Get HIPAA Compliant
by Beth Ehlich, D.C.
Now is the time to see that your office is HIPAA compliant with the new regulations that have been handed down by the Department of Health and Human Services. The deadline for compliance for the Health Insurance Portability and Accountability Act, or HIPAA, is April 14, 2003* (see page 3). It is on this day that your office will need to have a new approach to handling the personal history and information of the people you serve in your office through chiropractic care.
It will be important that you have a compliance manual for your office. The manual will document how you are protecting your patients’ privacy and therefore will have to be specific to your office.
Many people have approached me with questions about the issues that must be addressed with the new law. So much concern is being expressed that I have seen many people who just want to avoid the whole deal, do nothing and hope it will all go away like a bad dream. It is not going to go away, but complying is not going to be as bad as you thought it would be.
Remember, in the last issue of Straight Talk, we showed how those who do not file electronically will be least affected.
Let me bring you up to date and shed some light on this matter and maybe you too will see that compliance will not be much more than what you are already doing in your office as a responsible provider to the public.
The main thrust of the HIPAA law is to allow the patient more say as to how their personal health information is handled and to ensure that their information is kept private and confidential. Under the new regulations, patients have the opportunity to consent or deny consent for the use of their personal health information.
In other words, if a patient does not wish to participate in a marketing program, you must give them the opportunity to opt out for that or any other program that they choose not to participate in. This matter is handled by a simple form that is signed in the beginning of their care in your office.
However, under the law, this isn’t something that you the individual doctor or office can opt out of. You must inform the patient of your business procedures and then give them the chance to say, “Yes, that’s fine,” or “No, I do not wish to participate.” You must also inform the patient if you sell your patient’s addresses and again give them the chance to opt out if they do not wish to have their address information made available others.
You must take measures to insure confidentiality in your office. This translates into making sure files are not out and available for viewing by other patients or people that might be in your office.
If you have wall pockets that hold patient files, you must make sure the file names cannot be seen. Files and x-rays cannot be stored in places where patients could view them to the point of reading or identifying them or go through them.
Access to any personal information must be restricted to all except members of your staff that must have access to do their job. Most all of us already take these subjects seriously, but now even more so, we must be aware of any situation that could put any patient’s information at risk and take measures to fix it.
The questions on everyone’s minds are, “Can I still have a sign in sheet?” and “What about adjusting in an open adjusting environment?”
The answers are yes, you can still have a sign-in sheet and yes, you can adjust in an open adjusting environment. The sign-in sheet is not considered part of a file and is not a legal document, so therefore it is not subject to HIPAA laws.
Also, the open adjusting is fine. You are not expected to make structural changes to be compliant and as long as emergency rooms exist with curtains and semi-private rooms are available, it is understood that complete and total privacy isn’t possible.
You do, however, need to notify the patient of your open area policy and let them know a private room is available should they need to discuss a lengthy or sensitive matter with you or a staff member. The patient must also grant permission for a spouse or other family member or friend to hear a report or see them receive an adjustment.
There are other matters that concern all offices that handle private, personal health information. However, these matters are easily handled with a few forms and explanations and a greater awareness of how patient information is handled in an office. I encourage you to attend a HIPAA compliance seminar soon and examine you own office for any areas of improvement you can make in the handling of patient information.
Most offices are already very responsible in this area, but it is a good idea for everyone to check these areas to make sure all patients are receiving our very best when it comes to protecting their information and serving them through chiropractic care.
If you have further or more specific questions, you can contact me by e-mail at bethehlich@aol.com and I will respond with an answer. Also, leave a phone number just in case I need to speak with you by phone.
* Editor’s note: As we go to press, the PSCA has learned that the HIPAA deadline has been moved back to February 20, 2005, so you have time to work on the issues that will affect you. Don’t panic — the PSCA will keep you informed.