Preparing for Phase 2 of HIPAA Audits

Phase 2 HIPAA audits are here. It’s no longer a matter of when.

The question is: Are you ready?

On March 21, 2016, the HHS Office for Civil Rights (OCR) launched the second phase of audits for compliance with HIPAA privacy, security and breach notification rules. And in his July 18, article, Second phase of HIPAA audits shifts into high gear, HDM’s Managing Editor Greg Slabodkin informed us that according to OCR, letters were delivered via email to “167 health plans, healthcare providers and clearinghouses” on July 11. Unlike the pilot audits that focused only on covered entities, Phase 2 targets both covered entities and their business associates.

While most of the Phase 2 audits will be desk audits, some onsite audits will be conducted. Phase 2 audits will focus on areas with high occurrences of noncompliance in Phase 1, particularly issues raised during data breach investigations. These include risk analysis and management, notice of privacy practices, timeliness of breach notification, reasonable safeguards, facility access control, and workforce training on policies and procedures.

To prepare for Phase 2 audits, covered entities and business associates should review their HIPAA privacy, security and breach notification policies and confirm that the following requirements are in place and current:

Comprehensive documented risk assessment. Promptly address any deficiencies and complete all action items. Build on the assessment outcomes to create a strong risk assessment management program. Conduct a follow-up security risk analysis periodically to identify, address and document deficiencies that may occur.

Written HIPAA policies and procedures. These should reflect privacy and security standards along with any risks or vulnerabilities identified during the assessment process.

Incident response plan for responding to breach of protected health information (PHI). Implement breach notification policies and procedures that are aligned with requirements under the HIPAA breach notification standards. Conduct practice rounds to prepare staff for a real event should it occur. 

Current Notice of Privacy Practices. Provide printed copies of the most recent notice to patients and also make the notice available on the organization’s website. 

Safeguards to protect all forms of PHI. This applies to paper, electronic and verbal PHI, including mobile devices and storage media. For employees who have personal devices, implement a BYOD policy aligned with HIPAA standards. Keep an up-to-date inventory of all systems and mobile devices.

Workforce training program. Conduct and document training for new employees. Conduct and document ongoing training for all workforce members.

Business associate agreements. Organizations must maintain a current inventory of all business associates. Agreements should be updated and implemented in compliance with current HIPAA requirements.

PHI transmission policy. Verify that all PHI is encrypted, or document a risk analysis to support the decision not to use encryption technology. 

Even if your organization is not selected for a Phase 2 audit, implementing judicious measures now will support future audits and improve HIPAA compliance. 

It doesn’t just end with an audit occurring within the four walls of a healthcare organization. With more healthcare professionals working from home, there is growing concern about the possibility of “at-home” audits - if not now, these may happen in the near future. We’re operating in a virtual world - building a remote workforce, and many HIM departments are sending people home - coders, transcriptionists, even management staff. 

Suppose OCR conducts an onsite audit at your facility and finds that some employees work from home. You must be prepared for the inevitable questions. How are you protecting information offsite? What measures are you taking to make sure PHI is secure? What policies and procedures are in place to address specific issues of at-home worksites? If you’re preparing for OCR audits - or any audits - these are increasingly important points to consider.

Business associates should also be taking a proactive approach in case auditors want to know how workers at home are being audited. Options might include Skype, Facetime or Hangouts. Here are some basic questions to ask employees when evaluating at-home privacy and security risks: 

• Where are you located in your personal residence? 
• Is your workspace private? 
• Are passcodes properly concealed, not posted in the workspace? 
• Do you use a virtual privacy network (VPN)? 
• Do you have the capability to print information? 
• Do you have appropriate shredding capability? 
• Is your computer set to shut down (encryption mode) in your absence? 

These questions are just the beginning of the conversation. It is critical to communicate clear expectations to employees who work at home - along with consequences if they fail to maintain privacy and security according to your policies and procedures.

