http://www.privacyright.com/info/hipaaprivacy.html

DEMYSTIFYING THE HIPAA PRIVACY REGULATIONS
Some common misconceptions concerning the HIPAA privacy regulations, along with explanations of what these rules really mean for covered entities
A PrivacyRight White Paper, July 2002

Abstract

Some common misconceptions about HIPAA include:

1. Only health care enterprises and their business partners are affected by HIPAA
    
2. HIPAA only applies to electronic claims; it does not apply to paper-based claims
3. The HIPAA Privacy Rule is over 1,500 pages long and is too complex to understand
    
4. Physicians cannot speak freely about patients in a clinical settings and hospitals must be retrofitted wtih soundproof walls
    
5. Friends and family members will no longer be able to pick up prescriptions for others at the pharmacy
    
6. Patients can now demand that doctors change their medical records
    
7. JCAHO will be enforcing HIPAA
    
8. HIPAA requires the disclosure of protected health information to a wide range of federal governmental departments and agencies
    
9. Healthcare organizations can rely on their vendors or clearinghouses for HIPAA compliance
    
10. HIPAA is just a technology issue

Introduction

The HIPAA privacy regulations will roll into effect on April 14, 2003, less than one year from now. Due in part to the looming deadline, the IT community has begun describing HIPAA as "the next Y2K." However, aside from the fact that time is rapidly ticking down to a hard deadline, there are few other similarities. With Y2K, the IT requirements were simple - years that had been expressed using 2 digits had to be represented using 4 digits. With HIPAA, the IT requirements are anything but simple, and the chances that a health care organization will understand enough to come into compliance on time without a team of dedicated subject matter experts are rather low.

The fact that the HIPAA privacy regulations are not entirely straightforward has created some confusion in the healthcare community. To help clarify some of this confusion and to help covered entities meet the compliance deadline, we have put together a list of some common misconceptions concerning HIPAA, along with explanations of what these rules really mean for covered entities.

Keep in mind that the ultimate goal of HIPAA is to ensure the portability of health insurance for American workers. The privacy standards are there to define the context in which protected health information may or may not be used, and the security standards are there to enforce that context. Together, the HIPAA privacy and security standards help boost patient confidence in the health care system and help decrease the rate of errors and omissions in patient medical records. Properly implemented, HIPAA can save health care organizations a considerable amount of money over the medium- to long-term.
 

Misconception #1: Only health care enterprises and their business partners are affected by HIPAA

HIPAA requires all health plans, all health care clearinghouses and those health care providers that conduct certain types of EDI transactions to comply with its administrative simplification provisions. HIPAA also stipulates that protected health information may be used without patient authorization only for a very specific set of purposes, such as treatment, payment and related health care operations. It is somewhat obvious, therefore, that a health insurer that stores protected health information in a data warehouse and that lacks the necessary access controls, filters and other security tools to prevent the protected health data from being used for purposes not allowed by HIPAA runs the risk of being in violation of the law. Penalties for HIPAA noncompliance may run as high as $250,000 per incident and may include possible criminal convictions and prison sentences.

What is less obvious is that a company does not even have to be in the healthcare business to be covered by the HIPAA privacy rules. For instance, any company that makes a health benefit plan available to its workers - something commonly administered by enterprise resource planning (ERP) systems - is subject to the same security and privacy standards that a hospital or other health care entity would be when it comes to safeguarding the employee's personal health data. If your firm administers its own health plan, it's better to start thinking about HIPAA sooner rather than later.

TOP

Misconception #2: HIPAA only applies to electronic claims; it does not apply to paper-based claims

All of the administrative simplification provisions of HIPAA apply to all covered entities that fall under the scope of HIPAA. It is not enough for a covered entity to simply secure electronic claims and ignore the security and confidentiality of paper-based claims. The Privacy Rule applies to individually identifiable information in all forms, including electronic, written, oral and any other.

