Trends and Issues

Subscribe | Advertise | About Us | Contact Us | Home

April 2002

By Cherilyn G. Murer, JD, CRA

Protecting Patient Privacy

How to comply with HIPAA's Privacy Rule.

he Health Insurance Portability and Accountability Act of 1996 (HIPAA), Final Privacy Rule-Standards for Privacy of Individually Identifiable Health Information, enforced by the Department of Health and Human Services (DHHS), has a mandatory compliance date of April 14, 2003. With less than a year left to comply, now is a good time to examine how the Privacy Rule specifically affects the delivery of rehabilitation services.

Referrals
Because the Privacy Rule prohibits the disclosure of "protected health information" (PHI) prior to obtaining the patient's consent for "treatment, payment, or health care operations," rehab service providers, and outpatient rehab providers in particular, are faced with a serious problem. How can a rehab service provider to whom a patient is referred for the first time set up an appointment or schedule therapy without first obtaining the patient's written consent to the use of the patient's PHI?

DHHS states that "the Privacy Rule, as written, does not permit uses of PHI prior to obtaining the patient's written consent for treatment, payment, or health care operations. This unintended problem potentially exists in any circumstance when a patient's first contact with a direct treatment provider is not in person." Since virtually all outpatient rehab providers' business is generated by referrals from other providers, the Privacy Rule, as written, poses serious difficulties in generating new business. How, for example, can a physical therapist receive a referral from an orthopedist if the therapist cannot receive the patient's diagnosis before setting up the appointment?

The good news is that DHHS also states that "the Secretary is aware of the problem and will propose modifications to fix it." The bad news is that, to date, no such proposed modifications have been forthcoming. If DHHS does not modify the rule before the compliance date, outpatient rehab service providers should, as a stop-gap measure, supply the health care providers from whom they regularly receive patient referrals with PHI authorization forms that their patients can sign prior to the referral. Because the rehab services provider is itself a covered entity under the Privacy Rule, and because it will be seeking the authorization for its own purposes, the authorization will be subject to the "minimum necessary standard." The standard requires that most PHI disclosures be limited to "the minimum necessary to accomplish the intended purpose." In the case of rehab patient referrals, "minimum necessary" could mean that patient's name, address, phone number, age, diagnosis, and little else.

Treatment Environment
For rehab providers, concerns about the minimum necessary standard go well beyond its effect on referrals. The very nature of some rehabilitation services, like group therapy, necessitates that patients will share PHI with each other. Other rehab services require delivery in an open environment, such as the physical therapy gym or the occupational therapy activities of a daily living kitchen. Therefore, the minimum necessary standard, if strictly applied, could seriously disrupt the way rehab therapy is traditionally carried out. Fortunately, the guidance suggests that DHHS intends to apply a rule of reasonableness to the minimum necessary standard and, therefore, the standard's impact on the rehab treatment setting, while not insubstantial, will not be severe. As long as the rehab provider's consent forms make it clear to the patient that the treatment will involve sharing of PHI during group therapy or will take place in an open setting where the patient's conversations with the therapist may be overheard by other patients and staff, the rehab provider should be able to continue to deliver services in the traditional manner without having to expend vast sums in structural changes to its facilities.

For example, in response to questions of whether the Privacy Rule prohibits maintaining patient medical charts at bedside, x-ray light boards that can be seen by other patients and staff, and the use of sign-in sheets in waiting rooms, DHHS responded that no specific measures are required by the minimum necessary standard. Thus, "while the Privacy Rule does not require that x-ray boards be totally isolated from all other functions, it does require covered entities to take reasonable precautions to protect x-rays from being accessible to the public.... We did not intend to prohibit the use of sign-in sheets, but we understand that the Privacy Rule is ambiguous about this common practice. We, therefore, intend to propose modifications to the rule to clarify that this and similar practices are permissible."

In terms of the rule's particular application to rehab services, it is probably safe to assume that while the statement, "The use of a therapy board noting a patient's name, room number, and condition, that can be seen by anyone in the clinic or on the unit, will be a mechanism of the past," remains accurate, there is no need to throw the board away. Instead, positioning the board so that it is generally visible to the staff and not every patient in the facility probably will be sufficient.

The guidance's discussion of the Privacy Rule's applicability to oral communications lends even more force to the view that, while rehab services providers must implement substantial privacy precautions, the way rehab providers dispense their services will not require radical change. This conclusion is bolstered by DHHS's statement in the preamble to its discussion of oral communications: "We also understand that oral communications must occur freely and quickly in treatment settings, and thus understand the heightened concern that covered entities have about how the rule applies," and it is reinforced by the specific responses in the question and answer.

For example, in response to a question of whether engaging in confidential conversations with other providers or with patients violates the rule if there is a possibility that the conversation could be overheard, DHHS replied emphatically:

"The Privacy Rule is not intended to prohibit providers from talking to each other and to their patients.... We also understand that overheard communications are unavoidable...."

Furthermore, DHHS included among the examples of appropriate oral communications: "A health care professional may discuss laboratory test results with a patient or other provider in a joint treatment area.... We will propose regulatory language to reinforce and clarify that these and similar oral communications (such as calling out patient names in a waiting room) are permissible."

Structure of Facilities
DHHS also explicitly reassured providers that the Privacy Rule does not require the retrofitting of facilities to provide private rooms and soundproof walls in order to avoid any possibility that a conversation is overheard.

DHHS provided the following examples of reasonable safeguards: curtains or screens in areas where oral communications often occur between doctors and patients or among professionals treating the patients; and cubicles, dividers, shields, or similar barriers in areas where multiple patient-staff communications routinely occur.

Thus, rather than making prohibitively expensive and impractical alterations to existing facilities, rehab service providers may comply by making relatively inexpensive adjustments to open treatment areas and waiting rooms. For example, setting off one corner of the physical therapy gym with dividers for private conversations between the therapist and patient where the particulars of the patient's condition and program can be discussed should be sufficient. This kind of affordable, practical measure coupled with consent forms that, in plain language, explain to the patient that some or all of the treatment may take place in group settings or open environments where other patients and staff may be party to or overhear conversations regarding the patient's PHI should ensure a rehab therapy setting that is in full compliance with the HIPAA Privacy Rule.

Cherilyn G. Murer, JD, CRA, is CEO and founder of the Murer Group, a legal-based health care management consulting firm in Joliet, Ill, specializing in strategic analysis and business development. She may be reached at (815) 727-3355 or via the Web: www.murer.com.

LOOKING FOR EXPERT ADVICE?

Experts here are available to answer all your questions!

Please contact us for more information about this feature, or to become an expert.

MEDIA CENTER

Interactive Media

Resources

	Calendar
	Consumer Resources
	Media Kit
	Advertiser Index EAB Reprints Submit an Article

ADDITIONAL ONLINE RESOURCES

Allied Media
24X7mag Clinical Lab Products (CLP) Orthodontic Products The Hearing Review Hearing Review Products Rehab Management		Physical Therapy Products Plastic Surgery Practice Imaging Economics RT Magazine Sleep Review

Subscribe | Advertise | About Us | Contact Us | Home

April 2002