A company’s work-from-home policy defines the telecommuting work arrangement, including comprehensive privacy and security practices. The telecommuting employee must sign an agreement to ensure the protection of proprietary information and PHI, and to maintain the same level of confidentiality that exists on the company premises. If issues arise, there are several options depending on the severity of noncompliance - corrective action, education and training, increased audits, return to in-house, or termination of employment.

Although current OCR requirements do not specifically require at-home audits, the regulations clearly state that all reasonable precautions must be taken to ensure that all information is secure and privacy is maintained.

The best way to mitigate regulation issues is to have a solid HIPAA program in place and be well prepared to demonstrate best practices that proactively identify and address risks to PHI.

HIM must work closely with IT and other departments - risk management, C-suite, compliance, training and HR - to properly prepare for audits. HIM directors and their staff understand the content and use of PHI, where it is most likely to be at risk, and how to protect it. As experts in HIPAA and information governance practices, HIM professionals and Compliance Support Partners can lead organizations through a successful audit.

Also See: OCR's Top 7 Areas of Focus During Phase Two Audits

Source(s): Elizabeth A.Delahoussaye, http://www.healthdatamanagement.com, http://www.hcsiinc.com, https://oig.hhs.gov/, http://www.hhs.gov/

To subscribe to this blog, enter your email address:

Delivered by FeedBurner

OCR's Top 7 Areas of Focus During Phase Two Audits

Areas of improvement to focus on within your office.

During phase 2 of the Office for Civil Rights (OCR) HIPAA audits, they have decided to focus their attention on seven areas of compliance. These specific areas were chosen due to their history of non-compliance during multiple audits in the past. This is not to say that OCR will not investigate other areas, but their main focus will be on these specific requirements:

• Under the HIPAA Privacy Rule
• Notice of Privacy Practice and consent requirements
• Provision of notice - electronic notice (NPP acknowledgement in electronic format)
• Right to access (Patients right to access their PHI)
• Under the HIPAA Security Rule
• Security management process - risk analysis (Documented and completed internal risk analysis)
• Security management process - risk management (Documented policies and procedures that prevent, detect, contain, and correct security violations)
• Under the Breach Notification Rule
• Timeliness of notification (Notification of breach given to individual and OCR within required specifications)
• Content of notification (Notification of breach contains all of the required information as specified by OCR)

These are important areas of compliance that have been neglected or out right ignored by healthcare organizations. If you have not done so, get these areas of compliance in order within your organization.

For information on how to prepare for OCR's Phase 2 HIPAA audits go to:
http://hcsiinc.blogspot.com/2016/07/preparing-for-phase-2-of-hipaa-audits.html

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Patient Authorization For Disclosure Of PHI

Required Elements Of A Patient Authorization

HIPAA requires that certain elements be present on the authorization that the patient is to sign.  Whenever you receive an authorization (or “release”) asking you to disclose PHI and HIPAA requires an authorization for the disclosure, use this checklist to verify that the authorization meets the HIPAA requirements. If any ONE of the following elements is missing, you should NOT release the patient’s PHI until you have a valid authorization signed by the patient. If ALL the elements are present, the authorization is valid. 

•    A description of the PHI to be used or disclosed that identifies it in a specific and meaningful fashion.  They may request the entire medical record, all records between specific dates, or other specific items. 

•    The name or other specific identification of the person(s), or class of persons, who can make the requested use or disclosure.  For example, the signed request should list either your organization or someone in your organization by name.

•    The person(s), or class of persons, to whom you may make the requested disclosure.  The specific entity(ies) to receive the information should be identified.  A cover sheet stating who should receive the information is NOT sufficient.

•    A description of each purpose of the requested use or disclosure.  The statement “at the request of the individual” is a sufficient description of the purpose when a patient initiates the authorization and does not, or elects not to, provide a statement of the purpose. The above statement or some other description must be present.

•    An expiration date or an expiration event that is related to the individual or the purpose of the use and disclosure.  The statement “end of research study”, “none”, or similar language is sufficient if the authorization is for a use or disclosure of PHI for research.  Again, the statement must be present.

•   Signature of the patient and date.  If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.

•    The individual’ s right to revoke the authorization in writing, any exceptions to that right, and a description of how the individual may revoke the authorization.

•    The ability or inability to condition treatment on the authorization by stating either:  (A) The covered entity may not condition treatment on whether the individual signs the authorization or (B) The consequences to the individual for refusal to sign the authorization.  (Remember that there are very limited circumstances in which action can be a condition on a patient signing an authorization.)

•    A statement that informs of the potential for information to be re-disclosed by the person or organization to which it is sent.  The privacy of this information may not be protected under the Federal Privacy Rule depending on whom the information is disclosed to.

•    If the requested use or disclosure is for marketing purposes.  If the marketing involves direct or indirect remuneration to the covered entity from a third party, the authorization must state such remuneration.

--For more healthcare compliance information and discussion please join the LinkedIn group forum: The Healthcare Compliance Solutions Administrative Alert

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

5 Pioneering Changes to Healthcare Compliance Support

Excessive weight of compliance regulations has necessitated the need for more guided compliance support

Dr. Paul was just wrapping-up the recent OSHA audit. He was very frustrated as he was found to be in violation of more than a dozen OSHA regulations. Following the completion of his OSHA audit, he called the company he had entrusted with his compliance, Healthcare Compliance Solutions, Inc. (HCSI). After some discussion between Dr. Paul and the representative at HCSI, it was discovered that after Dr. Paul had purchased the HCSI Compliance Program, he did not fully incorporate the program into his seven locations that he was trying to support with the single compliance officer. Dr. Paul and HCSI worked together to ensure that the next audit, OSHA or HIPAA, would have a much different and positive result.

The case study described above really happened. It was this very situation that made it clear to everybody at HCSI that something different needed to be done in compliance support. Major changes were needed to the compliance industry and HCSI has taken it upon themselves to be the pioneer in the reformation process of healthcare compliance support.

Below is the list of the areas identified where changes are necessary:

• Training - It was previously thought that all an office needed was to train their employees once a year (if that) on compliance regulations while having a pizza party. Once the information was distributed, the employees would go about their days, having learned very little about the organization's procedures or the compliance regulations, and putting the organization at risk of a breach.
• Policies and Procedures - This is an issue that has proved to be very costly. The federal regulations require effective and written policies and procedures . For too many years this requirement has been taken lightly. Ineffective or incomplete manuals have become a plague on the healthcare industry. Many organizations simply say, "I have bought a manual, so I am compliant".
• Updating - The federal government requires every compliance program to be continuously updated. This necessitates the need to constant monitoring, adjusting, and retraining of compliance issues. This is either being done halfheartedly, in disarray, or in most cases, not at all.
• Support - Most organizations only call their compliance support company when they hit the panic button. As we learned in the case study at the beginning of this article, that is simply reactive when the goal with compliance is to be proactive.

The four points listed above are examples of how compliance is currently being supported in the healthcare industry. They are out-of-date and are simply ineffective in giving the healthcare industry the support it needs in order to comply with the federal regulations.

As previously stated, HCSI has taken it upon themselves to be the pioneer in the reformation process of healthcare compliance support. HCSI has recognized that in order to truly protect yourself from compliance liability and effectively adhere to the regulations, it is vital that a cultural change occur within the organization. By establishing a culture of compliance, any healthcare organization will be able to feel assured about their compliance adherence. In order to help healthcare organizations create a culture of compliance, here are the changes HCSI has made to compliance support in the healthcare industry:

