Living the Law
By Cherie Sohnen-Moe
In 1996 the Health Insurance Portability and Accountability Act, or HIPAA, was passed and healthcare providers (and other agents) were mandated to have it in place by April 2003. HIPAA has three major purposes: 1) To protect and enhance the rights of consumers by providing them access to their health information and controlling the inappropriate use of that information; 2) To improve the quality of healthcare in the United States by restoring trust in the healthcare system among consumers, healthcare professionals and the multitude of organizations and individuals committed to the delivery of care; and 3) To improve the efficiency and effectiveness of healthcare delivery by creating a national framework for health privacy protection that builds on efforts by states, health systems, individual organizations and individuals.
Four Facets to HIPAA
1. Electronic Health Transactions Standards: If billing insurance, practitioners are required to use the Standard Code Sets of the International Classification of Disease (ICD-9) codes and the Current Procedural Terminology (CPT) codes.
2. Unique Identifiers for Providers, Employers, Health Plans and Clients: Each practitioner who transmits claims electronically is assigned a National Provider Identifier (NPI).
3. Security of Health Information and Electronic Signature Standards: All practitioners must provide uniform levels of protection of all health information that is housed or transmitted electronically. This includes your computer, along with any faxes and e-mail messages sent. An electronic signature is required for all HIPAA transactions. (The final regulations are being completed as of this writing.)
Privacy and Confidentiality:
This limits the non-
is a Covered Entity?
Many companies are charging hundreds (and even thousands) of dollars to provide practitioners with training, guidelines and forms to ensure HIPAA compliance. Some of these may even be worth it. Caution is advised before investing in these programs, particularly since it’s still not clear exactly what is required of massage practitioners.
The current emphasis of HIPAA compliance centers on electronic transmission of clients’ Protected Health Information (PHI). When you go to the HIPAA site (See HIPAA References on sidebar) and fill out the questionnaire to determine if you are a covered entity, most massage practitioners (unless they are billing insurance) will find that indeed they are not required to be HIPAA compliant. Unfortunately, this is misleading because the privacy considerations remain. According to Marilyn Allen of the American Acupuncture Council, “The privacy of every client’s PHI is mandatory. When you maintain client records, gather information from a client, engage in oral communication or transmit records (whether electronic or not), you are considered a covered entity.”
Note that even if you do not need to be HIPAA compliant for your own practice, you still need to be compliant if you work with other covered entities. The term for this is a “chain of trust.” If you are a business associate, you must meet the same requirements for privacy and security as if you were a covered entity. According to the HIPAA regulations, a business associate is defined as: Persons, companies or entities hired by the practitioner to perform duties which require access, the use of, or disclosure of a client’s PHI. Thus, if a primary care provider refers a client to you or you send a client’s progress report to her doctor, then you are considered a business associate. There is a form that business associates must sign. If you are currently working with other providers and haven’t received one of these forms, you will soon. Also, be aware that your state regulations might be more stringent than the federal requirements.
Keep in mind that within the next few years all insurance companies will require that insurance forms be submitted electronically. So for those of you who bill insurance manually and avoid being a HIPAA covered entity, be aware that it’s just a matter of time before you will need to be compliant.
Myths abound regarding client paperwork such as sign-in sheets and files. You can still have client sign-in sheets as long as they don’t disclose any PHI. You can put clients’ charts on the treatment room doors as long as the clients’ names aren’t visible and unauthorized people don’t have access to the charts. For instance, if people must walk past a treatment room on the way to the bathroom, then it might not be wise to put a chart on that treatment room door.
One of the more recent myths I encountered was that your client database is no longer an asset that may be sold for any reason. This would make it extremely difficult to sell a practice. Carrie Allen, a business broker from Kiernan and Associates, Inc. in Tucson, Ariz., clarified that the concern with the database and records will not affect the sale of a practice very much: “According to the American Medical Association guidelines, patients have the right to know if the doctor is leaving or the practice is moving, but do not have to be notified until it happens, after the close. At that point the patients have to be notified that their records will be staying with the new doctor.” Thus, if you act in good faith to provide a qualified guardian of the records (and hopefully the care of the clients as well), then legally, the records stay with the practice. Of course the clients could request their records after they have been notified. This standard should equate to massage practitioners.
Hopefully, by now the majority of the myths have been debunked, although as witnessed by the examples above, I’m sure more will proliferate. Visit the websites listed in HIPAA References on sidebar for more common myths, as well as the HIPAA regulation guidelines.
Cherie Sohnen-Moe has been an author, business coach, international workshop leader and business owner since 1978. Before shifting her focus to education and coaching, she was in private practice for many years as a massage practitioner and holistic health educator. She is the author of Business Mastery and co-author of The Ethics of Touch. If you would like any of the sample forms in this article, visit www.sohnen-moe.com/forms.html.
Share your thoughts! Click here to send a letter to the editor and let us know what you think. Your letter may be used in an upcoming issue of Massage & Bodywork magazine.
Please close window after reading.
|©2003 Associated Bodywork & Massage Professionals. All rights reserved. No portion of this website may be reproduced, stored in a retrieval system, or transmitted in any form by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior written permission from ABMP.|