The misconception concerning electronic claims likely arose from some subtle distinctions as to what types of healthcare providers are classified as covered entities under HIPAA. HIPAA applies to all U.S. health plans and healthcare clearinghouses, but it only applies to those healthcare providers who conduct certain types of EDI transactions. If you are a healthcare provider, and you process all your claims entirely using paper-based forms, chances are you are not a covered entity under HIPAA. However, if you are a covered entity, you are still responsible for safeguarding the security and confidentiality and personally identifying health information transmitted with those forms - even if the claim forms you use are entirely paper-based.

TOP

Misconception #3: The HIPAA Privacy Rule is over 1,500 pages long and is too complex to understand

The Final HIPAA Privacy Rule, published on December 28, 2000, spans roughly 367 pages in the Federal Register. The bulk of this information is devoted to a lengthy preamble and to summarizing and responding to the more than 52,000 comments that were received by the Department of Health and Human Services (HHS) during the HIPAA rule making process.

Although this seems like a lot of information, most of it is really background material that documents the HIPAA rule-making process. The Privacy Rule itself is not nearly as long or complex - the text of the actual privacy regulation is less than 32 pages long, and can loosely be organized into the following sections:

• Right to notice of privacy practices
• Right to access to protected health information
• Right to amend protected health information
• Right to an accounting of disclosures of protected health information
• Uses and disclosures for which no authorization is required
• Uses and disclosures for which authorization is required
• Administrative requirements

The HIPAA Privacy Rule is not overly complex and in large part it follows widely accepted fair information principles, including (1) provision of notice of privacy practices; (2) provision of access to personally identifying information; (3) allowing patients to amend records containing personally identifying information; and (4) the establishment of reasonable precautions to ensure the security of medical records.

TOP

Misconception #4: Physicians cannot speak freely about patients in a clinical setting and hospitals must be retrofitted to include soundproof walls

HIPAA applies to personally identifiable health information in all forms - including oral communications. If oral communications were not covered, any health information could be disclosed to any person, so long as the disclosure was spoken. That means that covered entities must still document disclosures of PHI - even if the disclosure is made orally - if the purpose of the disclosure if for some reason other than treatment, payment and related health care operations.

However, oral communications must also occur freely and quickly in a medical treatment setting - after all, the patient's life is often at stake. The Department of Health and Human Services (HHS) recognizes this important fact, and explicitly stated in its July 6, 2001 guidance on HIPAA that providers must be allowed to communicate freely for treatment purposes. HHS cited the following practices as permissible if reasonable precautions (such as lowering voices) are taken:

• Health care staff may orally coordinate services at hospital nursing stations;
• Nurses and other health care professionals may discuss a patient's condition over the phone with the patient, a provider, or a family member;
• Health care professionals may discuss lab test results with a patient or other provider in a joint treatment area; and
• Health care professionals may discuss a patient's condition during training rounds in academic or training institutions.

HHS furthermore recognizes that restructuring an entire health care facility just to safeguard oral communications is outside the scope of what HIPAA is intended to accomplish. For example, the Privacy Rule does not require covered entities to make the following changes to their facilities:

• Building "private" rooms
• Soundproofing existing rooms
• Encrypting telephone systems

Covered entities must have in place appropriate and reasonable safeguards to protect the confidentiality of protected health information (even information that has only been communicated orally), but HHS recognizes that such safeguards must be cost effective as well.

TOP

Misconception #5: Friends and family members will no longer be able to pick up prescriptions for others at the pharmacy

The HIPAA privacy regulations explicitly state that this and other similar, common practices can continue. Section § 164.510.b of HIPAA outlines the uses and disclosures of protected health information where the notification and involvement of others in the individual's care is concerned. In it, the regulation specifies that a covered entity may disclose to a (i) family member, (ii) another relative, (iii) a close personal friend or (iv) any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's care or payment related to the individual's health care. In other words, covered entities can use their professional judgment and experience with such practices so that family members, friends and others may pick up items like prescriptions, medical supplies and x-rays.

TOP

Misconception #6: Patients can now demand that doctors change their medical records

Accurate medical records are essential to the provision of high quality health care. When patients are allowed access to copies of their medical records, oftentimes they notice inconsistencies and omissions that escaped the attention of the attending physician. To help increase the accuracy and relevance of patient medical data, the HIPAA privacy regulations therefore allow patients to request that a provider (or any other covered entity) make amendments to his or her medical records. There are two important points to remember concerning the amendment of medical records.