• Training - Created effective online training where each employee is held accountable for their own training. Each administrator has control over adding, deleting, and monitoring their employees. At the end of each training module, a certificate of completion is printed as proof of employee compliance education.
• Policies and Procedures - Written policies and procedures that are effective in supporting the office are required. HCSI's Audit Manual contains required policies and procedures that the federal government agencies are looking for. In addition, HCSI has created an extensive Compliance Reference Guide that gives further support and understanding for Compliance Officers.
• Updating - The federal government calls compliance a "continuous journey" and it is this "journey" that they are looking for during an audit. For this reason, weekly, monthly, and quarterly updates are mailed out to each HCSI client. These quarterly updates are reviewed and initialed by each employee as an ongoing training initiative. These updates keep your employees and compliance staff up-to-date with current compliance information and are an important part of the "continuous journey" of compliance.
• Support - The excessive weight of compliance regulations are taking a toll on the healthcare industry. HCSI has recognized this issue and has addressed it. In order to help ease the weight of compliance, Utilizing Client Relationship Specialists (CRS), HCSI supports its clients in ways that are unique in the healthcare industry. Every new HCSI client receives a phone call on a quarterly basis. HCSI understands that this first year is critical in creating a culture of compliance within the organization. These quarterly calls are intended to support the administrators and ease their burden. After the first year, HCSI will reach-out to each of their clients multiple times throughout the year. Had this new process been in place previously, it would have helped prevent the OSHA violations Dr. Paul experienced in the case study. In addition to the proactive approach to support, HCSI talks with thousands of healthcare professionals who reach out to HCSI's CRS' for answers to their compliance questions. Nobody likes feeling as though they are in the dark. With effective compliance support, no healthcare professional has to feel that way.
• Additional Resources - In addition to training, policies, updating, and support, HCSI recognized one missing element of support that has been previously missing within the healthcare industry. Customizable forms, resource updates, informational blog, Facebook community, and a Linkedin group, are all additional ways the healthcare industry is able to receive, well over due, comprehensive compliance support.
  

As Dr. Paul learned in the case study, healthcare organizations are no longer able to simply buy a manual or do the bare minimum. Healthcare compliance support, as it stands now, is no longer a viable option as it is grossly ineffective in protecting the healthcare organization from liability, from protecting patient's information, and protecting the healthcare employees themselves.

HCSI is pioneering a new compliance support program that is revolutionizing how healthcare organizations are meeting the federal compliance regulations. To begin incorporating a culture of compliance within your healthcare organization, look to HCSI's Compliance Program.

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Five Areas that Require Bio-hazard Labeling

The Bloodborne Pathogens Standard outlines the regulations for bio-hazard labeling and color-coding. Three signals can alert you to the presence of a bio-hazard or bio-hazardous waste: the word “bio-hazard”, the bio-hazard symbol, or the fluorescent orange or orange-red color-coding.

These five areas are ones to watch for bio-hazard labeling in your facility:

1. Regulated medical waste containers and other containers (according to OSHA) that warning labels must be affixed to:

• Containers of regulated waste,
• Refrigerators and freezers containing blood or other potentially infectious material; and
• Other containers used to store, transport or ship blood or other potentially infectious materials.

EXCEPTIONS include:

• Containers of blood, blood components, or blood products that are labeled and have been released for transfusion,
• Individual containers of blood or other potentially infectious materials that are placed in a labeled container during storage, transport, shipment or disposal, or
• Regulated waste that has been decontaminated.

2. Sharps Containers

Sharps containers must also be labeled or color-coded in accordance with the requirements of the Bloodborne Pathogens Standard.

3. Contaminated Laundry

The Bloodborne Pathogens Standard also requires contaminated laundry to be placed and transported in labeled or color-coded bags. When a facility utilizes Universal Precautions in the handling of all soiled laundry, alternative labeling or color-coding is sufficient if it permits all employees to recognize the containers as requiring compliance with Universal Precautions.

When a facility ships contaminated laundry off-site to a second facility which does not utilize Universal Precautions in the handling of all laundry, the facility generating the contaminated laundry must place such laundry in labeled or color-coded bags or containers.

4. Specimens

Specimens of blood or other potentially infectious materials must be placed in a container which prevents leakage during collection, handling, processing, storage, transport, or shipping. The container for storage, transport, or shipping must be labeled or color-coded and closed prior to being stored, transported, or shipped.

