TIME LEFT?

The deadline for initial compliance with the HIPAA Privacy Rule was April 14th, 2003. There is no more grace period. And stiff fines and even imprisonment for "wrongful disclosure of individually identifiable health information."

We help practitioners, agencies and organizations comply with their new obligations under the DHHS's Health Insurance Portability and Accountability Act [HIPAA]. Among many others, the Privacy Rule establishes a patient's rights regarding the use and disclosure of health care information. In addition, there are policy, procedure and business service agreements to control access and use of patient information.

FEDS VS STATE LAW

The HIPAA Privacy Rule establishes minimum criteria for the use and disclosure of health care information. If state laws are more protective than the minimum HIPAA requirement, the state law will take precedence. If less, the HIPAA provisions prevail. HIPPA requires a "Notice Form" which compares all laws related to health care delivery in your state, and an analysis of which regulations or statues gives the greatest level of protection to health care information.

While the Privacy Rule focuses on policy, procedure and business service agreements to control access and use of patient information, the Security Rule looks at such conditions as access to offices, files and computers to insure confidential storage and communication of patient information.

USE AND DISCLOSURE

Under the Privacy Rule "use" is defined as the sharing, employment, application, utilization, examination or analysis of individually identifiable health information within an entity that maintains such information. "Disclosure" refers to the release, transfer, provision or access to, or divulging in any other manner of information outside the entity holding the information.

What is critical here are regulations about greater access to patient records, and obligations to inform patients about the potential uses and disclosure of Protected Health Information [PHI].

MORE PATIENT RIGHTS

Patients can now request a change in their PHI, with exceptions, if they feel that the information is incorrect ["Right of Amendment"]. They also have the right to receive a listing of all disclosures of any PHI ["Right of Accounting"] for the previous six years [beginning on the compliance date].

Patients have the right to request restrictions on the use and disclosure of of PHI for treatment, payment and health care operations purposes. Individuals must be informed of their rights as part of a "consent to treatment" process...but provision of services may be conditioned on on that person's willingness to to provide consent to disclose.

OTHER IMPORTANT HIPAA PROVISIONS

The HIPAA regulations are involved and complex; the purpose of this brief outline is to highlight only some of the core provisions. Others which will merit review include:

·    PRE-EXEMPTION ANALYSIS

·    JUDICIARY AND LAW ENFORCEMENT AGENCIES

·    RULES FOR ELECTRONIC TRANSMISSION AND FAXES

·    RULE "TRIGGERS"

·    PERSONAL AND LEGAL REPRESENTATIVES

·    MINORS

·    MARKETING AND FUND RAISING

·    STAFF TRAINING

·    DUTY TO MITIGATE

Practitioners, agencies and organizations are urged to consult their professional associations for guidance and to review the regulations in detail. [Sources for this summary included the American Psychological Association's Practice Organization and APA Insurance Trust.]

You can learn more about the Privacy Rule at the HSS Office for Civil Rights Privacy Web site at www.hhs.gov/ocr/hippa/ and the Government Printing Office web site at www.access.gpo.gov/su_docs/aces/aces140.html.

The Vantagepoint Group can also help you conduct a HIPAA COMPLIANCE AUDIT or help with training, policy and procedures development, or consultation.

You can contact us with the email link below: