Laureen shows you her proprietary “Bubbling and Highlighting Technique”
Download your Free copy of my "Medical Coding From Home Ebook" at the top right corner of this page
Anthem paid a $ 16 million settlement resulting from a series of attacks in both 2014 and 2015 that had the potential to expose personal health information (PHI) of 79 million people. Although they paid the $ 16 million settlement, Anthem does not admit to any wrong doing. This represented the largest PHI breach in US history […]
The post Anthem Pays Largest HIPAA Fine appeared first on AAPC Knowledge Center.
Submit your HIPAA questions to Associate Editor Nicole Votta at [email protected] and we will work with our experts to provide you with the information you need.
Q: My office manager at an outpatient practice revealed to two employees that I’m a recovering alcoholic. I’m a midlevel practitioner and a patient of one of the physicians in the practice. Is this a HIPAA violation?
A: It may be a HIPAA violation because you are a patient of the practice. If the office manager accessed your medical record or learned of your condition during a conversation with your physician, it would be a violation of the HIPAA Privacy Rule. On the other hand, if the office manager disclosed information about your medical condition and it did not relate to treatment at the clinic (say, the information came from a job interview with you or was documented in your personnel file), it would not be a HIPAA violation because the information was available to your office manager acting as the employer. It may still be a violation of state law or other federal law, but it would not be a HIPAA violation.
Editor’s note: Chris Apgar, CISSP, president of Apgar and Associates in Portland, Oregon, answered this question for HCPro’s Briefings on HIPAA newsletter. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions.
In a time when many scoff at the potential of being levied steep penalties for violation of HIPAA rules, a judge just upheld a fine that the Department of Health and Human Services (HHS) issued in 2017 for Texas-based MD Anderson’s use of unencrypted devices. This penalty is stiff and says that you cannot just […]
AAPC Knowledge Center
HIPAA Q&A
Privacy in the workplace
by Chris Simons, MS, RHIA
Q: I work for a company that provides an array of services to children and adults with mental illness and developmental disabilities. We recently launched an audit of our signed HIPAA forms, which has led to this question: If the guardian for an individual should change, does the new guardian need to sign a HIPAA form?
A: The purpose of the acknowledgment (apart from compliance) is documentation that the legal decision-maker/patient has received the notice of privacy practices. Since the legal decision-maker has changed, the best practice would be to get another acknowledgment, consent for treatment, etc., signed by the new decision-maker. This person should receive the education about privacy necessary to perform his or her role.
Q: What protection is available for a former employee when the former employer falsifies a termination over an alleged HIPAA violation that was never reported as such? I recently requested information from the Office for Civil Rights about the violation, but no such report exists. My former employer did not conduct an internal investigation into the alleged HIPAA violation and did not conduct an access audit, risk assessment, or incident report. I don’t understand how an employer can terminate an employee for an alleged HIPAA violation without investigating the matter. Are there any protections in place to prevent employers from misrepresenting such an act or terminating an employee in such a manner?
A: Some of the answer here depends on your state law and your employer’s employment practices. Many states are at-will employment states, which means the employer has no legal obligation to justify the decision to terminate, absent some federal exclusion. For example, even in an at-will employment state, an employer cannot terminate for discriminatory reasons like race, age, and sex, including "whistle blower" activities on the part of an employee.
Also, remember that determining whether a particular disclosure was a breach and therefore reportable to OCR requires consideration of a number of factors; I can imagine a case where an employee could be terminated but the circumstances do not rise to the level of a reportable breach. The covered entity is responsible to investigate all alleged HIPAA violations and document that investigation, including outcomes, but not necessarily to report each investigation to the OCR.
I believe your concern is more related to employment law than HIPAA, and I suggest consulting an attorney who has experience with your state’s labor laws.
Q: The local police department often calls our hospital asking whether a certain person has been in our emergency department (ED). Once we were asked to contact the police department if a certain person showed up at the ED even though this person had not committed a crime. In this instance, I advised hospital personnel not to give out any patient information. Was this an acceptable approach or do we need to comply with the request of the police department?
A: This depends on your state law. Disclosures to law enforcement are permitted under certain circumstances under HIPAA, but not if state law is more stringent/restrictive. See the HHS website for specific circumstances under HIPAA when PHI can be disclosed without authorization: www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html.
One way to demonstrate cooperation with law enforcement without breaching patient privacy is to encourage the patient to contact law enforcement him- or herself. So, in the example above, the staff could have told the patient of law enforcement’s request and offered to assist the patient in contacting the police. If the patient does not want the police notified, then, I agree, unless certain exceptions apply, we should honor the patient’s wishes. Remember that law enforcement always has the option to obtain a court order or warrant that would compel the covered entity to comply.
Q: What recommendations do you have for handling medical records for staff members who are also patients at the organization where they work? Should we provide extra protection for these patients? What can we do to ensure that staff members are not accessing their coworkers’ records without permission or need?
A: I am a firm believer in not adding special protection to any record, because it implies that some records are more confidential than others. In fact, all records are confidential and staff should not access any record unless it is necessary to do so to do their jobs. And, if it is necessary, they should only access the minimum necessary to do the job. HIPAA requires access monitoring, so your organization should conduct routine audits to determine whether staff are accessing records without a work-related reason. There is now software available that can conduct routine audits by staff member and department. This software can be used to reassure staff that their information is not being accessed by coworkers and to hold accountable those who are not following the policy/law. When a staff member raises a concern, an audit should be run to determine whether inappropriate access has occurred, and if it has, sanctions should be applied. Organizations should also consider having a policy that staff should not handle coworkers’ (or family members’) records (except in an emergency) without the permission of their supervisor.
All of these points should be reviewed at orientation and during (at minimum) annual training to ensure all staff understand that the organization takes such transgressions seriously and will take action as needed to protect the privacy of every patient’s information.
HHS published a final rule January 6 that increases the amount of identifying information that can be reported to the National Instant Criminal Background Check System (NICS). This information concerns individuals who are prohibited by federal law from possessing a firearm due to specific mental health reasons. Laws prohibiting these individuals from possessing firearms already existed, but reporting the information was difficult due to certain HIPAA restrictions. Although reporting of complete and accurate information is improved by this modification, individuals’ privacy will still be strongly protected, HHS said in a statement. The final rule is effective February 5.
The modification clarifies that certain covered entities that process and store mental health information are allowed to disclose limited information to NICS. Previously, the way this information was collected and stored in certain states created limitations on properly reporting the information to NICS, Mental Health America President and CEO Paul Gionfriddo said in a statement. In some states, this information is held by covered entities. These covered entities do not release mental health information in response to NICS requests because it was not clear whether these disclosures are permissible. HIPAA itself has not changed and new restrictions have not been placed on gun ownership, Gionfriddo said, and the modifications make a clear and careful distinction between those who have mental illnesses and those who have mental illnesses as well as violent tendencies. The latter group is already prohibited from possessing firearms under the federal “mental health prohibitor” as part of 1993’s Brady Handgun Violence Prevention Act and the 1968 Gun Control Act. The Brady Law allows the NICS to enforce these restrictions. The NICS, which is managed by the Federal Bureau of Investigation, maintains a database that collects certain identifying information, including applicable mental health information, about individuals forbidden to possess firearms.
Individuals subject to the mental health prohibitor are those who have been involuntarily committed to a mental institution or found incompetent to stand trial or not guilty by reason of insanity. The prohibition also applies to individuals who have been determined by a court or other lawful authority to be a danger to themselves or others or have been declared incompetent. The information disclosed to NICS will be limited to demographic information and certain other information, but will not include medical records or any mental health information beyond whether the individual is subject to the prohibitor.
The Bureau of Alcohol, Tobacco, Firearms and Explosives defines categories of “prohibited persons” who are forbidden to transport, possess, receive, or ship firearms as part of the Gun Control Act, including those who:
This modification is part of President Obama’s plan to address gun violence, announced January 5. The plan also includes $ 500 million to improve access to mental health care, as well as rules and measures to strength background checks and access to criminal records and mandate the reporting of stolen shipments of firearms. Changes to HIPAA to allow more complete reporting of information to the NICS were first proposed January 2013, as part of President Obama’s executive action plan to reduce gun violence.
Americans with mental illnesses are more likely to be the victims of violence than the perpetrators of it, HHS makes clear in their statement. The American Psychological Association applauded the administration’s efforts to protect the rights and privacy of individuals with mental illnesses while bolstering existing laws that affect the minority of citizens who have demonstrated a propensity to commit violent acts.
The provider at my clinic is from a much older generation. As such, he has been rather slow to embrace EMR and relies heavily on his handwritten notes when examining patients. After the encounter, the medical assistants input his handwritten notes into the patient’s EMR and make sure every scrap of written documentation- from his notes, to the scripts, to any radiology, etc.- has been scanned into the computer and attached to the patient’s chart.
As the coder/biller/auditor, I then code the encounter and check it for accuracy. It is then presented to the provider for his final approval and to be electronically signed. It’s an overly drawn out process for something that really shouldn’t be so complicated.
How long is too long to complete this process? I ask because sometimes we get patients who want all of this documentation in their hands the day of the visit- not just the vitals or a quick summary. Legally, is there a timeframe for us to follow to comply with their request?
Thanks!
By Jillian Harrington, EdD, MHA, CPC, CPC-P, CPC-I, CEMC, CCS, CCS-P, AAPC Fellow Following several situations that have recently occurred, such as the mass shooting in Las Vegas, the weather related disasters in Florida and Texas, and the forest fire devastation in the West, there are times when friends, family, or someone else is involved […]
AAPC Knowledge Center
Established in the year 1996, the HIPAA is an act that proposed and did set up a few regulations and laws to defend the privacy of an individual’s medical records. Initiated by the Department of Health and Human Services, the act controls and makes it illegal to distribute and transmittal of a patient’s private information with regard to his medical history.
To whom does the HIPAA Regulations Apply to?
The HIPAA has been design to have a wide application and a terrible reach to all sorts of people and firms. The major firms affected by the bill are those that transfer, store and enable distribution of health care reports in any format. Called as ‘Covered Entities’ these companies are affected by the bill directly and the clients to whom they service also come under the same.
Do Medical Transcriptions Come Under The Covered Entities?
The only criteria that marks the Medical Transcribing firms as Covered Entities is when they indulge in activities that are covered by the bill. But otherwise, they are known as Business Associates who “are not under the direct control of the Covered Entity, but act or function on behalf of a Covered Entity”. However there is a stark difference between the state laws and the National act. Some states even differ in the fundamental level and name the MTs as covered entities directly.
Though not governed directly by the HIPAA, the general norm that is followed between the covered entity and the business associates is that the latter should give a written statement giving the former an assurance that the documents and records handled will completely be safeguarded and this should be drafted in a written contract duly agreed by both the parties.
The HIPAA was very austere on the Covered Entities and thus this was reflected to the business associates too. The act thus indirectly extracted substantiate proofs from the MT services that the records and documents were clearly safe and the act was complied indirectly. It was mandatory that the MT services create an action plan beforehand, follow it up and review the same such that it obeyed the act and did nothing to deviate from it.
In What Way does Independent Medical Transcriptionists get affected by HIPAA?
Independent Medical Transcriptionists are third parties and are people who work under contractors indirectly and aid the Business Associates in their transcription works indirectly. They will also be governed by the Act in a roundabout manner. Since they have immediate access to the patient’s files, they have to agree upon stern and strict safety measures to ensure that the data is completely isolated from transmission. They have to write out a similar contract comparable to the one between the Business Associates and the Covered Entities with the former lot assuring them of all safety precautions.
From When Does the Act Hold Good?
The initial rule was passed by April 14, 2001. But it took two solid years to make the law mandatory and by April 14, 2003, all the entities covered had to mandatorily stick to the law and enforce strict measures according to its clause.
Does the Act Govern the Transmittal of Electronic Patient Information?
The Act also governed the electronic transfer of electronic patient information by unifying it as the standard ANSI X12 format which gave laws related to the content of the files and the format was also prescribed which had to be strictly adhered to.
Other Provisions Of The Act:
The main clause elaborated prohibition of any form of distribution of a patient’s healthcare information in any format that is available. If at all a necessary transfer of information was required, elaborate conditions were chalked out which had to be satisfied before transferring information.
The general rules stated that any information that revealed patients name, age or personal data, that will aid the identification of the individual, should not be given out or distributed through health records in any form (oral, paper or electronic).
To follow the rules strictly, the Covered Entities had to follow certain rules and steps that ensure protection of information. They are:
Elaborate information, preferably written should be given to patients as to how safe their personal information is and if at all it needed distribution or disclosure, to who is will be done so etc.
The individual must sketch out a written consent allowing the firm to maintain and process his/her personal information.
Covered Entities should take all steps to preserve the information of the patients.
Information should be shared to Business Associated only after providing with the necessary written assurances about how well the data will be protected.
A separate individual must be employed to oversee the entire process and to keep a check on any sort of privacy measures being disrupted or covered. He/she should be available for receiving feedbacks from the customers and complaints regarding the same.
Proper training should be given to all employees to cover up all the privacy policies and stick to the Acts rules and regulations.
Technical, administrative and physical aid should be imparted to give maximum security to the data.
Penalties Involved if not complied.
Covered Entities which break the law and do not comply to the terms and conditions can be levied with a huge fine and sometimes inflicted with criminal charges that can lead to serious repercussions.
CLICK HERE To Find more valuable information on Medical Transcription
Related Medical Coding Articles