5. Equipment

Equipment that may become contaminated with blood or other potentially infectious materials shall be examined prior to servicing or shipping and shall be decontaminated as necessary, unless the employer can demonstrate that decontamination of such equipment or portions of such equipment is not feasible, according to OSHA. A readily observable bio-hazard label shall be attached to the equipment stating which portions remain contaminated.

Ensure that you have bio-hazard labeling or color-coding, as necessary, in these five areas and in other areas of your facility that fall under the guidelines of OSHA’s Bloodborne Pathogens Standard 1910.1030.  In practice, most facilities typically use BOTH bio-hazard labeling AND color-coding in most cases.

For more information please join the LinkedIn group: The Healthcare Compliance Solutions Administrative Alert

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Should HIPAA Be A Global Standard?

Is healthcare a basic human right or a privilege?

Where do patient rights regarding personal health information privacy, security and portability begin and end in a global healthcare reality?

Should there be a global standard for the expression of what HIPAA is trying to accomplish? Many countries have there own versions of "HIPAA" (Canada's PHIPA for example) albeit usually in many less volumes of bureaucracy then the United States version.  What about Europe, China, India, any developing countries?  Many of our Pharmaceuticals come from laboratories in India, medical supplies from Asia, various patient data services offshore to many locations.  Patient insurance portability for healthcare across state lines or country boarders... All these issues bring to mind these topics for discussion:  Should there be a "Global" standard for Healthcare, insurance portability and basic human rights to PHI privacy and security?  

What are your thoughts? Please join the discussion.

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

The DOL’s New FMLA Poster and Your FLMA Policy

Do You Need To Post The New FMLA Poster?

In April 2016, the U.S. Department of Labor (“DOL”) issued a new “Employee Rights Under The Family And Medical Leave Act” poster, to replace the prior poster on this subject.  The DOL has stated that the old poster (revised Feb. 2013) is still valid and can continue to be used – until further notice – to meet the posting requirement under the FMLA regulations. 

(Note: HCSI clients can also download this poster from the "Employment Law (HR)" section in the "Updates/News" area of our website http://www.hcsiinc.com.) 

The big question: If you already have an FMLA poster on your break room bulletin board, are you now required to display this new poster instead?  The answer is no, you don't have to post this new version as long as you are currently displaying a legal FMLA poster.  (The DOL poster that was last updated in 2013 is still valid).

The new 2016 version contains basically the same information as the 2013 poster, but the new version is organized in a more reader-friendly format. This version also adds more color to the poster. Plus, it highlights the DOL's contact information to file a complaint.

You do not need to rush to update your poster but... yet just as daylight saving time is a good time to change the batteries in your smoke alarms, now is a good time to review your FMLA policy to ensure that it contains all of the information that is on the new poster.  Of course, it is to your benefit to include additional provisions in your policy, such as a prohibition on the misuse of FMLA leave.  At a minimum, all of the information that is in the poster must be included.

This is a great time to re-evaluate your FMLA policy and make sure that your policy is updated to reflect and address all the entitlements and requirements of the new poster.  The FMLA regulations provide that, if an FMLA-covered employer has any FMLA-eligible employees, and if the employer has a written policy on the subject of leave/benefits, then the employer must ensure that its policy contains the same information that is in the FMLA poster.  (The notice requirements are discussed at pp. 12-13 of the helpful new publication from the DOL, “The Employer’s Guide to The Family and Medical Leave Act”.)

Note that “all” means “all”; your policy must include, for example, not only information about the employee’s rights and responsibilities, but also the information in the poster regarding the employer’s responsibilities, along with enforcement information such as the employee’s right to file a complaint with the U.S. Department of Labor (“DOL”) and the DOL’s contact information.

Some employers may choose to comply with the FMLA notice regulations by attaching a copy of the FMLA poster to their employee handbook, instead of incorporating all of the language in the poster into their FLMA policy.  If that’s your approach, just ensure that you update the attachment with the new poster.  Either way, however, you should make sure that your policy is compliant.  Because the information in the poster represents basic FMLA information, you should take steps to review and, if necessary, revise your FMLA policy now, even if you wait to hang up the new FMLA poster.

