliance Fine Received, PDPJ and URA metrics at certain thresholds
Monthly Summary of Aggregate Learner Performance Over Time with PDPJ and URA
Legal Department
Are we on track to meet or exceed compliance targets? Do we need to reallocate resources for litigation defense regarding noncompliance levels? What is the risk of this impacting our merger efforts with Wellmont Medical Group? Are we on track to meet or exceed compliance targets? What is the risk of this impacting our merger efforts with Wellmont Medical Group? Do the providers need to be more incentivized to contribute to compliance efforts?
Projected vs Actual ROI, Noncompliance Fines Year to Date, Projected Intangible Assets Depreciation Related to Noncompliance Year to Date Noncompliance Fines Year to Date, Projected Intangible Assets Depreciation Related to Noncompliance Year to Date, Patient Complaints Related to HIPAA Violations
Noncompliance Fine Received, PDPJ and URA metrics at certain thresholds
Noncompliance Fines Year to Date, Projected Intangible Assets Depreciation Related to Noncompliance Year to Date
PDPJ and URA Performance Over Time
Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate
Noncompliance Fines Year to Date, Projected Intangible Assets Depreciation Related to Noncompliance Year to Date, Patient Complaints Related to HIPAA Violations
Noncompliance Fine Received, PDPJ and URA metrics at certain thresholds
Noncompliance Fines Year to Date, Projected Intangible Assets Depreciation Related to Noncompliance Year to Date
PDPJ and URA Performance Over Time
Electronic Medical Record Portal/Home screen Includes Real Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate
Chief Medical Officer
Quarterly
Ad Hoc Data Access and URA Data Individually and the Facility Aggregate Qualitative Evaluation Full Access to Learning Aggregate Reports Reports from LMS, Across Cohorts, Electronic Medical PDPJ and URA Record Portal/Home Performance Over screen Includes Real Time Time Dashboard of PDPJ and URA Data Individually and the Facility Aggregate