First, the HIPAA regulations specify that patients may request amendments to their medical records, which are not necessarily the same as changes. Amending a medical record usually does not involve the actual deletion of relevant information, but rather the addition of an amendment that contains accurate data. Covered entities may make the amendments directly on the medical record itself, or may provide a link to the location of the amendment.

Secondly, there is a specific set of circumstances under which covered entities may deny such requests for amendments. These exceptions are outlined clearly in §164.526, and include cases where the medical records in question involve psychotherapy notes, information compiled in reasonable anticipation of criminal proceedings or if the data in question was not created by the covered entity.

TOP

Misconception #7: JCAHO will be enforcing HIPAA

JCAHO stands for the Joint Commission on Accreditation of Healthcare Organizations, whose mission it is to continuously improve the safety and quality of care provided to the public through the provision of health care accreditation and related services that support performance improvement in health care organizations. JCAHO accreditation is recognized nationwide as a symbol of quality that reflects an organization's commitment to meeting certain performance standards.

JCAHO accredits more than 17,000 health care organizations in the United States and around the world. Health care organizations seek JCAHO accreditation because it enhances community confidence in their services, offers an objective evaluation of the organization's performance and simulates the organization's quality improvement efforts, among other things.

However, JCAHO is not a government organization and it does any power to enforce HIPAA. Speaking at a conference in June 2002, Richard Croteau, M.D., executive director for strategic initiatives at JCAHO, clarified that JCAHO will not be enforcing HIPAA regulations, despite what some attorneys and consultants have been saying in recent years. "We will survey compliance with accreditation standards, not HIPAA regulations," Croteau said. Another misconception, according to Croteau, is that HIPAA and JCAHO requirements are in conflict. "There are no contradictions between HIPAA and JCAHO standards," contends Croteau.

TOP

Misconception #8: HIPAA requires the disclosure of protected health information to a wide range of federal government departments and agencies

There has been concern about how much disclosure to federal agencies is mandated by HIPAA ever since House Representative Dick Armey raised the issue in a letter to Department of Health and Human Services (HHS) Secretary Tommy Thompson in March 2001. HIPAA does in fact permit disclosures to various government agencies, but only when the agency requesting or receiving information has the authority to request or receive information through some other law. The most common examples are disclosures made to law enforcement agencies in response to subpoenas, court orders and other criminal or national security inquiries.

In reality, there are only two types of disclosures that HIPAA requires covered entities to make: (a) disclosures to the individual who is the subject of the protected health information and (b) disclosures to HHS for the purpose of enforcing the regulation. Disclosures to the individual are an obvious and necessary component of ensuring patient privacy, and disclosures to HHS are required in order to ensure compliance with the law. Without these provisions, it would be impossible for HHS to monitor and enforce compliance with HIPAA. Moreover, HIPAA places significant limitations on what HHS can due with personally identifying medical information once it has it. HHS is only allowed to use protected health data to ascertain or enforce compliance with HIPAA, or as required by some other law.

TOP

Misconception #9: Healthcare organizations can rely on their vendors or clearinghouses for HIPAA compliance

Vendors must provide modified systems that meet HIPAA requirements in time to meet the compliance deadline, but they cannot be responsible for training the people, modifying the paper forms and performing the other implementation activities that are necessary to achieve compliance. For all but the smallest health care organizations (HCOs), no one vendor will be able to give an overall picture of the impacted people, systems and processes, since the HCO will have systems from multiple vendors. HCOs must manage the overall process for themselves, although many of them will contract with services firms over and above their IT vendors for support in doing so.

TOP

Misconception #10: HIPAA is just a technology issue

HIPAA is a business issue, and it has a significant impact on the entire healthcare organization, including healthcare providers, clerks, admitting staff, and the billing staff, among others. The confidentiality provisions will require most organizations to revisit their current policies and procedures. Although technology can help healthcare organizations address security risks and privacy concerns, to label HIPAA as simply a technology issue ignores its real impact.