Source(s): https://www.dol.gov, http://www.jdsupra.com, http://www.lexology.com, http://www.businessmanagementdaily.com, HCSI

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

How HCSI is Making a Difference in the Healthcare Industry

By creating a compliance service that has supported the efforts and improvements of thousands of healthcare professionals all across the nation, HCSI has made a difference!

There is a current trend in the healthcare industry. Companies have been created with the sole purpose of compliance training for healthcare offices. This "rash" is irritating and annoying. These type of "training" companies do not care about the healthcare organization, their employees, the success of the administrators, or their patients. Healthcare offices itch and itch at this "rash" hoping it will feel better. "If I only do my compliance training, everything will be alright.". Only doing compliance training is like scratching at an irritating "rash", it will not make things better and the rash will never go away.

The Office of Civil Rights (OCR) has said that compliance is a "continuous journey". They are not looking to see if employees are simply trained in compliance as that is not enough! It is all about the "continuous journey" and not the final destination. Having a "rash" is not the final destination. There is no final destination in compliance!

It is the "continuous journey" of compliance that the OCR is looking for. They want healthcare professionals to have a sort of culture of compliance as part of their organization. Here is what the OCR is looking for:

• Established and written policies and procedures
• Documentation . . . about everything
• Continuous improvement
• Compliance education (yes, training is only one part of compliance)
• Self-Audits
• Accountability
• Effort, attitude, and mindset

Yes, there is an ointment to this compliance training "rash"!

For more than 30 years, Healthcare Compliance Solutions, Inc. (HCSI) has been working with healthcare professionals. HCSI has a compliance service that will cure that irritating training "rash" which as been plaguing healthcare offices' for many years. When a healthcare office becomes a Compliance Business Partner with HCSI, they begin their "continuous journey" of compliance by having:

• Established and written policies and procedures (Policy Manual)
• Documentation (Forms)
• Continuous improvement (Updates)
• Compliance education (Training Modules in HIPAA, OSHA, HR, Medicare)
• Self-Audits (Customization)
• Accountability (Employee Progress Tracking)
• Effort, attitude, and mindset (Support, Reference Manual, and Social Media)

HCSI's compliance service is not about only training and giving healthcare organizations a "rash". It is about creating an effective partnership that will help healthcare organizations establish a culture of compliance within their office by helping and supporting the organization, their employees, their administrator, compliance officers and their patients. HCSI has been making a difference in the healthcare industry for more than 30 years and HCSI will continue to make a difference for many years to come!

Remember, compliance it is not about having a "rash". Compliance is about a "continuous journey" and HCSI will be riding shotgun and sitting right beside you on this journey of compliance!

If you have any questions please feel free to contact support@hcsiinc.com

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Identifying Business Associates

Covered Entities & Business Associates

With business associates and business associate agreements (BAAs) coming under increased scrutiny in the latest round of HIPAA audits, some covered entities are wondering how to identify which vendors are considered business associates, and therefore require a BAA, and which vendors are not.

According to the Privacy Rule, a business associate is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information (PHI) on behalf of, or provides services to, a covered entity (CE).

Business associate functions and activities include the following:

●        Claims processing or administration;

●        Data analysis;

●        Processing or administration;

●        Utilization review;

●        Quality assurance;

●        Billing;

●        Benefit management;

●        Practice management; and

●        Repricing;

Additionally, any entity that provides any of the following services involving the disclosure of PHI by a CE, is a business associate:

●        Legal;

●        Actuarial;

●        Accounting;

●        Consulting;

●        Data aggregation;

●        Management;

●        Administrative;

●        Accreditation; or

●        Financial.

In addition, the Omnibus Rule includes a new definition of a business associate. A business associate is also defined as an individual or organization that creates, receives, maintains, or transmits PHI on behalf of a CE. In addition, four new categories were added to the definition:

●        Health Information Exchanges;

●        E-prescribing gateways;

●        Data transmission services; and

●        Entities that offer a personal health record to individuals on behalf of a CE.

The following is a list of sample business associates a CE may have. A BAA would need to be initiated for all of these vendors. Examples include

●        IT companies that support health care providers;

●        Electronic Health Record (EHR) system providers;

●        Data centers, online backup companies, cloud service providers, even if they do not access data;

●        Shredding companies;

●        Insurance agents;

●        A CPA firm whose accounting services to a health care provider involve access to PHI;

●        An attorney whose legal services to a health plan or provider involve access to PHI;

●        Any person or entity providing services to a business associate that requires access to PHI; and

●        Data centers, online backup companies, cloud service providers, providing services to a business associate, even if they do not access data.

The Privacy rule also outlines situations where it is not necessary to enter into a BAA. Some examples of when a BAA is not required are the following:

●        When a health care provider discloses PHI to a health plan for payment purposes, or when the health care provider simply accepts a discounted rate to participate in the health plan’s network.

●        With persons or organizations (e.g., janitorial service or electrician) whose functions or services do not involve the use or disclosure of PHI, and where any access to PHI by such persons would be incidental, if at all.

●        Among CEs who participate in an organized health care arrangement (OHCA) to make disclosures that relate to the joint health care activities of the OHCA.

●        Where a group health plan purchases insurance from a health insurance issuer or HMO.

●        Where one CE purchases a health plan product or other insurance, for example, reinsurance, from an insurer.

●        With a person or organization that acts merely as a conduit for PHI, for example, the US Postal Service, certain private couriers, and their electronic equivalents.

●        To disclose PHI to a researcher for research purposes, either with patient authorization, pursuant to a waiver, or as a limited data set.

●        When a financial institution processes consumer-conducted financial transactions by debit, credit, or other payment card, clears checks, initiates or processes electronic funds transfers, or conducts any other activity that directly facilitates or affects the transfer of funds for payment for health care or health plan premiums.

Also included are the following exceptions to the business associate standard. In these situations, a CE is not required to have a BAA or other written agreement in place before PHI may be disclosed to the person or entity.

●        Disclosures by a covered entity to a health care provider for treatment of the individual;

●        Disclosures to a health plan sponsor, such as an employer, by a group health plan, or by the health insurance issuer or HMO that provides the health insurance benefits or coverage for the group health plan, provided that the group health plan’s documents have been amended to limit the disclosures or one of the exceptions at 45 CFR 164.504(f) have been met;

●        The collection and sharing of PHI by a health plan that is a public benefits program, such as Medicare, and an agency other than the agency administering the health plan, such as the Social Security Administration, that collects PHI to determine eligibility or enrollment, or determines eligibility or enrollment, for the government program, where the joint activities are authorized by law; and

●        Patient safety organizations.

Source(s): http://www.hcsiinc.com, http://www.hhs.gov

To subscribe to this blog, enter your email address:


Delivered by FeedBurner

Discussion Point: Releasing Patient Information to a Pharmacy, Relating to Drug Use

I have a question for all of you.

A Doctor's office received a fax from a pharmacy (for the sake of clarification, let’s just say it was CVS) asking questions about one of their patients. The Doctor's office had treated the patient for one specific procedure and had prescribed medication (non-refillable) relating only to that procedure. The Pharmacy’s fax listed numerous prescriptions from various other sources that seemed excessive they and were apparently concerned the patient may be abusing these prescriptions in one way or another. The pharmacy wanted the Doctor's office to answer a questioner about the patient, their treatment, diagnosis, etc. A pharmacy is considered a Covered Entity but do they have the right, under HIPAA, to ask the Dr. these types of questions about the patient that are not necessarily related to a specific Treatment per se?

What are your thoughts based on your understanding of HIPAA and what limits, if any, are there on what the pharmacy may ask of the practice?  Should the pharmacy be able to ask any questions they want or is there a limit or minimum necessary, before the Privacy boundary is crossed?

By: David Low/HCSI

To subscribe to this blog, enter your email address:


Delivered by FeedBurner